data "aws_caller_identity" "current" {}

data "aws_iam_policy_document" "access_logs_kms_key_policy" {
  # checkov:skip=CKV_AWS_109:It is a KMS key policy, so it applies only to a specific key.
  # checkov:skip=CKV_AWS_111:The same as above.

  version                   = "2012-10-17"
  override_policy_documents = var.kms_override_policy_documents

  statement {
    sid    = "Enable IAM User Permissions"
    effect = "Allow"

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root",
      ]
    }

    actions = [
      "kms:*",
    ]

    resources = ["*"]
  }

  statement {
    sid    = "Allow SNS and S3 to use key"
    effect = "Allow"

    principals {
      type = "Service"
      identifiers = [
        "s3.amazonaws.com",
        "sns.amazonaws.com",
      ]
    }

    actions = [
      "kms:GenerateDataKey",
      "kms:Decrypt",
    ]

    resources = ["*"]
  }
}

resource "aws_kms_key" "access_logs_kms_key" {
  description             = "KMS key for encrypting ${var.access_log_type} access log events for ${var.environment}-${var.service_name}"
  enable_key_rotation     = true
  deletion_window_in_days = 30

  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = "true"
  }
}

resource "aws_kms_alias" "access_logs_kms_key_alias" {
  name          = "alias/${var.environment}-${var.service_name}-${var.access_log_type}-logs-key"
  target_key_id = aws_kms_key.access_logs_kms_key.key_id
}

resource "aws_kms_key_policy" "access_logs_kms_key" {
  key_id = aws_kms_key.access_logs_kms_key.key_id
  policy = data.aws_iam_policy_document.access_logs_kms_key_policy.json
}