resource "aws_kms_key" "rds" {
  for_each                = local.db_instances
  description             = each.key
  enable_key_rotation     = true
  deletion_window_in_days = 30

  tags = merge(var.service_tags, {
    Name = each.key
  })
}

resource "aws_kms_alias" "rds" {
  for_each      = local.db_instances
  name          = "alias/${each.key}"
  target_key_id = aws_kms_key.rds[each.key].id
}

resource "aws_db_subnet_group" "subnet_group" {
  for_each = local.db_instances

  name        = "${each.value.name}-subnet-group"
  description = "Database subnet group for ${each.value.name}"
  subnet_ids  = each.value.subnet_ids

  tags = merge(var.service_tags, {
    Name = "${each.value.name}-subnet-group"
  })
}

module "rds" {
  for_each = local.db_instances

  create_db_instance = each.value.create_db_instance
  source             = "terraform-aws-modules/rds/aws"
  identifier         = each.value.name
  version            = "6.9.0"

  engine               = each.value.engine
  engine_version       = each.value.engine_version
  family               = each.value.family         # DB parameter group
  major_engine_version = each.value.engine_version # DB option group
  instance_class       = each.value.type

  allocated_storage     = each.value.allocated_storage
  max_allocated_storage = each.value.max_allocated_storage

  publicly_accessible = false
  multi_az            = each.value.multi_az
  db_name             = each.value.db_name
  username            = each.value.username
  port                = each.value.port

  manage_master_user_password = true

  auto_minor_version_upgrade = true

  db_subnet_group_name   = aws_db_subnet_group.subnet_group[each.value.name].name
  vpc_security_group_ids = each.value.security_group_ids

  maintenance_window = each.value.maintenance_window
  backup_window      = each.value.backup_window

  # enabled_cloudwatch_logs_exports = ["error", "audit"]
  create_cloudwatch_log_group = true

  skip_final_snapshot   = false
  copy_tags_to_snapshot = true
  deletion_protection   = true
  storage_encrypted     = true
  kms_key_id            = aws_kms_key.rds[each.key].arn
  storage_type          = "gp3"

  performance_insights_enabled          = each.value.performance_insights_enabled
  performance_insights_retention_period = 7

  create_monitoring_role          = true
  monitoring_interval             = 60
  monitoring_role_name            = "monitoring-${each.value.engine}-role"
  monitoring_role_use_name_prefix = true
  monitoring_role_description     = "IAM role for monitoring ${each.value.engine}"

  backup_retention_period                = each.value.backup_retention_period
  cloudwatch_log_group_retention_in_days = each.value.log_group_retention_in_days

  parameters = each.value.parameters
  tags = merge(var.service_tags, {
    Name = "${each.value.name}"
    env  = "backup"
  })

  depends_on = [
    aws_db_subnet_group.subnet_group
  ]
}

resource "aws_db_event_subscription" "event_sub" {
  for_each  = local.db_instances
  name      = "${each.value.name}-event-sub"
  sns_topic = each.value.alerts_topic_arn

  source_type = "db-instance"
  source_ids  = [module.rds[each.value.name].db_instance_identifier]

  event_categories = [
    "deletion",
    "failover",
    "failure",
    "low storage",
    "maintenance",
    "recovery",
    "restoration",
    "security"
  ]

  tags = merge(var.service_tags, {
    Name = "${each.value.name}-event-sub"
  })
}