module "default_policy_template" {
  source = "../../modules/s3/bucket_policies/default_policy_template"
}

resource "aws_s3_bucket" "auth0_backups_bucket" {
  bucket = "${local.name_prefix}-auth0-backups"
  acl    = "private"
  tags   = local.common_tags

  logging {
    target_bucket = data.aws_s3_bucket.security_logs.id
    target_prefix = "s3/${local.env_prefix}-auth0-backups/"
  }

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = aws_kms_key.auth0_backups_kms_key.arn
        sse_algorithm     = "aws:kms"
      }
    }
  }
}

resource "aws_s3_bucket_ownership_controls" "auth0_backups_bucket" {
  bucket = aws_s3_bucket.auth0_backups_bucket.id

  rule {
    object_ownership = "BucketOwnerEnforced"
  }
}

resource "aws_s3_bucket_policy" "auth0_backups_bucket" {
  bucket = aws_s3_bucket.auth0_backups_bucket.id
  policy = replace(
    module.default_policy_template.document.json,
    module.default_policy_template.bucket_arn,
    aws_s3_bucket.auth0_backups_bucket.arn,
  )
}

module "auth0_backups_bucket_rw" {
  source = "../../modules/iam/policies/s3/buckets_rw"

  name        = "s3_auth0_backups_rw"
  name_prefix = local.name_prefix

  bucket_masks = [
    aws_s3_bucket.auth0_backups_bucket.id
  ]
}

resource "aws_s3_bucket" "splunk_packages_bucket" {
  bucket = "${local.name_prefix}-splunk-packages"
  acl    = "private"
  tags   = local.common_tags

  logging {
    target_bucket = data.aws_s3_bucket.security_logs.id
    target_prefix = "s3/${local.env_prefix}-splunk-packages/"
  }

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = aws_kms_key.splunk_packages_kms_key.arn
        sse_algorithm     = "aws:kms"
      }
    }
  }
}

resource "aws_s3_bucket_ownership_controls" "splunk_packages_bucket" {
  bucket = aws_s3_bucket.splunk_packages_bucket.id

  rule {
    object_ownership = "BucketOwnerEnforced"
  }
}

resource "aws_s3_bucket_policy" "splunk_packages_bucket" {
  bucket = aws_s3_bucket.splunk_packages_bucket.id
  policy = replace(
    module.default_policy_template.document.json,
    module.default_policy_template.bucket_arn,
    aws_s3_bucket.splunk_packages_bucket.arn,
  )
}

moved {
  from = module.s3_hightouch_logs.aws_s3_bucket.main
  to   = module.s3_hightouch_logs.aws_s3_bucket.this
}

moved {
  from = module.s3_hightouch_uk.aws_s3_bucket.main
  to   = module.s3_hightouch_uk.aws_s3_bucket.this
}

moved {
  from = module.s3_hightouch_au_nz.aws_s3_bucket.main
  to   = module.s3_hightouch_au_nz.aws_s3_bucket.this
}

module "s3_hightouch_logs" {
  source             = "../../modules/s3/private_bucket_with_logs_aes256_v2"
  bucket_name        = "${local.name_prefix}-hightouch-logs"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/hightouch-logs/"

  versioning                         = true
  noncurrent_version_expiration_days = 90

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_S3"
    }
  )
}

module "s3_hightouch_uk" {
  source             = "../../modules/s3/private_bucket_with_logs_aes256_v2"
  bucket_name        = "${local.name_prefix}-hightouch-sonymusic-uk"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/hightouch-sonymusic-uk/"

  versioning                         = false
  noncurrent_version_expiration_days = 90

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_S3"
    }
  )
}

module "s3_hightouch_au_nz" {
  source             = "../../modules/s3/private_bucket_with_logs_aes256_v2"
  bucket_name        = "${local.name_prefix}-hightouch-sonymusic-au-nz"
  logs_bucket_id     = data.aws_s3_bucket.security_logs.id
  logs_object_prefix = "${local.name_prefix}/hightouch-sonymusic-au-nz/"

  versioning                         = false
  noncurrent_version_expiration_days = 90

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_S3"
    }
  )
}