locals {
  dms_oidc_audience      = "observability.pingcap.com"
  dms_service_account    = "system:serviceaccount:self-monitoring:self-monitoring-kube-prome-alertmanager"
  aks_oidc_provider_host = trimprefix(module.aks.oidc_issuer, "https://")
}

resource "aws_iam_openid_connect_provider" "aks" {
  url             = module.aks.oidc_issuer
  client_id_list  = [local.dms_oidc_audience]
  thumbprint_list = ["df3c24f9bfd666761b268073fe06d1cc8d4f82a4"]
}

resource "aws_iam_role" "dms" {
  name = "${local.o11y_name}-dms"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Federated = aws_iam_openid_connect_provider.aks.arn
        }
        Action = "sts:AssumeRoleWithWebIdentity"
        Condition = {
          StringEquals = {
            "${local.aks_oidc_provider_host}:sub" = local.dms_service_account
            "${local.aks_oidc_provider_host}:aud" = local.dms_oidc_audience
          }
        }
      }
    ]
  })

  tags = local.tags
}

resource "aws_iam_role_policy_attachment" "dms_cloudwatch" {
  role       = aws_iam_role.dms.name
  policy_arn = "arn:aws:iam::aws:policy/CloudWatchFullAccess"
}

resource "aws_cloudwatch_metric_alarm" "watchdog_down" {
  alarm_name          = "WatchdogDown-${local.o11y_name}"
  alarm_description   = "Alarm for ${local.o11y_name}, triggered if deadmanswatch is down"
  namespace           = "DeadMansWatch"
  metric_name         = "Watchdog"
  comparison_operator = "LessThanThreshold"
  threshold           = 1
  evaluation_periods  = 5
  period              = 60
  statistic           = "Maximum"
  treat_missing_data  = "breaching"
  alarm_actions       = [var.o11y_sns_topic_arn]

  dimensions = {
    source      = local.o11y_name
    environment = var.env
    scope       = "self-monitoring"
  }

  tags = local.tags
}

resource "aws_cloudwatch_metric_alarm" "alertmanager_failed_to_send" {
  alarm_name          = "AlertmanagerClusterFailedToSendAlerts-${local.o11y_name}"
  alarm_description   = "Alarm for ${local.o11y_name}, triggered if alertmanager failed to send alerts to jiralert"
  namespace           = "DeadMansWatch"
  metric_name         = "AlertmanagerClusterFailedToSendAlerts"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  threshold           = 1
  evaluation_periods  = 1
  period              = 120
  statistic           = "SampleCount"
  treat_missing_data  = "notBreaching"
  alarm_actions       = [var.o11y_sns_topic_arn]

  dimensions = {
    source      = local.o11y_name
    environment = var.env
    scope       = "self-monitoring"
  }

  tags = local.tags
}