{% set config = merged_configs.get('aws_sqs_queue', {}) %}
{% set comments = compliance_comments.get('aws_sqs_queue', []) %}
# ------------------------------------------------------------------------------
# SQS Queue
# ------------------------------------------------------------------------------
{% for comment in comments %}
# {{ comment }}
{% endfor %}

resource "aws_sqs_queue" "this" {
  name = "{{ config.get('name', project_id ~ '-queue') }}"

  # Encryption
  kms_master_key_id                 = "{{ config.get('kms_master_key_id', 'alias/aws/sqs') }}"
  kms_data_key_reuse_period_seconds = {{ config.get('kms_data_key_reuse_period_seconds', 300) }}

  # Message settings
  message_retention_seconds  = {{ config.get('message_retention_seconds', 345600) }}
  visibility_timeout_seconds = {{ config.get('visibility_timeout_seconds', 30) }}
  max_message_size           = {{ config.get('max_message_size', 262144) }}
  delay_seconds              = {{ config.get('delay_seconds', 0) }}
  receive_wait_time_seconds  = {{ config.get('receive_wait_time_seconds', 0) }}

  {% if config.get('dead_letter_target_arn') %}
  redrive_policy = jsonencode({
    deadLetterTargetArn = "{{ config.dead_letter_target_arn }}"
    maxReceiveCount     = {{ config.get('max_receive_count', 3) }}
  })
  {% endif %}

  tags = {
    Name      = "{{ config.get('name', project_id ~ '-queue') }}"
    ManagedBy = "complyform"
  }
}

resource "aws_sqs_queue_policy" "this" {
  queue_url = aws_sqs_queue.this.id

  policy = jsonencode({
    Version = "2012-10-17"
    Id      = "{{ project_id }}-sqs-policy"
    Statement = [
      {
        Sid    = "EnforceHTTPS"
        Effect = "Deny"
        Principal = "*"
        Action    = "sqs:*"
        Resource  = aws_sqs_queue.this.arn
        Condition = {
          Bool = {
            "aws:SecureTransport" = "false"
          }
        }
      }
    ]
  })
}
