module "lambda_sr_delivery_tiktok_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  application_family = var.application_family
  environment        = var.environment
  platform           = "python"
  service_name       = var.sr_delivery_tiktok_function_name
  teams              = [var.environment]
}

data "aws_iam_policy_document" "s3_sr_versions_lambda_sr_delivery_tiktok_policy_document" {
  statement {
    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:GetBucketVersioning"
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_versions_bucket}/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_versions_bucket}"
    ]
  }
}

data "aws_iam_policy_document" "s3_sr_delivery_audit_lambda_sr_delivery_tiktok_policy_document" {
  statement {
    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectVersion"
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_delivery_audit_bucket}/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_delivery_audit_bucket}"
    ]
  }
}

data "aws_iam_policy_document" "s3_sr_delivery_upload_lambda_sr_delivery_tiktok_policy_document" {
  statement {
    actions = [
      "s3:PutObject",
      "s3:GetObject"
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_delivery_upload_bucket}/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_delivery_upload_bucket}"
    ]
  }
}

resource "aws_iam_policy" "s3_sr_versions_lambda_sr_delivery_tiktok_policy" {
  name   = "S3-${var.environment}-${var.sr_versions_bucket}-lambda-sr-delivery-tiktok-R-policy"
  policy = data.aws_iam_policy_document.s3_sr_versions_lambda_sr_delivery_tiktok_policy_document.json
}

resource "aws_iam_policy" "s3_sr_delivery_audit_lambda_sr_delivery_tiktok_policy" {
  name   = "S3-${var.environment}-${var.sr_delivery_audit_bucket}-lambda-sr-delivery-tiktok-RW-policy"
  policy = data.aws_iam_policy_document.s3_sr_delivery_audit_lambda_sr_delivery_tiktok_policy_document.json
}

resource "aws_iam_policy" "s3_sr_delivery_upload_lambda_sr_delivery_tiktok_policy" {
  name   = "S3-${var.environment}-${var.sr_delivery_upload_bucket}-lambda-sr-delivery-tiktok-RW-policy"
  description = "Allows sr-delivery-tiktok lambda read/write access to sr-delivery-upload bucket"
  policy = data.aws_iam_policy_document.s3_sr_delivery_upload_lambda_sr_delivery_tiktok_policy_document.json
}

data "aws_iam_policy" "s3_mezz_tiktok_ro_delivery" {
  name = "S3-${var.environment}-orcd-mezzanine-assets-RO"
}

module "lambda_sr_delivery_tiktok" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=4.1.0"

  application_family       = var.application_family
  datadog_advanced_enabled = true
  environment              = var.environment
  lambda_name              = var.sr_delivery_tiktok_function_name
  lambda_description       = "Delivery of sound recording to TikTok"
  lambda_function_timeout  = var.lambda_default_timeout
  use_container_image      = true
  vpc_id                   = module.vpc_info.vpc_id
  vpc_subnet_ids           = module.vpc_info.default_private_subnet_ids

  lambda_function_memory_size = 3000

  iam_managed_policy_attachments = [
    aws_iam_policy.s3_sr_versions_lambda_sr_delivery_tiktok_policy.arn,
    aws_iam_policy.s3_sr_delivery_audit_lambda_sr_delivery_tiktok_policy.arn,
    aws_iam_policy.s3_sr_delivery_upload_lambda_sr_delivery_tiktok_policy.arn,
    data.aws_iam_policy.s3_mezz_tiktok_ro_delivery.arn
  ]

  lambda_function_environment_variables = {
    ENVIRONMENT   = var.environment
    PROCESS_ASSET = var.process_asset
    PERFORM_FINAL_DDEX_COMPARISON = var.perform_final_ddex_comparison
    LOGGER_LEVEL = "WARN"
    DDEX_FILE_VERSION = var.ddex_file_version_tiktok
  }

  lambda_function_reserved_concurrent_executions = "20"
}

module "datadog_lambda_sr_delivery_tiktok_dashboards" {
  source                            = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.13.4"
  service_name                      = var.sr_delivery_tiktok_function_name
  environment                       = var.environment
  lambda_invocation_monitor_enabled = false
  lambda_error_monitor_enabled      = true
  notification_endpoints            = var.slack_alert_channel
}

resource "aws_iam_role" "sr_delivery_upload_lambda_sr_delivery_tiktok_role" {
  name   = "S3-${var.environment}-${var.sr_delivery_upload_bucket}-lambda-sr-delivery-tiktok-role"
  assume_role_policy = data.aws_iam_policy_document.sr_delivery_upload_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "sr_delivery_upload_tiktok_role_policy_attachment" {
  role       = aws_iam_role.sr_delivery_upload_lambda_sr_delivery_tiktok_role.id
  policy_arn = aws_iam_policy.s3_sr_delivery_upload_lambda_sr_delivery_tiktok_policy.arn
}

resource "aws_iam_group_policy_attachment" "sr_delivery_upload_policy_attachment" {
  group      = data.aws_iam_group.sr_delivery_upload_group.group_name
  policy_arn = aws_iam_policy.s3_sr_delivery_upload_lambda_sr_delivery_tiktok_policy.arn
}

moved {
  from = aws_iam_role.s3_sr_delivery_upload_lambda_sr_delivery_tiktok_role
  to   = aws_iam_role.sr_delivery_upload_lambda_sr_delivery_tiktok_role
}