# SSM documents ==============================================================

resource "aws_ssm_document" "this" {
  for_each = var.documents

  name            = each.value.name
  document_type   = each.value.document_type
  document_format = each.value.document_format
  content         = each.value.content
  target_type     = each.value.target_type
  version_name    = each.value.version_name

  permissions = each.value.permissions != null ? {
    type        = "Share"
    account_ids = join(",", each.value.permissions.account_ids)
  } : null

  tags = local.tags
}

# Maintenance windows ========================================================

resource "aws_ssm_maintenance_window" "this" {
  for_each = var.maintenance_windows

  name                       = each.value.name
  description                = each.value.description
  schedule                   = each.value.schedule
  duration                   = each.value.duration
  cutoff                     = each.value.cutoff
  allow_unassociated_targets = each.value.allow_unassociated_targets
  schedule_timezone          = each.value.schedule_timezone

  tags = local.tags
}

# Maintenance window targets -------------------------------------------------

resource "aws_ssm_maintenance_window_target" "this" {
  for_each = var.maintenance_window_targets

  window_id         = aws_ssm_maintenance_window.this[each.value.window_key].id
  resource_type     = each.value.resource_type
  owner_information = each.value.owner_information

  targets {
    key    = each.value.target_key
    values = each.value.target_values
  }
}

# Maintenance window tasks ---------------------------------------------------

resource "aws_ssm_maintenance_window_task" "this" {
  for_each = var.maintenance_window_tasks

  window_id        = aws_ssm_maintenance_window.this[each.value.window_key].id
  task_type        = each.value.task_type
  task_arn         = each.value.task_arn
  service_role_arn = each.value.service_role_arn
  priority         = each.value.priority
  max_concurrency  = each.value.max_concurrency
  max_errors       = each.value.max_errors

  targets {
    key    = "WindowTargetIds"
    values = [aws_ssm_maintenance_window_target.this[each.value.target_key].id]
  }

  dynamic "task_invocation_parameters" {
    for_each = each.value.run_command_parameters != null ? [each.value.run_command_parameters] : []
    content {
      run_command_parameters {
        document_version = task_invocation_parameters.value.document_version
        output_s3_bucket = task_invocation_parameters.value.output_s3_bucket

        dynamic "parameter" {
          for_each = task_invocation_parameters.value.parameters
          content {
            name   = parameter.key
            values = parameter.value
          }
        }
      }
    }
  }
}

# Patch baselines ============================================================

resource "aws_ssm_patch_baseline" "this" {
  for_each = var.patch_baselines

  name             = each.value.name
  description      = each.value.description
  operating_system = each.value.operating_system

  approved_patches = each.value.approved_patches
  rejected_patches = each.value.rejected_patches

  dynamic "approval_rule" {
    for_each = each.value.approval_rules
    content {
      approve_after_days = approval_rule.value.approve_after_days
      compliance_level   = approval_rule.value.compliance_level

      dynamic "patch_filter" {
        for_each = approval_rule.value.patch_filter_groups
        content {
          key    = keys(patch_filter.value)[0]
          values = values(patch_filter.value)[0]
        }
      }
    }
  }

  tags = local.tags
}