provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/terraform-lambda/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_iam_policy_document" "lambda_zappa_read_only_policy_document" {
  statement {
    actions = [
      "s3:GetObject",
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-lambda-zappa/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-lambda-zappa"
    ]
  }
}

resource "aws_iam_policy" "lambda_zappa_read_only_policy" {
  name   = "S3-${var.environment}-lambda-zappa-RO"
  policy = data.aws_iam_policy_document.lambda_zappa_read_only_policy_document.json
}

data "aws_vpc" "vpc" {
  id = var.vpc_id
}

resource "aws_security_group" "lambda_security_group" {
  name        = "${var.environment}-lambda-default-security-group"
  description = "Default security group for VPC-bound Lambda functions in ${var.environment} environment."
  vpc_id      = data.aws_vpc.vpc.id
  tags        = local.tags
}

resource "aws_security_group_rule" "allow_egress_for_lambda_security_group" {
  type              = "egress"
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  from_port         = 0
  to_port           = 0
  security_group_id = aws_security_group.lambda_security_group.id
}