#!/bin/bash
set -euo pipefail

# Variables
AWS_ACCOUNT_ID="339712817747"
VPC_ID="vpc-08d3efd68534a97a4"
SUBNET_ID="subnet-0dad3c15fcdf97d3b"
REGION="eu-west-2"
S3_SERVICE_NAME="com.amazonaws.$REGION.s3"

# Function to get Route Table ID associated with the Subnet
get_route_table_id() {
    aws ec2 describe-route-tables --filters "Name=association.subnet-id,Values=$SUBNET_ID" --query "RouteTables[0].RouteTableId" --output text
}

# Function to get the Security Group ID associated with the VPC Endpoint
get_security_group_id() {
    aws ec2 describe-security-groups --filters "Name=vpc-id,Values=$VPC_ID" --query "SecurityGroups[0].GroupId" --output text
}

# Function to get VPC Endpoint ID for S3
get_vpc_endpoint_id() {
    aws ec2 describe-vpc-endpoints --filters "Name=vpc-id,Values=$VPC_ID" "Name=service-name,Values=$S3_SERVICE_NAME" --query "VpcEndpoints[0].VpcEndpointId" --output text
}

# Function to create an S3 VPC Endpoint if it doesn't exist
create_s3_vpc_endpoint() {
    echo "Creating S3 VPC Endpoint..."
    aws ec2 create-vpc-endpoint --vpc-id $VPC_ID --service-name $S3_SERVICE_NAME --route-table-ids $ROUTE_TABLE_ID --region $REGION --query "VpcEndpoint.VpcEndpointId" --output text
}

# Function to check and add route to the Route Table if it doesn't exist
add_route_to_s3_endpoint() {
    echo "Adding route to S3 Endpoint in Route Table..."
    aws ec2 create-route --route-table-id $ROUTE_TABLE_ID --destination-prefix-list-id $PREFIX_LIST_ID --vpc-endpoint-id $VPC_ENDPOINT_ID --output json
}

# Function to check and add Security Group rules if they don't exist
add_security_group_rules() {
    echo "Adding Security Group rules..."
    aws ec2 authorize-security-group-ingress --group-id $SECURITY_GROUP_ID --protocol tcp --port 443 --cidr 0.0.0.0/0 --output json || echo "Ingress rule already exists or failed to add."
    aws ec2 authorize-security-group-egress --group-id $SECURITY_GROUP_ID --protocol tcp --port 443 --cidr 0.0.0.0/0 --output json || echo "Egress rule already exists or failed to add."
}

# Get Route Table ID
ROUTE_TABLE_ID=$(get_route_table_id)
if [[ -z "$ROUTE_TABLE_ID" ]]; then
    echo "No Route Table associated with Subnet $SUBNET_ID found."
    exit 1
fi
echo "Route Table ID: $ROUTE_TABLE_ID"

# Get Security Group ID
SECURITY_GROUP_ID=$(get_security_group_id)
if [[ -z "$SECURITY_GROUP_ID" ]]; then
    echo "No Security Group found in VPC $VPC_ID."
    exit 1
fi
echo "Security Group ID: $SECURITY_GROUP_ID"

# Get VPC Endpoint ID
VPC_ENDPOINT_ID=$(get_vpc_endpoint_id)
if [[ -z "$VPC_ENDPOINT_ID" ]]; then
    VPC_ENDPOINT_ID=$(create_s3_vpc_endpoint)
else
    echo "S3 VPC Endpoint already exists: $VPC_ENDPOINT_ID"
fi

# Get Prefix List ID for S3
PREFIX_LIST_ID=$(aws ec2 describe-managed-prefix-lists --query "PrefixLists[?PrefixListName=='com.amazonaws.$REGION.s3'].PrefixListId" --output text)
if [[ -z "$PREFIX_LIST_ID" ]]; then
    echo "Prefix List ID for S3 not found."
    exit 1
fi

# Check and add route to S3 Endpoint
ROUTE_EXISTS=$(aws ec2 describe-route-tables --route-table-ids $ROUTE_TABLE_ID --query "RouteTables[0].Routes[?DestinationPrefixListId=='$PREFIX_LIST_ID'].DestinationPrefixListId" --output text)
if [[ -z "$ROUTE_EXISTS" ]]; then
    add_route_to_s3_endpoint
else
    echo "Route to S3 Endpoint already exists in Route Table."
fi

# Add Security Group rules
add_security_group_rules

echo "Configuration completed."