main.tf

# Lambda function for syncing Redshift tables to Postgres checkout optimization staging
# Syncs: aggregated_performance_metrics_daily, lever_traffic_daily

locals {
  function_name = "redshift-to-postgres-sync"

  # VPC configuration
  vpc_id = "vpc-090a625fe7b124781"

  subnet_ids = [
    "subnet-0b4bc0f17cd069e34",  # eu-central-1a
    "subnet-0af7305f1d9cf8cae",  # eu-central-1b
    "subnet-0d763d3b4a95c70ba",  # eu-central-1c
  ]

  # Existing security groups
  redshift_client_sg    = "sg-0b21587bbe6704b01"  # prod-hive-redshift-client-sg
  postgres_staging_sg   = "sg-09c1ed14fd824be27"  # hive-checkout-optimization-rds-vercel-staging
}

# IAM Role for Lambda
resource "aws_iam_role" "lambda_role" {
  name = "${local.function_name}-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "lambda.amazonaws.com"
        }
      }
    ]
  })

  tags = {
    Name        = "${local.function_name}-role"
    Environment = "production"
    Project     = "checkout-optimization"
  }
}

# IAM Policy for Lambda
resource "aws_iam_role_policy" "lambda_policy" {
  name = "${local.function_name}-policy"
  role = aws_iam_role.lambda_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        # CloudWatch Logs
        Effect = "Allow"
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ]
        Resource = "arn:aws:logs:eu-central-1:*:*"
      },
      {
        # VPC ENI management (required for Lambda in VPC)
        Effect = "Allow"
        Action = [
          "ec2:CreateNetworkInterface",
          "ec2:DescribeNetworkInterfaces",
          "ec2:DeleteNetworkInterface",
          "ec2:AssignPrivateIpAddresses",
          "ec2:UnassignPrivateIpAddresses"
        ]
        Resource = "*"
      },
      {
        # Secrets Manager (for Postgres and Redshift credentials)
        Effect = "Allow"
        Action = [
          "secretsmanager:GetSecretValue"
        ]
        Resource = [
          "arn:aws:secretsmanager:eu-central-1:849181912040:secret:applications/production/checkout-optimization-*",
          "arn:aws:secretsmanager:eu-central-1:849181912040:secret:redshift/*"
        ]
      },
      {
        # Redshift IAM authentication
        Effect = "Allow"
        Action = [
          "redshift:GetClusterCredentials"
        ]
        Resource = [
          "arn:aws:redshift:eu-central-1:849181912040:dbuser:hive/dbt",
          "arn:aws:redshift:eu-central-1:849181912040:dbname:hive/main"
        ]
      }
    ]
  })
}

# Lambda Layer for dependencies (psycopg2, redshift-connector)
resource "aws_lambda_layer_version" "dependencies" {
  filename            = "${path.module}/lambda_layer.zip"
  layer_name          = "${local.function_name}-dependencies"
  compatible_runtimes = ["python3.12"]
  source_code_hash    = filebase64sha256("${path.module}/lambda_layer.zip")
  description         = "psycopg2-binary and redshift-connector for Lambda"
}

# Lambda function
resource "aws_lambda_function" "redshift_postgres_sync" {
  function_name = local.function_name
  role          = aws_iam_role.lambda_role.arn
  handler       = "redshift_to_postgres_sync.handler"
  runtime       = "python3.12"
  timeout       = 300
  memory_size   = 512

  # Code package (just the handler, no dependencies)
  filename         = "${path.module}/lambda_code.zip"
  source_code_hash = filebase64sha256("${path.module}/lambda_code.zip")

  # Attach the dependencies layer
  layers = [aws_lambda_layer_version.dependencies.arn]

  vpc_config {
    subnet_ids = local.subnet_ids
    security_group_ids = [
      local.redshift_client_sg,
      local.postgres_staging_sg
    ]
  }

  environment {
    variables = {
      REDSHIFT_HOST     = "hive.cjc3cej8scym.eu-central-1.redshift.amazonaws.com"
      REDSHIFT_PORT     = "5439"
      REDSHIFT_DATABASE = "main"
      REDSHIFT_USER     = "dbt"
      # REDSHIFT_PASSWORD fetched from Secrets Manager (redshift-dbt-credentials)
      POSTGRES_HOST     = "hive-checkout-optimization-production.cqufmenwec0c.eu-central-1.rds.amazonaws.com"
      POSTGRES_PORT     = "5432"
      POSTGRES_DATABASE = "hive_checkout_optimization"
      POSTGRES_USER     = "hive"
      # Source schema in Redshift where dbt marts live (events schema for aggregated tables)
      SOURCE_SCHEMA     = "events"
      TARGET_SCHEMA     = "public"
    }
  }

  tags = {
    Name        = local.function_name
    Environment = "production"
    Project     = "checkout-optimization"
  }
}

# CloudWatch Log Group
resource "aws_cloudwatch_log_group" "lambda_logs" {
  name              = "/aws/lambda/${local.function_name}"
  retention_in_days = 14

  tags = {
    Name        = "${local.function_name}-logs"
    Environment = "production"
    Project     = "checkout-optimization"
  }
}

# EventBridge Rule - Run daily at 07:00 UTC (after dbt models refresh)
resource "aws_cloudwatch_event_rule" "daily_sync" {
  name                = "${local.function_name}-daily"
  description         = "Trigger Redshift to Postgres sync daily"
  schedule_expression = "cron(0 6 * * ? *)"

  tags = {
    Name        = "${local.function_name}-schedule"
    Environment = "production"
    Project     = "checkout-optimization"
  }
}

# EventBridge Target
resource "aws_cloudwatch_event_target" "lambda_target" {
  rule      = aws_cloudwatch_event_rule.daily_sync.name
  target_id = "RedshiftPostgresSync"
  arn       = aws_lambda_function.redshift_postgres_sync.arn
}

# Lambda permission for EventBridge
resource "aws_lambda_permission" "allow_eventbridge" {
  statement_id  = "AllowExecutionFromEventBridge"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.redshift_postgres_sync.function_name
  principal     = "events.amazonaws.com"
  source_arn    = aws_cloudwatch_event_rule.daily_sync.arn
}

# Security group for VPC endpoints
resource "aws_security_group" "vpce_sg" {
  name        = "${local.function_name}-vpce-sg"
  description = "Security group for VPC endpoints used by Lambda"
  vpc_id      = local.vpc_id

  ingress {
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    security_groups = [local.redshift_client_sg]
  }

  tags = {
    Name        = "${local.function_name}-vpce-sg"
    Environment = "production"
    Project     = "checkout-optimization"
  }
}

# VPC Endpoint for Redshift API (required for IAM authentication from within VPC)
resource "aws_vpc_endpoint" "redshift" {
  vpc_id              = local.vpc_id
  service_name        = "com.amazonaws.eu-central-1.redshift"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = local.subnet_ids
  security_group_ids  = [aws_security_group.vpce_sg.id]
  private_dns_enabled = true

  tags = {
    Name        = "${local.function_name}-redshift-vpce"
    Environment = "production"
    Project     = "checkout-optimization"
  }
}