variable "upwind_trusted_account_id" {
  # For the majority of use cases this should be left as the default.
  description = "The identifier of the trusted account used for IAM cross-account access."
  type        = string
  default     = "340457201789"
  validation {
    condition     = can(regex("^[0-9]{12}$", var.upwind_trusted_account_id))
    error_message = "The value for the Upwind trusted account id must be a 12-digit AWS account ID."
  }
}

variable "upwind_cfn_bucket" {
  # For the majority of use cases this should be left as the default. Non-production
  # Upwind environments host their CloudFormation templates on a different bucket
  # (e.g. get.upwind.dev).
  description = "Hostname of the Upwind S3 bucket that hosts the CloudFormation templates referenced by the account service role policies."
  type        = string
  default     = "get.upwind.io"

  validation {
    condition     = length(var.upwind_cfn_bucket) > 0
    error_message = "The Upwind CloudFormation bucket host must not be empty."
  }
}

variable "external_id" {
  # The external_id is attached to the trusted entities allowing assume-role requests from upwind to be authenticated.
  description = "The external ID for secure cross-account role assumption."
  type        = string
}

variable "orchestrator_account_id" {
  # Additional permissions will be created in the orchestrator account - allowing CloudScanners to be installed. If provided additional roles will also be provided
  # in this account.
  description = "The account ID of the Upwind orchestrator account. If specified, certain roles will only be created in this account to maintain operational security and control."
  type        = string
  default     = null

  # If the orchestrator account id role is set it must be a valid account id
  validation {
    condition     = can(regex("^[0-9]{12}$", var.orchestrator_account_id)) || var.orchestrator_account_id == null
    error_message = "The value for the orchestrator account id must be a 12-digit AWS account ID or an empty string."
  }
}

variable "management_account_id" {
  # The Organization discovery role will be created in the management account.
  description = "The account ID of the AWS Organization management account. The Org discover role will be created in this account."
  type        = string

  # If the orchestrator account id role is set it must be a valid account id
  validation {
    condition     = can(regex("^[0-9]{12}$", var.management_account_id))
    error_message = "The value for the AWS management account must be a 12-digit AWS account ID or an empty string."
  }
}

variable "install_roles_in_management_account" {
  # Enabling this option will install additional roles in the management account which allows that account to be scanned if required.
  # It would also allow the management account to be used as the orchestrator account if the same account is selected.
  description = "Install the additional roles in the management account - if required."
  type        = bool
  default     = false
}

variable "organization_role_name" {
  description = "The base name of the IAM role to be created, used for account discovery within the AWS Org."
  type        = string
  default     = "UpwindOrganizationServiceRole"

  validation {
    condition     = can(regex("^[a-zA-Z0-9-_]+$", var.organization_role_name))
    error_message = "The base Org discovery role name contains invalid characters."
  }

  # Full Role name validation is delegated to the sub modules.
}

variable "account_service_role_name" {
  description = "The base name of the IAM role to be created, used for security auditing purposes."
  type        = string
  default     = "UpwindAccountServiceRole"

  validation {
    condition     = can(regex("^[a-zA-Z0-9-_]+$", var.account_service_role_name))
    error_message = "The base Account service role name contains invalid characters."
  }

  # Full role name validation is delegated to the sub modules.
}

variable "account_service_cloudformation_policy_name" {
  description = "The base name to be used for the Cloudformation policy name in the account service role."
  type        = string
  default     = "UpwindAccountServiceCloudFormationPolicy"

  validation {
    condition     = can(regex("^[a-zA-Z0-9-_]+$", var.account_service_cloudformation_policy_name))
    error_message = "The Cloudformation policy base name contains invalid characters."
  }

  # Full policy name validation is delegated to the sub modules.
}

variable "account_service_cloudscanner_ec2_policy_name" {
  description = "The base name to be used for the CloudScanner EC2 policy name in the account service role."
  type        = string
  default     = "UpwindAccountServiceCloudScannerEC2Policy"

  validation {
    condition     = can(regex("^[a-zA-Z0-9-_]+$", var.account_service_cloudscanner_ec2_policy_name))
    error_message = "The CloudScanner EC2 policy base name contains invalid characters."
  }
  # Full policy name validation is delegated to the sub modules.
}

variable "account_service_cloudscanner_policy_name" {
  description = "The base name to be used for the CloudScanner policy name in the account service role."
  type        = string
  default     = "UpwindAccountServiceCloudScannerPolicy"

  validation {
    condition     = can(regex("^[a-zA-Z0-9-_]+$", var.account_service_cloudscanner_policy_name))
    error_message = "The CloudScanner policy base name contains invalid characters."
  }

  # Full policy name validation is delegated to the sub modules.
}

variable "account_service_cloudscanner_ec2_network_policy_name" {
  description = <<EOT
The base name to be used when creating the CloudScanner EC2 Network Policy for the Account Service role.
This policy contains permissions to create and manage EC2 network resources which can be omitted if you
intend to provide the network stack configuration.
  EOT
  type        = string
  default     = "UpwindAccountServiceCloudScannerEC2NetworkPolicy"

  validation {
    condition     = can(regex("^[a-zA-Z0-9-_]+$", var.account_service_cloudscanner_ec2_network_policy_name))
    error_message = "The CloudScanner EC2 network policy base name contains invalid characters."
  }

  # Full policy name validation is delegated to the sub modules.
}

variable "account_service_agentless_k8s_access_entries_policy_name" {
  description = "The base name to be used for the agentless Kubernetes access entries policy in the account service role."
  type        = string
  default     = "UpwindAccountServiceAgentlessK8sAEPolicy"

  validation {
    condition     = can(regex("^[\\w+=,.@-]+$", var.account_service_agentless_k8s_access_entries_policy_name))
    error_message = "The agentless Kubernetes access entries policy base name contains invalid characters."
  }

  # Full policy name validation is delegated to the sub modules.
}

variable "account_service_agentless_k8s_ssm_policy_name" {
  description = "The base name to be used for the agentless Kubernetes SSM policy in the account service role."
  type        = string
  default     = "UpwindAccountServiceAgentlessK8sSSMPolicy"

  validation {
    condition     = can(regex("^[\\w+=,.@-]+$", var.account_service_agentless_k8s_ssm_policy_name))
    error_message = "The agentless Kubernetes SSM policy base name contains invalid characters."
  }

  # Full policy name validation is delegated to the sub modules.
}

variable "cloudscanner_administration_role_name" {
  description = "The base name of the IAM administration role to be created, used for cloud scanning operations."
  type        = string
  default     = "UpwindCloudScannerAdministrationRole"

  validation {
    condition     = can(regex("^[a-zA-Z0-9-_]+$", var.cloudscanner_administration_role_name))
    error_message = "The base CloudScanner admin role name contains invalid characters."
  }

  # Full role name validation is delegated to the sub modules.
}

variable "cloudscanner_administration_role_profile_name" {
  description = "The name to be used for the CloudScanner admin role instance profile."
  type        = string
  default     = "UpwindCloudScannerAdministrationRoleProfile"

  validation {
    condition     = can(regex("^[a-zA-Z0-9-_]+$", var.cloudscanner_administration_role_profile_name))
    error_message = "The CloudScanner Admin role instance profile name contains invalid characters."
  }

  # Full role name validation is delegated to the sub modules.
}


variable "cloudscanner_execution_role_name" {
  description = "The base name of the IAM execution role to be created, used for cloud scanning operations."
  type        = string
  default     = "UpwindCloudScannerExecutionRole"

  validation {
    condition     = can(regex("^[a-zA-Z0-9-_]+$", var.cloudscanner_execution_role_name))
    error_message = "The base CloudScanner execution role name contains invalid characters."
  }

  # Full Role name validation is delegated to the sub modules.
}

variable "upwind_cloudscanner_auth_client_id" {
  # The upwind_cloudscanner_auth_client_id and upwind_cloudscanner_auth_secret_value are used by the CloudScanner to make authenticated requests to the Upwind SaaS. If provided they will
  # be stored in a secret. Otherwise a secret ARN should be provided using upwind_cloudscanner_auth_secret_arn.
  description = "The CloudScanner client ID for Upwind Security authentication."
  type        = string
  sensitive   = true
  default     = null
}

variable "upwind_cloudscanner_auth_secret_value" {
  description = "The CloudScanner client secret for Upwind Security authentication."
  type        = string
  sensitive   = true
  default     = null
}

variable "upwind_cloudscanner_auth_secret_arn" {
  description = "The ARN of the secret containing the CloudScanner credentials."
  type        = string
  default     = null
  validation {
    # wildcard following '^arn:' accounts for use of AWS partitions
    condition     = can(regex("^arn:.+:secretsmanager:[a-z]{2}-[a-z]+-\\d:[0-9]{12}:secret:[a-zA-Z0-9_./-]+-[a-zA-Z0-9]+$", var.upwind_cloudscanner_auth_secret_arn)) || var.upwind_cloudscanner_auth_secret_arn == null
    error_message = "The secret ARN must be a valid AWS Secrets Manager ARN."
  }
}

variable "credentials_secret_name_prefix" {
  description = "The prefix for the AWS Secrets Manager secret name storing Upwind client credentials. Used to create the secret if `UpwindClientId` and `UpwindClientSecret` are provided."
  type        = string
  default     = "/upwind"
}

variable "cloudscanner_secret_name" {
  description = "The base name used when creating the CloudScanner credentials secret."
  type        = string
  default     = "/cloudscanner-credentials"
}

variable "role_name_suffix" {
  # The role name suffix shall be appended to role names to ensure they are unique for different installations.
  description = "A user specific suffix that will be appended to resources - eg role names."
  type        = string
  default     = null

  validation {
    condition     = can(regex("^[a-zA-Z0-9-_]+$", var.role_name_suffix)) || var.role_name_suffix == null
    error_message = "The suffix must contain only alpha numerical characters, if provided."
  }

  # The suffix will be appended to specific resource names - if provided, thus creating unique resource names.
  # These will be fully validated by the sub modules.
}

#######################################################################################
# The following variables are used conditionally enable / disable feature options
#######################################################################################
variable "upwind_feature_dspm_enabled" {
  description = "Enable the creation of roles to enable DSPM scanning. This includes permissions to access the the contents of S3 buckets."
  type        = bool
  default     = true
}

variable "upwind_feature_dspm_account_whitelist" {
  description = "(Optional). If set, and given upwind_feature_dspm_enabled is true, this will limit the accounts that we create the DSPM S3 permissions in"
  type        = list(string)
  default     = []
}

variable "upwind_feature_dspm_rds_enabled" {
  description = "Enable DSPM scanning of RDS databases. This includes the permissions required to snapshot and restore RDS databases so their contents can be scanned."
  type        = bool
  default     = false
}

variable "upwind_feature_dspm_rds_account_allowlist" {
  description = "(Optional). If set, and given upwind_feature_dspm_rds_enabled is true, this limits the accounts that we create the DSPM RDS permissions in."
  type        = list(string)
  default     = []
}

variable "upwind_cloudscanner_management_enabled" {
  description = "Enable the permissions necessary to support automated CloudScanner deployment and management."
  type        = bool
  default     = true
}

variable "upwind_include_ec2_network_management_permissions" {
  description = "Include permissions necessary to create and manage EC2 network resources."
  type        = bool
  default     = true
}

variable "custom_tags" {
  description = "Custom tags which shall be applied to each resource created by the module."
  type        = map(string)
  default     = {}
}

#######################################################################################
# The following variables configure Agentless Kubernetes support
#######################################################################################
variable "upwind_agentless_k8s_access_entries_enabled" {
  description = "Enable the creation of the policy for agentless Kubernetes resource fetching using EKS access entries as the authentication method."
  type        = bool
  default     = false
}

variable "current_account_id" {
  description = "(Optional). Explicit account ID for AWS account being configured. Provide this when using upwind_agentless_k8s_account_whitelist so terraform can determine resource creation during plan"
  type        = string
  default     = null

  validation {
    condition     = var.current_account_id == null || can(regex("^[0-9]{12}$", var.current_account_id))
    error_message = "current_account_id must be a 12-digit AWS account ID."
  }
}

variable "upwind_agentless_k8s_account_whitelist" {
  description = "(Optional). If set, this will limit the accounts in which the agentless Kubernetes access entry and SSM permissions are created."
  type        = list(string)
  default     = []
}

variable "upwind_agentless_k8s_ssm_enabled" {
  description = "Enable the creation of the policy for agentless Kubernetes resource fetching from private EKS clusters via SSM tunnels."
  type        = bool
  default     = false
}

variable "upwind_agentless_k8s_eks_admin_view_policy_enabled" {
  description = "Allow the role to associate AmazonEKSAdminViewPolicy (in addition to AmazonEKSViewPolicy) on Upwind-created access entries. Only takes effect when upwind_agentless_k8s_access_entries_enabled is true."
  type        = bool
  default     = true
}


#######################################################################################
# The following variables configure SaaS deployment mode
#######################################################################################
variable "is_saas" {
  description = "When true, configures the module for Upwind SaaS-managed CloudScanner deployment. In SaaS mode the CloudScanner admin role and credentials secret are not created; instead a customer assume role is created that the Upwind SaaS account can assume."
  type        = bool
  default     = false
}

variable "cloudscanner_saas_trusted_account_id" {
  description = "The AWS account ID of the Upwind SaaS account that will assume the customer assume role. Required when is_saas = true."
  type        = string
  default     = null

  validation {
    condition     = var.cloudscanner_saas_trusted_account_id == null || can(regex("^[0-9]{12}$", var.cloudscanner_saas_trusted_account_id))
    error_message = "cloudscanner_saas_trusted_account_id must be a 12-digit AWS account ID."
  }
}

variable "cloudscanner_saas_customer_assume_role_name" {
  description = "Base name of the IAM role created in the orchestrator account that the Upwind SaaS account assumes to perform scanning. Only used when is_saas = true."
  type        = string
  default     = "UpwindCloudScannerCustomerAssumeRole"

  validation {
    condition     = can(regex("^[a-zA-Z0-9-_]+$", var.cloudscanner_saas_customer_assume_role_name))
    error_message = "cloudscanner_saas_customer_assume_role_name contains invalid characters."
  }
}

#######################################################################################
# Permissions boundaries (optional).
#
# Each role created during onboarding can be constrained by a pre-existing IAM permissions boundary
# policy. A boundary caps the maximum permissions a role can have; it grants nothing itself and must
# already exist in the account. Each value may be either a full policy ARN (used as-is) or a bare
# policy name/path without a leading slash, in which case the ARN is formed for the account the role
# is created in. Leave null (the default) to create the role without a permissions boundary.
#
# Full role name validation is delegated to the sub modules.
#######################################################################################
variable "organization_role_permissions_boundary" {
  description = "(Optional). Permissions boundary policy (ARN or policy name/path) to attach to the Org Discovery role."
  type        = string
  default     = null

  validation {
    condition     = var.organization_role_permissions_boundary == null || can(regex("^arn:[a-z0-9-]*:iam::[0-9]{12}:policy/.+$", var.organization_role_permissions_boundary)) || can(regex("^[a-zA-Z0-9+=,.@_-][a-zA-Z0-9+=,.@_/-]*$", var.organization_role_permissions_boundary))
    error_message = "Must be null, a valid IAM policy ARN, or an IAM policy name/path without a leading slash."
  }
}

variable "account_service_role_permissions_boundary" {
  description = "(Optional). Permissions boundary policy (ARN or policy name/path) to attach to the Account Service role."
  type        = string
  default     = null

  validation {
    condition     = var.account_service_role_permissions_boundary == null || can(regex("^arn:[a-z0-9-]*:iam::[0-9]{12}:policy/.+$", var.account_service_role_permissions_boundary)) || can(regex("^[a-zA-Z0-9+=,.@_-][a-zA-Z0-9+=,.@_/-]*$", var.account_service_role_permissions_boundary))
    error_message = "Must be null, a valid IAM policy ARN, or an IAM policy name/path without a leading slash."
  }
}

variable "cloudscanner_administration_role_permissions_boundary" {
  description = "(Optional). Permissions boundary policy (ARN or policy name/path) to attach to the CloudScanner admin role."
  type        = string
  default     = null

  validation {
    condition     = var.cloudscanner_administration_role_permissions_boundary == null || can(regex("^arn:[a-z0-9-]*:iam::[0-9]{12}:policy/.+$", var.cloudscanner_administration_role_permissions_boundary)) || can(regex("^[a-zA-Z0-9+=,.@_-][a-zA-Z0-9+=,.@_/-]*$", var.cloudscanner_administration_role_permissions_boundary))
    error_message = "Must be null, a valid IAM policy ARN, or an IAM policy name/path without a leading slash."
  }
}

variable "cloudscanner_execution_role_permissions_boundary" {
  description = "(Optional). Permissions boundary policy (ARN or policy name/path) to attach to the CloudScanner execution role."
  type        = string
  default     = null

  validation {
    condition     = var.cloudscanner_execution_role_permissions_boundary == null || can(regex("^arn:[a-z0-9-]*:iam::[0-9]{12}:policy/.+$", var.cloudscanner_execution_role_permissions_boundary)) || can(regex("^[a-zA-Z0-9+=,.@_-][a-zA-Z0-9+=,.@_/-]*$", var.cloudscanner_execution_role_permissions_boundary))
    error_message = "Must be null, a valid IAM policy ARN, or an IAM policy name/path without a leading slash."
  }
}

variable "upwind_enable_self_managed_kms_key" {
  description = "Enable self managed kms key instead of upwind managed kms key"
  type        = bool
  default     = false
}