# Lambda function to sanitise RDS data.
module "sanitise_data_lambda" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=5.2.2"

  environment        = var.environment
  lambda_name        = local.sanitise_data_lambda_name
  lambda_description = "Lambda function that sanitises RDS database data."
  application_family = var.application_family

  lambda_runtime          = "python3.9"
  lambda_function_timeout = var.sanitise_data_function_timeout
  use_container_image     = true

  lambda_function_environment_variables = {
    SENTRY_DSN = module.sanitise_data_lambda_sentry_project.sentry_key_dsn_public_output
  }

  iam_managed_policy_attachments = [
    aws_iam_policy.sanitise_data_lambda_policy.arn,
  ]

  vpc_enabled    = true
  vpc_id         = module.vpc_info.vpc_id
  vpc_subnet_ids = module.vpc_info.default_private_subnet_ids

  additional_tags = local.tags
}

data "aws_iam_policy_document" "sanitise_data_lambda_policy_document" {
  # checkov:skip=CKV_AWS_111:This role needs to be able to reset the password for an arbitrary RDS database.

  statement {
    sid    = "AllowResetMasterPassword"
    effect = "Allow"

    actions = [
      "rds:DescribeDBClusters",
      "rds:DescribeDBInstances",
      "rds:ModifyDBCluster",
      "rds:ModifyDBInstance",
    ]

    resources = ["*"]
  }

}

resource "aws_iam_policy" "sanitise_data_lambda_policy" {
  name   = local.sanitise_data_lambda_name
  policy = data.aws_iam_policy_document.sanitise_data_lambda_policy_document.json
  tags   = local.tags
}

module "sanitise_data_lambda_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=5.0.0"

  environment        = var.environment
  service_name       = local.sanitise_data_lambda_name
  application_family = var.application_family
  teams              = [var.environment]
}