# =============================================================================
# DMS IAM Role for ACK OIDC
# =============================================================================

data "aws_iam_policy_document" "dms_assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Federated"
      identifiers = [aws_iam_openid_connect_provider.ack.arn]
    }

    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "${replace(aws_iam_openid_connect_provider.ack.url, "https://", "")}:aud"
      values   = ["observability.pingcap.com"]
    }
  }
}

resource "aws_iam_role" "dms" {
  name               = "o11y-${var.env}-regional-alicloud-${var.logical_region_name}-dms"
  assume_role_policy = data.aws_iam_policy_document.dms_assume_role.json

  tags = local.common_tags
}

resource "aws_iam_role_policy_attachment" "dms_cloudwatch" {
  role       = aws_iam_role.dms.name
  policy_arn = "arn:aws:iam::aws:policy/CloudWatchFullAccess"
}

data "aws_s3_object" "o11y_global" {
  bucket = "autonomous-deployment-terraform-state"
  key    = "aws/o11y-global/${var.env}.json"

  provider = aws.tf_state
}

locals {
  sns_topic_arn = jsondecode(data.aws_s3_object.o11y_global.body).outputs.sns_topic_arn.value
  sns_region    = element(split(":", local.sns_topic_arn), 3)
}

resource "aws_cloudwatch_metric_alarm" "watchdog_down" {
  alarm_name          = "WatchdogDown-${local.cluster_name}"
  alarm_description   = "Alarm for ${local.cluster_name}, triggered if deadmanswatch is down"
  namespace           = "DeadMansWatch"
  metric_name         = "Watchdog"
  comparison_operator = "LessThanThreshold"
  alarm_actions       = [local.sns_topic_arn]
  threshold           = 1
  evaluation_periods  = 5
  period              = 60
  statistic           = "Maximum"
  treat_missing_data  = "breaching"
  region              = local.sns_region

  dimensions = {
    source      = local.cluster_name
    environment = var.env
    scope       = "self-monitoring"
  }

  tags = {
    environment                   = var.env
    "tidbcloud-auto-deploy-owner" = local.cluster_name
  }
}


resource "aws_cloudwatch_metric_alarm" "alertmanager_failed_to_send_alerts" {
  alarm_name          = "AlertmanagerClusterFailedToSendAlerts-${local.cluster_name}"
  alarm_description   = "Alarm for ${local.cluster_name}, triggered if alertmanager cluster failed to send alerts to jiralert"
  namespace           = "DeadMansWatch"
  metric_name         = "AlertmanagerClusterFailedToSendAlerts"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  alarm_actions       = [local.sns_topic_arn]
  threshold           = 1
  evaluation_periods  = 1
  period              = 120
  statistic           = "SampleCount"
  treat_missing_data  = "notBreaching"
  region              = local.sns_region

  dimensions = {
    source      = local.cluster_name
    environment = var.env
    scope       = "self-monitoring"
  }

  tags = {
    environment                   = var.env
    "tidbcloud-auto-deploy-owner" = local.cluster_name
  }
}