module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/orcd-podcast-analytics/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "aws_accounts_map" {
  source = "git@github.com:theorchard/terraform-aws-accounts-map.git//modules/read_accounts_map?ref=3.1.0"
}

data "aws_iam_policy_document" "cross_account_s3_bucket_access_policy" {
  statement {
    sid = "SMEAWSAccountBucketTrustRelationship"
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::${local.all_accounts["sme-dc-prod"]}:role/EC2-dcp-datacollector-server-role",
      ]
    }

    actions = [
      "s3:ListBucket",
      "s3:ListBucketVersions",
      "s3:ListBucketMultipartUploads"
    ]

    resources = [
      module.s3_bucket.s3_bucket_arn_output
    ]
  }

  statement {
    sid = "SMEAWSRoleTrustRelationship"
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::${local.all_accounts["sme-dc-prod"]}:role/EC2-dcp-datacollector-server-role",
      ]
    }

    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
    ]

    resources = [
      module.s3_bucket.s3_bucket_arn_output,
      "${module.s3_bucket.s3_bucket_arn_output}/*",
    ]
  }
}

module "s3_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.15.7"

  env                = var.environment
  bucket_name        = var.bucket_name
  custom_bucket_name = var.bucket_name
  application_family = var.application_family

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  bucket_policy_overrides = [
    data.aws_iam_policy_document.cross_account_s3_bucket_access_policy.json
  ]

  apply_replication_configuration = [
    {
      delete_marker_replication_enabled = false
      destination_bucket                = "sony-megaphone-fp"
      enabled                           = true
      prefix                            = ""
      storage_class                     = "STANDARD"
    }
  ]

  lifecycle_rules_options_noncurrent_version_transition = [
    {
      prefix        = "frontend-podcast/"
      enabled       = true
      days          = 180
      storage_class = "DEEP_ARCHIVE"
    },
    {
      prefix        = ""
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    }
  ]

  lifecycle_rules_options_current_version_transition = [
    {
      prefix        = "frontend-podcast/"
      enabled       = true
      days          = 180
      storage_class = "DEEP_ARCHIVE"
    },
    {
      prefix        = ""
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    }
  ]
}

# Creates the KMS key
resource "aws_kms_key" "kms_key" {
  enable_key_rotation     = true
  rotation_period_in_days = 365
  tags = {
    environment = "prod"
    terraformed = "true"
  }
}

resource "aws_kms_alias" "kms_alias" {
  name          = "alias/${module.s3_bucket.s3_bucket_name_output}"
  target_key_id = aws_kms_key.kms_key.key_id
}

module "s3_read_only_policy" {
  source = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/s3/buckets_with_prefixes?ref=0.4.0"

  buckets = [
    {
      bucket = module.s3_bucket.s3_bucket_name_output,
    },
  ]
  action_types = ["read"]
}

module "s3_read_write_policy" {
  source = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/s3/buckets_with_prefixes?ref=0.4.0"

  buckets = [
    {
      bucket = module.s3_bucket.s3_bucket_name_output,
    },
  ]
  action_types = ["read", "write", "delete"]
}

# Creates policy for read-only access to the S3 bucket
resource "aws_iam_policy" "s3_read_only_policy" {
  name   = "S3-${module.s3_bucket.s3_bucket_name_output}-RO"
  policy = module.s3_read_only_policy.policy.json
}

# Create policy for read-write access to the S3 bucket
resource "aws_iam_policy" "s3_read_write_policy" {
  name   = "S3-${module.s3_bucket.s3_bucket_name_output}-RW"
  policy = module.s3_read_write_policy.policy.json
}

# SYS-19571 Read Only S3 Access for Lori Jones
resource "aws_iam_user" "tritondigital_iam_user" {
  name = "tritondigital"

  tags = {
    terraformed = true
    role        = "service-user"
  }
}

resource "aws_iam_policy_attachment" "tritondigital_iam_user_policy_attachment" {
  name = "SYS-19571 Read Only S3 Access for Lori Jones"
  users = [
    aws_iam_user.tritondigital_iam_user.name,
    "magellan",
    "kosani",
    "tkoshy",
    "alamech",
  ]
  policy_arn = aws_iam_policy.s3_read_only_policy.arn
}

module "temp_s3_read_write_policy" {
  source = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/s3/buckets_with_prefixes?ref=0.4.0"

  buckets = [
    {
      bucket = module.s3_bucket.s3_bucket_name_output,
    },
    {
      bucket   = "sme-dc-podcast-analytics",
      prefixes = ["megaphone/"]
    }
  ]
  action_types = ["read", "write"]
}

resource "aws_iam_policy" "temp_s3_read_write_policy" {
  name   = "S3-sme-dc-podcast-analytics-RW"
  policy = module.temp_s3_read_write_policy.policy.json
}