provider "aws" {
  region = var.region
}

# Terraform backends
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/frontend-video/terraform.tfstate"
    region  = "us-east-1"
    encrypt = true
  }
}

locals {
  distribution_domain = "${var.environment}-${var.video_assets_bucket_name}.s3.amazonaws.com"
  s3_origin_path      = "/thumbnails"
  s3_origin_id        = "${var.environment}-${var.video_assets_bucket_name}${local.s3_origin_path}"

  # Concatenate required and user-supplied tags
  combined_resource_tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = true
  }
}

data "aws_wafv2_web_acl" "waf" {
  name  = "${var.environment}-orcd-cloudfront-waf-block"
  scope = "CLOUDFRONT"
}

data "aws_acm_certificate" "certificate" {
  domain   = "*.${var.domain_name}"
  statuses = ["ISSUED"]
}

resource "aws_cloudfront_origin_access_identity" "thumbnails_origin_access_identity" {
  comment = "access-identity-${local.distribution_domain}"
}

data "aws_cloudfront_response_headers_policy" "response_headers_policy" {
  name = "${var.environment}-default"
}

resource "aws_cloudfront_distribution" "thumbnails_distribution" {
  comment         = "Distribution for video thumbnails: ${var.service_name_suffix}.${var.domain_name}"
  aliases         = ["${var.service_name_suffix}.${var.domain_name}"]
  enabled         = true
  is_ipv6_enabled = true
  http_version    = "http2"
  price_class     = "PriceClass_All"
  web_acl_id      = data.aws_wafv2_web_acl.waf.arn

  origin {
    domain_name = local.distribution_domain
    origin_id   = local.s3_origin_id
    origin_path = local.s3_origin_path

    s3_origin_config {
      origin_access_identity = aws_cloudfront_origin_access_identity.thumbnails_origin_access_identity.cloudfront_access_identity_path
    }
  }

  default_cache_behavior {
    target_origin_id       = local.s3_origin_id
    viewer_protocol_policy = var.viewer_protocol_policy
    allowed_methods        = var.allowed_methods
    cached_methods         = var.cached_methods
    default_ttl            = var.default_ttl
    min_ttl                = 0
    max_ttl                = 31536000
    compress               = true
    trusted_signers        = ["self"]

    response_headers_policy_id = data.aws_cloudfront_response_headers_policy.response_headers_policy.id

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    acm_certificate_arn      = data.aws_acm_certificate.certificate.arn
    ssl_support_method       = "sni-only"
    minimum_protocol_version = var.cloudfront_minimum_protocol_version
  }

  logging_config {
    include_cookies = true
    bucket          = "prod-${var.logging_bucket}.s3.amazonaws.com"
    prefix          = var.logging_prefix
  }
}