module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "qa-supply-chain-terraform-state"
    key     = "gsirt/cloudfront-logs/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_canonical_user_id" "current" {}

data "aws_cloudfront_log_delivery_canonical_user_id" "cloudfront_logs_id" {}

module "cloudfront_logs_bucket" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.2"

  environment     = var.environment
  service_name    = var.account_group
  access_log_type = "cloudfront"

  // Permissions for CloudFront logs must currently be configured via ACLs
  acl_policy_grants = [
    {
      id         = data.aws_canonical_user_id.current.id
      type       = "CanonicalUser"
      permission = "FULL_CONTROL"
    },
    {
      id         = data.aws_cloudfront_log_delivery_canonical_user_id.cloudfront_logs_id.id
      type       = "CanonicalUser"
      permission = "FULL_CONTROL"
    }
  ]
}