module "lambda_sr_delivery_youtube" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=4.3.0"

  application_family       = var.application_family
  datadog_advanced_enabled = true
  environment              = var.environment
  lambda_name              = var.sr_delivery_youtube_name
  lambda_description       = "Deliveries of sound recording to Youtube"
  lambda_function_timeout  = var.lambda_max_timeout
  use_container_image      = true
  vpc_id                   = module.vpc_info.vpc_id
  vpc_subnet_ids           = module.vpc_info.default_private_subnet_ids

  lambda_function_memory_size = 512

  iam_managed_policy_attachments = [
    aws_iam_policy.s3_sr_versions_lambda_sr_delivery_youtube_policy.arn,
    aws_iam_policy.s3_sr_delivery_audit_lambda_sr_delivery_youtube_policy.arn,
    aws_iam_policy.s3_sr_delivery_upload_lambda_sr_delivery_youtube_policy.arn,
    data.aws_iam_policy.s3_mezz_youtube_ro_delivery.arn
  ]

  lambda_function_environment_variables = {
    ENVIRONMENT                    = var.environment
    YOUTUBE_INCLUDE_TESTING_HEADER = "true"
    YOUTUBE_SFTP_HOSTNAME          = var.youtube_sftp_hostname
    YOUTUBE_SFTP_PORT              = var.youtube_sftp_port
    YOUTUBE_SFTP_USERNAME          = var.youtube_sftp_username
    YOUTUBE_SFTP_BASE_DIRNAME      = var.youtube_sftp_base_dirname
    PROCESS_ASSET                  = var.process_asset
    DDEX_FILE_VERSION              = var.ddex_file_version_youtube
  }


  lambda_function_reserved_concurrent_executions = "3"
}

module "lambda_sr_delivery_youtube_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  application_family = var.application_family
  environment        = var.environment
  platform           = "python"
  service_name       = var.sr_delivery_youtube_name
  teams              = [var.environment]
}

module "datadog_lambda_sr_delivery_youtube_dashboards" {
  source                            = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.13.7"
  service_name                      = var.sr_delivery_youtube_name
  environment                       = var.environment
  lambda_invocation_monitor_enabled = false
  lambda_error_monitor_enabled      = false
  notification_endpoints            = var.slack_alert_channel
}

data "aws_iam_policy_document" "s3_sr_versions_lambda_sr_delivery_youtube_policy_document" {
  statement {
    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:GetBucketVersioning"
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_versions_bucket}/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_versions_bucket}"
    ]
  }
}

data "aws_iam_policy_document" "s3_sr_delivery_audit_lambda_sr_delivery_youtube_policy_document" {
  statement {
    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectVersion"
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_delivery_audit_bucket}/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_delivery_audit_bucket}"
    ]
  }
}

# Access for sr-delivery-youtube to write to sr-delivery-upload bucket - ONLY NECESSARY IN QA
data "aws_iam_policy_document" "s3_sr_delivery_upload_lambda_sr_delivery_youtube_policy_document" {
  statement {
    actions = [
      "s3:PutObject",
      "s3:GetObject"
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_delivery_upload_bucket}/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_delivery_upload_bucket}"
    ]
  }
}

resource "aws_iam_policy" "s3_sr_versions_lambda_sr_delivery_youtube_policy" {
  name   = "S3-${var.environment}-${var.sr_versions_bucket}-lambda-sr-delivery-youtube-R-policy"
  policy = data.aws_iam_policy_document.s3_sr_versions_lambda_sr_delivery_youtube_policy_document.json
}

resource "aws_iam_policy" "s3_sr_delivery_audit_lambda_sr_delivery_youtube_policy" {
  name   = "S3-${var.environment}-${var.sr_delivery_audit_bucket}-lambda-sr-delivery-youtube-RW-policy"
  policy = data.aws_iam_policy_document.s3_sr_delivery_audit_lambda_sr_delivery_youtube_policy_document.json
}

resource "aws_iam_policy" "s3_sr_delivery_upload_lambda_sr_delivery_youtube_policy" {
  name        = "S3-${var.environment}-${var.sr_delivery_upload_bucket}-lambda-sr-delivery-youtube-W-policy"
  description = "Allows sr-delivery-youtube lambda read/write access to sr-delivery-upload bucket"
  policy      = data.aws_iam_policy_document.s3_sr_delivery_upload_lambda_sr_delivery_youtube_policy_document.json
}

resource "aws_iam_role" "sr_delivery_upload_lambda_sr_delivery_youtube_role" {
  name               = "S3-${var.environment}-${var.sr_delivery_upload_bucket}-lambda-sr-delivery-youtube-role"
  assume_role_policy = data.aws_iam_policy_document.sr_delivery_upload_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "sr_delivery_upload_lambda_sr_delivery_youtube_role_attachment" {
  role       = aws_iam_role.sr_delivery_upload_lambda_sr_delivery_youtube_role.name
  policy_arn = aws_iam_policy.s3_sr_delivery_upload_lambda_sr_delivery_youtube_policy.arn
}

resource "aws_iam_group_policy_attachment" "sr_delivery_upload_group_policy_youtube_attachment" {
  group      = data.aws_iam_group.sr_delivery_upload_group.group_name
  policy_arn = aws_iam_policy.s3_sr_delivery_upload_lambda_sr_delivery_youtube_policy.arn
}

module "sr_delivery_youtube_secrets" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"

  environment                    = var.environment
  service_name                   = var.sr_delivery_youtube_name
  secret_name                    = var.youtube_private_key_secret_name
  application_family             = var.application_family
  secret_recovery_window_in_days = 7
}

data "aws_iam_policy" "s3_mezz_youtube_ro_delivery" {
  name = "S3-${var.environment}-orcd-mezzanine-assets-RO"
}