# 🤖 Account-level hygiene, sibling to cloudtrail.tf: a spending alarm and
# the EBS encryption default. Both are settings, not infrastructure — cheap,
# reversible, and account-wide.

# The budget alarm: actual spend runs ~$5/month (books.json publishes it),
# so $25 is ~5× headroom — quiet in normal months, loud the month something
# runs away (a leaked key mining, a misconfigured loop hammering S3).
# Alerts at 80% actual and 100% forecasted, to the team address.
resource "aws_budgets_budget" "monthly" {
  name         = "eleven-monthly"
  budget_type  = "COST"
  limit_amount = "25"
  limit_unit   = "USD"
  time_unit    = "MONTHLY"

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 80
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = ["team@elevenmessenger.com"]
  }

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 100
    threshold_type             = "PERCENTAGE"
    notification_type          = "FORECASTED"
    subscriber_email_addresses = ["team@elevenmessenger.com"]
  }
}

# Every NEW EBS volume in eu-west-1 (the only region we use) is encrypted at
# rest with the default KMS key. Existing volumes are untouched — the one
# unencrypted volume (the dev box's root) is fixed by recreating the box
# (infra/dev/compute.tf now declares its root encrypted; apply with
# -replace=aws_instance.dev_box).
resource "aws_ebs_encryption_by_default" "on" {
  enabled = true
}