resource "aws_route53_resolver_endpoint" "private_resolver" {
  name      = "xdr_msoc_local"
  direction = "INBOUND"

  security_group_ids = [aws_security_group.resolver_security_group.id]

  dynamic "ip_address" {
    for_each = var.subnets

    content {
      subnet_id = ip_address.value
    }
  }

  tags = merge(local.standard_tags, var.tags)
}

resource "aws_security_group" "resolver_security_group" {
  name        = "route53_resolver_inbound"
  description = "Allow DNS inbound traffic"
  vpc_id      = var.primary_vpc

  ingress {
    description = "DNS_UDP"
    from_port   = 53
    to_port     = 53
    protocol    = "udp"
    cidr_blocks = ["10.0.0.0/8"]
  }

  ingress {
    description = "DNS_TCP"
    from_port   = 53
    to_port     = 53
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }

  egress {
    description = "DNS_UDP"
    from_port   = 53
    to_port     = 53
    protocol    = "udp"
    cidr_blocks = ["10.0.0.0/8"]
  }

  egress {
    description = "DNS_TCP"
    from_port   = 53
    to_port     = 53
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }

  tags = merge(local.standard_tags, var.tags)
}