provider "aws" {
  region = "us-east-1"
}

terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/terraform-vpc/test/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_vpc_endpoint_service" "ec2" {
  service = "ec2"
}

data "aws_iam_role" "flow_logs_role" {
  name = "flowlogsRole"
}

data "aws_cloudwatch_log_group" "flow_logs_group" {
  name = "/aws/vpclogflow"
}

data "aws_s3_bucket" "flow_logs_bucket" {
  bucket = "dev-orcd-vpc-logs"
}

data "aws_route53_resolver_firewall_rule_group" "dns_firewall_rule_group" {
  firewall_rule_group_id = "rslvr-frg-1764658298884585" # sony_ioc_rule_group
}

module "test_vpc" {
  source = "../vpc"

  env                        = var.environment
  account_group              = var.account_group
  dns_firewall_rule_group_id = data.aws_route53_resolver_firewall_rule_group.dns_firewall_rule_group.id

  vpc_cidr = "10.91.0.0/16"

  vpc_public_subnets = [
    { availability_zone = "us-east-1a", cidr_block = "10.91.0.0/20", name = "test_public_subnet_0" },
    { availability_zone = "us-east-1b", cidr_block = "10.91.16.0/20", name = "test_public_subnet_1" },
    { availability_zone = "us-east-1a", cidr_block = "10.91.64.0/20", name = "test_public_subnet_2" },
    { availability_zone = "us-east-1b", cidr_block = "10.91.80.0/20", name = "test_public_subnet_3" },
  ]

  vpc_private_subnets = [
    { availability_zone = "us-east-1a", cidr_block = "10.91.32.0/20", name = "test_private_subnet_0" },
    { availability_zone = "us-east-1b", cidr_block = "10.91.48.0/20", name = "test_private_subnet_1" },
    { availability_zone = "us-east-1a", cidr_block = "10.91.96.0/20", name = "test_private_subnet_2" },
    { availability_zone = "us-east-1b", cidr_block = "10.91.112.0/20", name = "test_private_subnet_3" },
  ]

  vpc_flow_logs = {
    cloudwatch = {
      iam_role_arn         = data.aws_iam_role.flow_logs_role.arn
      log_destination      = data.aws_cloudwatch_log_group.flow_logs_group.arn
      log_destination_type = "cloud-watch-logs"
      traffic_type         = "ALL"
    }
    s3 = {
      log_destination      = data.aws_s3_bucket.flow_logs_bucket.arn
      log_destination_type = "s3"
      traffic_type         = "REJECT"
    }
  }
}