module "cloudfront-waf-logs" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "cloudfront-waf-logs"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.cloudfront-waf-logs.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "cloudfront-waf-logs"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "CLOUDOPS"
  }
}

module "msrv-d-vpc-flow-logs" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "msrv-d-vpc-flow-logs"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.msrv-d-vpc-flow-logs.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-Unit  = "Delivery-Media-Services"
    Environment    = "Dev"
    Name           = "msrv-d-vpc-flow-logs"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "CLOUDOPS"
  }
}

module "msrv-s-vpc-flow-logs" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "msrv-s-vpc-flow-logs"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.msrv-s-vpc-flow-logs.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-Unit  = "Delivery-Media-Services"
    Environment    = "Dev"
    Name           = "msrv-s-vpc-flow-logs"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "CLOUDOPS"
  }
}

module "msrvd-lambda" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "msrvd-lambda"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.msrvd-lambda.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "msrvd-lambda"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "CLOUDOPS"
  }
}

module "msrvd-virginia-alb-logs" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "msrvd-virginia-alb-logs"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.msrvd-virginia-alb-logs.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "msrvd-virginia-alb-logs"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "LOGGING"
  }
}

module "msrvd-wafv2-logs" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "msrvd-wafv2-logs"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = false
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "msrvd-wafv2-logs"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    USE            = "LOGGING"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "LOGGING"
  }
}

module "s3-mirror-dest-dev" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "s3-mirror-dest-dev"
  versioning = {
    enabled = true
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.s3-mirror-dest-dev.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    App            = "Media-services"
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "s3-mirror-dest-dev"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-cf-dev-logs" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-cf-dev-logs"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-cf-dev-logs.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "sme-cf-dev-logs"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "CLOUDOPS"
  }
}

module "sme-dev-mps-datastore" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-dev-mps-datastore"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-dev-mps-datastore.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "sme-dev-mps-datastore"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-dev-origin-amp" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-dev-origin-amp"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-dev-origin-amp.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "sme-dev-origin-amp"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "CLOUDOPS"
  }
}

module "sme-dev-origin-medialib" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-dev-origin-medialib"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-dev-origin-medialib.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "sme-dev-origin-medialib"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}


module "sme-dev-origin-promommx" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-dev-origin-promommx"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-dev-origin-promommx.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy
  cors_rule = [
    {
      allowed_methods = ["GET", "HEAD"]
      allowed_origins = ["*"]
      allowed_headers = ["*"]
      expose_headers  = null
      max_age_seconds = null
    }
  ]
  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "sme-dev-origin-promommx"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-dev-report" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-dev-report"
  versioning = {
    enabled = true
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-dev-report.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    App            = "Media-services"
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "sme-dev-report"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-media-services-dev" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-media-services-dev"
  versioning = {
    enabled = true
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-media-services-dev.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    App            = "Media-services"
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "sme-media-services-dev"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "CLOUDOPS"
  }
}

module "sme-media-services-dev-athena-out" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-media-services-dev-athena-out"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = false
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-Unit  = "Delivery-Media-Services"
    Environment    = "Dev"
    Name           = "sme-media-services-dev-athena-out"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "CLOUDOPS"
  }
}

module "sme-media-services-dev-awsconfig" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-media-services-dev-awsconfig"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-media-services-dev-awsconfig.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "sme-media-services-dev-awsconfig"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "CLOUDOPS"
  }
}

module "sme-media-services-dev-eu-central-1-logs" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-media-services-dev-eu-central-1-logs"
  versioning = {
    enabled = true
  }
  providers = {
    aws = aws.eu-central-1
  }
  server_side_encryption_configuration = var.server_side_encryption_configuration

  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = false
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "sme-media-services-dev-us-east-1-logs"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    USE            = "LOGGING"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "LOGGING"
  }
}

module "sme-media-services-dev-rds-backups" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-media-services-dev-rds-backups"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-media-services-dev-rds-backups.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "sme-media-services-dev-rds-backups"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-media-services-dev-ssm-out" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-media-services-dev-ssm-out"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = false
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "sme-media-services-dev-ssm-out"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "CLOUDOPS"
  }
}

module "sme-media-services-dev-us-east-1-logs" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-media-services-dev-us-east-1-logs"
  versioning = {
    enabled = true
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration

  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-media-services-dev-us-east-1-logs.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "sme-media-services-dev-us-east-1-logs"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    USE            = "LOGGING"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "LOGGING"
  }
}

module "sme-media-services-dev-use1-s3-inventory" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-media-services-dev-use1-s3-inventory"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-media-services-dev-use1-s3-inventory.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-Unit  = "Delivery-Media-Services"
    Environment    = "Dev"
    Name           = "sme-media-services-dev-use1-s3-inventory"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "CLOUDOPS"
  }
}

module "sme-mgsrv-dev-shelf" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-mgsrv-dev-shelf"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-mgsrv-dev-shelf.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Name           = "sme-mgsrv-dev-shelf"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-msrv-d2-vpc-flowlogs" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-msrv-d2-vpc-flowlogs"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-msrv-d2-vpc-flowlogs.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "Delivery-Media-Services"
    Environment    = "Dev"
    Name           = "sme-msrv-d2-vpc-flowlogs"
    Owner          = "Mandar Padsalgikar"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-msrv-s2-vpc-flowlogs" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-msrv-s2-vpc-flowlogs"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-msrv-s2-vpc-flowlogs.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "Delivery-Media-Services"
    Environment    = "Stage"
    Name           = "sme-msrv-s2-vpc-flowlogs"
    Owner          = "Mandar Padsalgikar"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-msrvd-redshift-use1" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-msrvd-redshift-use1"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-msrvd-redshift-use1.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-Unit  = "Delivery-Media-Services"
    Environment    = "Dev"
    Name           = "sme-msrvd-redshift-use1"
    Owner          = "Mandar Padsalgikar"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-promo-origin-access-test" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-promo-origin-access-test"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-promo-origin-access-test.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "sme-media-services-dev-us-east-1-logs"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-regs-origin-medialib" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-regs-origin-medialib"
  versioning = {
    enabled = true
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-regs-origin-medialib.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "Dev"
    Name           = "sme-regs-origin-medialib"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-stage-mps-datastore" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-stage-mps-datastore"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-stage-mps-datastore.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "stage"
    Name           = "sme-stage-mps-datastore"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-stage-origin-amp" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-stage-origin-amp"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-stage-origin-amp.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "stage"
    Name           = "sme-stage-origin-amp"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-stage-origin-central" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-stage-origin-central"
  versioning = {
    enabled = true
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-stage-origin-central.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "stage"
    Name           = "sme-stage-origin-central"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-stage-origin-dx3" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-stage-origin-dx3"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-stage-origin-dx3.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "stage"
    Name           = "sme-stage-origin-dx3"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-stage-origin-medialib" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-stage-origin-medialib"
  versioning = {
    enabled = true
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-stage-origin-medialib.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "stage"
    Name           = "sme-stage-origin-medialib"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "sme-stage-origin-promommx" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "sme-stage-origin-promommx"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.sme-stage-origin-promommx.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy
  cors_rule = [
    {
      allowed_methods = ["GET", "HEAD"]
      allowed_origins = ["*"]
      allowed_headers = ["*"]
      expose_headers  = null
      max_age_seconds = null
    }
  ]
  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "stage"
    Name           = "sme-stage-origin-promommx"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "test-vpc-vpc-flow-logs" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "test-vpc-vpc-flow-logs"
  versioning = {
    enabled = false
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-us-east-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.test-vpc-vpc-flow-logs.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-Unit  = "Delivery-Media-Services"
    Environment    = "Dev"
    Name           = "test-vpc-vpc-flow-logs"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}

module "mediaservices-qa" {
  #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest
  #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default
  #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled
  #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.11.0"
  bucket  = "mediaservices-qa"
  versioning = {
    enabled = false
  }
  providers = {
    aws = aws.eu-central-1
  }

  server_side_encryption_configuration = var.server_side_encryption_configuration
  logging = {
    target_bucket = "sme-media-services-dev-eu-central-1-logs"
    target_prefix = "sme-media-services-dev/"
  }
  object_ownership                      = "BucketOwnerEnforced"
  object_lock_enabled                   = false
  block_public_acls                     = var.block_public_acls
  ignore_public_acls                    = var.ignore_public_acls
  restrict_public_buckets               = var.restrict_public_buckets
  block_public_policy                   = var.block_public_policy
  force_destroy                         = var.force_destroy
  attach_policy                         = var.attach_policy
  policy                                = data.aws_iam_policy_document.mediaservices-qa.json
  attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy
  attach_require_latest_tls_policy      = var.attach_require_latest_tls_policy

  tags = {
    Business-unit  = "DeliveryMedia-Services"
    Environment    = "stage"
    Name           = "mediaservices-qa"
    Owner          = "Robert Dewilder"
    Project-Code   = "SME-2000-0306G"
    Project-Name   = "Delivery-Media-Services"
    Classification = "internal-use-only"
    Terraform      = "True"
    Purpose        = "APP-SUPPORT"
  }
}