#
# Copyright Amazon.com, Inc. and its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT
#
# Licensed under the MIT License. See the LICENSE accompanying this file
# for the specific language governing permissions and limitations under
# the License.
#
resource "aws_api_gateway_rest_api" "apigw" {
  provider    = aws.dev
  name        = "waf-poc"
  description = "API for waf poc"
  endpoint_configuration {
    types = ["REGIONAL"]
  }

  tags = merge(
    local.app_tags,
    local.common_tags,
  )

  policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:eu-west-1:299537281981:*"
        }
    ]
}
EOF
}

resource "aws_api_gateway_resource" "dev" {
  provider    = aws.dev
  rest_api_id = aws_api_gateway_rest_api.apigw.id
  parent_id   = aws_api_gateway_rest_api.apigw.root_resource_id
  path_part   = "poc"
}

resource "aws_api_gateway_method" "dev" {
  provider      = aws.dev
  rest_api_id   = aws_api_gateway_rest_api.apigw.id
  resource_id   = aws_api_gateway_resource.dev.id
  http_method   = "GET"
  authorization = "NONE"
}

resource "aws_api_gateway_integration" "dev" {
  provider    = aws.dev
  rest_api_id = aws_api_gateway_rest_api.apigw.id
  resource_id = aws_api_gateway_method.dev.resource_id
  http_method = aws_api_gateway_method.dev.http_method

  # The integration HTTP method specifying how API Gateway 
  # will interact with the back end. Not all methods are 
  # compatible with all AWS integrations. e.g. 
  # Lambda function can only be invoked via POST.
  integration_http_method = "POST"
  type                    = "AWS_PROXY"
  uri                     = aws_lambda_function.dev.invoke_arn
}

######DEPLOYMENT AND PERMISSIONS
resource "aws_api_gateway_deployment" "dev" {
  provider    = aws.dev
  depends_on  = [aws_api_gateway_integration.dev, ]
  rest_api_id = aws_api_gateway_rest_api.apigw.id
  stage_name  = "dev"
}

resource "aws_api_gateway_stage" "dev" {
  provider      = aws.dev
  stage_name    = "preprod"
  deployment_id = aws_api_gateway_deployment.dev.id
  rest_api_id   = aws_api_gateway_rest_api.apigw.id
  tags = merge(
    local.app_tags,
    local.common_tags,
  )
}

resource "aws_lambda_permission" "dev" {
  provider      = aws.dev
  statement_id  = "AllowAPIGatewayInvoke"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.dev.function_name
  principal     = "apigateway.amazonaws.com"

  # The /*/* portion grants access from any method on any resource
  # within the API Gateway "REST API".
  source_arn = "${aws_api_gateway_rest_api.apigw.execution_arn}/*/GET/poc"
}

######BACKEND LAMBDA
data "archive_file" "dev" {
  type = "zip"

  output_path = "${path.module}/code/dev.zip"
  source {
    content  = file("${path.module}/code/dev.py")
    filename = "dev.py"
  }
}

resource "aws_lambda_function" "dev" {
  provider         = aws.dev
  filename         = "${path.module}/code/dev.zip"
  function_name    = "waf-poc-banckend"
  role             = aws_iam_role.dev-iam-role.arn
  handler          = "dev.handler"
  runtime          = "python3.7"
  source_code_hash = data.archive_file.dev.output_base64sha256
  timeout          = 900


  tags = merge(
    local.common_tags,
    {
      "Purpose" = "waf poc backend for api gw"
      "Name"    = "waf-poc-banckend"
    },
  )

}


resource "aws_iam_role" "dev-iam-role" {
  provider = aws.dev
  name     = "waf-poc-banckend"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Effect": "Allow"
    }
  ]
}
POLICY


  tags = merge(
    local.common_tags,
    {
      "Purpose" = "waf poc backend for api gw"
      "Name"    = "waf-poc-banckend"
    },
  )
}

# policy to let lambda access the ssm managed resources and logs
resource "aws_iam_role_policy" "dev-iam_inline_policy" {
  provider = aws.dev
  name     = "dev-inline-policy-logs-ssm"
  role     = aws_iam_role.dev-iam-role.id

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AWSLambdaBasicExecutionRoleAccess",
      "Effect": "Allow",
      "Action": [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AccessvpcResources",
      "Effect": "Allow",
      "Action":  [
          "ec2:CreateNetworkInterface",
          "ec2:DescribeNetworkInterfaces",
          "ec2:DeleteNetworkInterface"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AccessS3",
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "*"
    }
  ]
}
EOF

}