variable "bucket" {
  type        = string
  description = "S3 bucket name"
}

variable "admin_users" {
  type        = list(string)
  description = "List of admin user names"
}

variable "admin_roles" {
  type        = list(string)
  description = "List of admin role names"
  default     = []
}

variable "external_read_arns" {
  type        = list(string)
  description = "List of arns of external roles with read permissions"
  default     = []
}

variable "external_upload_arns" {
  type        = list(string)
  description = "List of arns of external roles with read-write permissions."
  default     = []
}

variable "external_delete_arns" {
  type        = list(string)
  description = "List of arns of external roles with delete and read-write permissions"
  default     = []
}

variable "denied_paths_for_roles" {
  type        = list(object({ paths = list(string), roles = list(string) }))
  description = "List of paths to which access is denied for list of roles"
  default     = []
}

variable "denied_paths_for_external_roles" {
  type        = list(object({ paths = list(string), role_arns = list(string) }))
  description = "List of paths to which access is denied for list of external roles arn"
  default     = []
}

variable "encryption_in_transit" {
  type        = bool
  description = "Enforce encryption in transit for the s3 bucket operations"
  default     = true
}