resource "aws_iam_role" "lambda_role" {
  name               = "${var.service_name}-lambda-role"
  assume_role_policy = data.aws_iam_policy_document.lambda_trust_policy.json
  tags = merge(var.service_tags, {
    Name = "${var.service_name}-lambda-role"
  })
}

resource "aws_iam_role_policy_attachment" "vpc_access" {
  role       = aws_iam_role.lambda_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
}

resource "aws_iam_policy" "lambda_policy" {
  name        = "${var.service_name}-lambda-policy"
  description = "Policy for Lambda functions"
  policy      = data.aws_iam_policy_document.lambda.json
  tags = merge(var.service_tags, {
    Name = "${var.service_name}-lambda-policy"
  })
}

resource "aws_iam_role_policy_attachment" "lambda_policy" {
  role       = aws_iam_role.lambda_role.name
  policy_arn = aws_iam_policy.lambda_policy.arn
}

resource "aws_cloudwatch_log_group" "lambda" {
  for_each          = local.lambda_functions
  name              = "/aws/lambda/${each.value.name}"
  retention_in_days = each.value.log_group_retention_in_days
  tags = merge(var.service_tags, {
    Name = "/aws/lambda/${each.value.name}"
  })
}

resource "aws_lambda_function" "this" {
  for_each = local.lambda_functions

  function_name = each.value.name
  description   = each.value.description
  role          = aws_iam_role.lambda_role.arn

  filename         = data.archive_file.placeholder.output_path
  source_code_hash = data.archive_file.placeholder.output_base64sha256
  handler          = "handler.handler"
  runtime          = each.value.runtime
  memory_size      = each.value.memory_size
  timeout          = each.value.timeout

  vpc_config {
    subnet_ids         = each.value.subnet_ids
    security_group_ids = each.value.security_group_ids
  }

  environment {
    variables = each.value.environment_variables
  }

  tracing_config {
    mode = "Active"
  }

  lifecycle {
    ignore_changes = [filename, source_code_hash]
  }

  depends_on = [
    aws_cloudwatch_log_group.lambda,
    aws_iam_role_policy_attachment.vpc_access,
  ]

  tags = merge(var.service_tags, {
    Name = each.value.name
  })
}

resource "aws_cloudwatch_metric_alarm" "lambda_errors" {
  for_each = local.lambda_functions

  alarm_name          = "${each.value.name}-errors"
  alarm_description   = "Lambda function error rate exceeded threshold"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 1
  metric_name         = "Errors"
  namespace           = "AWS/Lambda"
  period              = 60
  statistic           = "Sum"
  threshold           = 5
  treat_missing_data  = "notBreaching"

  dimensions = {
    FunctionName = each.value.name
  }

  alarm_actions = [each.value.alerts_topic_arn]
  ok_actions    = [each.value.alerts_topic_arn]

  tags = merge(var.service_tags, {
    Name = "${each.value.name}-errors"
  })
}