# -----------------------------------------------------------------------------
# Backup Vault - 本番用
# -----------------------------------------------------------------------------
resource "aws_backup_vault" "prod" {
  name = "example-prod-backup-vault"

  tags = {
    Name = "example-prod-backup-vault"
  }
}

# Vault Lock - ガバナンスモード
# changeable_for_days 未指定でガバナンスモード（ロック解除・変更可能）
resource "aws_backup_vault_lock_configuration" "prod" {
  backup_vault_name  = aws_backup_vault.prod.name
  min_retention_days = 15
}

# -----------------------------------------------------------------------------
# AWS Backup 実行ロール
# -----------------------------------------------------------------------------
data "aws_iam_policy_document" "backup_assume_role" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["backup.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "backup" {
  name               = "example-backup-role"
  assume_role_policy = data.aws_iam_policy_document.backup_assume_role.json
}

resource "aws_iam_role_policy_attachment" "backup_service" {
  role       = aws_iam_role.backup.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
}

# -----------------------------------------------------------------------------
# Step Functions 実行ロール
# -----------------------------------------------------------------------------
data "aws_iam_policy_document" "sfn_inline" {
  # EC2の停止・起動・状態確認
  statement {
    effect = "Allow"
    actions = [
      "ec2:StopInstances",
      "ec2:StartInstances",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceStatus",
    ]
    resources = ["*"]
  }

  # AWS Backupの起動・状態確認
  statement {
    effect = "Allow"
    actions = [
      "backup:StartBackupJob",
      "backup:DescribeBackupJob",
    ]
    resources = ["*"]
  }

  # AWS Backupの実行ロールを渡す権限
  statement {
    effect    = "Allow"
    actions   = ["iam:PassRole"]
    resources = [aws_iam_role.backup.arn]
  }

  # CloudWatch Logs / X-Ray（ログ出力・トレース用）
  statement {
    effect = "Allow"
    actions = [
      "logs:CreateLogDelivery",
      "logs:GetLogDelivery",
      "logs:UpdateLogDelivery",
      "logs:DeleteLogDelivery",
      "logs:ListLogDeliveries",
      "logs:PutResourcePolicy",
      "logs:DescribeResourcePolicies",
      "logs:DescribeLogGroups",
    ]
    resources = ["*"]
  }

  statement {
    effect = "Allow"
    actions = [
      "xray:PutTraceSegments",
      "xray:PutTelemetryRecords",
      "xray:GetSamplingRules",
      "xray:GetSamplingTargets",
    ]
    resources = ["*"]
  }
}

resource "aws_sfn_state_machine" "stop_backup_start" {
  name     = "example-stop-backup-start-sfn"
  role_arn = aws_iam_role.sfn.arn
  type     = "STANDARD"

  logging_configuration {
    log_destination        = "${aws_cloudwatch_log_group.sfn_stop_backup_start.arn}:*"
    include_execution_data = true
    level                  = "ALL"
  }

  tracing_configuration {
    enabled = true
  }

  definition = jsonencode({
    Comment = "EC2を停止してから静止点でAWS Backupを取得し、完了後に起動する"
    StartAt = "LookupInstanceId"
    States = {
      # Nameタグからインスタンスを1台に特定する
      LookupInstanceId = {
        Type     = "Task"
        Resource = "arn:aws:states:::aws-sdk:ec2:describeInstances"
        Parameters = {
          Filters = [
            {
              Name        = "tag:Name"
              "Values.$"  = "States.Array($.instance_name)"
            },
            {
              Name   = "instance-state-name"
              Values = ["pending", "running", "stopping", "stopped"]
            }
          ]
        }
        ResultSelector = {
          "instance_ids.$" = "$.Reservations[*].Instances[*].InstanceId"
        }
        ResultPath = "$.lookup"
        Next       = "CountInstances"
        Catch = [{ ErrorEquals = ["States.ALL"], Next = "ExecutionFailed" }]
      }

      CountInstances = {
        Type = "Pass"
        Parameters = {
          "count.$" = "States.ArrayLength($.lookup.instance_ids)"
        }
        ResultPath = "$.lookup_meta"
        Next       = "CheckLookupCount"
      }

      CheckLookupCount = {
        Type = "Choice"
        Choices = [
          {
            Variable      = "$.lookup_meta.count"
            NumericEquals = 1
            Next          = "ExtractInstanceId"
          }
        ]
        Default = "LookupFailed"
      }

      # ヒット件数が1件のときだけインスタンスIDを取り出す
      ExtractInstanceId = {
        Type = "Pass"
        Parameters = {
          "instance_id.$" = "$.lookup.instance_ids[0]"
        }
        ResultPath = "$.target"
        Next       = "StopInstance"
      }

      # 0件または複数件ヒットした場合は誤操作防止のため失敗させる
      LookupFailed = {
        Type  = "Fail"
        Cause = "Name tag did not match exactly one instance"
      }

      StopInstance = {
        Type     = "Task"
        Resource = "arn:aws:states:::aws-sdk:ec2:stopInstances"
        Parameters = {
          "InstanceIds.$" = "States.Array($.target.instance_id)"
        }
        ResultPath = "$.stop_result"
        Next       = "WaitBeforeCheckStopped"
        Catch = [{ ErrorEquals = ["States.ALL"], Next = "ExecutionFailed" }]
      }

      WaitBeforeCheckStopped = {
        Type    = "Wait"
        Seconds = 30
        Next    = "CheckStopped"
      }

      # IncludeAllInstances: true を付けないと停止済みインスタンスが結果に含まれない
      CheckStopped = {
        Type     = "Task"
        Resource = "arn:aws:states:::aws-sdk:ec2:describeInstanceStatus"
        Parameters = {
          "InstanceIds.$"      = "States.Array($.target.instance_id)"
          IncludeAllInstances = true
        }
        ResultPath = "$.status_result"
        Next       = "IsStopped"
        Catch = [{ ErrorEquals = ["States.ALL"], Next = "FallbackStartInstance" }]
      }

      IsStopped = {
        Type = "Choice"
        Choices = [
          {
            Variable      = "$.status_result.InstanceStatuses[0].InstanceState.Code"
            NumericEquals = 80
            Next          = "StartBackupJob"
          }
        ]
        Default = "WaitBeforeCheckStopped"
      }

      StartBackupJob = {
        Type     = "Task"
        Resource = "arn:aws:states:::aws-sdk:backup:startBackupJob"
        Parameters = {
          "BackupVaultName.$" = "$.backup_vault_name"
          "ResourceArn.$"     = "States.Format('arn:aws:ec2:ap-northeast-1:123456789012:instance/{}', $.target.instance_id)"
          IamRoleArn          = "arn:aws:iam::123456789012:role/example-backup-role"
          Lifecycle = {
            "DeleteAfterDays.$" = "$.retention_days"
          }
          RecoveryPointTags = {
            "Name.$"        = "$.instance_name"
            "Environment.$" = "$.environment"
          }
        }
        ResultPath = "$.backup_result"
        Next       = "WaitBeforeCheckBackup"
        Catch = [{ ErrorEquals = ["States.ALL"], Next = "FallbackStartInstance" }]
      }

      WaitBeforeCheckBackup = {
        Type    = "Wait"
        Seconds = 60
        Next    = "CheckBackupComplete"
      }

      CheckBackupComplete = {
        Type     = "Task"
        Resource = "arn:aws:states:::aws-sdk:backup:describeBackupJob"
        Parameters = {
          "BackupJobId.$" = "$.backup_result.BackupJobId"
        }
        ResultPath = "$.backup_status"
        Next       = "IsBackupComplete"
        Catch = [{ ErrorEquals = ["States.ALL"], Next = "FallbackStartInstance" }]
      }

      IsBackupComplete = {
        Type = "Choice"
        Choices = [
          {
            Variable     = "$.backup_status.State"
            StringEquals = "COMPLETED"
            Next         = "StartInstance"
          }
        ]
        Default = "WaitBeforeCheckBackup"
      }

      StartInstance = {
        Type     = "Task"
        Resource = "arn:aws:states:::aws-sdk:ec2:startInstances"
        Parameters = {
          "InstanceIds.$" = "States.Array($.target.instance_id)"
        }
        ResultPath = "$.start_result"
        Next       = "WaitBeforeCheckRunning"
        Catch = [{ ErrorEquals = ["States.ALL"], Next = "ExecutionFailed" }]
      }

      WaitBeforeCheckRunning = {
        Type    = "Wait"
        Seconds = 30
        Next    = "CheckRunning"
      }

      CheckRunning = {
        Type     = "Task"
        Resource = "arn:aws:states:::aws-sdk:ec2:describeInstanceStatus"
        Parameters = {
          "InstanceIds.$" = "States.Array($.target.instance_id)"
        }
        ResultPath = "$.running_result"
        Next       = "IsRunning"
        Catch = [{ ErrorEquals = ["States.ALL"], Next = "ExecutionFailed" }]
      }

      # running かつシステム/インスタンスの両ステータスチェックがokになるまで待つ
      IsRunning = {
        Type = "Choice"
        Choices = [
          {
            And = [
              {
                Variable      = "$.running_result.InstanceStatuses[0].InstanceState.Code"
                NumericEquals = 16
              },
              {
                Variable     = "$.running_result.InstanceStatuses[0].SystemStatus.Status"
                StringEquals = "ok"
              },
              {
                Variable     = "$.running_result.InstanceStatuses[0].InstanceStatus.Status"
                StringEquals = "ok"
              }
            ]
            Next = "Done"
          }
        ]
        Default = "WaitBeforeCheckRunning"
      }

      # 失敗時も停止したまま放置しないよう、起動だけは試みてから失敗扱いにする
      FallbackStartInstance = {
        Type     = "Task"
        Resource = "arn:aws:states:::aws-sdk:ec2:startInstances"
        Parameters = {
          "InstanceIds.$" = "States.Array($.target.instance_id)"
        }
        Next = "ExecutionFailed"
      }

      ExecutionFailed = {
        Type = "Fail"
      }

      Done = {
        Type = "Succeed"
      }
    }
  })
}

resource "aws_scheduler_schedule" "app_stop_backup_start" {
  name                         = "example-app-stop-backup-start-schedule"
  description                  = "APサーバーの停止→バックアップ→起動運用"
  schedule_expression          = "cron(0 1 ? * FRI *)"
  schedule_expression_timezone = "Asia/Tokyo"

  flexible_time_window {
    mode = "OFF"
  }

  target {
    arn      = aws_sfn_state_machine.stop_backup_start.arn
    role_arn = aws_iam_role.scheduler.arn

    input = jsonencode({
      instance_name     = "example-app-server"
      backup_vault_name = aws_backup_vault.prod.name
      retention_days    = 21
      environment       = "prod"
    })

    retry_policy {
      maximum_retry_attempts = 0
    }
  }
}