data "aws_s3_bucket" "security_logs" {
  bucket = "security-${local.account_id}-logs"
}

resource "aws_s3_bucket" "nexus_s3" {
  bucket              = "${local.name_prefix}-nexus-artifacts"
  acl                 = "private"
  acceleration_status = "Enabled"

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }

  logging {
    target_bucket = data.aws_s3_bucket.security_logs.id
    target_prefix = "s3/${local.name_prefix}/nexus-artifacts/"
  }

  lifecycle_rule {
    abort_incomplete_multipart_upload_days = 0
    enabled                                = true
    id                                     = "Expire soft-deleted blobstore objects"
    tags = {
      "deleted" = true
    }
    expiration {
      days                         = 3
      expired_object_delete_marker = false
    }
  }

  tags = merge(
    local.nexus_tags,
    {
      "Name" = "${local.name_prefix}-nexus-artifacts"
    },
  )
}

resource "aws_s3_bucket_ownership_controls" "nexus_s3" {
  bucket = aws_s3_bucket.nexus_s3.id

  rule {
    object_ownership = "BucketOwnerEnforced"
  }
}

module "default_policy_template" {
  source = "../../../modules/s3/bucket_policies/default_policy_template"
}

resource "aws_s3_bucket_policy" "nexus_s3" {
  bucket = aws_s3_bucket.nexus_s3.id
  policy = replace(
    module.default_policy_template.document.json,
    module.default_policy_template.bucket_arn,
    aws_s3_bucket.nexus_s3.arn,
  )
}