resource "aws_s3_bucket_policy" "vendor_image_caching_bucket_policy" {
  bucket = module.vendor_image_caching_bucket.bucket.id
  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSSLRequestsOnly",
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:*",
      "Resource": [
        "${module.vendor_image_caching_bucket.bucket.arn}/*",
        "${module.vendor_image_caching_bucket.bucket.arn}"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    },
    {
      "Sid": "OnlyCloudfrontReadAccess",
      "Principal": {
        "AWS": "${aws_cloudfront_origin_access_identity.vendor_image_caching_cdn_identity.iam_arn}"
      },
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "${module.vendor_image_caching_bucket.bucket.arn}/*"
    }
  ]
}
POLICY
}

resource "aws_cloudfront_origin_access_identity" "vendor_image_caching_cdn_identity" {
  comment = "Cloudfront access identity for accessing bucket ${module.vendor_image_caching_bucket.bucket.id}"
}

resource "aws_cloudfront_distribution" "vendor_image_caching_cdn" {
  enabled      = false
  price_class  = "PriceClass_100"
  http_version = "http2"
  web_acl_id   = data.aws_wafv2_web_acl.ioc_web_acl_global.arn

  origin {
    origin_id   = "origin-bucket-${module.vendor_image_caching_bucket.bucket.id}"
    domain_name = "${module.vendor_image_caching_bucket.bucket.id}.s3.${var.aws_region_id}.amazonaws.com"
    s3_origin_config {
      origin_access_identity = aws_cloudfront_origin_access_identity.vendor_image_caching_cdn_identity.cloudfront_access_identity_path
    }
  }

  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    target_origin_id       = "origin-bucket-${module.vendor_image_caching_bucket.bucket.id}"
    viewer_protocol_policy = "https-only"
    compress               = true
    min_ttl                = 0
    default_ttl            = 86400
    max_ttl                = 2629746 // 1 month
    forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
    }
  }

  logging_config {
    include_cookies = false
    bucket          = data.aws_s3_bucket.security_logs.bucket_domain_name
    prefix          = "cf/${local.name_prefix}-vendor-image-caching"
  }

  viewer_certificate {
    cloudfront_default_certificate = true
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "Cloudfront",
      plat_env_project_service = "${local.aggregated_tag}_PRL_CFR"
    }
  )
}

resource "aws_cloudfront_origin_access_identity" "apollo_go_swagger_identity" {
  comment = "Cloudfront access identity for accessing bucket ${aws_s3_bucket.apollo_go_swagger.id}"
}

resource "aws_cloudfront_distribution" "apollo_go_swagger" {
  enabled      = false
  web_acl_id   = data.aws_wafv2_web_acl.ioc_web_acl_global.arn
  price_class  = "PriceClass_100"
  http_version = "http2"
  aliases      = [aws_s3_bucket.apollo_go_swagger.id]

  logging_config {
    include_cookies = false
    bucket          = data.aws_s3_bucket.security_logs.bucket_domain_name
    prefix          = "cf/${local.name_prefix}-insights-swagger.apollo.stream"
  }

  origin {
    origin_id   = "origin-bucket-${aws_s3_bucket.apollo_go_swagger.id}"
    domain_name = aws_s3_bucket.apollo_go_swagger.bucket_regional_domain_name

    s3_origin_config {
      origin_access_identity = aws_cloudfront_origin_access_identity.apollo_go_swagger_identity.cloudfront_access_identity_path
    }
  }

  default_root_object = "swagger.html"

  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    target_origin_id       = "origin-bucket-${aws_s3_bucket.apollo_go_swagger.id}"
    min_ttl                = "0"
    default_ttl            = "3600"
    max_ttl                = "86400"
    viewer_protocol_policy = "redirect-to-https"
    compress               = true

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    acm_certificate_arn      = data.aws_acm_certificate.wildcard_filtr_apollo_cert.arn
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }

  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "Cloudfront",
      plat_env_project_service = "${local.aggregated_tag}_PRL_CFR"
    }
  )
}

resource "aws_route53_record" "apollo_go_swagger_record" {
  provider = aws.gdb-delphi-dev

  zone_id = data.aws_route53_zone.apollo_stream_domain.zone_id
  name    = "${local.env_prefix}-insights-swagger.apollo.stream"
  type    = "A"

  alias {
    name                   = aws_cloudfront_distribution.apollo_go_swagger.domain_name
    zone_id                = aws_cloudfront_distribution.apollo_go_swagger.hosted_zone_id
    evaluate_target_health = false
  }
}