data "aws_caller_identity" "current" {
}

# Create cloudtrail. Assumes S3 bucket already has bucket policy allowing cloudtrail to access.
resource "aws_cloudtrail" "gsirt_coudtrail" {
  # checkov:skip=CKV_AWS_252:This trail is used purely to deliver logs to GSIRT, so there is no need for SNS notifications.
  # checkov:skip=CKV2_AWS_10:This trail is used purely to deliver logs to GSIRT, so there is no need to log to CloudWatch.
  name                          = "${var.environment}-${var.service_name}-gsirt-cloudtrail"
  s3_bucket_name                = var.cloudtrail_s3_bucket_name
  kms_key_id                    = var.cloudtrail_kms_key_id
  include_global_service_events = true
  is_multi_region_trail         = true
  enable_logging                = true
  enable_log_file_validation    = var.cloudtrail_enable_log_file_validation

  event_selector {
    read_write_type           = "All"
    include_management_events = true

    data_resource {
      type   = "AWS::S3::Object"
      values = ["arn:aws:s3"]
    }

    data_resource {
      type   = "AWS::Lambda::Function"
      values = ["arn:aws:lambda"]
    }
  }

  tags = {
    Name         = "${var.environment}-${var.service_name}-gsirt-cloudtrail"
    TrailName    = "${var.environment}-${var.service_name}-gsirt-cloudtrail"
    environment  = var.environment
    service_name = var.service_name
    terraformed  = true
  }
}