locals {
  bucket_name = "content-apple-style-guide-validator"
}

module "apple_sg_validator_results_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.15.7"

  env                = var.environment
  bucket_name        = local.bucket_name
  application_family = var.application_family

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  lifecycle_rules_options_current_version_expiration = [
    {
      prefix  = var.bedrock_model_output_prefix
      enabled = true
      days    = 90
    },
    {
      prefix  = var.results_bucket_prefix
      enabled = true
      days    = 90
    }
  ]
}

data "aws_iam_policy_document" "sfn_apple_sg_validator_s3" {
  statement {
    actions   = ["s3:PutObject"]
    resources = ["${module.apple_sg_validator_results_bucket.s3_bucket_arn_output}/*"]
  }
}

resource "aws_iam_policy" "sfn_apple_sg_validator_s3" {
  name   = "S3-${var.environment}-${local.sfn_name}-W"
  policy = data.aws_iam_policy_document.sfn_apple_sg_validator_s3.json
}

resource "aws_iam_role_policy_attachment" "sfn_apple_sg_validator_s3" {
  role       = aws_iam_role.sfn_apple_sg_validator_assume_role.name
  policy_arn = aws_iam_policy.sfn_apple_sg_validator_s3.arn
}