# GuardDuty part
data "aws_iam_policy_document" "guardduty_key" {
  statement {
    sid       = "Enable IAM User Permissions"
    effect    = "Allow"
    actions   = ["kms:*"]
    resources = ["*"]
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${local.account_id}:root"]
    }
  }
  statement {
    sid       = "Allow GuardDuty to use the key"
    effect    = "Allow"
    actions   = ["kms:GenerateDataKey"]
    resources = ["*"]
    principals {
      type        = "Service"
      identifiers = ["guardduty.amazonaws.com"]
    }
  }
  statement {
    sid       = "Allow GSIRT to access enrypted files"
    effect    = "Allow"
    actions   = ["kms:Decrypt"]
    resources = ["*"]
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${local.account_id}:role/GSIRT_AWS_Monitoring_Role"]
    }
  }
}

resource "aws_kms_key" "guardduty" {
  description         = "KMS key for guardduty findings export."
  enable_key_rotation = true
  tags                = var.common_tags
  policy              = data.aws_iam_policy_document.guardduty_key.json
}

resource "aws_kms_alias" "guardduty_alias" {
  name          = "alias/guardduty"
  target_key_id = aws_kms_key.guardduty.key_id
}

resource "aws_guardduty_detector" "detector_us-east-1" {
  enable = true
  tags   = var.common_tags
}

locals {
  gd_folder = "gd/"
}

resource "aws_s3_object" "gd_folder" {
  count        = var.gd_publishing_s3 ? 1 : 0
  bucket       = data.aws_s3_bucket.logs.id
  acl          = "private"
  key          = local.gd_folder
  content_type = "application/x-directory"
}

resource "aws_guardduty_publishing_destination" "publishing_us-east-1" {
  count           = var.gd_publishing_s3 ? 1 : 0
  detector_id     = aws_guardduty_detector.detector_us-east-1.id
  destination_arn = "${data.aws_s3_bucket.logs.arn}/${trimsuffix(local.gd_folder, "/")}"
  kms_key_arn     = aws_kms_key.guardduty.arn

  depends_on = [
    aws_s3_object.gd_folder[0],
  ]
}
/*
resource aws_guardduty_detector detector_us-east-2 {
  provider = aws.us-east-2
  enable   = true
  tags     = var.common_tags
}

resource aws_guardduty_detector detector_us-west-1 {
  provider = aws.us-west-1
  enable   = true
  tags     = var.common_tags
}

resource aws_guardduty_detector detector_us-west-2 {
  provider = aws.us-west-2
  enable   = true
  tags     = var.common_tags
}

resource aws_guardduty_detector detector_ap-south-1 {
  provider = aws.ap-south-1
  enable   = true
  tags     = var.common_tags
}

resource aws_guardduty_detector detector_ap-northeast-2 {
  provider = aws.ap-northeast-2
  enable   = true
  tags     = var.common_tags
}

resource aws_guardduty_detector detector_ap-southeast-1 {
  provider = aws.ap-southeast-1
  enable   = true
  tags     = var.common_tags
}

resource aws_guardduty_detector detector_ap-southeast-2 {
  provider = aws.ap-southeast-2
  enable   = true
  tags     = var.common_tags
}

resource aws_guardduty_detector detector_ap-northeast-1 {
  provider = aws.ap-northeast-1
  enable   = true
  tags     = var.common_tags
}

resource aws_guardduty_detector detector_ca-central-1 {
  provider = aws.ca-central-1
  enable   = true
  tags     = var.common_tags
}

resource aws_guardduty_detector detector_eu-central-1 {
  provider = aws.eu-central-1
  enable   = true
  tags     = var.common_tags
}

resource aws_guardduty_detector detector_eu-west-1 {
  provider = aws.eu-west-1
  enable   = true
  tags     = var.common_tags
}

resource aws_guardduty_detector detector_eu-west-2 {
  provider = aws.eu-west-2
  enable   = true
  tags     = var.common_tags
}

resource aws_guardduty_detector detector_eu-west-3 {
  provider = aws.eu-west-3
  enable   = true
  tags     = var.common_tags
}

resource aws_guardduty_detector detector_eu-north-1 {
  provider = aws.eu-north-1
  enable   = true
  tags     = var.common_tags
}

resource aws_guardduty_detector detector_sa-east-1 {
  provider = aws.sa-east-1
  enable   = true
  tags     = var.common_tags
}
*/