{% set config = merged_configs.get('aws_route53_zone', {}) %}
{% set comments = compliance_comments.get('aws_route53_zone', []) %}
# ------------------------------------------------------------------------------
# Route 53 Hosted Zone
# ------------------------------------------------------------------------------
{% for comment in comments %}
# {{ comment }}
{% endfor %}

resource "aws_route53_zone" "this" {
  name    = "{{ config.get('name', 'example.com') }}"
  comment = "{{ config.get('comment', 'Managed by ComplyForm') }}"

  {% if config.get('private_zone', false) %}
  vpc {
    vpc_id = {{ config.get('vpc_id', 'null') }}
  }
  {% endif %}

  tags = {
    Name      = "{{ config.get('name', 'example.com') }}"
    ManagedBy = "complyform"
  }
}

{% if config.get('enable_dnssec', true) %}
resource "aws_route53_key_signing_key" "this" {
  hosted_zone_id             = aws_route53_zone.this.id
  key_management_service_arn = {{ config.get('dnssec_kms_key_arn', 'null') }}
  name                       = "{{ project_id }}-dnssec"
}

resource "aws_route53_hosted_zone_dnssec" "this" {
  hosted_zone_id = aws_route53_zone.this.id

  depends_on = [aws_route53_key_signing_key.this]
}
{% endif %}

resource "aws_route53_query_log" "this" {
  cloudwatch_log_group_arn = aws_cloudwatch_log_group.route53.arn
  zone_id                  = aws_route53_zone.this.zone_id
}

resource "aws_cloudwatch_log_group" "route53" {
  name              = "/aws/route53/{{ config.get('name', 'example.com') }}"
  retention_in_days = {{ config.get('log_retention_days', 90) }}
  kms_key_id        = {{ config.get('log_kms_key_id', 'null') }}

  tags = {
    Name      = "{{ project_id }}-route53-logs"
    ManagedBy = "complyform"
  }
}
