import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import { vpc } from './vpc';

const config = new pulumi.Config();

const domain = config.get("domain") || "tf-test";
const currentRegion = config.get("aws:region")

const currentCallerIdentity = pulumi.output(aws.getCallerIdentity({ async: true }));
const esSecurityGroup = new aws.ec2.SecurityGroup("es", {
    description: "Managed by Pulumi",
    ingress: [{
        cidrBlocks: [vpc.vpc.cidrBlock],
        fromPort: 443,
        protocol: "tcp",
        toPort: 443,
    }],
    vpcId: vpc.id,
});
// const esServiceLinkedRole = new aws.iam.ServiceLinkedRole("es", {
//     awsServiceName: "<http://es.amazonaws.com|es.amazonaws.com>",
// });

export const esDomain = new aws.elasticsearch.Domain("es", {
    accessPolicies: pulumi.interpolate`{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "es:*",
            "Principal": "*",
            "Effect": "Allow",
            "Resource": "arn:aws:es:${currentRegion}:${currentCallerIdentity.accountId}:domain/${domain}/*"
        }
    ]
}
`,
    advancedOptions: {
        "rest.action.multi.allow_explicit_index": "true",
    },
    clusterConfig: {
        instanceType: "t2.small.elasticsearch", // "c5.large.elasticsearch",
    },
    elasticsearchVersion: "5.6",
    snapshotOptions: {
        automatedSnapshotStartHour: 23,
    },
    tags: {
        Domain: "TestDomain",
    },
    vpcOptions: {
        securityGroupIds: [vpc.id],
        subnetIds: vpc.privateSubnetIds,
    },
    ebsOptions: ???.
}, { 
    // dependsOn: [esServiceLinkedRole]
});