module "throttler_lambda" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=1.2.2"

  aws_region               = var.aws_region
  environment              = var.environment
  lambda_name              = var.throttler_service_name
  lambda_description       = "The new delivery throttler script."
  use_custom_function_name = true
  custom_function_name     = "${var.throttler_service_name}-${var.environment}"

  lambda_function_memory_size                    = var.throttler_lambda_memory_size
  lambda_function_timeout                        = var.throttler_lambda_timeout
  lambda_function_reserved_concurrent_executions = var.throttler_lambda_reserved_concurrent_executions

  vpc_subnet_ids         = var.throttler_lambda_subnet_ids
  vpc_security_group_ids = var.throttler_lambda_security_group_ids

  iam_managed_policy_attachments = [
    aws_iam_policy.throttler_execution_policy.arn
  ]

  lambda_function_environment_variables = {
    Environment     = var.environment
    LOGGER_DSN      = var.LOGGER_DSN
    DATADOG_API_KEY = data.aws_secretsmanager_secret_version.datadog_api_key.secret_string
    DATADOG_APP_KEY = data.aws_secretsmanager_secret_version.datadog_app_key.secret_string
    SENTRY_DSN      = data.aws_secretsmanager_secret_version.throttler_sentry_dsn.secret_string
  }
}

resource "aws_iam_policy" "throttler_execution_policy" {
  name   = "${var.environment}-${var.throttler_service_name}-execution-policy"
  policy = data.aws_iam_policy_document.throttler_execution_policy.json
}

data "aws_iam_policy_document" "throttler_execution_policy" {
  statement {
    effect = "Allow"
    actions = [
      "logs:*"
    ]
    resources = [
      "arn:aws:logs:${var.aws_region}:${data.aws_caller_identity.current.account_id}:log-group:/aws/lambda/lambda-throttler-${var.environment}:log-stream:*"
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "ec2:AttachNetworkInterface",
      "ec2:CreateNetworkInterface",
      "ec2:DeleteNetworkInterface",
      "ec2:DescribeInstances",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DetachNetworkInterface",
      "ec2:ModifyNetworkInterfaceAttribute",
      "ec2:ResetNetworkInterfaceAttribute"
    ]
    resources = [
      "*"
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "sqs:GetQueueAttributes",
      "sqs:GetQueueUrl",
      "sqs:ListQueueTags",
      "sqs:ListQueues",
      "sqs:TagQueue",
      "sqs:UntagQueue",
      "sqs:SendMessageBatch",
      "sqs:SendMessage",
      "sqs:CreateQueue"
    ]
    resources = [
      "arn:aws:sqs:*"
    ]
  }
}