provider "aws" {
  alias  = "tokyo"
  region = "ap-northeast-1"
}

provider "aws" {
  alias  = "osaka"
  region = "ap-northeast-3"
}

# 共通設定
locals {
  tokyo = {
    region_code = "ap-northeast-1"
    az          = "ap-northeast-1a"
    vpc_cidr    = "10.0.0.0/16"
    subnet_cidr = "10.0.1.0/24"
    name_prefix = "Tokyo"
  }

  osaka = {
    region_code = "ap-northeast-3"
    az          = "ap-northeast-3a"
    vpc_cidr    = "10.1.0.0/16"
    subnet_cidr = "10.1.1.0/24"
    name_prefix = "Osaka"
  }
}

# Amazon Linux 2023 AMI - 東京
data "aws_ami" "tokyo_amazonlinux_2023" {
  provider    = aws.tokyo
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["al2023-ami-2023*-kernel-6.1-x86_64"]
  }
}

# Amazon Linux 2023 AMI - 大阪
data "aws_ami" "osaka_amazonlinux_2023" {
  provider    = aws.osaka
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["al2023-ami-2023*-kernel-6.1-x86_64"]
  }
}

# VPC - 東京
resource "aws_vpc" "tokyo_vpc" {
  provider   = aws.tokyo
  cidr_block = local.tokyo.vpc_cidr

  tags = {
    Name = "${local.tokyo.name_prefix}-VPC"
  }
}

# VPC - 大阪
resource "aws_vpc" "osaka_vpc" {
  provider   = aws.osaka
  cidr_block = local.osaka.vpc_cidr

  tags = {
    Name = "${local.osaka.name_prefix}-VPC"
  }
}

# パブリックサブネット - 東京
resource "aws_subnet" "tokyo_public" {
  provider                = aws.tokyo
  vpc_id                  = aws_vpc.tokyo_vpc.id
  cidr_block              = local.tokyo.subnet_cidr
  availability_zone       = local.tokyo.az
  map_public_ip_on_launch = true

  tags = {
    Name = "${local.tokyo.name_prefix}-Public-Subnet"
  }
}

# パブリックサブネット - 大阪
resource "aws_subnet" "osaka_public" {
  provider                = aws.osaka
  vpc_id                  = aws_vpc.osaka_vpc.id
  cidr_block              = local.osaka.subnet_cidr
  availability_zone       = local.osaka.az
  map_public_ip_on_launch = true

  tags = {
    Name = "${local.osaka.name_prefix}-Public-Subnet"
  }
}

# インターネットゲートウェイ - 東京
resource "aws_internet_gateway" "tokyo_igw" {
  provider = aws.tokyo
  vpc_id   = aws_vpc.tokyo_vpc.id

  tags = {
    Name = "${local.tokyo.name_prefix}-IGW"
  }
}

# インターネットゲートウェイ - 大阪
resource "aws_internet_gateway" "osaka_igw" {
  provider = aws.osaka
  vpc_id   = aws_vpc.osaka_vpc.id

  tags = {
    Name = "${local.osaka.name_prefix}-IGW"
  }
}

# VPCピアリング接続（東京から大阪へ）
resource "aws_vpc_peering_connection" "tokyo_osaka" {
  provider    = aws.tokyo
  vpc_id      = aws_vpc.tokyo_vpc.id
  peer_vpc_id = aws_vpc.osaka_vpc.id
  peer_region = local.osaka.region_code
  auto_accept = false

  tags = {
    Name = "Tokyo-Osaka-Peering"
  }
}

# VPCピアリング接続の承認（大阪側）
resource "aws_vpc_peering_connection_accepter" "osaka_accepter" {
  provider                  = aws.osaka
  vpc_peering_connection_id = aws_vpc_peering_connection.tokyo_osaka.id
  auto_accept               = true

  tags = {
    Name = "Osaka-Tokyo-Peering-Accepter"
  }
}

# ルートテーブル - 東京
resource "aws_route_table" "tokyo_rt" {
  provider = aws.tokyo
  vpc_id   = aws_vpc.tokyo_vpc.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.tokyo_igw.id
  }

  route {
    cidr_block                = local.osaka.vpc_cidr
    vpc_peering_connection_id = aws_vpc_peering_connection.tokyo_osaka.id
  }

  tags = {
    Name = "${local.tokyo.name_prefix}-Route-Table"
  }
}

# ルートテーブル - 大阪
resource "aws_route_table" "osaka_rt" {
  provider = aws.osaka
  vpc_id   = aws_vpc.osaka_vpc.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.osaka_igw.id
  }

  route {
    cidr_block                = local.tokyo.vpc_cidr
    vpc_peering_connection_id = aws_vpc_peering_connection.tokyo_osaka.id
  }

  tags = {
    Name = "${local.osaka.name_prefix}-Route-Table"
  }
}

# ルートテーブルの関連付け - 東京
resource "aws_route_table_association" "tokyo_rta" {
  provider       = aws.tokyo
  subnet_id      = aws_subnet.tokyo_public.id
  route_table_id = aws_route_table.tokyo_rt.id
}

# ルートテーブルの関連付け - 大阪
resource "aws_route_table_association" "osaka_rta" {
  provider       = aws.osaka
  subnet_id      = aws_subnet.osaka_public.id
  route_table_id = aws_route_table.osaka_rt.id
}

# SSMのためのIAMロール
resource "aws_iam_role" "ssm_role" {
  name = "SSMRoleForEC2"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      }
    ]
  })
}

# SSMポリシーのアタッチ
resource "aws_iam_role_policy_attachment" "ssm_attach" {
  role       = aws_iam_role.ssm_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

# EC2用のインスタンスプロファイル
resource "aws_iam_instance_profile" "ec2_profile" {
  name = "EC2InstanceProfile"
  role = aws_iam_role.ssm_role.name
}

# セキュリティグループ - 東京
resource "aws_security_group" "tokyo_sg" {
  provider    = aws.tokyo
  name        = "tokyo-sg"
  description = "Allow traffic for Tokyo EC2"
  vpc_id      = aws_vpc.tokyo_vpc.id

  tags = {
    Name = "${local.tokyo.name_prefix}-SG"
  }
}

# セキュリティグループ - 大阪
resource "aws_security_group" "osaka_sg" {
  provider    = aws.osaka
  name        = "osaka-sg"
  description = "Allow traffic for Osaka EC2"
  vpc_id      = aws_vpc.osaka_vpc.id

  tags = {
    Name = "${local.osaka.name_prefix}-SG"
  }
}

# 東京SG - VPC内通信許可ルール（東京VPC）
resource "aws_security_group_rule" "tokyo_sg_ingress_tokyo_vpc" {
  provider          = aws.tokyo
  security_group_id = aws_security_group.tokyo_sg.id
  type              = "ingress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = [local.tokyo.vpc_cidr]
  description       = "Allow all traffic from Tokyo VPC"
}

# 東京SG - VPC内通信許可ルール（大阪VPC）
resource "aws_security_group_rule" "tokyo_sg_ingress_osaka_vpc" {
  provider          = aws.tokyo
  security_group_id = aws_security_group.tokyo_sg.id
  type              = "ingress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = [local.osaka.vpc_cidr]
}

# 東京SG - 送信トラフィック許可ルール
resource "aws_security_group_rule" "tokyo_sg_egress" {
  provider          = aws.tokyo
  security_group_id = aws_security_group.tokyo_sg.id
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
}

# 大阪SG - VPC内通信許可ルール（大阪VPC）
resource "aws_security_group_rule" "osaka_sg_ingress_osaka_vpc" {
  provider          = aws.osaka
  security_group_id = aws_security_group.osaka_sg.id
  type              = "ingress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = [local.osaka.vpc_cidr]
}

# 大阪SG - VPC内通信許可ルール（東京VPC）
resource "aws_security_group_rule" "osaka_sg_ingress_tokyo_vpc" {
  provider          = aws.osaka
  security_group_id = aws_security_group.osaka_sg.id
  type              = "ingress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = [local.tokyo.vpc_cidr]
}

# 大阪SG - 送信トラフィック許可ルール
resource "aws_security_group_rule" "osaka_sg_egress" {
  provider          = aws.osaka
  security_group_id = aws_security_group.osaka_sg.id
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
}

# EC2インスタンス - 東京
resource "aws_instance" "tokyo_ec2" {
  provider               = aws.tokyo
  ami                    = data.aws_ami.tokyo_amazonlinux_2023.id
  instance_type          = "m6i.large"
  subnet_id              = aws_subnet.tokyo_public.id
  vpc_security_group_ids = [aws_security_group.tokyo_sg.id]
  iam_instance_profile   = aws_iam_instance_profile.ec2_profile.name

  user_data = <<-EOF
                #!/bin/bash
                sudo dnf install -y iperf3
                EOF

  tags = {
    Name = "${local.tokyo.name_prefix}-EC2"
  }
}

# EC2インスタンス - 大阪
resource "aws_instance" "osaka_ec2" {
  provider               = aws.osaka
  ami                    = data.aws_ami.osaka_amazonlinux_2023.id
  instance_type          = "m6i.large"
  subnet_id              = aws_subnet.osaka_public.id
  vpc_security_group_ids = [aws_security_group.osaka_sg.id]
  iam_instance_profile   = aws_iam_instance_profile.ec2_profile.name

  user_data = <<-EOF
                #!/bin/bash
                sudo dnf install -y iperf3
                EOF

  tags = {
    Name = "${local.osaka.name_prefix}-EC2"
  }
}

# EC2のパブリックIPを取得 - 東京
data "aws_instance" "tokyo_ec2_info" {
  provider    = aws.tokyo
  instance_id = aws_instance.tokyo_ec2.id

  depends_on = [aws_instance.tokyo_ec2]
}

# EC2のパブリックIPを取得 - 大阪
data "aws_instance" "osaka_ec2_info" {
  provider    = aws.osaka
  instance_id = aws_instance.osaka_ec2.id

  depends_on = [aws_instance.osaka_ec2]
}

# セキュリティグループルール追加 - 東京（大阪EC2からのアクセス許可）
resource "aws_security_group_rule" "tokyo_from_osaka" {
  provider          = aws.tokyo
  type              = "ingress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["${data.aws_instance.osaka_ec2_info.public_ip}/32"]
  security_group_id = aws_security_group.tokyo_sg.id

  depends_on = [aws_instance.osaka_ec2, data.aws_instance.osaka_ec2_info]
}

# セキュリティグループルール追加 - 大阪（東京EC2からのアクセス許可）
resource "aws_security_group_rule" "osaka_from_tokyo" {
  provider          = aws.osaka
  type              = "ingress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["${data.aws_instance.tokyo_ec2_info.public_ip}/32"]
  security_group_id = aws_security_group.osaka_sg.id

  depends_on = [aws_instance.tokyo_ec2, data.aws_instance.tokyo_ec2_info]
}

# インスタンス SSM接続コマンド
output "ssm_start_session" {
  value = {
    tokyo = "aws ssm start-session --target ${aws_instance.tokyo_ec2.id} --region ${local.tokyo.region_code}"
    osaka = "aws ssm start-session --target ${aws_instance.osaka_ec2.id} --region ${local.osaka.region_code}"
  }
}

# インスタンス IPアドレス
output "instance_ip" {
  value = {
    tokyo = {
      local  = aws_instance.tokyo_ec2.private_ip
      global = aws_instance.tokyo_ec2.public_ip
    }
    osaka = {
      local  = aws_instance.osaka_ec2.private_ip
      global = aws_instance.osaka_ec2.public_ip
    }
  }
}