variable "admin_users" {
  type        = list(string)
  description = "List of admin user names"
}

variable "admin_roles" {
  type        = list(string)
  description = "List of admin role names"
  default     = []
}

variable "external_read_arns" {
  type        = list(string)
  description = "List of arns of external users or roles with read permissions"
  default     = []
}

variable "external_upload_arns" {
  type        = list(string)
  description = "List of arns of external users or roles with read-write permissions."
  default     = []
}

variable "external_delete_arns" {
  type        = list(string)
  description = "List of arns of external users or roles with delete permissions"
  default     = []
}

variable "denied_paths_for_roles" {
  type        = list(object({ paths = list(string), roles = list(string) }))
  description = "List of paths to which access is denied for list of roles"
  default     = []
}

variable "denied_paths_for_external_roles" {
  type        = list(object({ paths = list(string), role_arns = list(string) }))
  description = "List of paths to which access is denied for list of external roles arn"
  default     = []
}

variable "template_bucket_arn" {
  type        = string
  description = "This value will be substituted to actual bucket arn during template apply in private_bucket_with_logs_aes256"
  default     = "template_bucket_arn"
}

variable "ses_account_id" {
  type        = string
  description = "Enable SES to put files in the bucket."
  default     = ""
}

variable "replication_roles" {
  type        = list(string)
  description = "List of arns of s3 replication roles"
  default     = []
}

variable "encryption_in_transit" {
  type        = bool
  description = "Enforce encryption in transit for the s3 bucket operations"
  default     = true
}

variable "custom_path_permissions" {
  type        = list(object({ arn = string, path = string, read = bool, write = bool, delete = bool }))
  description = ""
  default     = []
}