module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "shared-orcd-terraform-state"
    key     = "shared/datadog/missing-services-lambda/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = var.environment
}

module "lambda_software_catalog_diff_evaluator" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=5.2.1"

  environment              = var.environment
  lambda_name              = "lambda-${var.service_name}"
  application_family       = var.application_family
  lambda_description       = "Evaluates any services missing from Datadog Software Catalog."
  use_container_image      = true
  datadog_advanced_enabled = true
  vpc_id                   = module.vpc_info.vpc_id
  vpc_subnet_ids           = module.vpc_info.default_private_subnet_ids
  iam_managed_policy_attachments = [
    aws_iam_policy.lambda_s3_put_object.arn,
    aws_iam_policy.lambda_search_resource_explorer.arn,
  ]

  lambda_function_environment_variables = {
    Environment  = var.environment
    SERVICE_NAME = "lambda-${var.service_name}"
  }

  cloudwatch_event_enabled  = true
  cloudwatch_event_rules    = [
    {
      name     = "${var.service_name}-rule"
      schedule = "cron(0 6 ? * 3 *)" # Every Tuesday at 6 AM UTC
    }
  ]
}

data "aws_s3_bucket" "software_catalog_bucket" {
  bucket = "shared-datadog-software-catalog"
}

resource "aws_iam_policy" "lambda_s3_put_object" {
  name        = "lambda-${var.environment}-${var.service_name}-s3-put-object-policy"
  description = "lambda-${var.environment}-${var.service_name}-s3-put-object-policy"
  policy      = data.aws_iam_policy_document.lambda_s3_put_object_policy_document.json
}

resource "aws_iam_policy" "lambda_search_resource_explorer" {
  name        = "lambda-${var.environment}-${var.service_name}-resource-explorer-policy"
  description = "lambda-${var.environment}-${var.service_name}-resource-explorer-policy"
  policy      = data.aws_iam_policy_document.lambda_resource_explorer_policy.json
}

data "aws_iam_policy_document" "lambda_s3_put_object_policy_document" {
  statement {
    actions = [
      "s3:PutObject",
    ]

    resources = [
      "${data.aws_s3_bucket.software_catalog_bucket.arn}/*",
    ]
  }
}

data "aws_iam_policy_document" "lambda_resource_explorer_policy" {
  statement {
    actions = [
      "resource-explorer-2:Search",
    ]
    effect = "Allow"

    resources = [var.resource_explorer_view_arn]
  }
}

module "secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  environment        = var.environment
  service_name       = "lambda-${var.service_name}"
  secret_name        = each.value
  application_family = var.application_family
}