module "s3_ddex_feed" {
  source             = "../../../modules/s3/private_bucket_with_logs_aes256_v2"
  bucket_name        = "${local.env_prefix}-ddex-feed"
  logs_bucket_id     = data.aws_s3_bucket.logs.id
  logs_object_prefix = "${local.name_prefix}/ddex-feed/"
  expiration_days    = 14 # DAPD-720
  common_tags = merge(
    local.common_tags,
    {
      project                  = "SLZ Data",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_SLZD_S3"
    }
  )
}

module "s3_ddex_feed_bucket_policy" {
  source      = "../../../modules/s3/bucket_policies/restrictive_for_prod_v2"
  bucket      = module.s3_ddex_feed.bucket.id
  admin_users = var.admin_users
  admin_roles = var.admin_roles
}

module "iam_ddex_feed_rw_policy" {
  source       = "../../../modules/iam/policies/s3/buckets_rw"
  name         = "ddex-feed-s3-rw"
  name_prefix  = local.env_prefix
  bucket_masks = [module.s3_ddex_feed.bucket.id]
}

module "iam_ddex_feed_ro_policy" {
  source       = "../../../modules/iam/policies/s3/buckets_ro"
  name         = "ddex-feed-s3-ro"
  name_prefix  = local.env_prefix
  bucket_masks = [module.s3_ddex_feed.bucket.id]
}

resource "aws_iam_user" "ddex_feed_user" {
  name = "${local.env_prefix}_ddex_feed_user"
}

resource "aws_iam_user_policy_attachment" "ddex_feed_user_s3" {
  user       = aws_iam_user.ddex_feed_user.name
  policy_arn = module.iam_ddex_feed_rw_policy.policy.arn
}