terraform {
  required_version = ">= 0.12"
}

provider "aws" {
  region = "us-west-2"
}

resource "aws_ivs_channel" "example" {
  type = "BASIC"
}

data "aws_ivs_stream_key" "example" {
  channel_arn = aws_ivs_channel.example.arn
}

output "ingest_endpoint" {
  value = aws_ivs_channel.example.ingest_endpoint
}

output "stream_key" {
  value = data.aws_ivs_stream_key.example.value
}

output "playback_url" {
  value = aws_ivs_channel.example.playback_url
}

➜  terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
 + create
<= read (data resources)

Terraform will perform the following actions:

 # data.aws_ivs_stream_key.example will be read during apply
 # (config refers to values not yet known)
<= data "aws_ivs_stream_key" "example" {
     + arn         = (known after apply)
     + channel_arn = (known after apply)
     + id          = (known after apply)
     + tags        = (known after apply)
     + value       = (known after apply)
   }

 # aws_ivs_channel.example will be created
 + resource "aws_ivs_channel" "example" {
     + arn                         = (known after apply)
     + authorized                  = (known after apply)
     + id                          = (known after apply)
     + ingest_endpoint             = (known after apply)
     + latency_mode                = (known after apply)
     + name                        = (known after apply)
     + playback_url                = (known after apply)
     + recording_configuration_arn = (known after apply)
     + tags_all                    = (known after apply)
     + type                        = (known after apply)
   }

Plan: 1 to add, 0 to change, 0 to destroy.

Changes to Outputs:
 + ingest_endpoint = (known after apply)
 + playback_url    = (known after apply)
 + stream_key      = (known after apply)

Do you want to perform these actions?
 Terraform will perform the actions described above.
 Only 'yes' will be accepted to approve.

 Enter a value: yes

aws_ivs_channel.example: Creating...
aws_ivs_channel.example: Creation complete after 3s [id=arn:aws:ivs:us-west-2:326937407773:channel/EmVV0KxDONIR]
data.aws_ivs_stream_key.example: Reading...
data.aws_ivs_stream_key.example: Read complete after 1s [id=arn:aws:ivs:us-west-2:326937407773:stream-key/0Dy6pn6CQhMx]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

ingest_endpoint = "a447f74b0a52.global-contribute.live-video.net"
playback_url = "https://a447f74b0a52.us-west-2.playback.live-video.net/api/video/v1/us-west-2.326937407773.channel.EmVV0KxDONIR.m3u8"
stream_key = "sk_us-west-xxxxxxxxxxxxx"

provider "aws" {
   region = "us-west-2"
 }
+
+resource "aws_s3_bucket" "example" {
+  bucket_prefix = "tf-ivs-stream-archive-"
+  force_destroy = true
+}
+
+resource "aws_ivs_recording_configuration" "example" {
+  name = "tf-ivs-recording-configuration"
+  lifecycle {
+    create_before_destroy = true
+  }
+  thumbnail_configuration {
+    recording_mode = "INTERVAL"
+    target_interval_seconds = 30
+  }
+  destination_configuration {
+    s3 {
+      bucket_name = aws_s3_bucket.example.id
+    }
+  }
+}
+
 resource "aws_ivs_channel" "example" {
  type = "BASIC"
+  recording_configuration_arn = aws_ivs_recording_configuration.example.arn
 }

 data "aws_ivs_stream_key" "example" {

resource "aws_kms_key" "example" {
  description              = "KMS Key for IVS Playback"
  key_usage                = "SIGN_VERIFY"
  customer_master_key_spec = "ECC_NIST_P384"
}

data "aws_kms_public_key" "example" {
  key_id = aws_kms_key.example.key_id
}

resource "aws_ivs_playback_key_pair" "example" {
  name       = "tf-ivs-playback-key-pair"
  public_key = data.aws_kms_public_key.example.public_key_pem
}

resource "aws_ivs_channel" "example" {
  name       = "tf-ivs-playback-key-pair-example"
  authorized = true
}

➜  node create-playback-url-with-token.mjs \
  --keyId 3df50d5f-054a-4f20-88c6-bb7a73306dd0 \
  --channelArn arn:aws:ivs:us-west-2:326937407773:channel/aVbMPCM9Il2x \
  --expiresIn 30

https://a447f74b0a52.us-west-2.playback.live-video.net/api/video/v1/us-west-2.326937407773.channel.aVbMPCM9Il2x.m3u8?token=eyJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCJ9.eyJhd3M6Y2hhbm5lbC1hcm4iOiJhcm46YXdzOml2czp1cy13ZXN0LTI6MzI2OTM3NDA3NzczOmNoYW5uZWwvYVZiTVBDTTlJbDJ4IiwiYXdzOmFjY2Vzcy1jb250cm9sLWFsbG93LW9yaWdpbiI6IiIsImV4cCI6MTY3MzI3MzY5NCwiaWF0IjoxNjczMjczNjY0fQ.YAvlvVdO3rAq-7K3KHRPBvN1sU-JXJZ2963_thbaHBlBaYfyGYGAiqdJEN8XraEm3uc-h8NZiea8o0_XlOCHWIh9F1TGI1hSPqD7YY757C0ZF5cNsyBU49-sPbPvqpqa

resource "aws_ivschat_room" "example" {
}

// index.js

/** IVS Chat message review handler */
exports.handler = async function ({ Content }) {
    return {
        ReviewResult: "ALLOW",
        Content: `${Content} - edited by Lambda`
    };
}

# main.tf

data "aws_region" "current" {}

data "aws_caller_identity" "current" {}

resource "aws_iam_role" "example" {
  name               = "tf-ivschat-message-handler-role"
  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Action": ["sts:AssumeRole"],
        "Principal": {"Service": "lambda.amazonaws.com"}
    }]
}
EOF
}

data "archive_file" "message_review_handler" {
  type        = "zip"
  source_file = "${path.module}/index.js"
  output_path = "${path.module}/lambda-handler.zip"
}

resource "aws_lambda_function" "example" {
  filename         = data.archive_file.message_review_handler.output_path
  function_name    = "tf-ivschat-message-handler"
  role             = aws_iam_role.example.arn
  source_code_hash = data.archive_file.message_review_handler.output_base64sha256
  runtime          = "nodejs18.x"
  handler          = "index.handler"
}

resource "aws_lambda_permission" "example" {
  action         = "lambda:InvokeFunction"
  function_name  = aws_lambda_function.example.function_name
  principal      = "ivschat.amazonaws.com"
  source_account = data.aws_caller_identity.current.account_id
  source_arn     = "arn:aws:ivschat:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:room/*"
}

resource "aws_ivschat_room" "example" {
  name       = "tf-ivschat-room"
  depends_on = [aws_lambda_permission.example]

  message_review_handler {
    uri             = aws_lambda_function.example.arn
    fallback_result = "ALLOW"
  }
}

resource "aws_s3_bucket" "example" {
  bucket_prefix = "tf-ivschat-logging-"
  force_destroy = true
}

resource "aws_ivschat_logging_configuration" "example" {
  name = "tf-ivschat-logging-configuration"
  destination_configuration {
    s3 {
      bucket_name = aws_s3_bucket.example.id
    }
  }
}

resource "aws_ivschat_room" "example" {
  name                              = "tf-ivschat-room"
  logging_configuration_identifiers = [aws_ivschat_logging_configuration.example.arn]
}