module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = "us-east-1"
}

data "aws_caller_identity" "current" {}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/lambda-logging-upload-audit-logs-to-s3/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source      = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.2.2"
  environment = var.environment
}

module "lambda_upload_audit_logs_to_s3_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=5.1.0"

  environment        = var.environment
  platform           = "python"
  service_name       = var.service_name
  application_family = var.application_family
  teams              = [var.environment]
}

module "lambda_upload_audit_logs_to_s3" {
  source = "git@github.com:theorchard/terraform-lambda.git?ref=3.1.6"

  environment                                    = var.environment
  application_family                             = var.application_family
  lambda_name                                    = var.lambda_name
  lambda_description                             = "This Lambda uploads logs to S3 from lambda-logging repo"
  lambda_function_timeout                        = "300"
  use_container_image                            = true
  datadog_advanced_enabled                       = true
  event_source_mapping_batch_size                = "5"
  event_source_mapping_enabled                   = true
  event_source_mapping_resource_type             = "kinesis"
  event_source_mapping_starting_position         = "LATEST"
  event_source_mapping_stream_name               = "${var.environment}-maxwell-cloudsearch"
  iam_policy_file_enabled                        = true
  iam_policy_file_location                       = var.iam_policy_file_location
  lambda_function_reserved_concurrent_executions = "16" // This will be limited by the number of shards the Kinesis stream has.
  vpc_enabled                                    = true
  vpc_id                                         = module.vpc_info.vpc_id
  vpc_subnet_ids                                 = module.vpc_info.default_private_subnet_ids
  lambda_function_environment_variables = {
    Environment        = var.environment
    AWS_S3_BUCKET_NAME = "${var.environment}-orchard-logging"
    SENTRY_DSN         = var.SENTRY_DSN
  }
}

# Lambda Security Group.

resource "aws_security_group" "lambda_upload_audit_logs_to_s3_security_group" {
  name        = "${var.environment}-${var.lambda_name}-security-group"
  description = "Security group for ${var.environment}-${var.lambda_name} Lambda function"
  vpc_id      = module.vpc_info.vpc_id

  tags = {
    environment        = var.environment
    service_name       = var.lambda_name
    application_family = var.application_family
    terraformed        = true
    eiso-exception     = "aws.08.30"
  }
}

resource "aws_security_group_rule" "allow_egress_for_lambda_upload_audit_logs_to_s3_security_group" {
  type              = "egress"
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  from_port         = 0
  to_port           = 0
  security_group_id = aws_security_group.lambda_upload_audit_logs_to_s3_security_group.id
}

module "datadog_lambda_upload_audit_logs_to_s3" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.19.0"

  environment                       = var.environment
  service_name                      = var.lambda_name
  notification_endpoints            = var.datadog_notification_endpoints
  lambda_invocation_monitor_enabled = true
}