variables.tf

###############################################################################
# Identity
###############################################################################

variable "name" {
 description = <<EOT
Base name for the warehouse. In `provisioned` mode it is the
`cluster_identifier` and seeds the subnet/parameter group names
(`<name>-subnets`, `<name>-params`). In `serverless` mode it is the default
`namespace_name` and `workgroup_name` unless overridden.

FORCE-NEW — changing this destroys and recreates the warehouse (and its data).
Must be lowercase, 1-63 chars, begin with a letter, contain only lowercase
letters, digits, and hyphens, and not end with or contain consecutive hyphens.
EOT
 type = string

 validation {
 condition = can(regex("^[a-z][a-z0-9-]{0,62}$", var.name)) && !can(regex("--|-$", var.name))
 error_message = "name must be lowercase, 1-63 chars, start with a letter, use only lowercase letters/digits/hyphens, and not end with or contain consecutive hyphens."
 }
}

variable "deployment_mode" {
 description = <<EOT
Selects the warehouse shape. `provisioned` creates an `aws_redshift_cluster`
(plus subnet group, parameter group, and optional audit logging).
`serverless` creates an `aws_redshiftserverless_namespace` +
`aws_redshiftserverless_workgroup`.

The two modes are mutually exclusive — switching is a destroy/recreate, not an
in-place change.
EOT
 type = string
 default = "provisioned"

 validation {
 condition = contains(["provisioned", "serverless"], var.deployment_mode)
 error_message = "deployment_mode must be one of: provisioned, serverless."
 }
}

###############################################################################
# Networking (placement)
###############################################################################

variable "subnet_ids" {
 description = <<EOT
VPC subnet IDs for the warehouse. In `provisioned` mode these populate the
cluster subnet group this module creates; in `serverless` mode they are bound
directly to the workgroup. Place the warehouse in private subnets only
(PII/privacy-regulation baseline). Wire from `tf_mod_aws_vpc`. Required.
EOT
 type = list(string)

 validation {
 condition = length(var.subnet_ids) > 0
 error_message = "subnet_ids must contain at least one subnet."
 }
}

variable "vpc_security_group_ids" {
 description = <<EOT
VPC security group IDs associated with the warehouse. Restrict ingress to the
warehouse port (default 5439) from application security groups only — never
expose 0.0.0.0/0. Wire from `tf_mod_aws_security_group`.
EOT
 type = list(string)
 default = []
}

variable "subnet_group_description" {
 description = "(provisioned) Description for the cluster subnet group created by this module."
 type = string
 default = "Managed by Terraform"
}

variable "port" {
 description = "Port the warehouse accepts connections on. Null uses the engine default (5439)."
 type = number
 default = null
}

variable "enhanced_vpc_routing" {
 description = <<EOT
Whether COPY/UNLOAD traffic between the warehouse and other AWS services is
forced through the VPC (rather than the public internet). Defaults to true (secure baseline) so data movement stays inside the VPC and can be policed by
VPC endpoints, security groups, and flow logs.
EOT
 type = bool
 default = true
}

variable "publicly_accessible" {
 description = <<EOT
Whether the warehouse is reachable from a public network. Defaults to false
(secure baseline). Setting true exposes the warehouse via a public endpoint
(and, for provisioned clusters, an Elastic IP) — a documented exception only.
EOT
 type = bool
 default = false
}

variable "elastic_ip" {
 description = "(provisioned) Elastic IP address for the cluster. Only relevant when `publicly_accessible = true`. Null = none."
 type = string
 default = null
}

###############################################################################
# Provisioned cluster — compute
###############################################################################

variable "node_type" {
 description = <<EOT
(provisioned) Node type to provision (e.g. `ra3.xlplus`, `ra3.4xlarge`,
`dc2.large`). Required in provisioned mode; ignored in serverless mode. Changing
the node type is a resize operation, not an in-place edit.
EOT
 type = string
 default = null
}

variable "number_of_nodes" {
 description = <<EOT
(provisioned) Number of compute nodes. 1 yields a single-node cluster;
2 or more yields a multi-node cluster. `cluster_type` is derived from this value
unless set explicitly.
EOT
 type = number
 default = 1

 validation {
 condition = var.number_of_nodes >= 1
 error_message = "number_of_nodes must be at least 1."
 }
}

variable "cluster_type" {
 description = "(provisioned) Cluster type — `single-node` or `multi-node`. Null derives it from `number_of_nodes` (>1 => multi-node)."
 type = string
 default = null

 validation {
 condition = var.cluster_type == null || contains(["single-node", "multi-node"], coalesce(var.cluster_type, "single-node"))
 error_message = "cluster_type must be one of: single-node, multi-node."
 }
}

variable "cluster_version" {
 description = "(provisioned) Amazon Redshift engine version to deploy (e.g. `1.0`). Null uses the current default version."
 type = string
 default = null
}

variable "database_name" {
 description = <<EOT
Name of the first database created with the warehouse. Null lets AWS create the
default database (`dev`). FORCE-NEW on a provisioned cluster.
EOT
 type = string
 default = null
}

variable "availability_zone" {
 description = "(provisioned) AZ in which to provision the cluster. Null lets AWS choose. Can only change when `availability_zone_relocation_enabled = true`."
 type = string
 default = null
}

variable "availability_zone_relocation_enabled" {
 description = "(provisioned) Whether the cluster can be relocated to another AZ (automatically or on request). Available on the RA3 instance family only."
 type = bool
 default = null
}

variable "multi_az" {
 description = "(provisioned) Whether the cluster is a Multi-AZ deployment for higher availability. Supported on RA3 node types."
 type = bool
 default = null
}

###############################################################################
# Admin credentials (secure by default — Secrets Manager)
###############################################################################

variable "master_username" {
 description = <<EOT
Admin (master) username for the warehouse. Used by both deployment modes
(`master_username` for provisioned, `admin_username` for serverless). Required
unless restoring a provisioned cluster from a snapshot.
EOT
 type = string
 default = "admin"
}

variable "manage_admin_password" {
 description = <<EOT
Whether AWS Secrets Manager generates and manages the admin password. Defaults
to true (secure baseline) — the password is never a Terraform variable or
output. Set false only to supply `master_password` yourself.
EOT
 type = bool
 default = true
}

variable "master_password" {
 description = <<EOT
Admin password, used only when `manage_admin_password = false`. Must be 8-64
chars with at least one uppercase, one lowercase, and one digit. Prefer
`manage_admin_password = true`; if you must set this, source it from
`tf_mod_aws_secrets_manager` rather than inlining it. Null when Secrets Manager
manages the password.
EOT
 type = string
 default = null
 sensitive = true
}

variable "admin_password_secret_kms_key_id" {
 description = <<EOT
KMS key ID used to encrypt the admin-credentials secret created when
`manage_admin_password = true`. Null uses the AWS-managed key for Secrets
Manager. Wire from `tf_mod_aws_kms` for a customer-managed key.
EOT
 type = string
 default = null
}

###############################################################################
# Encryption at rest (secure by default)
###############################################################################

variable "encrypted" {
 description = <<EOT
Whether the warehouse data is encrypted at rest. Defaults to true (secure
baseline). Disabling is strongly discouraged for PII workloads. Applies to
provisioned clusters; serverless namespaces are always encrypted.
EOT
 type = bool
 default = true
}

variable "kms_key_arn" {
 description = <<EOT
ARN of a customer-managed KMS key (CMK) for at-rest encryption. Null uses the
AWS-managed Redshift key. The CMK's key policy must allow the Redshift service.
Wire from `tf_mod_aws_kms` (arn output) for an auditable, revocable key over PII
data.
EOT
 type = string
 default = null
}

###############################################################################
# IAM roles (COPY / UNLOAD / data sharing)
###############################################################################

variable "iam_roles" {
 description = <<EOT
List of IAM role ARNs to associate with the warehouse for COPY/UNLOAD and other
service integrations (max 10). Each role must trust `redshift.amazonaws.com`.
Wire from `tf_mod_aws_iam_role`. Requires `iam:PassRole` on the Terraform
identity.
EOT
 type = list(string)
 default = []

 validation {
 condition = length(var.iam_roles) <= 10
 error_message = "iam_roles supports at most 10 role ARNs."
 }
}

variable "default_iam_role_arn" {
 description = "ARN of the role (from `iam_roles`) to set as the warehouse default for COPY/UNLOAD. Null leaves no default. Must also appear in `iam_roles`."
 type = string
 default = null
}

###############################################################################
# Maintenance & versioning (provisioned)
###############################################################################

variable "allow_version_upgrade" {
 description = "(provisioned) Whether major version upgrades may be applied during the maintenance window. Default true."
 type = bool
 default = true
}

variable "apply_immediately" {
 description = "Whether modifications are applied immediately rather than during the next maintenance window. Immediate changes can cause a brief reboot."
 type = bool
 default = false
}

variable "preferred_maintenance_window" {
 description = "(provisioned) Weekly maintenance window in `ddd:hh24:mi-ddd:hh24:mi` UTC format, e.g. `sun:05:00-sun:09:00`. Null lets AWS choose."
 type = string
 default = null
}

variable "maintenance_track_name" {
 description = "(provisioned) Maintenance track for the cluster — `current` or `trailing`. Null uses the AWS default (`current`)."
 type = string
 default = null
}

###############################################################################
# Snapshots & recovery (secure by default)
###############################################################################

variable "automated_snapshot_retention_period" {
 description = <<EOT
(provisioned) Days to retain automated snapshots (0-35). Defaults to 7 (recovery baseline). 0 disables automated snapshots (discouraged).
EOT
 type = number
 default = 7

 validation {
 condition = var.automated_snapshot_retention_period >= 0 && var.automated_snapshot_retention_period <= 35
 error_message = "automated_snapshot_retention_period must be between 0 and 35 days."
 }
}

variable "manual_snapshot_retention_period" {
 description = "(provisioned) Default days to retain manual snapshots. -1 retains indefinitely. Null uses the AWS default."
 type = number
 default = null
}

variable "skip_final_snapshot" {
 description = <<EOT
(provisioned) Whether to skip the final snapshot on destroy. Defaults to false
(recovery baseline) — a final snapshot is taken. Setting true permanently
discards the data on delete (discouraged).
EOT
 type = bool
 default = false
}

variable "final_snapshot_identifier" {
 description = "(provisioned) Identifier for the final snapshot taken on destroy. Required when `skip_final_snapshot = false`. Null derives `<name>-final`."
 type = string
 default = null
}

variable "snapshot_identifier" {
 description = "(provisioned) Name of a snapshot to restore the cluster from at creation. Conflicts with `snapshot_arn`. Null = fresh cluster."
 type = string
 default = null
}

variable "snapshot_arn" {
 description = "(provisioned) ARN of a snapshot to restore the cluster from at creation. Conflicts with `snapshot_identifier`. Null = fresh cluster."
 type = string
 default = null
}

variable "snapshot_cluster_identifier" {
 description = "(provisioned) Cluster identifier the source snapshot was created from. Null = none."
 type = string
 default = null
}

variable "owner_account" {
 description = "(provisioned) AWS account that owns the source snapshot. Required only when restoring a snapshot you do not own."
 type = string
 default = null
}

###############################################################################
# Parameter group (provisioned)
###############################################################################

variable "parameter_group_name" {
 description = <<EOT
(provisioned) Name of an existing parameter group to associate with the cluster.
Used only when `parameter_group` is null. If both are null, the engine default
parameter group is used.
EOT
 type = string
 default = null
}

variable "parameter_group" {
 description = <<EOT
(provisioned) When set, the module creates a dedicated
`aws_redshift_parameter_group` named `<name>-params` and associates it with the
cluster (takes precedence over `parameter_group_name`).

- family: Parameter group family (e.g. `redshift-1.0`). Required. FORCE-NEW.
- description: Optional description.
- parameters: Map of parameter name => value (e.g. { require_ssl = "true" }).
EOT
 type = object({
 family = string
 description = optional(string, "Managed by Terraform")
 parameters = optional(map(string), {})
 })
 default = null
}

###############################################################################
# Audit logging (provisioned) — destination bucket is caller-owned
###############################################################################

variable "logging" {
 description = <<EOT
(provisioned) Audit-logging configuration via a standalone `aws_redshift_logging`
resource. Null disables logging. For PII workloads, enable logging to an
S3 bucket or CloudWatch Logs and retain per policy.

- log_destination_type: `s3` or `cloudwatch`.
- bucket_name: (s3) Caller-owned S3 bucket id; its bucket policy must
 grant the Redshift log-delivery service `s3:PutObject`
 and `s3:GetBucketAcl`. Wire from `tf_mod_aws_s3_bucket`.
- s3_key_prefix: (s3) Optional key prefix for log files.
- log_exports: List of log types to export — `connectionlog`,
 `useractivitylog`, `userlog` (used with `cloudwatch`).
EOT
 type = object({
 log_destination_type = optional(string, "s3")
 bucket_name = optional(string)
 s3_key_prefix = optional(string)
 log_exports = optional(list(string), [])
 })
 default = null

 validation {
 condition = var.logging == null || contains(["s3", "cloudwatch"], coalesce(try(var.logging.log_destination_type, null), "s3"))
 error_message = "logging.log_destination_type must be one of: s3, cloudwatch."
 }

 validation {
 condition = var.logging == null || alltrue([for t in coalesce(try(var.logging.log_exports, null), []): contains(["connectionlog", "useractivitylog", "userlog"], t)])
 error_message = "logging.log_exports entries must be one of: connectionlog, useractivitylog, userlog."
 }
}

###############################################################################
# Serverless — namespace
###############################################################################

variable "namespace_name" {
 description = "(serverless) Namespace name. Null defaults to `var.name`. Lowercase, 3-64 chars."
 type = string
 default = null
}

variable "serverless_log_exports" {
 description = "(serverless) Log types the namespace exports to CloudWatch Logs — any of `useractivitylog`, `userlog`, `connectionlog`. Empty = none."
 type = list(string)
 default = []

 validation {
 condition = alltrue([for t in var.serverless_log_exports: contains(["useractivitylog", "userlog", "connectionlog"], t)])
 error_message = "serverless_log_exports entries must be one of: useractivitylog, userlog, connectionlog."
 }
}

###############################################################################
# Serverless — workgroup
###############################################################################

variable "workgroup_name" {
 description = "(serverless) Workgroup name. Null defaults to `var.name`. Lowercase, 3-64 chars."
 type = string
 default = null
}

variable "base_capacity" {
 description = "(serverless) Base compute capacity in Redshift Processing Units (RPUs), in multiples of 8 (8-1024). Null uses the AWS default."
 type = number
 default = null
}

variable "max_capacity" {
 description = "(serverless) Maximum compute capacity in RPUs to cap cost on bursty workloads. Null = uncapped (AWS default)."
 type = number
 default = null
}

variable "track_name" {
 description = "(serverless) Maintenance track for the workgroup — `current` or `trailing`. Null uses the AWS default."
 type = string
 default = null
}

variable "config_parameters" {
 description = <<EOT
(serverless) Workgroup configuration parameters as a map of key => value, e.g.
`{ require_ssl = "true", max_query_execution_time = "3600" }`. Empty = AWS
defaults.
EOT
 type = map(string)
 default = {}
}

variable "price_performance_target" {
 description = <<EOT
(serverless) AI-driven price-performance scaling target. When set, the workgroup
auto-tunes RPUs toward the chosen level.

- enabled: Whether the target is active.
- level: Optimization level 1-100 (lower favors cost, higher favors speed).
EOT
 type = object({
 enabled = bool
 level = optional(number)
 })
 default = null
}

###############################################################################
# Universal tail: tags, then timeouts
###############################################################################

variable "tags" {
 description = <<EOT
A map of tags to assign to all taggable resources created by this module. These
merge with provider-level default_tags; resource tags win on key conflict. The
computed tags_all output reflects the merged set.
EOT
 type = map(string)
 default = {}
}

variable "timeouts" {
 description = "Optional Terraform operation timeouts for the keystone resource (provisioned cluster or serverless workgroup)."
 type = object({
 create = optional(string)
 update = optional(string)
 delete = optional(string)
 })
 default = {}
}