module "waf" {
  source             = "../../modules/aws-so-waf"
  name               = "${var.client_name}-${var.stage}-waf"
  associate_with_lb  = true
  scope              = "REGIONAL"
  access_logs_bucket = var.access_logs_bucket
  service_tags       = local.tags
}

resource "aws_wafv2_web_acl_association" "lb" {
  for_each = {
 #   private = module.alb-private.arn
    public  = module.alb-public.arn
  }
  resource_arn = each.value
  web_acl_arn  = module.waf.web_acl_arn
}

module "waf-cdn" {
  source = "../../modules/aws-so-waf"
  providers = {
    aws = aws.us-east-1
  }
  name               = "${var.client_name}-${var.stage}-waf-cdn"
  associate_with_lb  = false
  scope              = "CLOUDFRONT"
  access_logs_bucket = var.access_logs_bucket
  service_tags       = local.tags
}

data "aws_s3_bucket" "webportal" {
  bucket = "${var.client_name}-${var.stage}-webportal"
}

module "cdn" {
  source = "../../modules/aws-so-cdn"
  cdn = [
    {
      name              = "${var.client_name}-${var.stage}-cdn"
      public_dns        = ["webportal.${var.public_dns}"]
      origin_type       = "s3"
      s3_bucket_arn     = data.aws_s3_bucket.webportal.arn
      s3_bucket_domain  = data.aws_s3_bucket.webportal.bucket_regional_domain_name
      ssl_cert_arn      = module.acm-cdn.ssl_cert_arn
      ssl_cert_verified = true
      waf_acl_id        = module.waf-cdn.web_acl_arn
    }
  ]
  access_logs_bucket = var.access_logs_bucket
  service_tags       = local.tags
}