variable "bucket" {
  type        = string
  description = "S3 bucket name"
}

variable "admin_users" {
  type        = list(string)
  description = "List of admin user names"
}

variable "admin_roles" {
  type        = list(string)
  description = "List of admin role names"
  default     = []
}

variable "debug_users" {
  type        = list(string)
  description = "List of debug user names"
  default     = []
}

variable "internal_delete_roles" {
  type        = list(string)
  description = "List of names of internal roles with delete permissions."
  default     = []
}

variable "internal_upload_roles" {
  type        = list(string)
  description = "List of names of internal roles with upload permissions."
  default     = []
}

variable "internal_read_roles" {
  type        = list(string)
  description = "List of names of internal roles with read permissions."
  default     = []
}

variable "external_read_roles_arn" {
  type        = list(string)
  description = "List of arns of external roles with read permissions"
  default     = []
}

variable "external_read_roles_ids" {
  type        = list(string)
  description = "List of unique IDs of external roles with read permissions. IDs should be presented like 'SOMEID:*', without wildcards at the end it won't work"
  default     = []
}

variable "external_upload_roles_arn" {
  type        = list(string)
  description = "List of arns of external roles with read-write permissions."
  default     = []
}

variable "external_upload_roles_ids" {
  type        = list(string)
  description = "List of unique IDs of external roles with read-write permissions. IDs should be presented like 'SOMEID:*', without wildcards at the end it won't work"
  default     = []
}

variable "external_delete_roles_arn" {
  type        = list(string)
  description = "List of arns of external roles with delete and read-write permissions"
  default     = []
}

variable "external_delete_roles_ids" {
  type        = list(string)
  description = "List of unique IDs of external roles with delete and read-write permissions. IDs should be presented like 'SOMEID:*', without wildcards at the end it won't work"
  default     = []
}

variable "external_read_ip_list" {
  type        = list(object({ ipAddress = string, paths = list(string) }))
  description = "List of maps of IP addresses with bucket paths. Readonly permissions on this paths will be granted."
  default     = []
}

/*variable service_identifiers {
  type        = list(string)
  description = "List of AWS services allowed to perform read/write operations in bucket"
  default     = []
}*/

variable "denied_paths_for_roles" {
  type        = list(object({ paths = list(string), roles = list(string) }))
  description = "List of paths to which access is denied for list of roles"
  default     = []
}

variable "denied_paths_for_external_roles" {
  type        = list(object({ paths = list(string), role_arns = list(string) }))
  description = "List of paths to which access is denied for list of external roles arn"
  default     = []
}

variable "encryption_in_transit" {
  type        = bool
  description = "Enforce encryption in transit for the s3 bucket operations"
  default     = true
}