module "s3_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.14.1"

  env                 = var.environment
  bucket_name         = var.bucket_name
  application_family  = var.application_family
  s3_read_only_policy = true
  block_public_access = true
  bucket_policy_overrides = [
    data.aws_iam_policy_document.document_service_bucket_policy.json
  ]

  apply_server_side_encryption_by_default = {
    sse_algorithm = "aws:kms"
  }

  kms_key_enabled  = true
  kms_key_required = false
  kms_key_name     = "${var.service_name}-kms-key"

  kms_key_policy_overrides = [
    data.aws_iam_policy_document.document_service_bucket_kms_key_policy.json,
  ]
}

data "aws_iam_policy_document" "document_service_bucket_policy" {
  statement {
    sid = "DenyDestructiveActions"

    effect = "Deny"

    actions = [
      "s3:DeleteBucket",
      "s3:DeleteBucketPolicy",
    ]

    resources = [
      module.s3_bucket.s3_bucket_arn_output,
      "${module.s3_bucket.s3_bucket_arn_output}/*"
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    actions = [
      "s3:DeleteObject",
      "s3:DeleteObject*",
      "s3:GetObject",
      "s3:GetObject*",
      "s3:PutObject",
      "s3:PutObject*",
    ]

    resources = [
      "${module.s3_bucket.s3_bucket_arn_output}/*"
    ]

    principals {
      type        = "AWS"
      identifiers = [module.stripo_plugin_documents_service.fargate_task_iam_role_arn]
    }
  }

  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:ListBucket",
    ]

    resources = [
      module.s3_bucket.s3_bucket_arn_output
    ]

    principals {
      type        = "AWS"
      identifiers = [module.stripo_plugin_documents_service.fargate_task_iam_role_arn]
    }
  }

  statement {
    actions = [
      "s3:GetObject",
    ]

    resources = [
      "${module.s3_bucket.s3_bucket_arn_output}/*"
    ]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceArn"
      values = [
        aws_cloudfront_distribution.documents_assets.arn
      ]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "document_service_bucket_kms_key_policy" {
  statement {
    actions = [
      "kms:Decrypt",
      "kms:Encrypt",
      "kms:GenerateDataKey*",
    ]

    resources = [
      "*"
    ]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceArn"
      values = [
        aws_cloudfront_distribution.documents_assets.arn
      ]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }
  }
}

module "s3_bucket_custom_blocks" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.12.0"

  env                 = var.environment
  bucket_name         = var.custom_blocks_bucket_name
  application_family  = "fansifter"
  s3_read_only_policy = false
  block_public_access = true
  bucket_policy_overrides = [
    data.aws_iam_policy_document.custom_blocks_bucket_policy.json
  ]

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  bucket_cors_rule = [
    {
      allowed_headers = ["*"]
      allowed_methods = ["GET"]
      allowed_origins = ["*"]
      expose_headers  = []
      max_age_seconds = 3000
    },
  ]
}

data "aws_iam_policy_document" "custom_blocks_bucket_policy" {
  statement {
    sid = "DenyDestructiveActions"

    effect = "Deny"

    actions = [
      "s3:DeleteBucket",
      "s3:DeleteBucketPolicy",
    ]

    resources = [
      module.s3_bucket_custom_blocks.s3_bucket_arn_output,
      "${module.s3_bucket_custom_blocks.s3_bucket_arn_output}/*"
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }



  statement {
    actions = [
      "s3:GetObject",
    ]

    resources = [
      "${module.s3_bucket_custom_blocks.s3_bucket_arn_output}/*"
    ]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceArn"
      values = [
        aws_cloudfront_distribution.emple_ui.arn
      ]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }
  }
}