module "s3_billing_reports" {
  source             = "../../../modules/s3/private_bucket_with_logs_aes256_v2"
  bucket_name        = "${local.name_prefix}-billing-reports"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/billing-reports/"
  bucket_policy      = module.quicksight_to_s3_billing_access.policy_document.json

  versioning                         = true
  noncurrent_version_expiration_days = 30

  common_tags = {}
}

module "s3_billing_reports_staging" {
  source             = "../../../modules/s3/private_bucket_with_logs_aes256_v2"
  bucket_name        = "${local.name_prefix}-billing-reports-staging"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/billing-reports-staging/"
  bucket_policy      = module.quicksight_to_s3_billing_access.policy_document.json

  versioning                         = true
  noncurrent_version_expiration_days = 30

  common_tags = {}
}

module "quicksight_to_s3_billing_access" {
  source = "../../../modules/s3/bucket_policies/external_access_template"
  full_access_arns = [
    "arn:aws:iam::475275892927:role/service-role/aws-quicksight-s3-consumers-role-v0",
    "arn:aws:iam::475275892927:role/service-role/aws-quicksight-service-role-v0",
  ]
}

resource "aws_s3_object" "manifest_staging" {
  bucket                 = module.s3_billing_reports_staging.bucket.id
  key                    = "manifest.json"
  server_side_encryption = "AES256"
  content_type           = "application/json"

  content = templatefile(
    "${path.module}/manifest.json",
    {
      bucket        = module.s3_billing_reports_staging.bucket.id,
      report_prefix = "report"
    }
  )
}

resource "aws_s3_object" "manifest" {
  bucket                 = module.s3_billing_reports.bucket.id
  key                    = "manifest.json"
  server_side_encryption = "AES256"
  content_type           = "application/json"

  content = templatefile(
    "${path.module}/manifest.json",
    {
      bucket        = module.s3_billing_reports.bucket.id,
      report_prefix = "report"
    }
  )

}

module "s3_configs" {
  source             = "../../../modules/s3/private_bucket_with_logs_aes256_v2"
  bucket_name        = "${local.name_prefix}-configs"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/configs/"
  default_policy     = true

  versioning                         = true
  noncurrent_version_expiration_days = 30

  common_tags = {
    project                  = "Infrastructure",
    service                  = "S3",
    plat_env_project_service = "${local.aggregated_tag}_S3"
  }
}

resource "aws_s3_object" "account_mappings" {
  bucket                 = module.s3_configs.bucket.id
  key                    = "billing_account_mappings.json"
  server_side_encryption = "AES256"
  content_type           = "application/json"

  content = jsonencode(var.account_mappings)
}

resource "aws_s3_object" "tag_mappings" {
  bucket                 = module.s3_configs.bucket.id
  key                    = "billing_tag_mappings.json"
  server_side_encryption = "AES256"
  content_type           = "application/json"

  content = jsonencode(var.tag_mappings)
}