data "aws_s3_bucket" "s3_code_push_server_failover_bucket" {
  provider = aws.failover
  bucket   = "${var.environment}-${var.code_push_server_replication_destination_bucket_name}"
}

data "aws_iam_policy_document" "s3_code_push_server_bucket_policy" {
  statement {
    actions = [
      "s3:GetObject",
    ]

    resources = [
      "${module.s3_code_push_server_bucket.s3_bucket_arn_output}/*"
    ]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceArn"
      values = [
        aws_cloudfront_distribution.code_push_server_cdn.arn
      ]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }
  }
}

module "s3_code_push_server_bucket" {
  source             = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.12.1"
  env                = var.environment
  bucket_name        = var.code_push_server_bucket_name
  application_family = var.application_family

  bucket_policy_overrides = [
    data.aws_iam_policy_document.s3_code_push_server_bucket_policy.json
  ]

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  apply_replication_configuration = [{
    destination_bucket                = data.aws_s3_bucket.s3_code_push_server_failover_bucket.id
    storage_class                     = "STANDARD"
    enabled                           = true
    delete_marker_replication_enabled = true
    prefix                            = ""
  }]
}