module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "prod-royaltyshare-terraform-state"
    key     = "prod/rpsapp-servers/terraform.tfstate"
    region  = "us-west-2"
    encrypt = "true"
  }
}

data "aws_vpc" "royaltyshare" {
  tags = {
    Name = "RoyaltyShare"
  }
}

data "aws_subnet" "app_2b" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.royaltyshare.id]
  }
  filter {
    name   = "tag:Name"
    values = ["Application 2b 64"]
  }
}

data "aws_subnet" "app_2c" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.royaltyshare.id]
  }
  filter {
    name   = "tag:Name"
    values = ["Application 2c 48"]
  }
}

# Shared security groups managed outside this configuration (attach to non-rpsapp hosts).
data "aws_security_group" "internal_ssh" {
  id = "sg-e1674899"
}

data "aws_security_group" "datacenter_ssh" {
  id = "sg-9bc397e0"
}

resource "aws_security_group" "rpsapp" {
  name        = "rpsapp"
  description = "Application server security group"
  vpc_id      = data.aws_vpc.royaltyshare.id

  tags = {
    Name = "rpsapp"
  }
}

resource "aws_vpc_security_group_ingress_rule" "rpsapp_http" {
  #checkov:skip=CKV_AWS_260:Ingress is from a referenced security group (internal ECS web ALB), not 0.0.0.0/0.
  security_group_id            = aws_security_group.rpsapp.id
  description                  = "HTTP from internal ECS web ALB"
  referenced_security_group_id = "sg-03eb3c42b6baa922a"
  from_port                    = 80
  to_port                      = 80
  ip_protocol                  = "tcp"
}

resource "aws_vpc_security_group_egress_rule" "rpsapp_all" {
  security_group_id = aws_security_group.rpsapp.id
  cidr_ipv4         = "0.0.0.0/0"
  ip_protocol       = "-1"
}

# EC2 instances backfilled from the royaltyshare account (us-west-2, rpsapp* fleet).
# Imported as-is: unencrypted root volumes, IMDSv1 and no IAM role are pre-existing
# and intentionally preserved to avoid disrupting running production app servers.

resource "aws_instance" "rpsapp05" {
  #checkov:skip=CKV_AWS_8:Migrated existing instance as-is - root volume not encrypted.
  #checkov:skip=CKV_AWS_79:Migrated existing instance as-is - IMDSv1 optional.
  #checkov:skip=CKV2_AWS_41:Migrated existing instance as-is - no IAM role attached.
  ami           = "ami-4836a428"
  instance_type = "m4.large"
  key_name      = "RSProduction"
  subnet_id     = data.aws_subnet.app_2b.id
  ebs_optimized = true
  monitoring    = true

  vpc_security_group_ids = [
    aws_security_group.rpsapp.id,
    data.aws_security_group.internal_ssh.id,
    data.aws_security_group.datacenter_ssh.id,
  ]

  metadata_options {
    http_tokens = "optional"
  }

  root_block_device {
    volume_type           = "gp3"
    volume_size           = 8
    iops                  = 3000
    throughput            = 125
    encrypted             = false
    delete_on_termination = true

    tags = {
      Name = "rpsapp05 root"
    }
  }

  tags = {
    Name = "rpsapp05"
  }

  lifecycle {
    ignore_changes = [ami, user_data]
  }
}

resource "aws_instance" "rpsapp20" {
  #checkov:skip=CKV_AWS_8:Migrated existing instance as-is - root volume not encrypted.
  #checkov:skip=CKV_AWS_79:Migrated existing instance as-is - IMDSv1 optional.
  #checkov:skip=CKV_AWS_126:Migrated existing instance as-is - detailed monitoring disabled.
  ami                  = "ami-0f06900b072018ede"
  instance_type        = "m5zn.6xlarge"
  key_name             = "RSProduction"
  subnet_id            = data.aws_subnet.app_2c.id
  ebs_optimized        = true
  monitoring           = false
  iam_instance_profile = aws_iam_instance_profile.rpsapp20_statement_attachments_uploader.name

  vpc_security_group_ids = [
    aws_security_group.rpsapp.id,
    data.aws_security_group.internal_ssh.id,
  ]

  metadata_options {
    http_tokens = "optional"
  }

  root_block_device {
    volume_type           = "gp3"
    volume_size           = 256
    iops                  = 3000
    throughput            = 125
    encrypted             = false
    delete_on_termination = false

    tags = {
      Name = "rpsapp20 root"
    }
  }

  tags = {
    Name = "rpsapp20"
  }

  lifecycle {
    ignore_changes = [ami, user_data]
  }
}

resource "aws_instance" "rpsapp21" {
  #checkov:skip=CKV_AWS_8:Migrated existing instance as-is - root volume not encrypted.
  #checkov:skip=CKV_AWS_79:Migrated existing instance as-is - IMDSv1 optional.
  #checkov:skip=CKV_AWS_126:Migrated existing instance as-is - detailed monitoring disabled.
  #checkov:skip=CKV2_AWS_41:Migrated existing instance as-is - no IAM role attached.
  ami           = "ami-0f06900b072018ede"
  instance_type = "m5zn.6xlarge"
  key_name      = "RSProduction"
  subnet_id     = data.aws_subnet.app_2c.id
  ebs_optimized = true
  monitoring    = false

  vpc_security_group_ids = [
    aws_security_group.rpsapp.id,
    data.aws_security_group.internal_ssh.id,
  ]

  metadata_options {
    http_tokens = "optional"
  }

  root_block_device {
    volume_type           = "gp3"
    volume_size           = 256
    iops                  = 3000
    throughput            = 125
    encrypted             = false
    delete_on_termination = false

    tags = {
      Name = "rpsapp21 root"
    }
  }

  tags = {
    Name = "rpsapp21"
  }

  lifecycle {
    ignore_changes = [ami, user_data]
  }
}

resource "aws_instance" "rpsapp22" {
  #checkov:skip=CKV_AWS_8:Migrated existing instance as-is - root volume not encrypted.
  #checkov:skip=CKV_AWS_79:Migrated existing instance as-is - IMDSv1 optional.
  #checkov:skip=CKV_AWS_126:Migrated existing instance as-is - detailed monitoring disabled.
  #checkov:skip=CKV2_AWS_41:Migrated existing instance as-is - no IAM role attached.
  ami           = "ami-0f06900b072018ede"
  instance_type = "m5zn.6xlarge"
  key_name      = "RSProduction"
  subnet_id     = data.aws_subnet.app_2b.id
  ebs_optimized = true
  monitoring    = false

  vpc_security_group_ids = [
    aws_security_group.rpsapp.id,
    data.aws_security_group.internal_ssh.id,
  ]

  metadata_options {
    http_tokens = "optional"
  }

  root_block_device {
    volume_type           = "gp3"
    volume_size           = 256
    iops                  = 3000
    throughput            = 125
    encrypted             = false
    delete_on_termination = false

    tags = {
      Name = "rpsapp22 root"
    }
  }

  tags = {
    Name = "rpsapp22"
  }

  lifecycle {
    ignore_changes = [ami, user_data]
  }
}

resource "aws_instance" "rpsapp23" {
  #checkov:skip=CKV_AWS_8:Migrated existing instance as-is - root volume not encrypted.
  #checkov:skip=CKV_AWS_79:Migrated existing instance as-is - IMDSv1 optional.
  #checkov:skip=CKV_AWS_126:Migrated existing instance as-is - detailed monitoring disabled.
  #checkov:skip=CKV2_AWS_41:Migrated existing instance as-is - no IAM role attached.
  ami           = "ami-0f06900b072018ede"
  instance_type = "m5zn.6xlarge"
  key_name      = "RSProduction"
  subnet_id     = data.aws_subnet.app_2b.id
  ebs_optimized = true
  monitoring    = false

  vpc_security_group_ids = [
    aws_security_group.rpsapp.id,
    data.aws_security_group.internal_ssh.id,
  ]

  metadata_options {
    http_tokens = "optional"
  }

  root_block_device {
    volume_type           = "gp3"
    volume_size           = 256
    iops                  = 3000
    throughput            = 125
    encrypted             = false
    delete_on_termination = false

    tags = {
      Name = "rpsapp23 root"
    }
  }

  tags = {
    Name = "rpsapp23"
  }

  lifecycle {
    ignore_changes = [ami, user_data]
  }
}

resource "aws_instance" "rpsapp24" {
  #checkov:skip=CKV_AWS_8:Migrated existing instance as-is - root volume not encrypted.
  #checkov:skip=CKV_AWS_79:Migrated existing instance as-is - IMDSv1 optional.
  #checkov:skip=CKV_AWS_126:Migrated existing instance as-is - detailed monitoring disabled.
  #checkov:skip=CKV2_AWS_41:Migrated existing instance as-is - no IAM role attached.
  ami           = "ami-0f06900b072018ede"
  instance_type = "m5zn.6xlarge"
  key_name      = "RSProduction"
  subnet_id     = data.aws_subnet.app_2c.id
  ebs_optimized = true
  monitoring    = false

  vpc_security_group_ids = [
    aws_security_group.rpsapp.id,
    data.aws_security_group.internal_ssh.id,
  ]

  metadata_options {
    http_tokens = "optional"
  }

  root_block_device {
    volume_type           = "gp3"
    volume_size           = 256
    iops                  = 3000
    throughput            = 125
    encrypted             = false
    delete_on_termination = false

    tags = {
      Name = "rpsapp24 root"
    }
  }

  tags = {
    Name = "rpsapp24"
  }

  lifecycle {
    ignore_changes = [ami, user_data]
  }
}

resource "aws_instance" "rpsapp25" {
  #checkov:skip=CKV_AWS_8:Migrated existing instance as-is - root volume not encrypted.
  #checkov:skip=CKV_AWS_79:Migrated existing instance as-is - IMDSv1 optional.
  #checkov:skip=CKV_AWS_126:Migrated existing instance as-is - detailed monitoring disabled.
  #checkov:skip=CKV2_AWS_41:Migrated existing instance as-is - no IAM role attached.
  ami           = "ami-0f06900b072018ede"
  instance_type = "m5zn.6xlarge"
  key_name      = "RSProduction"
  subnet_id     = data.aws_subnet.app_2c.id
  ebs_optimized = true
  monitoring    = false

  vpc_security_group_ids = [
    aws_security_group.rpsapp.id,
    data.aws_security_group.internal_ssh.id,
  ]

  metadata_options {
    http_tokens = "optional"
  }

  root_block_device {
    volume_type           = "gp3"
    volume_size           = 256
    iops                  = 3000
    throughput            = 125
    encrypted             = false
    delete_on_termination = false

    tags = {
      Name = "rpsapp25 root"
    }
  }

  tags = {
    Name = "rpsapp25"
  }

  lifecycle {
    ignore_changes = [ami, user_data]
  }
}

# Non-root (data) EBS volumes for the rpsapp fleet, imported as-is.
# Existing volumes are unencrypted; preserved to avoid disrupting running instances.

# rpsapp05
resource "aws_ebs_volume" "rpsapp05_sdg" {
  #checkov:skip=CKV_AWS_3:Migrated existing volume as-is - not encrypted.
  #checkov:skip=CKV_AWS_189:Migrated existing volume as-is - not encrypted with CMK.
  #checkov:skip=CKV2_AWS_2:Migrated existing volume as-is - not encrypted.
  availability_zone = aws_instance.rpsapp05.availability_zone
  size              = 1000
  type              = "gp3"
  iops              = 3000
  throughput        = 125
  encrypted         = false

  tags = {
    Name = "rpsapp05 data"
  }
}

resource "aws_volume_attachment" "rpsapp05_sdg" {
  device_name = "/dev/sdg"
  volume_id   = aws_ebs_volume.rpsapp05_sdg.id
  instance_id = aws_instance.rpsapp05.id
}

# rpsapp20
resource "aws_ebs_volume" "rpsapp20_xvdf" {
  #checkov:skip=CKV_AWS_3:Migrated existing volume as-is - not encrypted.
  #checkov:skip=CKV_AWS_189:Migrated existing volume as-is - not encrypted with CMK.
  #checkov:skip=CKV2_AWS_2:Migrated existing volume as-is - not encrypted.
  availability_zone = aws_instance.rpsapp20.availability_zone
  size              = 64
  type              = "gp3"
  iops              = 3000
  throughput        = 125
  encrypted         = false

  tags = {
    Name = "rpsapp20 swap"
  }
}

resource "aws_volume_attachment" "rpsapp20_xvdf" {
  device_name = "/dev/xvdf"
  volume_id   = aws_ebs_volume.rpsapp20_xvdf.id
  instance_id = aws_instance.rpsapp20.id
}

resource "aws_ebs_volume" "rpsapp20_xvdg" {
  #checkov:skip=CKV_AWS_3:Migrated existing volume as-is - not encrypted.
  #checkov:skip=CKV_AWS_189:Migrated existing volume as-is - not encrypted with CMK.
  #checkov:skip=CKV2_AWS_2:Migrated existing volume as-is - not encrypted.
  availability_zone = aws_instance.rpsapp20.availability_zone
  size              = 2048
  type              = "gp3"
  iops              = 16000
  throughput        = 1000
  encrypted         = false

  tags = {
    Name = "rpsapp20 data"
  }
}

resource "aws_volume_attachment" "rpsapp20_xvdg" {
  device_name = "/dev/xvdg"
  volume_id   = aws_ebs_volume.rpsapp20_xvdg.id
  instance_id = aws_instance.rpsapp20.id
}

# rpsapp21
resource "aws_ebs_volume" "rpsapp21_xvdf" {
  #checkov:skip=CKV_AWS_3:Migrated existing volume as-is - not encrypted.
  #checkov:skip=CKV_AWS_189:Migrated existing volume as-is - not encrypted with CMK.
  #checkov:skip=CKV2_AWS_2:Migrated existing volume as-is - not encrypted.
  availability_zone = aws_instance.rpsapp21.availability_zone
  size              = 64
  type              = "gp3"
  iops              = 3000
  throughput        = 125
  encrypted         = false

  tags = {
    Name = "rpsapp21 swap"
  }
}

resource "aws_volume_attachment" "rpsapp21_xvdf" {
  device_name = "/dev/xvdf"
  volume_id   = aws_ebs_volume.rpsapp21_xvdf.id
  instance_id = aws_instance.rpsapp21.id
}

resource "aws_ebs_volume" "rpsapp21_xvdg" {
  #checkov:skip=CKV_AWS_3:Migrated existing volume as-is - not encrypted.
  #checkov:skip=CKV_AWS_189:Migrated existing volume as-is - not encrypted with CMK.
  #checkov:skip=CKV2_AWS_2:Migrated existing volume as-is - not encrypted.
  availability_zone = aws_instance.rpsapp21.availability_zone
  size              = 2048
  type              = "gp3"
  iops              = 16000
  throughput        = 1000
  encrypted         = false

  tags = {
    Name = "rpsapp21 data"
  }
}

resource "aws_volume_attachment" "rpsapp21_xvdg" {
  device_name = "/dev/xvdg"
  volume_id   = aws_ebs_volume.rpsapp21_xvdg.id
  instance_id = aws_instance.rpsapp21.id
}

# rpsapp22
resource "aws_ebs_volume" "rpsapp22_xvdf" {
  #checkov:skip=CKV_AWS_3:Migrated existing volume as-is - not encrypted.
  #checkov:skip=CKV_AWS_189:Migrated existing volume as-is - not encrypted with CMK.
  #checkov:skip=CKV2_AWS_2:Migrated existing volume as-is - not encrypted.
  availability_zone = aws_instance.rpsapp22.availability_zone
  size              = 64
  type              = "gp3"
  iops              = 3000
  throughput        = 125
  encrypted         = false

  tags = {
    Name = "rpsapp22 swap"
  }
}

resource "aws_volume_attachment" "rpsapp22_xvdf" {
  device_name = "/dev/xvdf"
  volume_id   = aws_ebs_volume.rpsapp22_xvdf.id
  instance_id = aws_instance.rpsapp22.id
}

resource "aws_ebs_volume" "rpsapp22_xvdg" {
  #checkov:skip=CKV_AWS_3:Migrated existing volume as-is - not encrypted.
  #checkov:skip=CKV_AWS_189:Migrated existing volume as-is - not encrypted with CMK.
  #checkov:skip=CKV2_AWS_2:Migrated existing volume as-is - not encrypted.
  availability_zone = aws_instance.rpsapp22.availability_zone
  size              = 2048
  type              = "gp3"
  iops              = 16000
  throughput        = 1000
  encrypted         = false

  tags = {
    Name = "rpsapp22 data"
  }
}

resource "aws_volume_attachment" "rpsapp22_xvdg" {
  device_name = "/dev/xvdg"
  volume_id   = aws_ebs_volume.rpsapp22_xvdg.id
  instance_id = aws_instance.rpsapp22.id
}

# rpsapp23
resource "aws_ebs_volume" "rpsapp23_xvdf" {
  #checkov:skip=CKV_AWS_3:Migrated existing volume as-is - not encrypted.
  #checkov:skip=CKV_AWS_189:Migrated existing volume as-is - not encrypted with CMK.
  #checkov:skip=CKV2_AWS_2:Migrated existing volume as-is - not encrypted.
  availability_zone = aws_instance.rpsapp23.availability_zone
  size              = 64
  type              = "gp3"
  iops              = 3000
  throughput        = 125
  encrypted         = false

  tags = {
    Name = "rpsapp23 swap"
  }
}

resource "aws_volume_attachment" "rpsapp23_xvdf" {
  device_name = "/dev/xvdf"
  volume_id   = aws_ebs_volume.rpsapp23_xvdf.id
  instance_id = aws_instance.rpsapp23.id
}

resource "aws_ebs_volume" "rpsapp23_xvdg" {
  #checkov:skip=CKV_AWS_3:Migrated existing volume as-is - not encrypted.
  #checkov:skip=CKV_AWS_189:Migrated existing volume as-is - not encrypted with CMK.
  #checkov:skip=CKV2_AWS_2:Migrated existing volume as-is - not encrypted.
  availability_zone = aws_instance.rpsapp23.availability_zone
  size              = 2048
  type              = "gp3"
  iops              = 16000
  throughput        = 1000
  encrypted         = false

  tags = {
    Name = "rpsapp23 data"
  }
}

resource "aws_volume_attachment" "rpsapp23_xvdg" {
  device_name = "/dev/xvdg"
  volume_id   = aws_ebs_volume.rpsapp23_xvdg.id
  instance_id = aws_instance.rpsapp23.id
}

# rpsapp24
resource "aws_ebs_volume" "rpsapp24_xvdf" {
  #checkov:skip=CKV_AWS_3:Migrated existing volume as-is - not encrypted.
  #checkov:skip=CKV_AWS_189:Migrated existing volume as-is - not encrypted with CMK.
  #checkov:skip=CKV2_AWS_2:Migrated existing volume as-is - not encrypted.
  availability_zone = aws_instance.rpsapp24.availability_zone
  size              = 64
  type              = "gp3"
  iops              = 3000
  throughput        = 125
  encrypted         = false

  tags = {
    Name = "rpsapp24 swap"
  }
}

resource "aws_volume_attachment" "rpsapp24_xvdf" {
  device_name = "/dev/xvdf"
  volume_id   = aws_ebs_volume.rpsapp24_xvdf.id
  instance_id = aws_instance.rpsapp24.id
}

resource "aws_ebs_volume" "rpsapp24_xvdg" {
  #checkov:skip=CKV_AWS_3:Migrated existing volume as-is - not encrypted.
  #checkov:skip=CKV_AWS_189:Migrated existing volume as-is - not encrypted with CMK.
  #checkov:skip=CKV2_AWS_2:Migrated existing volume as-is - not encrypted.
  availability_zone = aws_instance.rpsapp24.availability_zone
  size              = 2048
  type              = "gp3"
  iops              = 16000
  throughput        = 1000
  encrypted         = false

  tags = {
    Name = "rpsapp24 data"
  }
}

resource "aws_volume_attachment" "rpsapp24_xvdg" {
  device_name = "/dev/xvdg"
  volume_id   = aws_ebs_volume.rpsapp24_xvdg.id
  instance_id = aws_instance.rpsapp24.id
}

# rpsapp25
resource "aws_ebs_volume" "rpsapp25_xvdf" {
  #checkov:skip=CKV_AWS_3:Migrated existing volume as-is - not encrypted.
  #checkov:skip=CKV_AWS_189:Migrated existing volume as-is - not encrypted with CMK.
  #checkov:skip=CKV2_AWS_2:Migrated existing volume as-is - not encrypted.
  availability_zone = aws_instance.rpsapp25.availability_zone
  size              = 64
  type              = "gp3"
  iops              = 3000
  throughput        = 125
  encrypted         = false

  tags = {
    Name = "rpsapp25 swap"
  }
}

resource "aws_volume_attachment" "rpsapp25_xvdf" {
  device_name = "/dev/xvdf"
  volume_id   = aws_ebs_volume.rpsapp25_xvdf.id
  instance_id = aws_instance.rpsapp25.id
}

resource "aws_ebs_volume" "rpsapp25_xvdg" {
  #checkov:skip=CKV_AWS_3:Migrated existing volume as-is - not encrypted.
  #checkov:skip=CKV_AWS_189:Migrated existing volume as-is - not encrypted with CMK.
  #checkov:skip=CKV2_AWS_2:Migrated existing volume as-is - not encrypted.
  availability_zone = aws_instance.rpsapp25.availability_zone
  size              = 2048
  type              = "gp3"
  iops              = 16000
  throughput        = 1000
  encrypted         = false

  tags = {
    Name = "rpsapp25 data"
  }
}

resource "aws_volume_attachment" "rpsapp25_xvdg" {
  device_name = "/dev/xvdg"
  volume_id   = aws_ebs_volume.rpsapp25_xvdg.id
  instance_id = aws_instance.rpsapp25.id
}