Resources:

  S3UserFilesBucket:
    Type: AWS::S3::Bucket
    Condition: ShouldProvisionS3andCognito
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      # Bucket name should not contain uppercase characters.
      BucketName: ${{self:provider.environment.USER_FILES_BUCKET_NAME}}
      LoggingConfiguration:
        DestinationBucketName: fansifter-s3-server-access-logs
        LogFilePrefix: ${{self:provider.environment.USER_FILES_BUCKET_NAME}}
      CorsConfiguration:
        CorsRules: 
          - AllowedHeaders:
            - "*"
            AllowedMethods:
              - GET
              - PUT
              - POST
            AllowedOrigins:
              - "*"

  S3UserFilesBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Condition: ShouldProvisionS3andCognito
    Properties:
      Bucket: !Ref S3UserFilesBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowSSLRequestsOnly
            Effect: Deny
            Principal: "*"
            Action: s3:*
            Resource:
              - !GetAtt S3UserFilesBucket.Arn
              - !Join ['', [!GetAtt S3UserFilesBucket.Arn, '/*']]
            Condition:
              Bool:
                aws:SecureTransport: false
          - Sid: DenyUnEncryptedObjectUploads
            Effect: Deny
            Principal: "*"
            Action: s3:PutObject
            Resource: !Join [ '', [ !GetAtt S3UserFilesBucket.Arn, '/*' ] ]
            Condition:
              "Null":
                s3:x-amz-server-side-encryption: "true"

  S3SystemFilesBucket:
    Type: AWS::S3::Bucket
    Condition: ShouldProvisionS3andCognito
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      # Bucket name should not contain uppercase characters.
      BucketName: ${{self:provider.environment.SYSTEM_FILES_BUCKET_NAME}}
      LoggingConfiguration:
        DestinationBucketName: fansifter-s3-server-access-logs
        LogFilePrefix: ${{self:provider.environment.SYSTEM_FILES_BUCKET_NAME}}

  S3SystemFilesBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Condition: ShouldProvisionS3andCognito
    Properties:
      Bucket: !Ref S3SystemFilesBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowSSLRequestsOnly
            Effect: Deny
            Principal: "*"
            Action: s3:*
            Resource:
              - !GetAtt S3SystemFilesBucket.Arn
              - !Join ['', [!GetAtt S3SystemFilesBucket.Arn, '/*']]
            Condition:
              Bool:
                aws:SecureTransport: false
          - Sid: DenyUnEncryptedObjectUploads
            Effect: Deny
            Principal: "*"
            Action: s3:PutObject
            Resource: !Join ['', [!GetAtt S3SystemFilesBucket.Arn, '/*']]
            Condition:
              "Null":
                s3:x-amz-server-side-encryption: "true"