provider "aws" {
  region = "us-east-1"
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/ny-t0-veeam/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

resource "aws_db_option_group" "db_option_group" {
  name                     = "${var.environment}-${var.service_name}-db-option-group"
  option_group_description = "${var.environment}-${var.service_name} DB option group"
  engine_name              = "sqlserver-ee"
  major_engine_version     = "13.00"

  option {
    option_name = "TDE"
  }
}

# KMS key used for storage encryption; needed to access RDS snapshots if we want to restore them.
resource "aws_kms_key" "kms_key" {
  description             = "${var.environment}_${var.service_name}_rds_encryption_key"
  deletion_window_in_days = 30

  tags = {
    terraformed  = true
    environment  = "${var.environment}"
    service_name = "${var.service_name}"
  }
}

resource "aws_kms_alias" "kms_alias" {
  name          = "alias/${aws_kms_key.kms_key.description}"
  target_key_id = "${aws_kms_key.kms_key.key_id}"
}