staging.tf

# Lambda function for syncing Redshift tables to Postgres checkout optimization STAGING
# Syncs: aggregated_performance_metrics_daily, lever_traffic_daily

locals {
  staging_function_name = "redshift-to-postgres-sync-staging"

  # Staging Postgres security group
  postgres_staging_rds_sg = "sg-09c1ed14fd824be27"  # hive-checkout-optimization-rds-vercel-staging
}

# IAM Role for Staging Lambda
resource "aws_iam_role" "staging_lambda_role" {
  name = "${local.staging_function_name}-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "lambda.amazonaws.com"
        }
      }
    ]
  })

  tags = {
    Name        = "${local.staging_function_name}-role"
    Environment = "staging"
    Project     = "checkout-optimization"
  }
}

# IAM Policy for Staging Lambda
resource "aws_iam_role_policy" "staging_lambda_policy" {
  name = "${local.staging_function_name}-policy"
  role = aws_iam_role.staging_lambda_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        # CloudWatch Logs
        Effect = "Allow"
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ]
        Resource = "arn:aws:logs:eu-central-1:*:*"
      },
      {
        # VPC ENI management (required for Lambda in VPC)
        Effect = "Allow"
        Action = [
          "ec2:CreateNetworkInterface",
          "ec2:DescribeNetworkInterfaces",
          "ec2:DeleteNetworkInterface",
          "ec2:AssignPrivateIpAddresses",
          "ec2:UnassignPrivateIpAddresses"
        ]
        Resource = "*"
      },
      {
        # Secrets Manager (for Postgres and Redshift credentials)
        Effect = "Allow"
        Action = [
          "secretsmanager:GetSecretValue"
        ]
        Resource = [
          "arn:aws:secretsmanager:eu-central-1:849181912040:secret:applications/staging/checkout-optimization-*",
          "arn:aws:secretsmanager:eu-central-1:849181912040:secret:redshift/*"
        ]
      },
      {
        # Redshift IAM authentication
        Effect = "Allow"
        Action = [
          "redshift:GetClusterCredentials",
          "redshift:DescribeClusters"
        ]
        Resource = [
          "arn:aws:redshift:eu-central-1:849181912040:cluster:hive",
          "arn:aws:redshift:eu-central-1:849181912040:dbuser:hive/dbt",
          "arn:aws:redshift:eu-central-1:849181912040:dbname:hive/main"
        ]
      }
    ]
  })
}

# Staging Lambda function
resource "aws_lambda_function" "staging_redshift_postgres_sync" {
  function_name = local.staging_function_name
  role          = aws_iam_role.staging_lambda_role.arn
  handler       = "redshift_to_postgres_sync.handler"
  runtime       = "python3.12"
  timeout       = 300
  memory_size   = 512

  # Code package (same as production)
  filename         = "${path.module}/lambda_code.zip"
  source_code_hash = filebase64sha256("${path.module}/lambda_code.zip")

  # Attach the dependencies layer (shared with production)
  layers = [aws_lambda_layer_version.dependencies.arn]

  vpc_config {
    subnet_ids = local.subnet_ids
    security_group_ids = [
      local.redshift_client_sg,
      local.postgres_staging_rds_sg
    ]
  }

  environment {
    variables = {
      REDSHIFT_HOST     = "hive.cjc3cej8scym.eu-central-1.redshift.amazonaws.com"
      REDSHIFT_PORT     = "5439"
      REDSHIFT_DATABASE = "main"
      REDSHIFT_USER     = "dbt"
      # Staging Postgres
      POSTGRES_HOST     = "hive-checkout-optimization-staging.cqufmenwec0c.eu-central-1.rds.amazonaws.com"
      POSTGRES_PORT     = "5432"
      POSTGRES_DATABASE = "hive_checkout_optimization"
      POSTGRES_USER     = "hive"
      # Staging secret name
      POSTGRES_SECRET   = "applications/staging/checkout-optimization"
      # Source schema in Redshift where dbt marts live
      SOURCE_SCHEMA     = "events"
      TARGET_SCHEMA     = "public"
    }
  }

  tags = {
    Name        = local.staging_function_name
    Environment = "staging"
    Project     = "checkout-optimization"
  }
}

# CloudWatch Log Group for Staging
resource "aws_cloudwatch_log_group" "staging_lambda_logs" {
  name              = "/aws/lambda/${local.staging_function_name}"
  retention_in_days = 14

  tags = {
    Name        = "${local.staging_function_name}-logs"
    Environment = "staging"
    Project     = "checkout-optimization"
  }
}

# EventBridge Rule for Staging - Run daily at 07:00 UTC (after dbt models refresh)
resource "aws_cloudwatch_event_rule" "staging_daily_sync" {
  name                = "${local.staging_function_name}-daily"
  description         = "Trigger Redshift to Postgres sync daily (staging)"
  schedule_expression = "cron(0 6 * * ? *)"

  tags = {
    Name        = "${local.staging_function_name}-schedule"
    Environment = "staging"
    Project     = "checkout-optimization"
  }
}

# EventBridge Target for Staging
resource "aws_cloudwatch_event_target" "staging_lambda_target" {
  rule      = aws_cloudwatch_event_rule.staging_daily_sync.name
  target_id = "RedshiftPostgresSyncStaging"
  arn       = aws_lambda_function.staging_redshift_postgres_sync.arn
}

# Lambda permission for EventBridge (Staging)
resource "aws_lambda_permission" "staging_allow_eventbridge" {
  statement_id  = "AllowExecutionFromEventBridge"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.staging_redshift_postgres_sync.function_name
  principal     = "events.amazonaws.com"
  source_arn    = aws_cloudwatch_event_rule.staging_daily_sync.arn
}