resource "aws_sns_topic" "logs_sns_topic" {
  name              = "${var.environment}-${var.service_name}-${var.access_log_type}-logs"
  kms_master_key_id = aws_kms_alias.access_logs_kms_key_alias.name
}

data "aws_iam_policy_document" "logs_sns_topic_policy" {
  override_policy_documents = var.sns_override_policy_documents

  statement {
    actions = [
      "SNS:Publish",
    ]

    condition {
      test     = "ArnLike"
      variable = "AWS:SourceArn"

      values = [
        var.bucket_arn,
      ]
    }

    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    resources = [
      aws_sns_topic.logs_sns_topic.arn,
    ]
  }
}

resource "aws_sns_topic_policy" "logs_sns_topic_policy" {
  arn    = aws_sns_topic.logs_sns_topic.arn
  policy = data.aws_iam_policy_document.logs_sns_topic_policy.json
}

resource "aws_sns_topic_subscription" "logs_sns_sqs_target" {
  topic_arn = aws_sns_topic.logs_sns_topic.arn
  protocol  = "sqs"
  endpoint  = module.logs_sqs_queue_with_deadletter.queue_arn
}

resource "aws_s3_bucket_notification" "logs_bucket_notification" {
  bucket = reverse(split(":", var.bucket_arn))[0]

  topic {
    topic_arn = aws_sns_topic.logs_sns_topic.arn
    events    = var.s3_bucket_notification_sns_events
  }

  depends_on = [
    aws_sns_topic_policy.logs_sns_topic_policy,
  ]
}