module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "shared-orcd-terraform-state"
    key     = "shared/gsirt/cloudfront-logs/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_canonical_user_id" "current" {}

data "aws_cloudfront_log_delivery_canonical_user_id" "cloudfront_logs_id" {}

module "aws_accounts" {
  source = "git@github.com:theorchard/terraform-aws-accounts-map.git//modules/read_accounts_map?ref=3.1.0"
}

module "cloudfront_logs_bucket" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  environment     = var.environment
  service_name    = var.account_group
  access_log_type = "cloudfront"

  bucket_policy_overrides = [data.aws_iam_policy_document.cloudfront_logs_bucket_policy_document.json]

  // Permissions for CloudFront logs must currently be configured via ACLs
  acl_policy_grants = concat([
    {
      id         = data.aws_canonical_user_id.current.id
      type       = "CanonicalUser"
      permission = "FULL_CONTROL"
    },
    {
      id         = data.aws_cloudfront_log_delivery_canonical_user_id.cloudfront_logs_id.id
      type       = "CanonicalUser"
      permission = "FULL_CONTROL"
    }],
    [
      for k, v in module.aws_accounts.accounts_map : {
        id         = v.canonical_id
        type       = "CanonicalUser"
        permission = "FULL_CONTROL"
      }
    ]
  )
}

data "aws_iam_policy_document" "cloudfront_logs_bucket_policy_document" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = [module.cloudfront_logs_bucket.access_logs_bucket_arn]
    actions = [
      "s3:GetBucketAcl",
      "s3:PutBucketAcl",
    ]

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = module.aws_accounts.account_ids
    }
  }
}

data "aws_iam_role" "security_lake_role" {
  name = var.security_lake_iam_role_name
}

resource "aws_cloudwatch_event_rule" "security_lake_cloudfront_event_forwarder" {
  name        = "Shared-${var.security_lake_iam_role_name}-cloudfront-log-forward"
  description = "Forward S3 Object Created events for CloudFront log bucket to Security Lake account"

  event_pattern = jsonencode({
    source      = ["aws.s3"]
    detail-type = ["Object Created"]
    detail = {
      bucket = {
        name = [module.cloudfront_logs_bucket.access_logs_bucket_name]
      }
    }
  })
}

resource "aws_cloudwatch_event_target" "security_lake_event_bus_target" {
  rule      = aws_cloudwatch_event_rule.security_lake_cloudfront_event_forwarder.name
  target_id = "SecurityLakeEventBus"
  arn       = "arn:aws:events:us-east-1:${var.security_lake_account_id}:event-bus/default"
  role_arn  = data.aws_iam_role.security_lake_role.arn
}