variables.tf

variable "name" {
  description = "(Required) The name of the service. The name must be unique within the account. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen. This name will become part of the service DNS and can't be changed after the VPC Lattice service is created."
  type        = string
  nullable    = false

  # INFO: Not support negative lookahead
  # validation {
  #   condition     = regex("^(?!svc-)(?![-])(?!.*[-]$)(?!.*[-]{2})[a-z0-9-]+$", var.name)
  #   error_message = "The name must satisfy regular expression pattern: `^(?!svc-)(?![-])(?!.*[-]$)(?!.*[-]{2})[a-z0-9-]+$`."
  # }
}

variable "description" {
  description = "(Optional) The description of the service. This creates a tag with a key of `Description` and a value that you specify."
  type        = string
  default     = "Managed by Terraform."
  nullable    = false
}

variable "policy" {
  description = <<EOF
  (Optional) A resource-based permission policy for the service. The policy must contain the same actions and condition statements as the Amazon Web Services Resource Access Manager permission for sharing services and service networks.
  EOF
  type        = string
  default     = null
  nullable    = true

  validation {
    condition     = var.policy == null || can(jsondecode(var.policy))
    error_message = "The policy string in JSON must not contain newlines or blank lines."
  }
}

variable "auth_type" {
  description = <<EOF
  (Optional) The type of authentication and authorization that manages client access to the service. Valid values are `AWS_IAM` or `NONE`. Defaults to `NONE`.
    `NONE` - Authentication and authorization is turned off at the service level. Access to this service remains subject to the service network policy, if present. If a policy is not present, all traffic from VPCs associated to the service network is allowed.
    `AWS_IAM` - Applies an AWS IAM resource policy on the service giving service owners the ability to enforce authentication and write fine grained permissions. This policy is evaluated in addition to any policy present at the service network.
  EOF
  type        = string
  default     = "NONE"
  nullable    = false

  validation {
    condition     = contains(["AWS_IAM", "NONE"], var.auth_type)
    error_message = "Valid values for `auth_type` are `AWS_IAM` or `NONE`."
  }
}

variable "auth_policy" {
  description = <<EOF
  (Optional) The auth policy. Authorization decisions are made based on the service network policy, this policy, and IAM permissions attached to the client identity (if referencing IAM identities in this policy). The policy string in JSON must not contain newlines or blank lines.
  EOF
  type        = string
  default     = null
  nullable    = true

  validation {
    condition     = var.auth_policy == null || can(jsondecode(var.auth_policy))
    error_message = "The policy string in JSON must not contain newlines or blank lines."
  }
}

variable "custom_domain" {
  description = <<EOF
  (Optional) The configuration for a custom domain name to use in addition to the domain name that is generated by VPC Lattice. For HTTPS requests, you must also specify an SSL/TLS certificate that matches the custom domain name. If you specify a custom domain name, you must configure DNS routing after your service is created. This is to map DNS queries for the custom domain name to the VPC Lattice endpoint. If you’re using Route 53 as your DNS service, you can configure a CNAME record within the hosted zone that you own. `custom_domain` as defined below.
    (Required) `name` - The name of the custom domain. The custom domain name will be used in addition to the domain name that VPC Lattice generates for the service. You can't change the custom domain name after the service is created. For a custom domain name change, you would need to create a new service.
    (Optional) `tls_certificate` - The ARN (Amazon Resource Name) of the SSL/TLS certificate. The certificate will be required to process HTTPS requests for the custom domain name.
  EOF
  type = object({
    name            = string
    tls_certificate = optional(string)
  })
  default  = null
  nullable = true
}

variable "service_network_associations" {
  description = <<EOF
  (Optional) The configuration for the service network associations with the service. To facilitate network client access to your service, you will need to associate your service to the relevant service networks. Only service networks created in the same account, or that have been shared with you (by way of Resource Access Manager), are available for you to create associations with. Each block of `service_network_associations` as defined below.
    (Required) `name` - The name of the service association.
    (Required) `service_network` - The ID or ARN (Amazon Resource Name) of the service network.
    (Optional) `tags` - A map of tags to add to the service association.
  EOF
  type = list(object({
    name            = string
    service_network = string
    tags            = optional(map(string), {})
  }))
  default  = []
  nullable = false
}

variable "listeners" {
  description = <<EOF
  (Optional) The configuration to add one or more listeners for the service. Set up listeners and rules to define how network traffic is routed within the service. A listener is a process that checks for connection requests, using the protocol and port that you configure. Each listener has a default action, and you can optionally define rules to enable content-based routing to the target groups that make up your service. Each block of `listeners` as defined below.
    (Required) `name` - The name of the service listener. The name must be unique within the service. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.
    (Optional) `port` - The number of port on which the listener of the service is listening. Valid values are from `1` to `65535`. If `port` is not specified and `protocol` is `HTTP`, the value will default to `80`. If `port` is not specified and `protocol` is `HTTPS`, the value will default to `443`.
    (Required) `protocol` - The protocol for the service listener. Valid values are `HTTP` and `HTTPS`.
    (Required) `default_action_type` - The type of default routing action. Default action apply to traffic that does not meet the conditions of rules on your listener. Rules can be configured after the listener is created. Valid values are `FORWARD`, `FIXED_RESPONSE`.
    (Optional) `default_action_parameters` - The configuration for the parameters of the default routing action. `default_action_parameters` block as defined below.
      (Optional) `status_code` - Custom HTTP status code to drop client requests and return a custom HTTP response. Valid values are `404`. Only supported if `default_action_type` is `FIXED_RESPONSE`.
      (Optional) `destinations` - A list of one or more target groups to route traffic. Only supported if `default_action_type` is `FORWARD`. Each item of `destinations` block as defined below.
        (Required) `target_group` - The ID or ARN of the target group to which to route traffic.
        (Optional) `weight` - The weight to use routing traffic to `target_group`. how requests are distributed to the target group. Only required if you specify multiple target groups for a forward action. For example, if you specify two target groups, one with a weight of 10 and the other with a weight of 20, the target group with a weight of 20 receives twice as many requests as the other target group. Valid value is `0` to `999`. Defaults to `100`.
    (Optional) `rules` - A list of rules to enable content-based routing to the target groups that make up the service. Each rule consists of a priority, one or more actions, and one or more conditions. Each block of `rules` block as defined below.
      (Required) `priority` - The priority assigned to the rule. Each rule for a specific listener must have a unique priority. The lower the priority number the higher the priority.
      (Optional) `name` - A rule name can describe the purpose of the rule or the type of traffic it is intended to handle. Rule names can't be changed after creation. Defaults to `$(service)-$(priority)`.
      (Required) `conditions` - The rule conditions. `conditions` block as defined below.
        (Optional) `method` - The condition of HTTP request method. Valid values are `GET`, `HEAD`, `POST`, `PUT`, `DELETE`, `CONNECT`, `OPTIONS`, `TRACE`, `PATCH`.
        (Required) `path` - The condition of HTTP request path. `path` block as defined below.
          (Required) `value` - The path pattern. The pattern must start with `/`.
          (Optional) `operator` - The operator that you want to use to determine whether an HTTP request path matches the conditions. Valid values are `EXACT`, `PREFIX`. Defaults to `PREFIX`.
          (Optional) `case_sensitive` - Whether to match the `value` condition using a case-sensitive match. Defaults to `false`.
        (Optional) `headers` - The condition of HTTP request headers. Each block of `headers` as defined below.
          (Required) `name` - The name of the HTTP header field.
          (Required) `value` - The value of the HTTP header field.
          (Optional) `operator` - The operator that you want to use to determine whether an HTTP header matches the conditions. Valid values are `EXACT`, `PREFIX`, `CONTAINS`. Defaults to `EXACT`.
          (Optional) `case_sensitive` - Whether to match the `value` condition using a case-sensitive match. Defaults to `false`.
      (Required) `action_type` - The action type for the rule of the service. Valid values are `FORWARD`, `FIXED_RESPONSE`.
      (Optional) `action_parameters` - The configuration for the parameters of the routing action. `action_parameters` block as defined below.
        (Optional) `status_code` - Custom HTTP status code to drop client requests and return a custom HTTP response. Valid values are `404`. Only supported if `action_type` is `FIXED_RESPONSE`.
        (Optional) `destinations` - A list of one or more target groups to route traffic. Only supported if `action_type` is `FORWARD`. Each item of `destinations` block as defined below.
          (Required) `target_group` - The ID or ARN of the target group to which to route traffic.
          (Optional) `weight` - The weight to use routing traffic to `target_group`. how requests are distributed to the target group. Only required if you specify multiple target groups for a forward action. For example, if you specify two target groups, one with a weight of 10 and the other with a weight of 20, the target group with a weight of 20 receives twice as many requests as the other target group. Valid value is `0` to `999`. Defaults to `100`.
    (Optional) `tags` - A map of tags to add to the service listeners.
  EOF
  type = list(object({
    name     = string
    port     = optional(number)
    protocol = string

    default_action_type = string
    default_action_parameters = optional(object({
      status_code = optional(number, 404)
      destinations = optional(list(object({
        target_group = string
        weight       = optional(number, 100)
      })), [])
    }), {})

    rules = optional(list(object({
      priority = number
      name     = optional(string)

      conditions = object({
        method = optional(string)
        path = object({
          value          = string
          operator       = optional(string, "PREFIX")
          case_sensitive = optional(bool, false)
        })
        headers = optional(list(object({
          name           = string
          value          = string
          operator       = optional(string, "EXACT")
          case_sensitive = optional(bool, false)
        })), [])
      })

      action_type = string
      action_parameters = optional(object({
        status_code = optional(number, 404)
        destinations = optional(list(object({
          target_group = string
          weight       = optional(number, 100)
        })), [])
      }), {})
    })), [])

    tags = optional(map(string), {})
  }))
  default  = []
  nullable = false

  validation {
    condition     = length(var.listeners) <= 2
    error_message = "Valid values for `auth_type` are `AWS_IAM` or `NONE`."
  }
}

variable "logging_to_cloudwatch" {
  description = <<EOF
  (Optional) The configuration to enable access logs to be sent to Amazon CloudWatch Log Group. The service owner can use the access logs to audit the services in the network. The service owner will only see access logs from clients and services that are associated with their service. Access log entries represent traffic originated from VPCs associated with that network. `logging_to_cloudwatch` as defined below.
    (Optional) `enabled` - Whether to enable access logs to be sent to Amazon CloudWatch Log Group.
    (Optional) `log_group` - The ARN (Amazon Resource Name) of the CloudWatch Log Group.
  EOF
  type = object({
    enabled   = optional(bool, false)
    log_group = optional(string, "")
  })
  default  = {}
  nullable = false

  validation {
    condition = anytrue([
      var.logging_to_cloudwatch.enabled == false,
      var.logging_to_cloudwatch.enabled && startswith(var.logging_to_cloudwatch.log_group, "arn:aws:logs:"),
    ])
    error_message = "Valid value for `log_group` must be the ARN (Amazon Resource Name) of the CloudWatch Log Group."
  }
}

variable "logging_to_kinesis_data_firehose" {
  description = <<EOF
  (Optional) The configuration to enable access logs to be sent to Amazon Kinesis Data Firehose. The service owner can use the access logs to audit the services in the network. The service owner will only see access logs from clients and services that are associated with their service. Access log entries represent traffic originated from VPCs associated with that network. `logging_to_kinesis_data_firehose` as defined below.
    (Optional) `enabled` - Whether to enable access logs to be sent to Amazon Kinesis Data
  Firehose.
    (Optional) `delivery_stream` - The ARN (Amazon Resource Name) of the Kinesis Data Firehose
  delivery stream.
  EOF
  type = object({
    enabled         = optional(bool, false)
    delivery_stream = optional(string, "")
  })
  default  = {}
  nullable = false

  validation {
    condition = anytrue([
      var.logging_to_kinesis_data_firehose.enabled == false,
      var.logging_to_kinesis_data_firehose.enabled && startswith(var.logging_to_kinesis_data_firehose.delivery_stream, "arn:aws:firehose:"),
    ])
    error_message = "Valid value for `delivery_stream` must be the ARN (Amazon Resource Name) of the Kinesis Data Firehose Delivery Stream."
  }
}

variable "logging_to_s3" {
  description = <<EOF
  (Optional) The configuration to enable access logs to be sent to Amazon S3 Bucket. The service owner can use the access logs to audit the services in the network. The service owner will only see access logs from clients and services that are associated with their service. Access log entries represent traffic originated from VPCs associated with that network. `logging_to_s3` as defined below.
    (Optional) `enabled` - Whether to enable access logs to be sent to Amazon S3 Bucket.
    (Optional) `bucket` - The ARN (Amazon Resource Name) of the S3 Bucket.
  EOF
  type = object({
    enabled = optional(bool, false)
    bucket  = optional(string, "")
  })
  default  = {}
  nullable = false

  validation {
    condition = anytrue([
      var.logging_to_s3.enabled == false,
      var.logging_to_s3.enabled && startswith(var.logging_to_s3.bucket, "arn:aws:s3:"),
    ])
    error_message = "Valid value for `bucket` must be the ARN (Amazon Resource Name) of the S3 Bucket."
  }
}

variable "timeouts" {
  description = "(Optional) How long to wait for the service to be created/deleted."
  type = object({
    create = optional(string, "5m")
    delete = optional(string, "5m")
  })
  default  = {}
  nullable = false
}

variable "tags" {
  description = "(Optional) A map of tags to add to all resources."
  type        = map(string)
  default     = {}
  nullable    = false
}

variable "module_tags_enabled" {
  description = "(Optional) Whether to create AWS Resource Tags for the module informations."
  type        = bool
  default     = true
  nullable    = false
}


###################################################
# Resource Group
###################################################

variable "resource_group_enabled" {
  description = "(Optional) Whether to create Resource Group to find and group AWS resources which are created by this module."
  type        = bool
  default     = true
  nullable    = false
}

variable "resource_group_name" {
  description = "(Optional) The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`."
  type        = string
  default     = ""
  nullable    = false
}

variable "resource_group_description" {
  description = "(Optional) The description of Resource Group."
  type        = string
  default     = "Managed by Terraform."
  nullable    = false
}


###################################################
# Resource Sharing by RAM (Resource Access Manager)
###################################################

variable "shares" {
  description = "(Optional) A list of resource shares via RAM (Resource Access Manager)."
  type = list(object({
    name = optional(string)

    permissions = optional(set(string), ["AWSRAMPermissionVpcLatticeServiceReadWrite"])

    external_principals_allowed = optional(bool, false)
    principals                  = optional(set(string), [])

    tags = optional(map(string), {})
  }))
  default  = []
  nullable = false
}