provider "aws" {
  alias  = "aws_us_east_1"
  region = "us-east-1"
}

provider "aws" {
  alias  = "aws_us_east_2"
  region = "us-east-2"
}

provider "aws" {
  alias  = "aws_us_west_2"
  region = "us-west-2"
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "backup-orcd-terraform-state"
    key     = "backup/inventory/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "aws_accounts" {
  source = "git@github.com:theorchard/terraform-aws-accounts-map.git//modules/read_accounts_map?ref=3.0.2"
}

module "inventory_bucket_aws_us_east_1" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.10.3"

  providers = {
    aws = aws.aws_us_east_1
  }

  env                 = var.environment
  bucket_name         = "pde-inventory-us-east-1"
  custom_bucket_name  = "pde-inventory-us-east-1"
  application_family  = var.application_family
  block_public_access = true

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  bucket_policy_overrides = [data.aws_iam_policy_document.inventory_sources_us_east_1.json]

  lifecycle_rules_options_noncurrent_version_transition = local.lifecycle_rules_options_noncurrent_version_transition
  lifecycle_rules_options_noncurrent_version_expiration = local.lifecycle_rules_options_noncurrent_version_expiration
  lifecycle_rules_options_current_version_transition    = local.lifecycle_rules_options_current_version_transition
  lifecycle_rules_options_current_version_expiration    = local.lifecycle_rules_options_current_version_expiration
}

module "inventory_bucket_aws_us_east_2" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.10.3"

  providers = {
    aws = aws.aws_us_east_2
  }

  env                   = var.environment
  bucket_name           = "pde-inventory-us-east-2"
  custom_bucket_name    = "pde-inventory-us-east-2"
  custom_logging_bucket = "backup-orcd-us-east-2-s3-logs"
  application_family    = var.application_family
  block_public_access   = true

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  bucket_policy_overrides = [data.aws_iam_policy_document.inventory_sources_us_east_2.json]

  lifecycle_rules_options_noncurrent_version_transition = local.lifecycle_rules_options_noncurrent_version_transition
  lifecycle_rules_options_noncurrent_version_expiration = local.lifecycle_rules_options_noncurrent_version_expiration
  lifecycle_rules_options_current_version_transition    = local.lifecycle_rules_options_current_version_transition
  lifecycle_rules_options_current_version_expiration    = local.lifecycle_rules_options_current_version_expiration
}

module "inventory_bucket_aws_us_west_2" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.10.3"

  providers = {
    aws = aws.aws_us_west_2
  }

  env                   = var.environment
  bucket_name           = "pde-inventory-us-west-2"
  custom_bucket_name    = "pde-inventory-us-west-2"
  custom_logging_bucket = "backup-orcd-us-west-2-s3-logs"
  application_family    = var.application_family
  block_public_access   = true

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  bucket_policy_overrides = [data.aws_iam_policy_document.inventory_sources_us_west_2.json]

  lifecycle_rules_options_noncurrent_version_transition = local.lifecycle_rules_options_noncurrent_version_transition
  lifecycle_rules_options_noncurrent_version_expiration = local.lifecycle_rules_options_noncurrent_version_expiration
  lifecycle_rules_options_current_version_transition    = local.lifecycle_rules_options_current_version_transition
  lifecycle_rules_options_current_version_expiration    = local.lifecycle_rules_options_current_version_expiration
}

data "aws_iam_policy_document" "inventory_sources_us_east_1" {
  statement {
    sid = "inventory_source"

    principals {
      identifiers = ["s3.amazonaws.com"]
      type        = "Service"
    }
    actions   = ["s3:PutObject"]
    resources = ["arn:aws:s3:::pde-inventory-us-east-1/*"]

    condition {
      test     = "StringEquals"
      values   = module.aws_accounts.account_ids
      variable = "aws:SourceAccount"
    }

    condition {
      test     = "StringEquals"
      values   = ["bucket-owner-full-control"]
      variable = "s3:x-amz-acl"
    }
  }
}

data "aws_iam_policy_document" "inventory_sources_us_east_2" {
  statement {
    sid = "inventory_source"

    principals {
      identifiers = ["s3.amazonaws.com"]
      type        = "Service"
    }
    actions   = ["s3:PutObject"]
    resources = ["arn:aws:s3:::pde-inventory-us-east-2/*"]

    condition {
      test     = "StringEquals"
      values   = module.aws_accounts.account_ids
      variable = "aws:SourceAccount"
    }

    condition {
      test     = "StringEquals"
      values   = ["bucket-owner-full-control"]
      variable = "s3:x-amz-acl"
    }
  }
}

data "aws_iam_policy_document" "inventory_sources_us_west_2" {
  statement {
    sid = "inventory_source"

    principals {
      identifiers = ["s3.amazonaws.com"]
      type        = "Service"
    }
    actions   = ["s3:PutObject"]
    resources = ["arn:aws:s3:::pde-inventory-us-west-2/*"]

    condition {
      test     = "StringEquals"
      values   = module.aws_accounts.account_ids
      variable = "aws:SourceAccount"
    }

    condition {
      test     = "StringEquals"
      values   = ["bucket-owner-full-control"]
      variable = "s3:x-amz-acl"
    }
  }
}

locals {
  lifecycle_rules_options_noncurrent_version_transition = [
    {
      prefix        = ""
      enabled       = true
      days          = 30
      storage_class = "DEEP_ARCHIVE"
    }
  ]
  lifecycle_rules_options_noncurrent_version_expiration = [
    {
      prefix  = ""
      enabled = true
      days    = 365
    }
  ]
  lifecycle_rules_options_current_version_transition = [
    {
      prefix        = ""
      enabled       = true
      days          = 30
      storage_class = "GLACIER"
    }
  ]
  lifecycle_rules_options_current_version_expiration = [
    {
      prefix  = ""
      enabled = true
      days    = 730
    }
  ]
}