namespace   = "your-org"
environment = "dev"
region      = "us-east-1"

# Replace with your actual KMS key ARN
kms_key_arn = "arn:aws:kms:us-east-1:YOUR_ACCOUNT:key/YOUR_KEY_ID"

# Replace with your actual VPC subnet IDs
vpc_subnet_ids = [
  "subnet-YOUR_SUBNET_1",
  "subnet-YOUR_SUBNET_2"
]

# Replace with your actual security group IDs
vpc_security_group_ids = [
  "sg-YOUR_SECURITY_GROUP"
]

# Replace with your actual SQS DLQ ARN
dlq_arn = "arn:aws:sqs:us-east-1:YOUR_ACCOUNT:YOUR_DLQ_NAME"

security_control_overrides = {
  disable_vpc_requirement = true
  disable_kms_requirement = true
  justification           = "Basic Lambda function with no sensitive data or private resource access."
}

security_control_overrides = {
  disable_vpc_requirement = true
  justification           = "Public-facing Lambda invoked by API Gateway. VPC would add cold start latency."
}

module "custom_lambda" {
  source = "github.com/islamelkadi/terraform-aws-lambda"
  
  inline_policies = {
    s3_access = jsonencode({
      Version = "2012-10-17"
      Statement = [{
        Effect   = "Allow"
        Action   = ["s3:GetObject", "s3:PutObject"]
        Resource = "arn:aws:s3:::my-bucket/*"
      }]
    })
  }
}

module "lambda_with_layers" {
  source = "github.com/islamelkadi/terraform-aws-lambda"
  
  layers = [
    "arn:aws:lambda:us-east-1:123456789012:layer:my-layer:1"
  ]
}

module "container_lambda" {
  source = "github.com/islamelkadi/terraform-aws-lambda"
  
  package_type = "Image"
  image_uri    = "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-lambda:latest"
}

module "lambda" {
  source = "github.com/islamelkadi/terraform-aws-lambda"
  namespace   = "example"
  environment = "prod"
  name        = "event-processor"
  region      = "us-east-1"
  
  runtime = "python3.13"
  handler = "index.handler"
  filename = "lambda.zip"
  
  memory_size = 512
  timeout     = 30
  
  environment_variables = {
    LOG_LEVEL = "INFO"
  }
  
  tags = {
    Project = "CorporateActions"
  }
}

module "lambda" {
  source = "github.com/islamelkadi/terraform-aws-lambda"
  security_controls = module.metadata.security_controls
  
  namespace   = "example"
  environment = "prod"
  name        = "event-processor"
  region      = "us-east-1"
  
  runtime = "python3.13"
  handler = "index.handler"
  filename = "lambda.zip"
  
  # VPC configuration (required by security controls)
  vpc_config = {
    subnet_ids         = module.vpc.private_subnet_ids
    security_group_ids = [module.lambda_sg.id]
  }
  
  # KMS encryption (required by security controls)
  kms_key_arn = module.kms.key_arn
  
  # Reserved concurrency (required by security controls)
  reserved_concurrent_executions = 10
  
  # Dead letter queue (required by security controls)
  dead_letter_config = {
    target_arn = module.dlq.arn
  }
  
  # CloudWatch Logs with compliance retention
  log_retention_days = 365
  
  # X-Ray tracing enabled
  enable_tracing = true
  
  memory_size = 1024
  timeout     = 300
  
  environment_variables = {
    DB_ENDPOINT = module.rds.endpoint
    S3_BUCKET   = module.s3.bucket_name
  }
}

module "lambda" {
  source = "github.com/islamelkadi/terraform-aws-lambda"
  security_controls = module.metadata.security_controls
  
  # Override security controls for development
  security_control_overrides = {
    disable_vpc_requirement      = true
    disable_reserved_concurrency = true
    disable_dead_letter_queue    = true
    justification = "Development function for testing. No VPC access needed. Unpredictable load pattern. Non-critical failures acceptable."
  }
  
  namespace   = "example"
  environment = "dev"
  name        = "test-function"
  region      = "us-east-1"
  
  runtime = "python3.13"
  handler = "index.handler"
  filename = "lambda.zip"
  
  memory_size = 256
  timeout     = 60
  
  log_retention_days = 7
}

module "api_lambda" {
  source = "github.com/islamelkadi/terraform-aws-lambda"
  security_controls = module.metadata.security_controls
  
  # Override VPC requirement for public API
  security_control_overrides = {
    disable_vpc_requirement = true
    justification = "Public API function invoked by API Gateway. No private resource access required. Reviewed and approved by security team."
  }
  
  namespace   = "example"
  environment = "prod"
  name        = "api-handler"
  region      = "us-east-1"
  
  runtime = "nodejs20.x"
  handler = "index.handler"
  filename = "api-lambda.zip"
  
  # Still use KMS encryption for environment variables
  kms_key_arn = module.kms.key_arn
  
  # Reserved concurrency for API stability
  reserved_concurrent_executions = 100
  
  memory_size = 512
  timeout     = 30
  
  environment_variables = {
    API_KEY_SECRET = "arn:aws:secretsmanager:..."
  }
}

# Lambda Function Examples
# Demonstrates various Lambda configurations with security control overrides

# ============================================================================
# Example 1: Basic Lambda Function
# Minimal configuration with fictitious deployment package
# Override: VPC and KMS not required for simple functions
# ============================================================================

module "basic_lambda" {
  source = "github.com/islamelkadi/terraform-aws-lambda"
  namespace   = var.namespace
  environment = var.environment
  name        = "basic-function"
  region      = var.region

  handler = "index.handler"
  runtime = "python3.13"

  # Fictitious deployment package - replace with your actual Lambda code
  # Create a simple Lambda: zip index.py -r lambda.zip
  filename = "${path.module}/lambda-packages/basic.zip"

  description = "Basic Lambda function for simple tasks"
  memory_size = 512
  timeout     = 60

  # Security Control Overrides: Relaxed for basic function
  security_control_overrides = {
    disable_vpc_requirement = true
    disable_kms_requirement = true
    justification           = "Basic Lambda function with no sensitive data or private resource access. VPC and KMS encryption not required."
  }

  # Basic monitoring
  enable_tracing     = true
  log_retention_days = 90

  tags = {
    Example = "basic"
  }
}

# ============================================================================
# Example 2: Production Lambda with Full Compliance
# All security controls enforced (VPC, KMS, DLQ, Reserved Concurrency)
# ============================================================================

module "production_lambda" {
  source = "github.com/islamelkadi/terraform-aws-lambda"
  namespace   = var.namespace
  environment = "prod"
  name        = "data-processor"
  region      = var.region

  handler  = "index.handler"
  runtime  = "python3.13"
  filename = "${path.module}/lambda-packages/processor.zip"

  description = "Production Lambda with full security compliance"
  memory_size = 2048
  timeout     = 300

  # VPC Configuration - replace with your actual VPC resources
  vpc_config = {
    subnet_ids         = var.vpc_subnet_ids
    security_group_ids = var.vpc_security_group_ids
  }

  # KMS Encryption - replace with your actual KMS key ARN
  kms_key_arn = var.kms_key_arn

  # Dead Letter Queue - replace with your actual SQS queue ARN
  dead_letter_config = {
    target_arn = var.dlq_arn
  }

  # Reserved Concurrency - prevent resource exhaustion
  reserved_concurrent_executions = 50

  # X-Ray Tracing - observability
  enable_tracing = true
  tracing_mode   = "Active"

  # CloudWatch Logs - 365-day retention for compliance
  log_retention_days = 365
  create_log_group   = true

  # Environment Variables
  environment_variables = {
    LOG_LEVEL = "INFO"
    STAGE     = "production"
  }

  tags = {
    Environment = "Production"
    Compliance  = "FullyCompliant"
    Example     = "production"
  }
}

# ============================================================================
# Example 3: API Lambda (API Gateway Integration)
# Override: VPC not required for public-facing functions
# ============================================================================

module "api_lambda" {
  source = "github.com/islamelkadi/terraform-aws-lambda"
  namespace   = var.namespace
  environment = var.environment
  name        = "public-api"
  region      = var.region

  handler  = "index.handler"
  runtime  = "python3.13"
  filename = "${path.module}/lambda-packages/api.zip"

  description = "Public-facing Lambda invoked by API Gateway"
  memory_size = 1024
  timeout     = 30

  # Security Control Override: VPC not required
  security_control_overrides = {
    disable_vpc_requirement = true
    justification           = "Public-facing Lambda invoked by API Gateway. VPC integration would add cold start latency without security benefit."
  }

  # KMS encryption for environment variables
  kms_key_arn = var.kms_key_arn

  # Dead letter queue
  dead_letter_config = {
    target_arn = var.dlq_arn
  }

  reserved_concurrent_executions = 10
  enable_tracing                 = true
  log_retention_days             = 90

  environment_variables = {
    API_VERSION = "v1"
  }

  tags = {
    UseCase = "PublicAPI"
    Example = "api-gateway"
  }
}