#SNS Topic
resource "aws_sns_topic" "notification_service" {
  name = "tf-notification-service"
  tags = {
    nf_node_type      = "MOP"
    nf_environment    = local.workspace["deploy_env_name"]
    cost_environment  = local.workspace["deploy_env_name"] == "production" ? "production" : "non-production"
    cost_category     = "MOPINT"
    cost_team_owner   = "MOPPLT"
  }
  lifecycle {
    ignore_changes  = [ tags ]
  }
}

# Current Account ID
data "aws_caller_identity" "current" {}

data "aws_region" "current" {}

# Allow SNS To Invoke the Lambda
resource "aws_lambda_permission" "with_sns" {
  statement_id  = "AllowExecutionFromSNS-v2"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.lambda_sns_processor.function_name
  principal     = "sns.amazonaws.com"
  source_arn    = aws_sns_topic.notification_service.arn
}

# Attach Lambda Subscription
resource "aws_sns_topic_subscription" "lambda_subscription" {
  topic_arn = aws_sns_topic.notification_service.arn
  protocol  = "lambda"
  endpoint  = aws_lambda_function.lambda_sns_processor.arn
}


data "aws_iam_policy_document" "notification_sns_lambda_doc" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}


# Trust Lambda service to assume role
resource "aws_iam_role" "notification_sns_lambda" {
  name = "tf-lambda-notification-sns-to-sqs${local.workspace["iam_suffix"]}"
  assume_role_policy = data.aws_iam_policy_document.notification_sns_lambda_doc.json

}


data "aws_iam_policy_document" "sqs_send_doc" {
  statement {
    actions = ["sqs:SendMessage"]
    effect = "Allow"
    resources = [
      aws_sqs_queue.terraform_queue_v7.arn
    ]
  }
}

# Allow the lambda to write to sqs
resource "aws_iam_policy" "sqs_send" {
  name = "tf-notification-sqs-send${local.workspace["iam_suffix"]}"
  description = "Allows messages to be written to sqs queues"
  policy = data.aws_iam_policy_document.sqs_send_doc.json

}

# Attach policy
resource "aws_iam_role_policy_attachment" "send_to_sqs_attachment" {
  role = aws_iam_role.notification_sns_lambda.name
  policy_arn = aws_iam_policy.sqs_send.arn
}




data "aws_iam_policy_document" "cloudwatch_stuff" {
  statement {
    effect = "Allow"
    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents"]
    resources = ["*"]
  }
}

# Allow the lambda to log to Cloudwatch
resource "aws_iam_policy" "lambda_execute" {
  name = "tf-lambda-notification-execute${local.workspace["iam_suffix"]}"
  description = "tf-lambda-notification-execute"
  policy = data.aws_iam_policy_document.cloudwatch_stuff.json

}

# Attach policy
resource "aws_iam_role_policy_attachment" "lambda_exec" {
  role = aws_iam_role.notification_sns_lambda.name
  policy_arn = aws_iam_policy.lambda_execute.arn
}

# compose the zip file for upload
data archive_file "lambda_file" {
  type        = "zip"
  source_file = "files/lambda.py"
  output_path = "files/lambda.zip"

}

# Upload the lambda
resource "aws_lambda_function" "lambda_sns_processor" {
  filename         = "files/lambda.zip"
  function_name    = "tf-notification-sns-processor"
  timeout          = 10
  role             = aws_iam_role.notification_sns_lambda.arn
  handler          = "lambda.lambda_handler"
  source_code_hash = data.archive_file.lambda_file.output_base64sha256
  runtime          = "python3.9"

  environment {
    variables = {
      DESTINATION_URL = "https://sqs.${data.aws_region.current.name}.amazonaws.com/${data.aws_caller_identity.current.account_id}/"
      DESTINATION_QUEUE = aws_sqs_queue.terraform_queue_v7.name //default to V7
      ALLOW_QUEUE_OVERRIDE = "true"
    }
  }
}