resource "aws_s3_bucket_policy" "developer_filtr_com_bucket_policy" {
  bucket = module.developer_filtr_com_bucket.bucket.id
  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSSLRequestsOnly",
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:*",
      "Resource": [
        "${module.developer_filtr_com_bucket.bucket.arn}/*",
        "${module.developer_filtr_com_bucket.bucket.arn}"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    },
    {
      "Sid": "OnlyCloudfrontReadAccess",
      "Principal": {
        "AWS": "${aws_cloudfront_origin_access_identity.developer_filtr_com_identity.iam_arn}"
      },
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "${module.developer_filtr_com_bucket.bucket.arn}/*"
    }
  ]
}
POLICY
}

resource "aws_cloudfront_origin_access_identity" "developer_filtr_com_identity" {
  comment = "Cloudfront access identity for accessing bucket ${module.developer_filtr_com_bucket.bucket.id}"
}

resource "aws_cloudfront_distribution" "developer_filtr_com_static_distribution" {
  enabled      = false
  price_class  = "PriceClass_100"
  http_version = "http2"
  aliases      = ["developer.filtr.com"]
  web_acl_id   = "arn:aws:wafv2:us-east-1:475275892927:global/webacl/gdb-delphi-dev_web_acl/2812c00b-d92f-4413-a239-393669394990"

  logging_config {
    include_cookies = false
    bucket          = data.aws_s3_bucket.security_logs.bucket_domain_name
    prefix          = "cf/${local.name_prefix}-developer-filtr-com"
  }

  origin {
    origin_id   = "origin-bucket-${module.developer_filtr_com_bucket.bucket.id}"
    domain_name = module.developer_filtr_com_bucket.bucket.bucket_domain_name

    s3_origin_config {
      origin_access_identity = aws_cloudfront_origin_access_identity.developer_filtr_com_identity.cloudfront_access_identity_path
    }
  }

  default_root_object = "index.html"
  default_cache_behavior {
    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "origin-bucket-${module.developer_filtr_com_bucket.bucket.id}"
    min_ttl          = "43200"    // 12 hours
    default_ttl      = "86400"    // 1 day
    max_ttl          = "31536000" // 1 year
    // This redirects any HTTP request to HTTPS. Security first!
    viewer_protocol_policy = "redirect-to-https"
    compress               = true

    forwarded_values {
      query_string = false
      headers      = ["Origin"]
      cookies {
        forward = "none"
      }
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    acm_certificate_arn      = "arn:aws:acm:us-east-1:475275892927:certificate/24b371bc-88e8-4d18-9afc-2ca9e19b714b"
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }

  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "Cloudfront",
      plat_env_project_service = "${local.aggregated_tag}_PRL_CFR"
    }
  )
}

resource "aws_cloudfront_origin_access_identity" "sony_editorial_images_identity" {
  comment = "Cloudfront access identity for accessing bucket ${aws_s3_bucket.sony_editorial_images.id}"
}

resource "aws_cloudfront_distribution" "sony_editorial_images_distribution" {
  enabled      = true
  price_class  = "PriceClass_All"
  http_version = "http2"
  web_acl_id   = "arn:aws:wafv2:us-east-1:475275892927:global/webacl/gdb-delphi-dev_web_acl/2812c00b-d92f-4413-a239-393669394990"

  logging_config {
    include_cookies = false
    bucket          = data.aws_s3_bucket.security_logs.bucket_domain_name
    prefix          = "cf/${local.name_prefix}-editorialimages"
  }

  origin {
    origin_id   = "MyOrigin"
    domain_name = aws_s3_bucket.sony_editorial_images.bucket_domain_name

    s3_origin_config {
      origin_access_identity = aws_cloudfront_origin_access_identity.sony_editorial_images_identity.cloudfront_access_identity_path
    }
  }

  default_root_object = "index.html"
  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    target_origin_id       = "MyOrigin"
    min_ttl                = "0"
    max_ttl                = "31536000"
    viewer_protocol_policy = "https-only"
    compress               = true

    forwarded_values {
      query_string = false
      headers      = ["Origin"]
      cookies {
        forward = "none"
      }
    }
  }

  custom_error_response {
    error_caching_min_ttl = 43200 // 12 hours
    error_code            = 404
    response_code         = 200
    response_page_path    = "/index.html"
  }

  custom_error_response {
    error_caching_min_ttl = 43200 // 12 hours
    error_code            = 403
    response_code         = 200
    response_page_path    = "/index.html"
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
  }

  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "Cloudfront",
      plat_env_project_service = "${local.aggregated_tag}_PRL_CFR"
    }
  )
}