module "default_policy_template" {
  source = "../../../modules/s3/bucket_policies/default_policy_template"
}

resource "aws_s3_bucket" "docs_bucket" {
  bucket        = module.domains[local.env_prefix]["swagger"]
  force_destroy = true

  tags = merge(
    local.common_tags,
    {
      project                  = "Core",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_CORE_S3"
    }
  )
}

resource "aws_s3_bucket_logging" "docs_bucket" {
  bucket        = aws_s3_bucket.docs_bucket.id
  target_bucket = data.aws_s3_bucket.security_logs.id
  target_prefix = "s3/${local.name_prefix}/docs.atlas.stream/"
}

resource "aws_s3_bucket_website_configuration" "docs_bucket" {
  bucket = aws_s3_bucket.docs_bucket.id
  index_document {
    suffix = "index.html"
  }
  error_document {
    key = "error.html"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "docs_bucket" {
  bucket = aws_s3_bucket.docs_bucket.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_bucket_ownership_controls" "docs_bucket" {
  bucket = aws_s3_bucket.docs_bucket.id

  rule {
    object_ownership = "BucketOwnerEnforced"
  }
}

data "aws_iam_policy_document" "docs_bucket_policy_document" {
  version   = "2012-10-17"
  policy_id = "CloudFrontRO"

  source_policy_documents = [replace(
    module.default_policy_template.document.json,
    module.default_policy_template.bucket_arn,
    aws_s3_bucket.docs_bucket.arn,
  )]

  statement {
    sid       = "CloudFrontRO"
    effect    = "Allow"
    actions   = ["s3:GetObject"]
    resources = ["${aws_s3_bucket.docs_bucket.arn}/*"]

    principals {
      identifiers = [aws_cloudfront_origin_access_identity.docs_access_identity.iam_arn]
      type        = "AWS"
    }
  }
}

resource "aws_s3_bucket_policy" "docs_bucket_policy" {
  bucket = aws_s3_bucket.docs_bucket.id
  policy = data.aws_iam_policy_document.docs_bucket_policy_document.json
}

module "images_mapping_bucket" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256"

  bucket_name        = "${local.name_prefix}-images-mapping"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "s3/${local.name_prefix}/images-mapping/"
  versioning         = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Core",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_CORE_S3"
    }
  )
}

module "static_files" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256_v2"

  bucket_name        = "${local.name_prefix}-static-um"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/static-um/"

  cors = {
    allowed_methods = ["GET", "HEAD"]
    allowed_origins = ["https://${module.domains[local.env_prefix]["atlas-um"]}"]
  }
}

data "aws_iam_policy_document" "static_files_bucket_policy_document" {
  version   = "2012-10-17"
  policy_id = "CloudFrontRO"

  source_policy_documents = [replace(
    module.default_policy_template.document.json,
    module.default_policy_template.bucket_arn,
    module.static_files.bucket.arn,
  )]

  statement {
    sid       = "CloudFrontRO"
    effect    = "Allow"
    actions   = ["s3:GetObject"]
    resources = ["${module.static_files.bucket.arn}/*"]

    principals {
      identifiers = [aws_cloudfront_origin_access_identity.static_files_access_identity.iam_arn]
      type        = "AWS"
    }
  }
}

resource "aws_s3_bucket_policy" "static_files_bucket_policy" {
  bucket = module.static_files.bucket.id
  policy = data.aws_iam_policy_document.static_files_bucket_policy_document.json
}

module "lambda_artifacts_s3_bucket" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256_v2"

  bucket_name        = "${local.name_prefix}-lambda-artifacts"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/lambda-artifacts/"
  default_policy     = true
}

module "athena_results_s3_bucket" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256_v2"

  bucket_name        = "${local.name_prefix}-athena-results"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/athena-results/"
  default_policy     = true
}

module "static_notifications" {
  source = "../../../modules/s3/private_bucket_with_logs_aes256_v2"

  bucket_name        = "${local.name_prefix}-static-notifications"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/static-notifications/"

  cors = {
    allowed_methods = ["GET", "HEAD"]
    allowed_origins = ["https://${module.domains[local.env_prefix]["notifications-api"]}"]
  }
}

data "aws_iam_policy_document" "static_notifications_bucket_policy_document" {
  version   = "2012-10-17"
  policy_id = "CloudFrontRO"

  source_policy_documents = [replace(
    module.default_policy_template.document.json,
    module.default_policy_template.bucket_arn,
    module.static_notifications.bucket.arn,
  )]

  statement {
    sid       = "CloudFrontRO"
    effect    = "Allow"
    actions   = ["s3:GetObject"]
    resources = ["${module.static_notifications.bucket.arn}/*"]

    principals {
      identifiers = [aws_cloudfront_origin_access_identity.static_notifications_access_identity.iam_arn]
      type        = "AWS"
    }
  }
}

resource "aws_s3_bucket_policy" "static_notifications_bucket_policy" {
  bucket = module.static_notifications.bucket.id
  policy = data.aws_iam_policy_document.static_notifications_bucket_policy_document.json
}