# =============================================================================
# DMS (dead man's switch) — IRSA role for the self-monitoring alertmanager and
# CloudWatch alarms wired to the o11y-global SNS topic. Ported from basic/dms;
# the alarms live in the SNS topic's region (parsed from the topic ARN), same
# as the alicloud o11y-region module.
# =============================================================================

data "aws_iam_policy_document" "dms_assume_role" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = [module.eks.oidc_provider_arn]
    }

    condition {
      test     = "StringEquals"
      variable = "${local.oidc_issuer}:sub"
      values   = ["system:serviceaccount:self-monitoring:self-monitoring-kube-prome-alertmanager"]
    }

    condition {
      test     = "StringEquals"
      variable = "${local.oidc_issuer}:aud"
      values   = ["sts.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "dms" {
  name               = "${local.cluster_name}-dms"
  assume_role_policy = data.aws_iam_policy_document.dms_assume_role.json
  tags               = local.common_tags
}

resource "aws_iam_role_policy_attachment" "dms_cloudwatch" {
  role       = aws_iam_role.dms.name
  policy_arn = "arn:aws:iam::aws:policy/CloudWatchFullAccess"
}

locals {
  sns_region = element(split(":", local.sns_topic_arn), 3)
}

resource "aws_cloudwatch_metric_alarm" "watchdog_down" {
  alarm_name          = "WatchdogDown-${local.cluster_name}"
  alarm_description   = "Alarm for ${local.cluster_name}, triggered if deadmanswatch is down"
  namespace           = "DeadMansWatch"
  metric_name         = "Watchdog"
  comparison_operator = "LessThanThreshold"
  alarm_actions       = [local.sns_topic_arn]
  threshold           = 1
  evaluation_periods  = 5
  period              = 60
  statistic           = "Maximum"
  treat_missing_data  = "breaching"
  region              = local.sns_region

  dimensions = {
    source      = local.cluster_name
    environment = var.env
    scope       = "self-monitoring"
  }

  tags = {
    environment                   = var.env
    "tidbcloud-auto-deploy-owner" = local.cluster_name
  }
}

resource "aws_cloudwatch_metric_alarm" "alertmanager_failed_to_send_alerts" {
  alarm_name          = "AlertmanagerClusterFailedToSendAlerts-${local.cluster_name}"
  alarm_description   = "Alarm for ${local.cluster_name}, triggered if alertmanager cluster failed to send alerts to jiralert"
  namespace           = "DeadMansWatch"
  metric_name         = "AlertmanagerClusterFailedToSendAlerts"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  alarm_actions       = [local.sns_topic_arn]
  threshold           = 1
  evaluation_periods  = 1
  period              = 120
  statistic           = "SampleCount"
  treat_missing_data  = "notBreaching"
  region              = local.sns_region

  dimensions = {
    source      = local.cluster_name
    environment = var.env
    scope       = "self-monitoring"
  }

  tags = {
    environment                   = var.env
    "tidbcloud-auto-deploy-owner" = local.cluster_name
  }
}