# Inspector v2 enablement ====================================================

resource "aws_inspector2_enabler" "this" {
  account_ids    = concat([data.aws_caller_identity.current.account_id], values(var.member_accounts))
  resource_types = local.resource_types
}

data "aws_caller_identity" "current" {}

# Delegated administrator ----------------------------------------------------

resource "aws_inspector2_delegated_admin_account" "this" {
  for_each = var.delegated_admin_account_id != null ? { admin = var.delegated_admin_account_id } : {}

  account_id = each.value

  depends_on = [aws_inspector2_enabler.this]
}

# Organization configuration -------------------------------------------------

resource "aws_inspector2_organization_configuration" "this" {
  for_each = var.delegated_admin_account_id != null ? { config = true } : {}

  auto_enable {
    ec2    = var.enable_ec2_scanning
    ecr    = var.enable_ecr_scanning
    lambda = var.enable_lambda_scanning
  }

  depends_on = [aws_inspector2_delegated_admin_account.this]
}

# Finding suppression filters ------------------------------------------------

resource "aws_inspector2_filter" "this" {
  for_each = var.filter_criteria

  name        = each.key
  description = each.value.description
  action      = each.value.action

  dynamic "filter_criteria" {
    for_each = each.value.filter_criteria != null ? [each.value.filter_criteria] : []
    content {
      # Dynamic blocks for each supported criterion are omitted here
      # as their structure varies; callers supply the raw filter_criteria block.
    }
  }

  tags = local.tags
}