module "assets_s3_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.15.7"

  bucket_name                         = var.assets_s3_bucket_name
  env                                 = var.environment
  application_family                  = var.application_family
  enable_guardduty_malware_protection = true
  bucket_policy_overrides = [
    data.aws_iam_policy_document.assets_s3_bucket_policy.json
  ]

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
  acceleration_status = "Enabled"

  bucket_cors_rule = [
    {
      allowed_headers = ["*"]
      allowed_methods = ["GET"]
      allowed_origins = ["*"]
      expose_headers  = []
      max_age_seconds = 3600
    },
    {
      allowed_headers = ["*"]
      allowed_methods = ["PUT", "POST"],
      allowed_origins = var.bucket_cors_allowed_write_origins
      expose_headers = [
        "ETag",
        "x-amz-checksum-crc32",
      ]
      max_age_seconds = 3600
    },
  ]

  lifecycle_rules_options_noncurrent_version_expiration = [
    {
      prefix  = ""
      enabled = true
      days    = 7
    }
  ]

  lifecycle_rules_abort_incomplete_multipart_upload_days = [
    {
      prefix  = ""
      enabled = true
      days    = 1
    }
  ]
}

module "datadog" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/s3?ref=6.16.2"

  bucket_name                       = module.assets_s3_bucket.s3_bucket_name_output
  environment                       = var.environment
  service_name                      = var.service_name
  application_family                = var.application_family
  teams                             = [var.application_family]
  notification_endpoints            = var.notification_endpoints
  escalation_notification_endpoints = var.escalation_notification_endpoints

  dashboard_configuration = {
    enabled                       = false
    show_advanced_storage_metrics = false
    show_replication_metrics      = false
    show_activity_metrics         = false
  }

  guardduty_malware_monitor_configuration = {
    enabled = true
  }
}

data "aws_iam_policy_document" "assets_s3_bucket_policy" {
  statement {
    sid = "DenyDestructiveActions"

    effect = "Deny"

    actions = [
      "s3:DeleteBucket",
      "s3:DeleteBucketPolicy",
    ]

    resources = [
      module.assets_s3_bucket.s3_bucket_arn_output,
      "${module.assets_s3_bucket.s3_bucket_arn_output}/*"
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    actions = [
      "s3:GetObject",
    ]

    resources = [
      "${module.assets_s3_bucket.s3_bucket_arn_output}/*"
    ]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceArn"
      values = [
        aws_cloudfront_distribution.assets_distribution.arn
      ]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "assets_s3_rw_policy_document" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetBucketLocation",
      "s3:GetObject*",
      "s3:HeadObject",
      "s3:PutObject*",
      "s3:DeleteObject*",
      "s3:CreateMultipartUpload",
      "s3:UploadPart",
      "s3:AbortMultipartUpload",
      "s3:CompleteMultipartUpload",
    ]

    resources = [
      "${module.assets_s3_bucket.s3_bucket_arn_output}/*",
    ]
  }
}

resource "aws_iam_policy" "assets_s3_rw_policy" {
  name   = "S3-${var.environment}-${var.service_name}-RW-policy"
  policy = data.aws_iam_policy_document.assets_s3_rw_policy_document.json
}

data "aws_iam_policy_document" "assets_s3_wo_policy_document" {
  statement {
    effect = "Allow"

    actions = [
      "s3:PutObject",
      "s3:CreateMultipartUpload",
      "s3:UploadPart",
      "s3:AbortMultipartUpload",
      "s3:CompleteMultipartUpload",
    ]

    resources = [
      "${module.assets_s3_bucket.s3_bucket_arn_output}/*",
    ]
  }
}

resource "aws_iam_policy" "assets_s3_wo_policy" {
  name   = "S3-${var.environment}-${var.service_name}-WO-policy"
  policy = data.aws_iam_policy_document.assets_s3_wo_policy_document.json
}