# Granting access to buckets from production account
module "aws_accounts_list" {
  source = "../../../modules/iam/aws_accounts_list"
}

locals {
  delphi_prod_root_arn = "arn:aws:iam::${module.aws_accounts_list.accounts.gdb-delphi-prod}:root"
  delphi_dev_root_arn  = "arn:aws:iam::${module.aws_accounts_list.accounts.gdb-delphi-dev}:root"
}

module "s3_crm-ecommerce-data" {
  source             = "../../../modules/s3/private_bucket_with_logs_aes256_v2"
  bucket_name        = "${local.env_prefix}-crm-ecommerce-data"
  logs_bucket_id     = data.aws_s3_bucket.logs.id
  logs_object_prefix = "${local.name_prefix}/crm-ecommerce-data/"
  default_policy     = true

  custom_expiration = {
    "customer_delete_requests/"   = 15
    "woocommerce_italy_customer/" = 15
    "woocommerce_italy_order/"    = 15
    "woocommerce_italy_product/"  = 15
  }

  common_tags = merge(
    local.common_tags,
    {
      project                  = "CRM",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_CRM_S3"
    }
  )
}

module "s3_crm-marketing-cloud-email" {
  source             = "../../../modules/s3/private_bucket_with_logs_aes256_v2"
  bucket_name        = "${local.env_prefix}-crm-marketing-cloud-email"
  logs_bucket_id     = data.aws_s3_bucket.logs.id
  logs_object_prefix = "${local.name_prefix}/crm-marketing-cloud-email/"
  default_policy     = true
  common_tags = merge(
    local.common_tags,
    {
      project                  = "CRM",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_CRM_S3"
    }
  )
}

module "s3_crm-marketing-campaign-assets" {
  source             = "../../../modules/s3/private_bucket_with_logs_aes256_v2"
  bucket_name        = "${local.env_prefix}-crm-marketing-campaign-assets"
  logs_bucket_id     = data.aws_s3_bucket.logs.id
  logs_object_prefix = "${local.name_prefix}/crm-marketing-campaign-assets/"
  default_policy     = false
  common_tags = merge(
    local.common_tags,
    {
      project                  = "CRM",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_CRM_S3"
    }
  )
}


resource "aws_s3_bucket_policy" "s3_crm-marketing-campaign-assets_policy" {
  bucket = module.s3_crm-marketing-campaign-assets.bucket.id
  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSSLRequestsOnly",
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:*",
      "Resource": [
        "${module.s3_crm-marketing-campaign-assets.bucket.arn}/*",
        "${module.s3_crm-marketing-campaign-assets.bucket.arn}"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    },
    {
      "Sid": "OnlyCloudfrontReadAccess",
      "Principal": {
        "AWS": "${aws_cloudfront_origin_access_identity.mct_frontend_identity.iam_arn}"
      },
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "${module.s3_crm-marketing-campaign-assets.bucket.arn}/*"
    }
  ]
}
POLICY
}