resource "aws_vpc_endpoint" "this" {
  vpc_id = var.vpc_id
  service_name = "com.amazonaws.us-east-1.elasticmapreduce"
  vpc_endpoint_type = "Interface"
  security_group_ids = [aws_security_group.vpc-endpoints.id]
  subnet_ids = var.private_subnets
  private_dns_enabled = true
  tags = {
    Name = "${module.vpc.name}-emr-endpoint"
  }
  policy = data.aws_iam_policy_document.vpc-endpoint-policy.json
}

resource "aws_security_group" "vpc-endpoints" {
 name        = "vpc-endpoints"
  description = "Security group for VPC Endpoints"
  vpc_id      = var.vpc_id
  tags = {
    "Name" = "${module.vpc.name}-endpoints"
  }
  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_vpc_security_group_ingress_rule" "vpc-endpoints-ingress" {
  description       = "Allow traffic to VPC endpoints"
  security_group_id = aws_security_group.vpc-endpoints.id
  cidr_ipv4         = "10.0.0.0/8"
  from_port         = 443
  to_port           = 443
  ip_protocol       = "tcp"
}

data "aws_iam_policy_document" "vpc-endpoint-policy" {
  statement {
    sid       = "DenyIfNotFromVpc"
    effect    = "Deny"
    actions   = ["*"]
    resources = ["*"]
    principals {
      type        = "*"
      identifiers = ["*"]
    }
    condition {
      test     = "StringNotEquals"
      values   = [var.vpc_id]
      variable = "aws:sourceVpc"
    }
  }
}