{% set config = merged_configs.get('aws_rds_cluster', {}) %}
{% set comments = compliance_comments.get('aws_rds_cluster', []) %}
# ------------------------------------------------------------------------------
# Aurora RDS Cluster
# ------------------------------------------------------------------------------
{% for comment in comments %}
# {{ comment }}
{% endfor %}

resource "aws_rds_cluster" "this" {
  cluster_identifier = "{{ config.get('cluster_identifier', project_id ~ '-aurora') }}"

  engine         = "{{ config.get('engine', 'aurora-postgresql') }}"
  engine_version = "{{ config.get('engine_version', '16.4') }}"

  database_name   = "{{ config.get('database_name', 'appdb') }}"
  master_username = "{{ config.get('master_username', 'dbadmin') }}"
  master_password = var.aurora_master_password

  # Encryption at rest
  storage_encrypted = {{ config.get('storage_encrypted', true) | lower }}
  kms_key_id        = {{ config.get('kms_key_id', 'null') }}

  # Network
  db_subnet_group_name   = {{ config.get('db_subnet_group_name', 'null') }}
  vpc_security_group_ids = {{ config.get('vpc_security_group_ids', '[]') }}

  # Backup & recovery
  backup_retention_period      = {{ config.get('backup_retention_period', 7) }}
  preferred_backup_window      = "{{ config.get('preferred_backup_window', '03:00-04:00') }}"
  preferred_maintenance_window = "{{ config.get('preferred_maintenance_window', 'sun:04:00-sun:05:00') }}"

  # Logging
  enabled_cloudwatch_logs_exports = {{ config.get('enabled_cloudwatch_logs_exports', '["postgresql"]') }}

  # Deletion protection
  deletion_protection = {{ config.get('deletion_protection', true) | lower }}
  skip_final_snapshot = {{ config.get('skip_final_snapshot', false) | lower }}

  # IAM authentication
  iam_database_authentication_enabled = {{ config.get('iam_database_authentication_enabled', true) | lower }}

  # Copy tags to snapshots
  copy_tags_to_snapshot = {{ config.get('copy_tags_to_snapshot', true) | lower }}

  tags = {
    Name      = "{{ config.get('cluster_identifier', project_id ~ '-aurora') }}"
    ManagedBy = "complyform"
  }
}

resource "aws_rds_cluster_instance" "this" {
  count = {{ config.get('instance_count', 2) }}

  identifier         = "{{ config.get('cluster_identifier', project_id ~ '-aurora') }}-${count.index}"
  cluster_identifier = aws_rds_cluster.this.id
  instance_class     = "{{ config.get('instance_class', 'db.r6g.large') }}"
  engine             = aws_rds_cluster.this.engine
  engine_version     = aws_rds_cluster.this.engine_version

  auto_minor_version_upgrade = {{ config.get('auto_minor_version_upgrade', true) | lower }}

  performance_insights_enabled = {{ config.get('performance_insights_enabled', true) | lower }}
  monitoring_interval          = {{ config.get('monitoring_interval', 60) }}
  monitoring_role_arn          = {{ config.get('monitoring_role_arn', 'null') }}

  tags = {
    Name      = "{{ config.get('cluster_identifier', project_id ~ '-aurora') }}-${count.index}"
    ManagedBy = "complyform"
  }
}

variable "aurora_master_password" {
  description = "Aurora cluster master password"
  type        = string
  sensitive   = true
}
