provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "prod-royaltyshare-terraform-state"
    key     = "prod/whitehat-sentinel-appliance/terraform.tfstate"
    region  = "us-west-2"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

# imported AMI - ami-0d7f71a5d7a674983

data "aws_ami" "whitehat_sentinel_appliance_ami" {
  most_recent      = true
  owners           = ["self"]
  name_regex = "import-ami-*"

  filter {
    name   = "tag:Name"
    values = ["whitehat-appliance"]
  }

  filter {
    name   = "root-device-type"
    values = ["ebs"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

# IAM policy document for ec2 instance's role
data "aws_iam_policy_document" "instance-assume-role-policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "Service"
      identifiers = [
        "ec2.amazonaws.com"
      ]
    }
  }
}

resource "aws_iam_role" "whitehat_sentinel_appliance_role" {
  name               = "${var.environment}-${var.service_name}-service-role"
  assume_role_policy = data.aws_iam_policy_document.instance-assume-role-policy.json
}

resource "aws_iam_instance_profile" "whitehat_sentinel_appliance_instance_profile" {
  name = "${var.environment}-${var.service_name}-instance-profile"
  role = aws_iam_role.whitehat_sentinel_appliance_role.name
}

data "aws_vpc" "vpc" {
  tags = {
    Name = "RoyaltyShare"
  }
}

data "aws_subnet" "private_subnet_1" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.vpc.id]
  }
  filter {
    name   = "tag:Name"
    values = ["Application 2b 64"]
  }
}

data "aws_subnet" "private_subnet_2" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.vpc.id]
  }
  filter {
    name   = "tag:Name"
    values = ["Application 2c 48"]
  }
}

resource "aws_security_group" "whitehat_sentinel_appliance_instance_sg" {
  name        = "${var.environment}-${var.service_name}-instance-sg"
  description = "Instance security group for ${var.environment}-${var.service_name}"
  vpc_id      = data.aws_vpc.vpc.id
  tags        = merge(local.tags, { eiso-exception = "aws.08.30" })
}

resource "aws_security_group_rule" "whitehat_sentinel_appliance_instance_ingress_9100_sg_rule" {
  type              = "ingress"
  from_port         = 9100
  to_port           = 9100
  protocol          = "tcp"
  cidr_blocks       = var.health_check_cidr_blocks
  security_group_id = aws_security_group.whitehat_sentinel_appliance_instance_sg.id
}

resource "aws_security_group_rule" "whitehat_sentinel_appliance_instance_ingress_9200_sg_rule" {
  type              = "ingress"
  from_port         = 9200
  to_port           = 9200
  protocol          = "tcp"
  cidr_blocks       = var.health_check_cidr_blocks
  security_group_id = aws_security_group.whitehat_sentinel_appliance_instance_sg.id
}

resource "aws_security_group_rule" "whitehat_sentinel_appliance_instance_egress_sg_rule" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.whitehat_sentinel_appliance_instance_sg.id
}

resource "aws_instance" "whitehat_sentinel_appliance_instance" {
  # checkov:skip=CKV_AWS_79:deemed not safe to enable, will be silenced globally
  ami                                  = "ami-0a62d3aafb18488c7"
  instance_type                        = "t3.medium"
  key_name                             = var.aws_key_name
  monitoring                           = true
  subnet_id                            = data.aws_subnet.private_subnet_1.id
  vpc_security_group_ids               = [aws_security_group.whitehat_sentinel_appliance_instance_sg.id]
  associate_public_ip_address          = false
  iam_instance_profile                 = aws_iam_instance_profile.whitehat_sentinel_appliance_instance_profile.name
  instance_initiated_shutdown_behavior = "stop"
  ebs_optimized                        = true
  disable_api_termination              = false

  root_block_device {
    volume_type           = "gp3"
    volume_size           = 40
    delete_on_termination = true
    encrypted             = true
  }

  tags = local.tags

  volume_tags = {
    Name         = "${var.environment}-${var.service_name}"
    environment  = var.environment
    service_name = var.service_name
    terraformed  = true
  }

  # lifecycle {
  #   ignore_changes = [ami]
  # }
}