# Bootstrap: failover bucket is created separately in the us-west-2 config.
# Re-enable this data source (and the apply_replication_configuration block
# below) after the us-west-2 apply creates the bucket.
data "aws_s3_bucket" "s3_hot_updater_server_failover_bucket" {
  provider = aws.failover
  bucket   = "${var.environment}-${var.hot_updater_server_replication_destination_bucket_name}"
}

data "aws_iam_policy_document" "s3_hot_updater_server_bucket_policy" {
  statement {
    actions = [
      "s3:GetObject",
    ]

    resources = [
      "${module.s3_hot_updater_server_bucket.s3_bucket_arn_output}/*"
    ]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceArn"
      values = [
        aws_cloudfront_distribution.hot_updater_server_cdn.arn
      ]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }
  }
}

module "s3_hot_updater_server_bucket" {
  source             = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.12.1"
  env                = var.environment
  bucket_name        = var.hot_updater_server_bucket_name
  application_family = var.application_family

  bucket_policy_overrides = [
    data.aws_iam_policy_document.s3_hot_updater_server_bucket_policy.json
  ]

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  # Bootstrap: destination bucket lives in us-west-2 and is applied separately.
  # Re-enable after the us-west-2 apply creates the bucket.
  apply_replication_configuration = [{
    destination_bucket                = data.aws_s3_bucket.s3_hot_updater_server_failover_bucket.id
    storage_class                     = "STANDARD"
    enabled                           = true
    delete_marker_replication_enabled = true
    prefix                            = ""
  }]
}