terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~>4.11"
    }
  }
  backend "azurerm" {}
}
provider "aws" {
  region = "us-west-2"
}
provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

variable "aks_oidc" {
  type = string
}

variable "env" {
  type = string
}

variable "logical_region_name" {
  type = string
}

variable "controlplane_account" {
  type = string
}

variable "crossplane_role_arn" {
  type = string
}

module "region-server" {
  source = "../../modules/controlplane"

  controlplane_account = var.controlplane_account
  oidc                 = var.aks_oidc
  role_name            = "${var.env}-${var.logical_region_name}-drs"
  service_account      = "dedicated-regional-server-manager"
  policy_document = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        "Action" : [
          "ec2:*",
          "iam:ListRoles",
          "route53:*",
          "sts:AssumeRole",
          "sts:GetCallerIdentity",
          "tag:*"
        ],
        "Effect" : "Allow",
        "Resource" : "*"
      }
    ]
  })
}

# crossplane-provider uses this role to manage controlplane resources for region-server
module "crossplane" {
  source = "../../modules/crossplane"

  assumed_role_name   = "${var.env}-${var.logical_region_name}-dp4drs-gr"
  crossplane_role_arn = [var.crossplane_role_arn, module.region-server.controlplane_role_arn]
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "route53:*", # manage route53 DNS recordset
          "iam:*"      # grant dataplane cert-manager to access global PCA
        ]
        Effect   = "Allow"
        Resource = "*"
      }
    ]
  })
}

output "role_arn" {
  value = module.region-server.controlplane_role_arn
}

output "crossplane_assumed_role_arn" {
  value = module.crossplane.assumed_role_arn
}