data "aws_s3_bucket" "security_logs" {
  bucket = "security-${local.account_id}-logs"
}

module "default_policy_template" {
  source = "../../../../modules/s3/bucket_policies/default_policy_template"
}

module "images_api_uploaded_files" {
  source = "../../../../modules/s3/private_bucket_with_logs_aes256_v2"

  bucket_name        = "${local.name_prefix}-images-api-uploads"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/images-api-uploads/"

  cors = {
    allowed_methods = ["GET", "HEAD"]
    allowed_origins = ["https://${module.domains[local.env_prefix]["images-api"]}"]
  }
}

data "aws_iam_policy_document" "images_api_uploaded_files_bucket_policy_document" {
  version   = "2012-10-17"
  policy_id = "CloudFrontRO"

  source_policy_documents = [replace(
    module.default_policy_template.document.json,
    module.default_policy_template.bucket_arn,
    module.images_api_uploaded_files.bucket.arn,
  )]
 /*
  statement {
    sid       = "CloudFrontRO"
    effect    = "Allow"
    actions   = ["s3:GetObject"]
    resources = ["${module.images_api_uploaded_files.bucket.arn}/*"]

    principals {
      identifiers = [aws_cloudfront_origin_access_identity.images_api_uploaded_files_access_identity.iam_arn]
      type        = "AWS"
    }
  }
  */
}

resource "aws_s3_bucket_policy" "images_api_uploaded_files_bucket_policy" {
  bucket = module.images_api_uploaded_files.bucket.id
  policy = data.aws_iam_policy_document.images_api_uploaded_files_bucket_policy_document.json
}