# GuardDuty Detector Configuration ============================================
# Run in the delegated administrator (security) account after the
# governance/organization module registers delegated_administrators
# ["guardduty.amazonaws.com"].

# GuardDuty Detector ----------------------------------------------------------

resource "aws_guardduty_detector" "this" {
  enable                       = var.enable
  finding_publishing_frequency = var.finding_publishing_frequency

  tags = local.tags
}

# Detector Features ------------------------------------------------------------

resource "aws_guardduty_detector_feature" "this" {
  for_each = var.detector_features

  detector_id = aws_guardduty_detector.this.id
  name        = each.key
  status      = each.value.status

  dynamic "additional_configuration" {
    for_each = each.value.additional_configuration
    content {
      name   = additional_configuration.key
      status = additional_configuration.value.status
    }
  }
}

# Organization Configuration ---------------------------------------------------

resource "aws_guardduty_organization_configuration" "this" {
  count = var.detector_organization_configuration != null ? 1 : 0

  auto_enable_organization_members = var.detector_organization_configuration.auto_enable_org_members
  detector_id                      = aws_guardduty_detector.this.id

  depends_on = [aws_guardduty_detector.this]
}

# Organization Features --------------------------------------------------------

resource "aws_guardduty_organization_configuration_feature" "this" {
  for_each = local.organization_features

  detector_id = aws_guardduty_detector.this.id
  name        = each.key
  auto_enable = each.value.auto_enable

  dynamic "additional_configuration" {
    for_each = each.value.additional_configuration
    content {
      name        = additional_configuration.key
      auto_enable = additional_configuration.value.auto_enable
    }
  }

  depends_on = [aws_guardduty_organization_configuration.this]
}