_variable.tf

variable "internal" {
  type        = bool
  description = "Flag to determine if the several AWS resources are public (intended for external access, public internet) or private (only intended to be accessed within your AWS VPC or avaiable with other means, a transit gateway for example)."
  default     = true
}

variable "alb_idle_timeout" {
  type        = number
  description = "The idle timeout value in seconds for the Application Load Balancer (ALB)"
  default     = 900
}

variable "alb_listener_ssl_policy" {
  type        = string
  description = "SSL policy to use for the listener. This policy determines how SSL/TLS connections are handled."
  default     = "ELBSecurityPolicy-TLS13-1-2-2021-06"
}

variable "appmesh_name" {
  type        = string
  description = "Name of the AWS App Mesh"
  default     = ""
}

variable "cloudmap_namespace_name" {
  type        = string
  description = "Name of the AWS Cloud Map namespace"
  default     = ""
}

variable "cw_retention_in_days" {
  type        = number
  description = "Retention period in days for CloudWatch logs"
  default     = 365
}

variable "ecs_alb_name" {
  description = "Name of the Application Load Balancer (ALB)"
  type        = string
  default     = ""
}

variable "ecs_alb_tg_name" {
  description = "Name of the ALB Target Group"
  type        = string
  default     = ""
}

variable "ecs_cluster_name" {
  type        = string
  description = "Name of the ECS Cluster"
  default     = ""
}

variable "ecs_cloudwatch_group" {
  type        = string
  description = "Name of the AWS CloudWatch Log Group for ECS"
  default     = ""
}

variable "ecs_task_execution_role_name" {
  type        = string
  description = "Name of the ECS Task Execution Role"
  default     = ""
}

variable "ecs_task_role_name" {
  type        = string
  description = "Name of the ECS Task Role"
  default     = ""
}

variable "enable_autoscaling" {
  type        = bool
  description = "Flag to enable autoscaling for the ECS services"
  default     = true
}

variable "enable_alb_logs" {
  type        = bool
  description = "Flag to enable ALB access and connection logging to s3 logging bucket"
  default     = true
}

variable "enable_alb_deletion_protection" {
  type        = bool
  description = "Flag to enable ALB deletion protection"
  default     = true
}

variable "private_subnet_ids" {
  type        = list(string)
  description = "List of private subnet IDs"
}

variable "public_subnet_ids" {
  type        = list(string)
  description = "List of public subnet IDs"
}

variable "region" {
  type        = string
  description = "The AWS region where resources are created"
}

variable "s3_viewer_bucket_name" {
  type        = string
  description = "Name of the S3 bucket for the viewer"
  default     = ""
}

variable "s3_viewer_bucket_role_name" {
  type        = string
  description = "Name of the IAM role for the ecr-viewer bucket"
  default     = ""
}

variable "s3_logging_bucket_name" {
  type        = string
  description = "Name of the S3 bucket for logging"
  default     = ""
}
variable "phdi_version" {
  type        = string
  description = "Version of the PHDI application"
  default     = "v2.0.0-beta"
}

variable "service_data" {
  type = map(object({
    short_name        = string
    app_repo          = string
    app_image         = string
    app_version       = string
    container_port    = number
    host_port         = number
    public            = bool
    registry_url      = string
    root_service      = bool
    listener_priority = number
    env_vars = list(object({
      name  = string
      value = string
    }))
  }))
  description = "Data for the DIBBS services"
  default     = {}
}

variable "ecr_viewer_bucket_lifecycle_configuration" {
  type = list(object({
    status                             = string
    prefix                             = string
    abort_incomplete_upload_after_days = number
    expiration_days                    = number
    transitions = list(object({
      days          = number
      storage_class = string
    }))
  }))
  description = "S3 lifecycle rules"
  default = [{
    status                             = "Enabled"
    prefix                             = "/"
    abort_incomplete_upload_after_days = 3
    expiration_days                    = 365
    transitions = [
      {
        days          = 0
        storage_class = "INTELLIGENT_TIERING"
      }
    ]
  }]
}

variable "logging_bucket_lifecycle_configuration" {
  type = list(object({
    status                             = string
    prefix                             = string
    abort_incomplete_upload_after_days = number
    expiration_days                    = number
    transitions = list(object({
      days          = number
      storage_class = string
    }))
  }))
  description = "S3 lifecycle rules"
  default = [{
    status                             = "Enabled"
    prefix                             = "/"
    abort_incomplete_upload_after_days = 3
    expiration_days                    = 365
    transitions = [
      {
        days          = 0
        storage_class = "INTELLIGENT_TIERING"
      }
    ]
  }]
}


variable "override_autoscaling" {
  type = map(object({
    cpu           = number
    memory        = number
    min_capacity  = number
    max_capacity  = number
    target_cpu    = number
    target_memory = number
  }))
  description = "Autoscaling configuration for the DIBBS services"
  default     = {}
}

variable "secrets_manager_connection_string_version" {
  type      = string
  default   = ""
  sensitive = true
}

variable "secrets_manager_sqlserver_user_version" {
  type      = string
  default   = ""
  sensitive = true
}

variable "secrets_manager_sqlserver_password_version" {
  type      = string
  default   = ""
  sensitive = true
}

variable "secrets_manager_sqlserver_host_version" {
  type      = string
  default   = ""
  sensitive = true
}

variable "secrets_manager_metadata_database_migration_secret_version" {
  type      = string
  default   = ""
  sensitive = true
}

variable "auth_provider" {
  type        = string
  default     = ""
  description = "The authentication provider used. Either keycloak or ad."
}

variable "auth_client_id" {
  type        = string
  default     = ""
  description = "The application/client id used to idenitfy the client"
}

variable "auth_issuer" {
  type        = string
  default     = ""
  description = "Additional information used during authentication process. For Azure AD, this will be the 'Tenant Id'. For Keycloak, this will be the url issuer including the realm - e.g. https://my-keycloak-domain.com/realms/My_Realm"
}

variable "auth_url" {
  type        = string
  default     = ""
  description = "Optional. The full URL of the auth api. By default https://your-site.com/ecr-viewer/api/auth."
}

variable "auth_session_duration_min" {
  type        = string
  default     = ""
  description = "Duration in minutes before auto signout, defaults to 30 if not set"
}

variable "secrets_manager_auth_secret_version" {
  type        = string
  default     = ""
  description = "The secret containing the auth secret. This is used by eCR viewer to encrypt authentication. This can be generated by running `openssl rand -base64 32`."
  sensitive   = true
}

variable "secrets_manager_auth_client_secret_version" {
  type        = string
  default     = ""
  description = "The secret containing the auth client secret. This is the secret that comes from the authentication provider."
  sensitive   = true
}

variable "certificate_arn" {
  type        = string
  description = "ARN of the SSL certificate that enables ssl termination on the ALB"
  default     = ""
}

variable "vpc_id" {
  type        = string
  description = "ID of the VPC"
}

variable "owner" {
  type        = string
  description = "Owner of the resources"
  default     = "CDC"
}

variable "project" {
  type        = string
  description = "The project name"
  default     = "dibbs"
}

variable "disable_ecr" {
  type        = bool
  description = "Flag to disable the aws ecr service for docker image storage, defaults to false"
  default     = false
}

variable "enable_enhanced_ecr_registry_scanning" {
  type        = bool
  description = "Flag to enable enhanced ecr registry scanning, defaults to false"
  default     = false
}
variable "tags" {
  type        = map(string)
  description = "Tags to apply to resources"
  default     = {}
}

variable "ecr_viewer_auth_pub_key" {
  type        = string
  description = "The public key used to validate the incoming authenication for the eCR Viewer."
  default     = ""
}

variable "ecr_viewer_auth_api_pub_key" {
  type        = string
  description = "The public key used to validate the incoming authenication for the eCR Viewer API."
  default     = ""
}

variable "dibbs_config_name" {
  type        = string
  description = "Name of the DIBBS configuration"
  default     = ""
}

variable "dibbs_repo" {
  type        = string
  description = "Name of the DIBBS repository"
  default     = "ghcr.io/cdcgov/dibbs-ecr-viewer"
}

variable "db_cipher" {
  type        = string
  description = "The cipher to use for the sql server database connection"
  default     = ""
}

variable "ecr_viewer_object_retention_days" {
  type        = number
  description = "Number of days to retain S3 ecr viewer objects in compliance mode"
  default     = 365
}

variable "logging_object_retention_days" {
  type        = number
  description = "Number of days to retain S3 logging objects in compliance mode"
  default     = 365
}

variable "ecr_viewer_object_mode" {
  type        = string
  description = "Mode to set the S3 ecr viewer objects to"
  default     = "GOVERNANCE"
}

variable "logging_object_mode" {
  type        = string
  description = "Mode to set the S3 logging objects to"
  default     = "GOVERNANCE"
}

variable "ecr_processing_timeout" {
  type        = string
  description = "Set processing timeout length in ms,if not set defaults to 900000ms (15min)"
  default     = "900000"
}

variable "waf_web_acl_arn" {
  type        = string
  description = "Existing WAF Web ACL ID to associate with ALB. If empty, a new ACL will be created."
  default     = ""
}

variable "waf_enable_cloudwatch_metrics" {
  type        = bool
  description = "Flag to enable CloudWatch metrics for WAF. Set to false to disable compliance."
  default     = true
}

variable "waf_enable_sampled_requests" {
  type        = bool
  description = "Flag to enable sampled requests for WAF. Set to false to disable compliance."
  default     = true
}

variable "waf_rules" {
  type = list(any)
  default = [
    {
      name        = "AWSManagedRulesCommonRuleSet"
      vendor_name = "AWS"
      priority    = 1
      allow       = []
      block = [
        "NoUserAgent_HEADER",
        "UserAgent_BadBots_HEADER",
        "SizeRestrictions_QUERYSTRING",
        "SizeRestrictions_Cookie_HEADER",
        "SizeRestrictions_URIPATH",
        "EC2MetaDataSSRF_BODY",
        "EC2MetaDataSSRF_COOKIE",
        "EC2MetaDataSSRF_URIPATH",
        "EC2MetaDataSSRF_QUERYARGUMENTS",
        "GenericLFI_QUERYARGUMENTS",
        "GenericLFI_URIPATH",
        "RestrictedExtensions_URIPATH",
        "RestrictedExtensions_QUERYARGUMENTS",
        "GenericRFI_QUERYARGUMENTS",
        "GenericRFI_BODY",
        "GenericRFI_URIPATH",
        "CrossSiteScripting_BODY",
        "CrossSiteScripting_COOKIE",
        "CrossSiteScripting_QUERYARGUMENTS",
        "CrossSiteScripting_URIPATH",
      ]
      captcha   = []
      challenge = []
      count = [
        "SizeRestrictions_BODY",
        "GenericLFI_BODY",
      ]
      }, {
      name        = "AWSManagedRulesLinuxRuleSet"
      vendor_name = "AWS"
      priority    = 2
      allow       = []
      block = [
        "LFI_URIPATH",
        "LFI_QUERYSTRING",
        "LFI_HEADER"
      ]
      captcha   = []
      challenge = []
      count     = []
      }, {
      name        = "AWSManagedRulesUnixRuleSet"
      vendor_name = "AWS"
      priority    = 3
      allow       = []
      block = [
        "UNIXShellCommandsVariables_QUERYARGUMENTS",
        "UNIXShellCommandsVariables_BODY",
      ]
      captcha   = []
      challenge = []
      count     = []
      }, {
      name        = "AWSManagedRulesSQLiRuleSet"
      vendor_name = "AWS"
      priority    = 4
      allow       = []
      block = [
        "SQLi_QUERYARGUMENTS",
        "SQLiExtendedPatterns_QUERYARGUMENTS",
        "SQLi_BODY",
        "SQLiExtendedPatterns_BODY",
        "SQLi_COOKIE",
      ]
      captcha   = []
      challenge = []
      count     = []
      }, {
      name        = "AWSManagedRulesKnownBadInputsRuleSet"
      vendor_name = "AWS"
      priority    = 5
      allow       = []
      block = [
        "JavaDeserializationRCE_HEADER",
        "JavaDeserializationRCE_BODY",
        "JavaDeserializationRCE_URIPATH",
        "JavaDeserializationRCE_QUERYSTRING",
        "Host_localhost_HEADER",
        "PROPFIND_METHOD",
        "ExploitablePaths_URIPATH",
        "Log4JRCE_HEADER",
        "Log4JRCE_QUERYSTRING",
        "Log4JRCE_BODY",
        "Log4JRCE_URIPATH",
      ]
      captcha   = []
      challenge = []
      count     = []
      }, {
      name        = "AWSManagedRulesBotControlRuleSet"
      vendor_name = "AWS"
      priority    = 6
      allow       = []
      block = [
        "SignalAutomatedBrowser",
        "CategoryAdvertising",
        "CategoryArchiver",
        "CategoryContentFetcher",
        "CategoryEmailClient",
        "CategoryLinkChecker",
        "CategoryMiscellaneous",
        "CategoryMonitoring",
        "CategoryScrapingFramework",
        "CategorySearchEngine",
        "CategorySecurity",
        "CategorySeo",
        "CategorySocialMedia",
        "CategoryAI",
        "SignalKnownBotDataCenter"
      ]
      captcha   = []
      challenge = []
      count = [
        "SignalNonBrowserUserAgent",
        "CategoryHttpLibrary",
      ]
    }
  ]
}

variable "block_ip_set" {
  default     = []
  type        = list(string)
  description = "List of IP to block"
}

variable "enable_ecr_viewer_sns_topic" {
  type        = bool
  description = "Enable ECR Viewer bucket SNS topic"
  default     = true
}

variable "ecr_viewer_bucket_sns_topic_events" {
  type        = list(any)
  default     = ["s3:ObjectCreated:CompleteMultipartUpload"]
  description = "List of events that trigger the SNS ecr viewer topic"
}

variable "enable_logging_sns_topic" {
  type        = bool
  description = "Enable logging bucket SNS topic"
  default     = true
}

variable "logging_bucket_sns_topic_events" {
  type        = list(any)
  default     = ["s3:ObjectCreated:CompleteMultipartUpload"]
  description = "List of events that trigger the SNS logging topic"
}