module "s3_jobs-responses" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256"

  bucket_name        = "${local.name_prefix}-jobs-responses"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/jobs-responses/"

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Data",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_DATA_S3"
    }
  )
}

module "s3-spotify_charts" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256"

  bucket_name        = "${local.name_prefix}-spotify-charts"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/spotify-charts/"

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Data",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_DATA_S3"
    }
  )
}

module "bucket_policies" {
  source = "../../../modules/s3/bucket_policies/external_access_multibucket"

  full_access_arns = [
    local.delphi_dev_root_arn,
    local.delphi_prod_root_arn
  ]

  bucket_list = [
    module.s3_jobs-responses.bucket.id,
    module.s3-spotify_charts.bucket.id,
  ]
}

// We have to use dev-apollo-new prefix because bucket without -new prefix already exists
module "lambda_artifacts_bucket" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256"

  bucket_name        = "${local.name_prefix}-new-lambda-artifacts"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/lambda_artifacts/"
  default_policy     = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_S3"
    }
  )
}

module "vendor_image_caching_bucket" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256"

  bucket_name        = "${local.name_prefix}-vendor-image-caching"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/vendor-image-caching/"
  expiration_days    = 1

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_PRL_S3"
    }
  )
}

module "admin_panel_assets" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256"

  bucket_name        = "${local.name_prefix}-admin-panel-assets"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/admin-panel-assets/"
  ignore_public_acls = false
  block_public_acls  = false
  default_policy     = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_PRL_S3"
    }
  )
}

module "apollo_notifications_bucket" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256"

  bucket_name        = "${local.name_prefix}-notifications"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/notifications/"
  default_policy     = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_PRL_S3"
    }
  )
}

module "auth0_log_offset_bucket" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256"

  bucket_name        = "${local.name_prefix}-auth0-log-offset"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/auth0-log-offset/"
  default_policy     = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_PRL_S3"
    }
  )
}

module "export_playlists_daily_bucket" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256"

  bucket_name        = "${local.name_prefix}-export-playlists-daily"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/export-playlists-daily/"
  default_policy     = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_PRL_S3"
    }
  )
}

module "s3_athena_output" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256"

  bucket_name        = "${local.name_prefix}-athena-output"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/athena-output/"
  default_policy     = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_S3"
    }
  )
}

module "s3_athena_alb_logs_db" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256"

  bucket_name        = "${local.name_prefix}-alb-logs-query-results"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/alb-logs-query-results/"
  default_policy     = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Data",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_DATA_S3"
    }
  )
}


module "s3_filtr" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256_v2"

  bucket_name        = "filtr.com"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/filtr.com/"
  default_policy     = false
  versioning         = true
  object_ownership   = "BucketOwnerEnforced"

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_S3"
    }
  )
}

resource "aws_s3_bucket_website_configuration" "s3_filtr" {
  bucket = module.s3_filtr.id

  index_document {
    suffix = "index.html"
  }

  error_document {
    key = "index.html"
  }
}

module "filtr_default_bucket_policy" {
  source              = "../../../modules/s3/bucket_policies/default_policy_template"
  template_bucket_arn = module.s3_filtr.arn
}

data "aws_iam_policy_document" "filtr" {
  version                 = "2012-10-17"
  policy_id               = "CloudFrontRO"
  source_policy_documents = [module.filtr_default_bucket_policy.document.json]

  statement {
    sid       = "CloudFrontRO"
    effect    = "Allow"
    actions   = ["s3:GetObject"]
    resources = ["${module.s3_filtr.arn}/*"]

    principals {
      identifiers = [aws_cloudfront_origin_access_identity.filtr.iam_arn]
      type        = "AWS"
    }
  }
}

resource "aws_s3_bucket_policy" "filtr" {
  bucket = module.s3_filtr.id
  policy = data.aws_iam_policy_document.filtr.json
}