resource "aws_iam_role" "rds_proxy" {
  name               = "${var.service_name}-rds-proxy-role"
  assume_role_policy = data.aws_iam_policy_document.proxy_assume_role.json

  tags = merge(var.service_tags, {
    Name = "${var.service_name}-rds-proxy-role"
  })
}

resource "aws_iam_policy" "rds_proxy" {
  name        = "${var.service_name}-rds-proxy-policy"
  description = "Allows RDS Proxy to retrieve DB credentials from Secrets Manager"
  policy      = data.aws_iam_policy_document.proxy_secrets.json

  tags = merge(var.service_tags, {
    Name = "${var.service_name}-rds-proxy-policy"
  })
}

resource "aws_iam_role_policy_attachment" "rds_proxy" {
  role       = aws_iam_role.rds_proxy.name
  policy_arn = aws_iam_policy.rds_proxy.arn
}

resource "aws_db_proxy" "this" {
  for_each = local.proxies

  name                   = each.value.name
  debug_logging          = false
  engine_family          = each.value.engine_family
  idle_client_timeout    = 1800
  require_tls            = true
  role_arn               = aws_iam_role.rds_proxy.arn
  vpc_security_group_ids = each.value.security_group_ids
  vpc_subnet_ids         = each.value.subnet_ids

  auth {
    auth_scheme = "SECRETS"
    iam_auth    = "DISABLED"
    secret_arn  = each.value.secret_arn
  }

  tags = merge(var.service_tags, {
    Name = each.value.name
  })
}

resource "aws_db_proxy_default_target_group" "this" {
  for_each      = local.proxies
  db_proxy_name = aws_db_proxy.this[each.key].name

  connection_pool_config {
    max_connections_percent = 90
  }
}

resource "aws_db_proxy_target" "this" {
  for_each               = local.proxies
  db_proxy_name          = aws_db_proxy.this[each.key].name
  target_group_name      = aws_db_proxy_default_target_group.this[each.key].name
  db_instance_identifier = each.value.db_instance_identifier
}