module "s3_interm_delivery_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.13.0"

  application_family = var.application_family
  env                = var.environment
  bucket_name        = var.interm_delivery_bucket_name

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}

data "aws_iam_policy_document" "s3_interm_delivery_bucket_uploaders" {
  statement {
    effect = "Allow"

    actions = [
      "s3:PutObject",
      "s3:DeleteObject"
    ]

    resources = [
      "${module.s3_interm_delivery_bucket.s3_bucket_arn_output}/ready/*"
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "s3:GetObject"
    ]

    resources = [
      "${module.s3_interm_delivery_bucket.s3_bucket_arn_output}/*"
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "s3:ListBucket"
    ]

    resources = [
      module.s3_interm_delivery_bucket.s3_bucket_arn_output
    ]

  }
}

resource "aws_iam_policy" "s3_interm_delivery_bucket_uploaders_policy" {
  name        = "${var.environment}-s3-interm-delivery-bucket-uploaders-policy"
  policy      = data.aws_iam_policy_document.s3_interm_delivery_bucket_uploaders.json
  description = "Provides granular upload access to interm delivery bucket data to be processed."
}

resource "aws_iam_group" "s3_interm_delivery_uploaders" {
  name = "${var.environment}-s3-interm-delivery-uploaders"
}

resource "aws_iam_group_membership" "s3_interm_delivery_uploaders_membership" {
  name = "s3-interm-delivery-uploaders-membership"

  users = [
    "ajohnesgeorge",
    "ahanna",
    "ccesaro",
    "jbarcella",
    "jblancas",
    "jkenny",
    "mnigro",
    "mrawat",
    "mstyles",
    "rchandrasekharan",
    "tmckee",
  ]

  group = aws_iam_group.s3_interm_delivery_uploaders.name
}

resource "aws_iam_group_policy_attachment" "s3_interm_delivery_uploaders_iam_policy_attachment" {
  group      = aws_iam_group.s3_interm_delivery_uploaders.name
  policy_arn = aws_iam_policy.s3_interm_delivery_bucket_uploaders_policy.arn
}