provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "backup-orcd-terraform-state"
    key     = "prod/quartz-shield/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "s3_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.12.1"

  env                        = var.environment
  bucket_name                = var.service_name
  application_family         = var.application_family
  s3_read_only_policy        = true
  block_public_access        = true
  replication_helper_allowed = true
  bucket_policy_overrides    = [
    data.aws_iam_policy_document.quartz_shield_bucket_policy.json
  ]

  apply_server_side_encryption_by_default = {
    sse_algorithm = "aws:kms"
  }

  kms_key_enabled  = true
  kms_key_required = true
  kms_key_name     = "${var.service_name}-kms-key"

  lifecycle_rules_options_current_version_transition = [{
    prefix        = ""
    enabled       = true
    days          = 0
    storage_class = "INTELLIGENT_TIERING"
    },
    {
      prefix        = ""
      enabled       = true
      days          = 30
      storage_class = "DEEP_ARCHIVE"
    }
  ]

  lifecycle_rules_options_noncurrent_version_transition = [{
    prefix        = ""
    enabled       = true
    days          = 30
    storage_class = "DEEP_ARCHIVE"
  }]

  lifecycle_rules_options_noncurrent_version_expiration = [{
    prefix  = ""
    enabled = true
    days    = 90
  }]
}

data "aws_iam_policy_document" "quartz_shield_bucket_policy" {
  statement {
    sid = "DenyDestructiveActions"

    effect = "Deny"

    actions = [
      "s3:DeleteBucket",
      "s3:DeleteBucketPolicy",
      "s3:DeleteObject*"
    ]

    resources = [
      module.s3_bucket.s3_bucket_arn_output,
      "${module.s3_bucket.s3_bucket_arn_output}/*"
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}