<commit_before>provider "aws" {
  profile = "${var.aws_profile}"
  region  = "${var.aws_region}"
}

module "cloudhealth" {
  source = "github.com/nubisproject/nubis-terraform-cloudhealth"

  aws_profile = "${var.aws_profile}"
  aws_region  = "${var.aws_region}"
}

resource "aws_iam_user" "datadog" {
  path = "/nubis/datadog/"
  name = "datadog"
}

resource "aws_iam_access_key" "datadog" {
  user = "${aws_iam_user.datadog.name}"
}

resource "aws_iam_user_policy" "datadog" {
  name = "datadog-readonly"
  user = "${aws_iam_user.datadog.name}"

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
"Action": [
                    "autoscaling:Describe*",
                    "cloudtrail:DescribeTrails",
                    "cloudtrail:GetTrailStatus",
                    "cloudwatch:Describe*",
                    "cloudwatch:Get*",
                    "cloudwatch:List*",
                    "dynamodb:list*",
                    "dynamodb:describe*",
                    "ec2:Describe*",
                    "ec2:Get*",
                    "ecs:Describe*",
                    "ecs:List*",
                    "elasticache:Describe*",
                    "elasticache:List*",
                    "elasticloadbalancing:Describe*",
                    "elasticmapreduce:List*",
                    "elasticmapreduce:Describe*",
                    "kinesis:List*",
                    "kinesis:Describe*",
                    "logs:Get*",
                    "logs:Describe*",
                    "logs:FilterLogEvents",
                    "logs:TestMetricFilter",
                    "rds:Describe*",
                    "rds:List*",
                    "route53:List*",
                    "ses:Get*",
                    "sns:List*",
                    "sns:Publish",
                    "sqs:GetQueueAttributes",
                    "sqs:ListQueues",
                    "sqs:ReceiveMessage",
                    "support:*"
                  ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
POLICY
}

resource "aws_route53_zone" "master_zone" {
  name = "${var.account_name}.${var.nubis_domain}"

  tags {
    ServiceName      = "${var.account_name}"
    TechnicalContact = "${var.technical_contact}"
  }
}

resource "aws_route53_record" "nubis-version" {
  zone_id = "${aws_route53_zone.master_zone.id}"
  name    = "version.nubis"

  type    = "TXT"
  ttl     = "300"
  records = ["${var.nubis_version}"]
}

resource "aws_route53_record" "nubis-state" {
  zone_id = "${aws_route53_zone.master_zone.id}"
  name    = "state.nubis"

  type = "A"

  alias {
    name                   = "${aws_cloudfront_distribution.public-state.domain_name}"
    zone_id                = "${aws_cloudfront_distribution.public-state.hosted_zone_id}"
    evaluate_target_health = true
  }
}

resource "aws_iam_role" "global_lambda" {
  lifecycle {
    create_before_destroy = true
  }

  name = "lambda-global-${var.aws_region}"

  provisioner "local-exec" {
    command = "sleep 30"
  }

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "lambda.amazonaws.com"
                ]
              },
              "Action": [
                "sts:AssumeRole"
              ]
            }
          ]
}
EOF
}

# XXX: Duplicated here to avoid chicken-and-egg with VPCs
resource "aws_lambda_function" "GlobalUUID" {
  lifecycle {
    #create_before_destroy = true
    ignore_changes = [
      "runtime"
    ]
  }

  function_name = "GlobalUUID"
  s3_bucket     = "nubis-stacks-${var.aws_region}"
  s3_key        = "${var.nubis_version}/lambda/UUID.zip"
  handler       = "index.handler"
  description   = "Generate UUIDs for use in Nubis Meta"
  memory_size   = 128
  runtime       = "nodejs4.3"
  timeout       = "10"
  role          = "${aws_iam_role.global_lambda.arn}"
}

module "public-state-uuid" {
  source  = "../../uuid"
  enabled = "1"

  aws_profile = "${var.aws_profile}"
  aws_region  = "${var.aws_region}"

  name = "public-state"

  environments = "global"

  lambda_uuid_arn = "${aws_lambda_function.GlobalUUID.arn}"
}

resource "aws_s3_bucket" "public-state" {
  bucket = "public-state-${module.public-state-uuid.uuids}"
  acl    = "private"

  policy = <<EOF<commit_msg>Enable versionning on our state S3 bucket (#191)<commit_after>provider "aws" {
  profile = "${var.aws_profile}"
  region  = "${var.aws_region}"
}

module "cloudhealth" {
  source = "github.com/nubisproject/nubis-terraform-cloudhealth"

  aws_profile = "${var.aws_profile}"
  aws_region  = "${var.aws_region}"
}

resource "aws_iam_user" "datadog" {
  path = "/nubis/datadog/"
  name = "datadog"
}

resource "aws_iam_access_key" "datadog" {
  user = "${aws_iam_user.datadog.name}"
}

resource "aws_iam_user_policy" "datadog" {
  name = "datadog-readonly"
  user = "${aws_iam_user.datadog.name}"

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
"Action": [
                    "autoscaling:Describe*",
                    "cloudtrail:DescribeTrails",
                    "cloudtrail:GetTrailStatus",
                    "cloudwatch:Describe*",
                    "cloudwatch:Get*",
                    "cloudwatch:List*",
                    "dynamodb:list*",
                    "dynamodb:describe*",
                    "ec2:Describe*",
                    "ec2:Get*",
                    "ecs:Describe*",
                    "ecs:List*",
                    "elasticache:Describe*",
                    "elasticache:List*",
                    "elasticloadbalancing:Describe*",
                    "elasticmapreduce:List*",
                    "elasticmapreduce:Describe*",
                    "kinesis:List*",
                    "kinesis:Describe*",
                    "logs:Get*",
                    "logs:Describe*",
                    "logs:FilterLogEvents",
                    "logs:TestMetricFilter",
                    "rds:Describe*",
                    "rds:List*",
                    "route53:List*",
                    "ses:Get*",
                    "sns:List*",
                    "sns:Publish",
                    "sqs:GetQueueAttributes",
                    "sqs:ListQueues",
                    "sqs:ReceiveMessage",
                    "support:*"
                  ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
POLICY
}

resource "aws_route53_zone" "master_zone" {
  name = "${var.account_name}.${var.nubis_domain}"

  tags {
    ServiceName      = "${var.account_name}"
    TechnicalContact = "${var.technical_contact}"
  }
}

resource "aws_route53_record" "nubis-version" {
  zone_id = "${aws_route53_zone.master_zone.id}"
  name    = "version.nubis"

  type    = "TXT"
  ttl     = "300"
  records = ["${var.nubis_version}"]
}

resource "aws_route53_record" "nubis-state" {
  zone_id = "${aws_route53_zone.master_zone.id}"
  name    = "state.nubis"

  type = "A"

  alias {
    name                   = "${aws_cloudfront_distribution.public-state.domain_name}"
    zone_id                = "${aws_cloudfront_distribution.public-state.hosted_zone_id}"
    evaluate_target_health = true
  }
}

resource "aws_iam_role" "global_lambda" {
  lifecycle {
    create_before_destroy = true
  }

  name = "lambda-global-${var.aws_region}"

  provisioner "local-exec" {
    command = "sleep 30"
  }

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "lambda.amazonaws.com"
                ]
              },
              "Action": [
                "sts:AssumeRole"
              ]
            }
          ]
}
EOF
}

# XXX: Duplicated here to avoid chicken-and-egg with VPCs
resource "aws_lambda_function" "GlobalUUID" {
  lifecycle {
    #create_before_destroy = true
    ignore_changes = [
      "runtime"
    ]
  }

  function_name = "GlobalUUID"
  s3_bucket     = "nubis-stacks-${var.aws_region}"
  s3_key        = "${var.nubis_version}/lambda/UUID.zip"
  handler       = "index.handler"
  description   = "Generate UUIDs for use in Nubis Meta"
  memory_size   = 128
  runtime       = "nodejs4.3"
  timeout       = "10"
  role          = "${aws_iam_role.global_lambda.arn}"
}

module "public-state-uuid" {
  source  = "../../uuid"
  enabled = "1"

  aws_profile = "${var.aws_profile}"
  aws_region  = "${var.aws_region}"

  name = "public-state"

  environments = "global"

  lambda_uuid_arn = "${aws_lambda_function.GlobalUUID.arn}"
}

resource "aws_s3_bucket" "public-state" {
  bucket = "public-state-${module.public-state-uuid.uuids}"
  acl    = "private"

  versioning {
    enabled = true
  }

  policy = <<EOF
{'fraction_non_alphanumeric': 0.13902771467514766, 'fraction_numerical': 0.010904134484325307, 'mean_word_length': 1.8157978893508155, 'pattern_counts': {'":': 22, '<': 15, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '213098', 'n_tokens_mistral': 2993, 'n_tokens_neox': 2835, 'n_words': 421}