/* provider "aws" {
  region = "ap-northeast-1"
  alias  = "ap_northeast_1"
}

provider "aws" {
  region = "ap-northeast-2"
  alias  = "ap_northeast_2"
}

provider "aws" {
  region = "ap-northeast-3"
  alias  = "ap_northeast_3"
}

provider "aws" {
  region = "ap-south-1"
  alias  = "ap_south_1"
}

provider "aws" {
  region = "ap-southeast-1"
  alias  = "ap_southeast_1"
}

provider "aws" {
  region = "ap-southeast-2"
  alias  = "ap_southeast_2"
}

provider "aws" {
  region = "ca-central-1"
  alias  = "ca_central_1"
} */

provider "aws" {
  region = "eu-central-1"
  alias  = "eu_central_1"
}

/* provider "aws" {
  region = "eu-north-1"
  alias  = "eu_north_1"
}

provider "aws" {
  region = "eu-west-1"
  alias  = "eu_west_1"
}

provider "aws" {
  region = "eu-west-2"
  alias  = "eu_west_2"
}

provider "aws" {
  region = "eu-west-3"
  alias  = "eu_west_3"
}

provider "aws" {
  region = "sa-east-1"
  alias  = "sa_east_1"
} */

provider "aws" {
  region = "us-east-1"
  alias  = "us_east_1"
}

provider "aws" {
  region = "us-east-2"
  alias  = "us_east_2"
}

provider "aws" {
  region = "us-west-1"
  alias  = "us_west_1"
}

provider "aws" {
  region = "us-west-2"
  alias  = "us_west_2"
}


# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/gsirt/guardduty/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

/* resource "aws_guardduty_detector" "guardduty_ap_northeast_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.ap_northeast_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_ap_northeast_1" {
  provider        = aws.ap_northeast_1
  detector_id     = aws_guardduty_detector.guardduty_ap_northeast_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_ap_northeast_2" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.ap_northeast_2
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_ap_northeast_2" {
  provider        = aws.ap_northeast_2
  detector_id     = aws_guardduty_detector.guardduty_ap_northeast_2.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_ap_northeast_3" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.ap_northeast_3
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_ap_northeast_3" {
  provider        = aws.ap_northeast_3
  detector_id     = aws_guardduty_detector.guardduty_ap_northeast_3.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_ap_south_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.ap_south_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_ap_south_1" {
  provider        = aws.ap_south_1
  detector_id     = aws_guardduty_detector.guardduty_ap_south_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_ap_southeast_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.ap_southeast_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_ap_southeast_1" {
  provider        = aws.ap_southeast_1
  detector_id     = aws_guardduty_detector.guardduty_ap_southeast_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_ap_southeast_2" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.ap_southeast_2
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_ap_southeast_2" {
  provider        = aws.ap_southeast_2
  detector_id     = aws_guardduty_detector.guardduty_ap_southeast_2.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_ca_central_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.ca_central_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_ca_central_1" {
  provider        = aws.ca_central_1
  detector_id     = aws_guardduty_detector.guardduty_ca_central_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
} */

resource "aws_guardduty_detector" "guardduty_eu_central_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.eu_central_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_eu_central_1" {
  provider        = aws.eu_central_1
  detector_id     = aws_guardduty_detector.guardduty_eu_central_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

/* resource "aws_guardduty_detector" "guardduty_eu_north_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.eu_north_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_eu_north_1" {
  provider        = aws.eu_north_1
  detector_id     = aws_guardduty_detector.guardduty_eu_north_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_eu_west_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.eu_west_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_eu_west_1" {
  provider        = aws.eu_west_1
  detector_id     = aws_guardduty_detector.guardduty_eu_west_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_eu_west_2" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.eu_west_2
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_eu_west_2" {
  provider        = aws.eu_west_2
  detector_id     = aws_guardduty_detector.guardduty_eu_west_2.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_eu_west_3" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.eu_west_3
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_eu_west_3" {
  provider        = aws.eu_west_3
  detector_id     = aws_guardduty_detector.guardduty_eu_west_3.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_sa_east_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.sa_east_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_sa_east_1" {
  provider        = aws.sa_east_1
  detector_id     = aws_guardduty_detector.guardduty_sa_east_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}*/

resource "aws_guardduty_detector" "guardduty_us_east_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.us_east_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_us_east_1" {
  provider        = aws.us_east_1
  detector_id     = aws_guardduty_detector.guardduty_us_east_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_us_east_2" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.us_east_2
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_us_east_2" {
  provider        = aws.us_east_2
  detector_id     = aws_guardduty_detector.guardduty_us_east_2.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_us_west_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.us_west_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_us_west_1" {
  provider        = aws.us_west_1
  detector_id     = aws_guardduty_detector.guardduty_us_west_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_us_west_2" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.us_west_2
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_us_west_2" {
  provider        = aws.us_west_2
  detector_id     = aws_guardduty_detector.guardduty_us_west_2.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}