module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "backup-orcd-terraform-state"
    key     = "prod/ows-pypi-server-replica/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "s3_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.12.1"

  env                   = var.environment
  bucket_name           = "${var.service_name}-replica"
  application_family    = var.application_family
  s3_read_only_policy   = true
  block_public_access   = true
  custom_logging_bucket = var.custom_logging_bucket
  bucket_policy_overrides = [
    data.aws_iam_policy_document.bucket_policy.json
  ]

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  lifecycle_rules_options_current_version_transition = [{
    prefix        = ""
    enabled       = true
    days          = 30
    storage_class = "DEEP_ARCHIVE"
  }]

  lifecycle_rules_options_noncurrent_version_transition = [{
    prefix        = ""
    enabled       = true
    days          = 30
    storage_class = "DEEP_ARCHIVE"
  }]

  lifecycle_rules_options_noncurrent_version_expiration = [{
    prefix  = ""
    enabled = true
    days    = 365
  }]

  apply_replication_destination_configuration = [{
    replication_source_iam_role_arn = "arn:aws:iam::086679231553:role/S3-shared-ows-pypi-server-replication-role"
  }]
}

module "s3_bucket_shared" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.12.1"

  env                   = "shared"
  bucket_name           = "${var.service_name}-replica"
  application_family    = var.application_family
  s3_read_only_policy   = true
  block_public_access   = true
  custom_logging_bucket = var.custom_logging_bucket
  bucket_policy_overrides = [
    data.aws_iam_policy_document.bucket_policy_shared.json
  ]

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  lifecycle_rules_options_current_version_transition = [{
    prefix        = ""
    enabled       = true
    days          = 30
    storage_class = "DEEP_ARCHIVE"
  }]

  lifecycle_rules_options_noncurrent_version_transition = [{
    prefix        = ""
    enabled       = true
    days          = 30
    storage_class = "DEEP_ARCHIVE"
  }]

  lifecycle_rules_options_noncurrent_version_expiration = [{
    prefix  = ""
    enabled = true
    days    = 365
  }]

  apply_replication_destination_configuration = [{
    replication_source_iam_role_arn = "arn:aws:iam::086679231553:role/S3-shared-ows-pypi-server-replication-role"
  }]
}

data "aws_iam_policy_document" "bucket_policy_shared" {
  statement {
    sid = "DenyDestructiveActions"

    effect = "Deny"

    actions = [
      "s3:DeleteBucket",
      "s3:DeleteBucketPolicy",
      "s3:DeleteObject*"
    ]

    resources = [
      module.s3_bucket_shared.s3_bucket_arn_output,
      "${module.s3_bucket_shared.s3_bucket_arn_output}/*"
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "bucket_policy" {
  statement {
    sid = "DenyDestructiveActions"

    effect = "Deny"

    actions = [
      "s3:DeleteBucket",
      "s3:DeleteBucketPolicy",
      "s3:DeleteObject*"
    ]

    resources = [
      module.s3_bucket.s3_bucket_arn_output,
      "${module.s3_bucket.s3_bucket_arn_output}/*"
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}