provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "backup-orcd-terraform-state"
    key     = "prod/orcd-mezzanine-assets-replica/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "s3_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.10.3"

  env                   = var.environment
  bucket_name           = "${var.source_bucket_name}-replica"
  application_family    = var.application_family
  s3_read_only_policy   = true
  block_public_access   = true
  custom_logging_bucket = var.custom_logging_bucket
  bucket_policy_overrides = [
    data.aws_iam_policy_document.orcd-mezzanine-assets_bucket_policy.json
  ]

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  lifecycle_rules_options_current_version_transition = [{
    prefix        = ""
    enabled       = true
    days          = 90
    storage_class = "DEEP_ARCHIVE"
  }]

  lifecycle_rules_options_noncurrent_version_transition = [{
    prefix        = ""
    enabled       = true
    days          = 30
    storage_class = "DEEP_ARCHIVE"
  }]

  lifecycle_rules_options_noncurrent_version_expiration = [{
    prefix  = ""
    enabled = true
    days    = 365
  }]

  apply_replication_destination_configuration = [{
    replication_source_iam_role_arn = "arn:aws:iam::437795906767:role/S3-prod-orcd-mezzanine-assets-replication-role"
  }]
}

data "aws_iam_policy_document" "orcd-mezzanine-assets_bucket_policy" {
  statement {
    sid = "DenyDestructiveActions"

    effect = "Deny"

    actions = [
      "s3:DeleteBucket",
      "s3:DeleteBucketPolicy",
      "s3:DeleteObject*"
    ]

    resources = [
      module.s3_bucket.s3_bucket_arn_output,
      "${module.s3_bucket.s3_bucket_arn_output}/*"
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}