main.tf

locals {
    short_mcomm = lower(replace(split("@", var.mcomm_group_email)[0],".","-"))

    project_id_prefix = "${var.division}-audit-"
    project_id_customer = substr(local.short_mcomm,0,30-5-length(local.project_id_prefix))
    project_id = "${local.project_id_prefix}${local.project_id_customer}-${random_id.id[0].hex}"

    project_name = substr("${var.division} Audit ${local.short_mcomm}",0,30)

    security_contact = "security@umich.edu"
    # customer_service_account_id = "${local.customer_service_account_prefix}${local.customer_service_account_suffix}"
    filter_string = "Change_Me_to_Send_Additional_Logs_to_Splunk; Leave_Exclusions_in_Place_PLEASE"
    log_filter_list = [
      "log_id(\"cloudaudit.googleapis.com/activity\")",
      "log_id(\"externalaudit.googleapis.com/activity\")",
      "log_id(\"cloudaudit.googleapis.com/system_event\")", 
      "log_id(\"externalaudit.googleapis.com/system_event\")",
      "log_id(\"cloudaudit.googleapis.com/access_transparency\")",
      "log_id(\"externalaudit.googleapis.com/access_transparency\")",
      "log_id(\"cloudaudit.googleapis.com/data_access\")",
      "log_id(\"externalaudit.googleapis.com/data_access\")",
      "log_id(\"compute.googleapis.com/vpc_flows\")",
    ]
    log_filters = join(" OR ", local.log_filter_list)

    curl_body           = {
        kind               = "project"
        security_contact   = local.security_contact
        mcomm_group_email  = var.mcomm_group_email
        shortcode          = var.shortcode
        vpn                = false 
        dt_phi             = true
        dt_ferpa           = false
        dt_pii             = false
        dt_glba            = false
        dt_hsr             = false
        dt_ssn             = false
        dt_acp             = false
        dt_it_sec_info     = true
        dt_itar            = false
        dt_pci             = false
        dt_fisma           = false
        dt_other_data      = false
        dt_other_data_info = ""
    }
    log_export_project = split("/",local.log_export_destination[var.environment][var.division])[2]
    
    log_export_destination = {
        //dev = ""
        test = {
            its               = "pubsub.googleapis.com/projects/gcp-at-um-test-mon/topics/gcp-at-um-logs-test"
            campus            = "pubsub.googleapis.com/projects/gcp-at-um-test-mon/topics/gcp-at-um-logs-test"
            # michigan_medicine = "pubsub.googleapis.com/projects/gcp-at-um-test-mon/topics/gcp-at-um-logs-test"
            mm                = "pubsub.googleapis.com/projects/gcp-at-um-test-mon/topics/gcp-at-um-logs-test"
            hipaa             = "pubsub.googleapis.com/projects/gcp-at-um-test-mon/topics/hipaa-logs-test"
            # "pubsub.googleapis.com/projects/gcp-at-um-mon/topics/hipaa-logs-test"
              
        } 
        prod = {
            its               = "pubsub.googleapis.com/projects/gcp-at-um-mon/topics/gcp-at-um-logs-prod"
            campus            = "pubsub.googleapis.com/projects/gcp-at-um-mon/topics/gcp-at-um-logs-prod"
            # michigan_medicine = "pubsub.googleapis.com/projects/gcp-at-um-mon/topics/gcp-at-um-logs-prod"
            mm                = "pubsub.googleapis.com/projects/gcp-at-um-test-mon/topics/gcp-at-um-logs-test"
            hipaa             = "pubsub.googleapis.com/projects/gcp-at-um-mon/topics/hipaa-logs-prod" # "pubsub.googleapis.com/projects/${var.division}-logs-${var.environment}" 
        }
    }

    big_query_enabled        = var.big_query ? 1 : 0
    gcs_enabled              = var.gcs ? 1 : 0
    big_query_or_gcs_enabled = var.gcs || var.big_query ? 1 : 0

    gcs_expiration_seconds   = (var.gcs_expiration_days - 1) * 24 * 60 * 60
}

resource "google_project" "gcp_project" {    
    count               = local.big_query_or_gcs_enabled
    name                = local.project_name
    project_id          = local.project_id
    folder_id           = var.folder_id
    billing_account     = var.billing_id
    auto_create_network = false
    labels = {
        "shortcode" = var.shortcode 
    }
    lifecycle {
    ignore_changes = [
      project_id, 
      name,
    ]
  }
}

module "log_export_bq" {
  count                  = local.big_query_enabled
  source                 = "terraform-google-modules/log-export/google"
  version                = "5.1.0"
  destination_uri        = module.destination_bq[0].destination_uri # "${module.destination_bq.destination_uri}"
  filter                 = local.log_filters
  log_sink_name          = "${var.division}-audit-bq"
  parent_resource_id     = var.folder_id
  parent_resource_type   = "folder"
  unique_writer_identity = true
  include_children       = true
}

module "destination_bq" {
  count                    = local.big_query_enabled
  source                   = "terraform-google-modules/log-export/google//modules/bigquery"
  project_id               = google_project.gcp_project[0].project_id
  dataset_name             = replace("${var.division}-audit-${local.short_mcomm}-${random_id.id[0].hex}", "-", "_")
  description              = "Aggregated Log Sink (folder) - ${var.division} Customer Logs"
  log_sink_writer_identity = module.log_export_bq[0].writer_identity # "${module.log_export_bq.writer_identity}"  
  location                 = "US"
  expiration_days          = var.big_query_retention
}

resource "google_bigquery_dataset_iam_binding" "bq_user" {
  count         = local.big_query_enabled
  project       = google_project.gcp_project[0].project_id
  dataset_id    = module.destination_bq[0].resource_name
  role          = "roles/bigquery.user"  
  members       = [
    # "user:kenmoore@umich.edu",
    "group:${var.audit_logs_access}",
    "group:${var.mcomm_group_email}"
  ]
}

# resource "google_bigquery_dataset_iam_binding" "job_user" {
#   project       = google_project.gcp_project.project_id
#   dataset_id    = module.destination_bq.resource_name
#   role          = "roles/bigquery.jobUser"

#   members       = [
#     "user:kenmoore@umich.edu",
#   ]
# }
data "google_service_account_id_token" "customer_db_token" {
    target_audience = var.database_function_url
}

resource "null_resource" "customer_database" {
    triggers = {
        security_contact = local.security_contact
        mcomm_group_email = var.mcomm_group_email
        shortcode = var.shortcode
    }

    provisioner "local-exec" {
        command = "curl ${var.database_function_url} -H \"Authorization: Bearer ${data.google_service_account_id_token.customer_db_token.id_token}\" -H \"Content-Type: application/json\" -d '${jsonencode(local.curl_body)}'"
    }
}


resource "google_project_iam_member" "project_iam" {
    count   = local.big_query_or_gcs_enabled
    project = google_project.gcp_project[0].project_id
    role    = "roles/viewer"
    member  = "group:${var.mcomm_group_email}"
}

# # Create logging config # # - use Google Module to create export to splunk

# module "gcp-at-um-project" {
#     count = var.division == "hipaa" ? 1 : 0
#     source = "/mnt/c/Users/kenmoore/Documents/code/projects/terraform-google-gcp-at-um-project"
#     project_name = "${var.division}-audit-${local.short_mcomm}"
#     # project_id = ""
#     folder_id = google_folder.customer_folder.id # "958858037302" # module.gcp-at-um-customer.google_folder.customer_folder.folder_id # need to get this from the customer module    
#     mcomm_group_email = "gcp.admins@umich.edu" # need a var for auditors for hipaa?
#     billing_id = "010AF9-D1F2C5-DCC86F" # should be from output - billing_account_id
#     security_contact = "mjsager@umich.edu"
#     egress_waiver = true
#     red_hat_byol = false
#     shortcode = "048843"
#     requestor = "kenmoore@umich.edu"      
#     vpn = false    
#     log_export_destination = "pubsub.googleapis.com/projects/gcp-at-um-mon/topics/hipaa-logs-test"
# }

# working on lien on audit project
resource "google_resource_manager_lien" "project_lien" {
    count = local.big_query_or_gcs_enabled
    parent = "projects/${google_project.gcp_project[0].project_id}"
    restrictions = ["resourcemanager.projects.delete"]
    origin = "Prevent deletion of ${google_project.gcp_project[0].project_id}"
    reason = "${google_project.gcp_project[0].project_id} holds the audit logs for ${var.division} customer folder id ${var.folder_id}"
}

resource "random_id" "id" {
    count = local.big_query_or_gcs_enabled
    byte_length = 2
}

resource "google_logging_folder_sink" "customer_logs" {
    count       = local.gcs_enabled
    name        = "${var.division}-audit-${local.short_mcomm}"
    description = "Aggregated Log Sink - ${var.division} - ${local.short_mcomm} Customer Logs"
    folder      = var.folder_id
    
    # include logs from all projects in folder
    include_children = true

    # send to GCS bucket in audit project
    destination = "storage.googleapis.com/${google_storage_bucket.customer_logs[0].name}"
    
    filter = local.log_filters
    lifecycle {
    ignore_changes = [      
      name,
    ]
  }
}

resource "google_storage_bucket" "customer_logs" {
    count                       = local.gcs_enabled
    project                     = google_project.gcp_project[0].project_id
    name                        = "${var.division}-audit-${local.short_mcomm}-${random_id.id[0].hex}"
    location                    = "US-CENTRAL1"    
    force_destroy               = false
    uniform_bucket_level_access = true
    storage_class               = var.gcs_storage_class

    retention_policy {
        retention_period = local.gcs_expiration_seconds # just over 3 years ## <-- needs to be a local
    }
    
    lifecycle_rule {
        action {
          type = "SetStorageClass"
          storage_class = "ARCHIVE"
        }
        condition {
          age = 180
        }
    }

    dynamic "lifecycle_rule" {
        for_each = var.gcs_expiration_days == null ? [] : [ var.gcs_expiration_days ]
        content {
            action {
            type = "Delete"          
            }
            condition {
            age = var.gcs_expiration_days # just over 3 x 365 days = 3 years (slightly more than the retention policy)
            }
        }
    }
    lifecycle {
    ignore_changes = [
      name,
    ]
  }
}

resource "google_project_iam_binding" "customer_log_writer" {
    count   = local.gcs_enabled
    project = google_project.gcp_project[0].project_id
    role    = "roles/storage.objectCreator"

    members = [
      google_logging_folder_sink.customer_logs[0].writer_identity,
    ]
}

# resource "google_logging_project_sink" "log_export" {    
#     count       = local.big_query_or_gcs_enabled
#     project     = google_project.gcp_project.project_id
#     # name = "${google_project.gcp_project.project_id}-log-export"        
#     name        = "log-export-splunk"
#     destination = local.log_export_destination[var.environment][var.division]    
#     filter      = local.filter_string # if adding filter to match nothing; use in conjunction with aggregated log sink + exclusion filter    
#     exclusions {
#         name        = "Aggregated_Logs_Exclusion"
#         description = "Excluding logs already captured by aggregated log sink (at folder). Please DO NOT alter/remove."
#         filter      = local.log_filters
#     }
#     unique_writer_identity = true    
# }


# resource "google_pubsub_topic_iam_member" "publisher" {
#     count       = local.big_query_or_gcs_enabled
#     project     = local.log_export_project
#     topic       = local.log_export_destination[var.environment][var.division] 
#     role        = "roles/pubsub.publisher"
#     member      = google_logging_project_sink.log_export.writer_identity      
# }