data "aws_caller_identity" "current" {}

# Account main log bucket
data "aws_s3_bucket" "logs" {
  bucket = "security-${data.aws_caller_identity.current.account_id}-logs"
}

module "audit_bucket" {
  source             = "../../../modules/s3/private_bucket_with_logs_aes256_v2"
  bucket_name        = "${var.name_prefix}-audit-logs"
  logs_bucket_id     = data.aws_s3_bucket.logs.id
  logs_object_prefix = "${var.name_prefix}/audit-logs/"
  common_tags        = var.common_tags
}

resource "aws_s3_bucket_policy" "main" {
  bucket = module.audit_bucket.bucket.id
  policy = data.aws_iam_policy_document.main.json
}

module "default_bucket_policy" {
  source              = "../../../modules/s3/bucket_policies/default_policy_template"
  template_bucket_arn = module.audit_bucket.bucket.arn
}

data "aws_iam_policy_document" "main" {
  version   = "2012-10-17"
  policy_id = "Resource policy for ${module.audit_bucket.bucket.id}"

  source_policy_documents = [module.default_bucket_policy.document.json]

  statement {
    sid    = "Explicit allow for external write if match the condition"
    effect = "Allow"
    actions = [
      "s3:PutObject",
    ]
    resources = [
      "${module.audit_bucket.bucket.arn}/*",
    ]
    principals {
      type        = "AWS"
      identifiers = [var.audit_writer_role]
    }
  }
}