// Scoped VPN #2 integration for an existing Azure cell.
// Core VNet, VM, NIC and public IP resources remain owned by
// eg334s-azure-cell.bicep; this deployment touches only VPN #2 resources.
// This file contains no direct Virginia-to-Singapore connection. The current
// two-VPN architecture retains the explicit non-transitive AWS VGW boundary.
param location string = 'southeastasia'
param vnetName string = 'eg334s-vnet'
param gatewayPublicIpName string = 'eg334s-vpngw-pip'
param awsPublicCidr string = '10.1.0.0/16'
param awsVpnTunnelPublicIp string
@secure()
param vpn2SharedKey string

resource vnet 'Microsoft.Network/virtualNetworks@2023-11-01' existing = {
  name: vnetName
}

resource gatewayPublicIp 'Microsoft.Network/publicIPAddresses@2023-11-01' existing = {
  name: gatewayPublicIpName
}

resource vpnGateway 'Microsoft.Network/virtualNetworkGateways@2023-11-01' = {
  name: 'eg334s-vpngw'
  location: location
  tags: { Project: 'EG334S' }
  properties: {
    activeActive: false
    enableBgp: false
    enablePrivateIpAddress: false
    gatewayType: 'Vpn'
    vpnType: 'RouteBased'
    vpnGatewayGeneration: 'Generation1'
    ipConfigurations: [
      {
        name: 'vnetGatewayConfig'
        properties: {
          privateIPAllocationMethod: 'Dynamic'
          publicIPAddress: { id: gatewayPublicIp.id }
          subnet: {
            id: resourceId('Microsoft.Network/virtualNetworks/subnets', vnet.name, 'GatewaySubnet')
          }
        }
      }
    ]
    sku: {
      name: 'VpnGw1AZ'
      tier: 'VpnGw1AZ'
    }
  }
}

resource awsLocalGateway 'Microsoft.Network/localNetworkGateways@2023-11-01' = {
  name: 'eg334s-aws-lng'
  location: location
  tags: {
    Project: 'EG334S'
    Connection: 'VPN2'
  }
  properties: {
    gatewayIpAddress: awsVpnTunnelPublicIp
    localNetworkAddressSpace: {
      addressPrefixes: [ awsPublicCidr ]
    }
  }
}

resource vpn2Connection 'Microsoft.Network/connections@2023-11-01' = {
  name: 'eg334s-vpn2-connection'
  location: location
  tags: {
    Project: 'EG334S'
    Connection: 'VPN2'
  }
  properties: {
    connectionType: 'IPsec'
    connectionProtocol: 'IKEv2'
    enableBgp: false
    routingWeight: 0
    sharedKey: vpn2SharedKey
    usePolicyBasedTrafficSelectors: false
    virtualNetworkGateway1: any({ id: vpnGateway.id })
    localNetworkGateway2: any({ id: awsLocalGateway.id })
  }
}

output vpnGatewayName string = vpnGateway.name
output vpnGatewayPublicIp string = gatewayPublicIp.properties.ipAddress
output vpn2ConnectionName string = vpn2Connection.name