variable "vpc_id" {
  type = string
  default = "vpc-095cec1486c102bb6"
}

variable "utility_subnets" {
  type    = map
  default = {
    "us-east-1a" = "10.95.32.80/28"
    "us-east-1b" = "10.95.32.64/28"
    # "us-east-1c" = "10.95.XX.XX/28"
    # "us-east-1d" = "10.95.XX.XX/28"
    # "us-east-1e" = "10.95.XX.XX/28"
    # "us-east-1f" = "10.95.XX.XX/28"
  }
}

data "aws_ec2_transit_gateway_vpc_attachment" "tgw" {
  filter {
    name   = "vpc-id"
    values = [ var.vpc_id ]
  }
}

###############################################################################
# IMPORT STATEMENTS
#
# Selectively import utility subnets only for the relevant AZs in your VPC
# 
# terraform import 'aws_subnet.tgw_utility_subnets["us-east-1a"]' AZ_1A_SUBNET_ID
# terraform import 'aws_subnet.tgw_utility_subnets["us-east-1b"]' AZ_1B_SUBNET_ID
# terraform import 'aws_subnet.tgw_utility_subnets["us-east-1c"]' AZ_1C_SUBNET_ID
# terraform import 'aws_subnet.tgw_utility_subnets["us-east-1d"]' AZ_1D_SUBNET_ID
# terraform import 'aws_subnet.tgw_utility_subnets["us-east-1e"]' AZ_1E_SUBNET_ID
# terraform import 'aws_subnet.tgw_utility_subnets["us-east-1f"]' AZ_1F_SUBNET_ID
###############################################################################

resource "aws_subnet" "tgw_utility_subnets" {
  for_each = var.utility_subnets

  vpc_id            = var.vpc_id
  availability_zone = each.key
  cidr_block        = each.value

  tags = {
    Name = "tgw-utility-${each.key}-do-not-use"
    "cit:contact-email" = "cloud-support@cornell.edu"
    "cit:dc-arch-migration-description" = "This utility subnet hosts a transit gateway attachment. Do not use for other purposes."
    "cit:dc-arch-migration-new-resource" = "yes"
    "cit:dc-arch-migration-target" = "yes"
    "cit:dc-arch-version" = "v2"
    "cit:documentation" = "https://confluence.cornell.edu/x/vKr2Gg"
    "cit:source" ="https://github.com/CU-CommunityApps/ct-aws-tgw/"
    "cit:subnet-type" = "utility"
    "cit:tgw-attachment-target" = "yes"
  }
}

###############################################################################
# IMPORT STATEMENT
#
# terraform import aws_route_table.tgw_utility UTILITY_ROUTE_TABLE_ID
###############################################################################
resource "aws_route_table" "tgw_utility" {
  vpc_id = var.vpc_id

  tags = {
    Name = "tgw-utility-rt-for-${var.vpc_id}-do-not-use"
    "cit:contact-email" = "cloud-support@cornell.edu"
    "cit:dc-arch-exclude-tgw-routes" = "yes"
    "cit:dc-arch-migration-new-resource" = "yes"
    "cit:dc-arch-migration-description" = "This route table is to be used only for TGW utility subnets."
    "cit:dc-arch-migration-target" = "yes"
    "cit:dc-arch-version" = "v2"
    "cit:documentation" = "https://confluence.cornell.edu/x/vKr2Gg"
    "cit:source" ="https://github.com/CU-CommunityApps/ct-aws-tgw/"
  }
}

###############################################################################
# IMPORT STATEMENT
#
# Import the association once for EACH utility subnet in your VPC, by availability zone.
#
# terraform import 'aws_route_table_association.tgw_utility["us-east-1a"]' AZ_1A_SUBNET_ID/UTILITY_ROUTE_TABLE_ID
# terraform import 'aws_route_table_association.tgw_utility["us-east-1b"]' AZ_1B_SUBNET_ID/UTILITY_ROUTE_TABLE_ID
# terraform import 'aws_route_table_association.tgw_utility["us-east-1c"]' AZ_1C_SUBNET_ID/UTILITY_ROUTE_TABLE_ID
# terraform import 'aws_route_table_association.tgw_utility["us-east-1d"]' AZ_1D_SUBNET_ID/UTILITY_ROUTE_TABLE_ID
# terraform import 'aws_route_table_association.tgw_utility["us-east-1e"]' AZ_1E_SUBNET_ID/UTILITY_ROUTE_TABLE_ID
# terraform import 'aws_route_table_association.tgw_utility["us-east-1f"]' AZ_1F_SUBNET_ID/UTILITY_ROUTE_TABLE_ID
###############################################################################
resource "aws_route_table_association" "tgw_utility" {
  for_each = var.utility_subnets

  subnet_id      = aws_subnet.tgw_utility_subnets[each.key].id
  route_table_id = aws_route_table.tgw_utility.id
}

###############################################################################
# IMPORT STATEMENT
#
# terraform import aws_network_acl.utility NACL_ID
###############################################################################
resource "aws_network_acl" "utility" {
  vpc_id     = var.vpc_id
  subnet_ids = [ 
    for key, item in var.utility_subnets:
      aws_subnet.tgw_utility_subnets[key].id
  ]

  egress {
    protocol   = "-1"
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 0
    to_port    = 0
  }

  ingress {
    protocol   = "-1"
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 0
    to_port    = 0
  }

  tags = {
    Name = "tgw-utility-nacl-for-${var.vpc_id}-do-not-use"
    "cit:contact-email" = "cloud-support@cornell.edu"
    "cit:documentation" = "https://confluence.cornell.edu/x/vKr2Gg"
    "cit:dc-arch-version" = "v2"
    "cit:dc-arch-migration-target" = "yes"
    "cit:dc-arch-migration-description" = "This permissive NACL is to be used only for TGW utility subnets."
    "cit:dc-arch-migration-new-resource" = "yes"
    "cit:source" ="https://github.com/CU-CommunityApps/ct-aws-tgw/"
  }
}