if inside?(:default)
  ecs_services :change_log_ingest do
    cluster :services
    only_in settings.core_environments

    service :change_log_ingest do
      internal

      certificate settings.changelog_service.certificate

      valid_hostname settings.changelog.valid_hostnames

      add_dns_alias subdomain: 'change-log-ingest', domain: settings.internal_services.domain, zone: settings.internal_services.dns_zone, type: :regional
      ingress port: 443, source: settings.trusted_subnets.internal

      health_check_path '/debug/running'

      access_logs bucket: :alb_access_logs

      task_role do
        allow actions: 's3:GetObject', resource: [settings.arcana_s3_bucket_arn, "#{service_id}/*"].join('/')
        allow actions: 's3:PutObject', resource: [settings.audit_s3_bucket_arn, '*'].join('/')
        allow actions: 'sns:Publish', resource: arn_builder(service: :sns, resource: :audit_log_ingress)
        allow actions: ['ssm:PutParameter', 'ssm:DeleteParameter', 'ssm:GetParameterHistory', 'ssm:GetParametersByPath', 'ssm:GetParameters', 'ssm:GetParameter', 'ssm:DeleteParameters'], resource: arn_builder(service: :ssm, resource: 'parameter', path: "#{service_id}/*")
        allow actions: ['sns:Publish'], resource: arn_builder(service: :sns, resource: :sensu_ingress)
        allow actions: 'cloudwatch:PutMetricData', resource: '*'
      end

      kms_key service_id do
        allow role: :task_role
        allow :full, role: 'CPE-Admin'
      end
    end 
  end
end

if inside?(:shadow)
  ecs_services :change_log_ingest do
    cluster :services
    only_in settings.core_environments

    service :change_log_ingest do
      internal

      certificate settings.changelog_service.certificate

      valid_hostname settings.changelog.valid_hostnames

      add_dns_alias subdomain: 'change-log-ingest', domain: settings.internal_services.domain, zone: settings.internal_services.dns_zone, type: :regional
      
      ingress port: 443, source: settings.trusted_subnets.internal

      health_check_path '/debug/running'

      access_logs bucket: :alb_access_logs

      task_role do
        allow actions: 's3:GetObject', resource: [settings.arcana_s3_bucket_arn, "#{service_id}/*"].join('/')
        allow actions: 's3:PutObject', resource: [settings.audit_s3_bucket_arn, '*'].join('/')
        allow actions: 'sns:Publish', resource: arn_builder(service: :sns, resource: :audit_log_ingress) 
        allow actions: ['ssm:PutParameter', 'ssm:DeleteParameter', 'ssm:GetParameterHistory', 'ssm:GetParametersByPath', 'ssm:GetParameters', 'ssm:GetParameter', 'ssm:DeleteParameters'], resource: arn_builder(service: :ssm, resource: 'parameter', path: "#{service_id}/*")         
        allow actions: ['sns:Publish'], resource: arn_builder(service: :sns, resource: :sensu_ingress)
        allow actions: 'cloudwatch:PutMetricData', resource: '*'
      end

      kms_key service_id do
        allow role: :task_role
        allow :full, role: 'CPE-Admin'
      end
    end 
  end
end
