data "aws_ami" "sgw_ami" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["aws-storage-gateway-*"]
  }
}

resource "aws_instance" "example" {
  ami                         = data.aws_ami.sgw_ami.id
  associate_public_ip_address = false
  availability_zone           = "ap-northeast-1a"
  instance_type               = "m5.xlarge"
  subnet_id                   = "<既存のサブネット ID>"

  tags = {
    Name = "terraform-sgw"
  }

  tags_all = {
    Name = "terraform-sgw"
  }

  vpc_security_group_ids = [aws_security_group.example_sgw_ec2.id]

  ebs_block_device {
    delete_on_termination = false
    device_name           = "/dev/sdf"
    iops                  = 3000
    tags = {
      Name = "terraform-sgw-cache"
    }
    throughput  = 125
    volume_size = 150
    volume_type = "gp3"
  }

  root_block_device {
    delete_on_termination = true
    iops                  = 3000
    throughput            = 125
    volume_size           = 80
    volume_type           = "gp3"
  }
}

# ----------------------------------------
# Security Group - storagegateway EC2
# ----------------------------------------

resource "aws_security_group" "example_sgw_ec2" {
  name   = "sgw-ec2-security-group"
  vpc_id = "<既存のVPC ID>"
}

resource "aws_security_group_rule" "nfs_tcp" {
  type              = "ingress"
  from_port         = 2049
  to_port           = 2049
  protocol          = "tcp"
  description       = "NFS-TCP"
  cidr_blocks       = ["<既存のVPC CIDR>"]
  security_group_id = aws_security_group.example_sgw_ec2.id
}

resource "aws_security_group_rule" "nfs_udp" {
  type              = "ingress"
  from_port         = 2049
  to_port           = 2049
  protocol          = "udp"
  description       = "NFS-UDP"
  cidr_blocks       = ["<既存のVPC CIDR>"]
  security_group_id = aws_security_group.example_sgw_ec2.id
}

resource "aws_security_group_rule" "nfs_portmapper_tcp" {
  type              = "ingress"
  from_port         = 111
  to_port           = 111
  protocol          = "tcp"
  description       = "NFS-portmapper-TCP"
  cidr_blocks       = ["<既存のVPC CIDR>"]
  security_group_id = aws_security_group.example_sgw_ec2.id
}

resource "aws_security_group_rule" "nfs_portmap_udp" {
  type              = "ingress"
  from_port         = 111
  to_port           = 111
  protocol          = "udp"
  description       = "NFS-portmapper-UDP"
  cidr_blocks       = ["<既存のVPC CIDR>"]
  security_group_id = aws_security_group.example_sgw_ec2.id
}


resource "aws_security_group_rule" "nfs_v3_tcp" {
  type              = "ingress"
  from_port         = 20048
  to_port           = 20048
  protocol          = "tcp"
  description       = "NFSv3-TCP"
  cidr_blocks       = ["<既存のVPC CIDR>"]
  security_group_id = aws_security_group.example_sgw_ec2.id
}

resource "aws_security_group_rule" "nfs_v3_udp" {
  type              = "ingress"
  from_port         = 20048
  to_port           = 20048
  protocol          = "UDP"
  description       = "NFSv3-UDP"
  cidr_blocks       = ["<既存のVPC CIDR>"]
  security_group_id = aws_security_group.example_sgw_ec2.id
}

resource "aws_security_group_rule" "egress" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.example_sgw_ec2.id
}

# ----------------------------------------
# Security Group - storagegateway VPC endpoint
# ----------------------------------------

resource "aws_security_group" "example_sgw_vpce" {
  name   = "sgw-vpce-security-group"
  vpc_id = "<既存のVPC ID>"
}

resource "aws_security_group_rule" "tcp_1026_1028" {
  type                     = "ingress"
  from_port                = 1026
  to_port                  = 1028
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.example_sgw_ec2.id
  security_group_id        = aws_security_group.example_sgw_vpce.id
}

resource "aws_security_group_rule" "tcp_1031" {
  type                     = "ingress"
  from_port                = 1031
  to_port                  = 1031
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.example_sgw_ec2.id
  security_group_id        = aws_security_group.example_sgw_vpce.id
}

resource "aws_security_group_rule" "tcp_2222" {
  type                     = "ingress"
  from_port                = 2222
  to_port                  = 2222
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.example_sgw_ec2.id
  security_group_id        = aws_security_group.example_sgw_vpce.id
}

resource "aws_security_group_rule" "tcp_443_sgwvpce" {
  type                     = "ingress"
  from_port                = 443
  to_port                  = 443
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.example_sgw_ec2.id
  security_group_id        = aws_security_group.example_sgw_vpce.id
}

resource "aws_security_group_rule" "egress_sgwvpce" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.example_sgw_vpce.id
}

# ----------------------------------------
# Security Group - S3 VPC endpoint
# ----------------------------------------

resource "aws_security_group" "example_s3_vpce" {
  name   = "s3-vpce-security-group"
  vpc_id = "<既存のVPC ID>"
}

resource "aws_security_group_rule" "tcp_443_s3vpce" {
  type                     = "ingress"
  from_port                = 443
  to_port                  = 443
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.example_sgw_ec2.id
  security_group_id        = aws_security_group.example_s3_vpce.id
}

resource "aws_security_group_rule" "egress_s3vpce" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.example_s3_vpce.id
}

resource "aws_storagegateway_gateway" "example" {
  activation_key       = "<curl で取得したアクティベーションキー>"
  gateway_name         = "terraform-sgw"
  gateway_timezone     = "GMT+9:00"
  gateway_type         = "FILE_S3"
  gateway_vpc_endpoint = lookup(aws_vpc_endpoint.sgw_example.dns_entry[0], "dns_name")

  maintenance_start_time {
    day_of_month   = null
    day_of_week    = "2"
    hour_of_day    = 0
    minute_of_hour = 10
  }
}

data "aws_storagegateway_local_disk" "sgw" {
  gateway_arn = aws_storagegateway_gateway.example.arn
  disk_node   = "/dev/sdf"
  disk_path   = "/dev/sdf"
}
resource "aws_storagegateway_cache" "sgw" {
  gateway_arn = aws_storagegateway_gateway.example.arn
  disk_id     = data.aws_storagegateway_local_disk.sgw.id
}

resource "aws_vpc_endpoint" "s3_example" {
  ip_address_type     = "ipv4"
  private_dns_enabled = true
  security_group_ids  = [aws_security_group.example_s3_vpce.id]
  service_name        = "com.amazonaws.ap-northeast-1.s3"
  subnet_ids          = ["<既存のサブネット ID>"]

  tags = {
    Name = "s3-interface-endpoint"
  }

  vpc_endpoint_type = "Interface"
  vpc_id            = "<既存のVPC ID>"

  dns_options {
    dns_record_ip_type = "ipv4"
  }
}

resource "aws_vpc_endpoint" "sgw_example" {
  ip_address_type     = "ipv4"
  private_dns_enabled = true
  security_group_ids  = [aws_security_group.example_sgw_vpce.id]
  service_name        = "com.amazonaws.ap-northeast-1.storagegateway"
  subnet_ids          = ["<既存のサブネット ID>"]

  tags = {
    Name = "sgw-interface-endpoint"
  }

  vpc_endpoint_type = "Interface"
  vpc_id            = "<既存のVPC ID>"

  dns_options {
    dns_record_ip_type = "ipv4"
  }
}

resource "aws_storagegateway_nfs_file_share" "example" {
  client_list           = ["0.0.0.0/0"]
  gateway_arn           = aws_storagegateway_gateway.example.arn
  location_arn          = "<既存のS3バケット ARN>"
  bucket_region         = "ap-northeast-1"
  role_arn              = aws_iam_role.example.arn
  vpc_endpoint_dns_name = substr("${lookup(aws_vpc_endpoint.s3_example.dns_entry[0], "dns_name")}", 2, -1)
}

resource "aws_iam_role" "example" {
  name = "file-share-role"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "storagegateway.amazonaws.com"
      },
      "Effect": "Allow"
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "s3" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3FullAccess"
}