{% set config = merged_configs.get('aws_lambda_function', {}) %}
{% set comments = compliance_comments.get('aws_lambda_function', []) %}
# ------------------------------------------------------------------------------
# Lambda Function
# ------------------------------------------------------------------------------
{% for comment in comments %}
# {{ comment }}
{% endfor %}

resource "aws_lambda_function" "this" {
  function_name = "{{ config.get('function_name', project_id ~ '-function') }}"
  description   = "{{ config.get('description', 'Managed by ComplyForm') }}"

  runtime     = "{{ config.get('runtime', 'python3.12') }}"
  handler     = "{{ config.get('handler', 'index.handler') }}"
  timeout     = {{ config.get('timeout', 30) }}
  memory_size = {{ config.get('memory_size', 256) }}

  role = {{ config.get('role', 'aws_iam_role.lambda_exec.arn') }}

  # Package
  filename         = {{ config.get('filename', 'null') }}
  source_code_hash = {{ config.get('source_code_hash', 'null') }}
  s3_bucket        = {{ config.get('s3_bucket', 'null') }}
  s3_key           = {{ config.get('s3_key', 'null') }}

  # Encryption
  kms_key_arn = {{ config.get('kms_key_arn', 'null') }}

  # Networking (VPC)
  {% if config.get('subnet_ids') %}
  vpc_config {
    subnet_ids         = {{ config.get('subnet_ids', '[]') }}
    security_group_ids = {{ config.get('security_group_ids', '[]') }}
  }
  {% endif %}

  # Environment variables
  {% if config.get('environment_variables') %}
  environment {
    variables = {{ config.get('environment_variables', '{}') }}
  }
  {% endif %}

  # Tracing
  tracing_config {
    mode = "{{ config.get('tracing_mode', 'Active') }}"
  }

  # Dead letter queue
  {% if config.get('dead_letter_target_arn') %}
  dead_letter_config {
    target_arn = "{{ config.dead_letter_target_arn }}"
  }
  {% endif %}

  # Reserved concurrency
  reserved_concurrent_executions = {{ config.get('reserved_concurrent_executions', -1) }}

  # Code signing
  {% if config.get('code_signing_config_arn') %}
  code_signing_config_arn = "{{ config.code_signing_config_arn }}"
  {% endif %}

  tags = {
    Name      = "{{ config.get('function_name', project_id ~ '-function') }}"
    ManagedBy = "complyform"
  }
}

resource "aws_cloudwatch_log_group" "lambda" {
  name              = "/aws/lambda/{{ config.get('function_name', project_id ~ '-function') }}"
  retention_in_days = {{ config.get('log_retention_days', 90) }}
  kms_key_id        = {{ config.get('log_kms_key_id', 'null') }}

  tags = {
    Name      = "{{ project_id }}-lambda-logs"
    ManagedBy = "complyform"
  }
}

resource "aws_iam_role" "lambda_exec" {
  name = "{{ config.get('function_name', project_id ~ '-function') }}-exec"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "lambda.amazonaws.com"
        }
      }
    ]
  })

  tags = {
    Name      = "{{ project_id }}-lambda-exec"
    ManagedBy = "complyform"
  }
}

resource "aws_iam_role_policy_attachment" "lambda_basic" {
  role       = aws_iam_role.lambda_exec.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

{% if config.get('subnet_ids') %}
resource "aws_iam_role_policy_attachment" "lambda_vpc" {
  role       = aws_iam_role.lambda_exec.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
}
{% endif %}
