provider "aws" {
  region = var.region
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/royalties-spark-cluster/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "template_file" "emr_configurations" {
  template = file("configurations/default.json")
}

data "aws_vpc" "prod" {
  tags = {
    Name = "prod"
  }
}

data "aws_subnet_ids" "private1" {
  vpc_id = data.aws_vpc.prod.id
  tags = {
    Name = "prod_private_subnet_0"
  }
}

# Private subnet for TCP 8998 access
data "aws_subnet_ids" "private_subnets" {
  vpc_id = data.aws_vpc.prod.id
  tags = {
    tier = "private"
  }
}

# This syntax is required until https://github.com/terraform-providers/terraform-provider-aws/issues/7522 is resolved
data "aws_subnet" "private_subnets" {
  count = length(data.aws_subnet_ids.private_subnets.ids)
  id    = element(tolist(data.aws_subnet_ids.private_subnets.ids), count.index)
}

resource "aws_s3_bucket_object" "bootstrapscript" {
  bucket = "${var.environment}-orcdbucket"
  key    = "/${var.service_name}/${var.bootstrap_script_name}"
  source = "scripts/${var.bootstrap_script_name}"
}

# create policy for read only access to royalties-compute emr s3 bucket
data "aws_iam_policy_document" "royalties_compute_s3_read_only_policy" {
  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:GetObject*",
      "s3:ListBucket"
    ]

    effect    = "Allow"
    resources = ["arn:aws:s3:::${var.environment}-orcdbucket/${var.service_name}/*"]
  }

  statement {
    actions = [
      "s3:ListBucket"
    ]

    effect    = "Allow"
    resources = ["arn:aws:s3:::${var.environment}-orcdbucket"]
  }

  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets"
    ]

    effect    = "Allow"
    resources = ["*"]
  }
}

# create policy for read only access to the S3 bucket
resource "aws_iam_policy" "royalties_compute_s3_read_only_policy" {
  name        = "${var.environment}-royalties-compute-s3-read-only-policy"
  description = "Read only access to royalties-compute emr s3 bucket"
  policy      = data.aws_iam_policy_document.royalties_compute_s3_read_only_policy.json
}

module "emr" {
  source = "git@github.com:theorchard/terraform-emr//?ref=1.1.0"

  environment                   = var.environment
  service_name                  = var.service_name
  release_label                 = "emr-5.29.0"
  route53_zone_id               = var.route53_zone_id

  applications = [
    "Hadoop",
    "Hive",
    "Pig",
    "Hue",
    "Spark",
    "Ganglia",
    "Livy",
    "Sqoop",
  ]

  configurations = data.template_file.emr_configurations.rendered
  key_name       = "orchard_admin"
  subnet_id      = sort(data.aws_subnet_ids.private1.ids)[0]

  job_flow_keep_alive = true

  leader_instance_group_name           = "LeaderInstanceGroup"
  leader_instance_group_instance_type  = "m5.xlarge"
  leader_instance_group_instance_count = "1"
  qa_8998_listener_allow_cidr_blocks = concat(
    data.aws_subnet.private_subnets.*.cidr_block,
    [
      "192.168.31.0/24",
      "192.168.32.0/24",
      "192.168.33.0/24",
      "10.30.0.0/22",
      "10.40.0.0/22",
    ]
  )

  leader_instance_group_ebs_size = "64"
  leader_instance_group_ebs_type = "gp2"

  core_instance_group_name           = "CoreInstanceGroup"
  core_instance_group_instance_type  = "m5.xlarge"
  core_instance_group_instance_count = "2"
  core_instance_group_ebs_size       = "64"

  bootstrap_name = "custom_royalties_s3_action"
  bootstrap_uri  = "s3://${var.environment}-orcdbucket${aws_s3_bucket_object.bootstrapscript.id}"
  bootstrap_args = []
  log_uri        = "s3://aws-logs-437795906767-${var.region}/elasticmapreduce/${var.environment}-${var.service_name}/"

  emr_service_role_iam_managed_policy_attachments = [
    aws_iam_policy.royalties_compute_s3_read_only_policy.arn
  ]

  emr_ec2_role_iam_managed_policy_attachments = [
   aws_iam_policy.royalties_compute_s3_read_only_policy.arn
  ]
}