// CDK: per-function execution role with minimal permissions
import { Function, Runtime, Code } from 'aws-cdk-lib/aws-lambda'
import { Role, ServicePrincipal, PolicyStatement, Effect } from 'aws-cdk-lib/aws-iam'
import { Table } from 'aws-cdk-lib/aws-dynamodb'
import { Queue } from 'aws-cdk-lib/aws-sqs'

const orderTable = Table.fromTableName(this, 'OrderTable', 'Orders')
const orderQueue = Queue.fromQueueArn(this, 'OrderQueue', orderQueueArn)

// ❌ Shared role: every function gets DynamoDB full access on all tables
const sharedRole = new Role(this, 'SharedLambdaRole', {
  assumedBy: new ServicePrincipal('lambda.amazonaws.com'),
})
sharedRole.addToPolicy(new PolicyStatement({
  effect: Effect.ALLOW,
  actions: ['dynamodb:*'], // WAY too broad
  resources: ['*'],        // All tables in the account
}))

// ✅ Per-function role: OrderProcessor can ONLY GetItem/PutItem on the Orders table
const orderProcessorRole = new Role(this, 'OrderProcessorRole', {
  assumedBy: new ServicePrincipal('lambda.amazonaws.com'),
  managedPolicies: [
    ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole')
  ]
})

orderProcessorRole.addToPolicy(new PolicyStatement({
  effect: Effect.ALLOW,
  actions: [
    'dynamodb:GetItem',
    'dynamodb:PutItem',
    'dynamodb:UpdateItem',
    // NOT: DeleteItem, Scan, Query, BatchWrite, CreateTable, DeleteTable
  ],
  resources: [
    orderTable.tableArn,              // Only the Orders table
    `${orderTable.tableArn}/index/*`, // Include GSIs if Query is needed on them
  ]
}))

orderProcessorRole.addToPolicy(new PolicyStatement({
  effect: Effect.ALLOW,
  actions: ['sqs:ReceiveMessage', 'sqs:DeleteMessage', 'sqs:GetQueueAttributes'],
  resources: [orderQueue.queueArn],   // Only the Order queue
}))

const orderProcessorFn = new Function(this, 'OrderProcessor', {
  runtime: Runtime.NODEJS_20_X,
  handler: 'handler.main',
  code: Code.fromAsset('dist/order-processor'),
  role: orderProcessorRole, // Dedicated role, not shared
})

// Condition key: restrict DynamoDB access to specific table partition key prefixes
// Prevents an order-processing Lambda from reading user profile data
orderProcessorRole.addToPolicy(new PolicyStatement({
  effect: Effect.ALLOW,
  actions: ['dynamodb:GetItem', 'dynamodb:PutItem'],
  resources: [orderTable.tableArn],
  conditions: {
    'ForAllValues:StringLike': {
      'dynamodb:LeadingKeys': ['ORDER#*'], // Only partition keys starting with ORDER#
    }
  }
}))

// Condition key: restrict S3 operations to a specific prefix
processingRole.addToPolicy(new PolicyStatement({
  effect: Effect.ALLOW,
  actions: ['s3:GetObject'],
  resources: [`${bucket.bucketArn}/invoices/*`], // Only the invoices/ prefix
}))

// Condition key: allow Secrets Manager access only from VPC (prevents exfiltration from outside VPC)
secretsRole.addToPolicy(new PolicyStatement({
  effect: Effect.ALLOW,
  actions: ['secretsmanager:GetSecretValue'],
  resources: [secret.secretArn],
  conditions: {
    StringEquals: {
      'aws:SourceVpc': vpcId, // Only from within the VPC
    }
  }
}))

// CDK: Lambda inside VPC for RDS access
import { Function } from 'aws-cdk-lib/aws-lambda'
import { Vpc, SubnetType, SecurityGroup } from 'aws-cdk-lib/aws-ec2'

const vpc = Vpc.fromLookup(this, 'Vpc', { vpcId: 'vpc-abc123' })

const lambdaSg = new SecurityGroup(this, 'LambdaSG', { vpc, allowAllOutbound: false })

const dbFn = new Function(this, 'DbFunction', {
  runtime: Runtime.NODEJS_20_X,
  handler: 'handler.main',
  code: Code.fromAsset('dist'),
  vpc,
  vpcSubnets: { subnetType: SubnetType.PRIVATE_WITH_EGRESS }, // Private subnets
  securityGroups: [lambdaSg],
})

// Allow Lambda SG to connect to RDS SG on port 5432
lambdaSg.addEgressRule(rdsSg, Port.tcp(5432))
rdsSg.addIngressRule(lambdaSg, Port.tcp(5432))

// CDK: Gateway VPC Endpoints for DynamoDB and S3 (free — no per-GB charge)
import { GatewayVpcEndpoint, GatewayVpcEndpointAwsService } from 'aws-cdk-lib/aws-ec2'

// Gateway Endpoints: no hourly cost, no data processing cost
new GatewayVpcEndpoint(this, 'DynamoDBEndpoint', {
  vpc,
  service: GatewayVpcEndpointAwsService.DYNAMODB,
  // Adds route table entries — DynamoDB traffic stays on AWS backbone
})

new GatewayVpcEndpoint(this, 'S3Endpoint', {
  vpc,
  service: GatewayVpcEndpointAwsService.S3,
})

// Interface Endpoints: $0.01/hr per AZ + no per-GB data charge
import { InterfaceVpcEndpoint, InterfaceVpcEndpointAwsService } from 'aws-cdk-lib/aws-ec2'

new InterfaceVpcEndpoint(this, 'SecretsManagerEndpoint', {
  vpc,
  service: InterfaceVpcEndpointAwsService.SECRETS_MANAGER,
  privateDnsEnabled: true, // Lambda calls secretsmanager.us-east-1.amazonaws.com → routes to VPC endpoint
  subnets: { subnetType: SubnetType.PRIVATE_WITH_EGRESS },
})

Workload: Lambda in VPC making 1M DynamoDB calls/day with avg 10KB response = 10 GB/day = 300 GB/month

NAT Gateway cost:
  Data processing: 300 GB × $0.045 = $13.50/month
  NAT GW hourly: ~$32.40/month (2 AZs × $0.045/hr × 720 hrs)
  Total: ~$45.90/month

Gateway VPC Endpoint cost:
  $0 (no hourly, no data processing charge)
  Monthly savings: $45.90

Payback period: immediate — Gateway Endpoints are always free

// ❌ Secrets in environment variables
const fn = new Function(this, 'Fn', {
  environment: {
    DB_PASSWORD: 'my-plaintext-password', // Visible in console, in CloudTrail, in logs
    STRIPE_KEY: 'sk_live_xxx',            // Rotated = redeploy required
    JWT_SECRET: 'my-jwt-secret',          // Blast radius: any function with env access reads this
  }
})

// CDK: Add AWS Parameters and Secrets Lambda Extension
import { LayerVersion } from 'aws-cdk-lib/aws-lambda'

// The extension is provided as a managed Lambda Layer — region-specific ARNs
const secretsExtensionLayer = LayerVersion.fromLayerVersionArn(
  this,
  'SecretsExtension',
  'arn:aws:lambda:us-east-1:177933569100:layer:AWS-Parameters-and-Secrets-Lambda-Extension:11'
)

const fn = new Function(this, 'Fn', {
  layers: [secretsExtensionLayer],
  environment: {
    PARAMETERS_SECRETS_EXTENSION_CACHE_ENABLED: 'true',
    PARAMETERS_SECRETS_EXTENSION_CACHE_SIZE: '1000',
    // Note: The secret VALUE is not in environment variables
    // Only the secret NAME is (not sensitive)
    SECRET_ARN: secret.secretArn,
  }
})

// Grant permission to read the specific secret only
secret.grantRead(fn)

// Handler: fetch secret from local extension cache (no network call to Secrets Manager)
async function getDatabasePassword(): Promise<string> {
  const secretArn = process.env.SECRET_ARN!
  const port = process.env.PARAMETERS_SECRETS_EXTENSION_HTTP_PORT ?? '2773'
  const token = process.env.AWS_SESSION_TOKEN!

  const response = await fetch(
    `http://localhost:${port}/secretsmanager/get?secretId=${encodeURIComponent(secretArn)}`,
    { headers: { 'X-Aws-Parameters-Secrets-Token': token } }
  )
  const { SecretString } = await response.json() as { SecretString: string }
  return JSON.parse(SecretString).password
}

// CDK: enable automatic rotation with a rotation Lambda
import { Secret } from 'aws-cdk-lib/aws-secretsmanager'
import { HostedRotation } from 'aws-cdk-lib/aws-secretsmanager'

const dbPassword = new Secret(this, 'DBPassword', {
  generateSecretString: {
    secretStringTemplate: JSON.stringify({ username: 'app_user' }),
    generateStringKey: 'password',
    excludeCharacters: '"@/',
  }
})

// Automatic rotation every 30 days
dbPassword.addRotationSchedule('RotationSchedule', {
  hostedRotation: HostedRotation.mysqlSingleUser({ vpc }),
  automaticallyAfter: Duration.days(30),
})