provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/prod-datalytics/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "prod_datalytics_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.13.0"

  env                   = var.environment
  bucket_name           = "datalytics"
  custom_logging_bucket = "prod-orcd-s3-logs"
  s3_read_only_policy   = false
  application_family    = var.application_family

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }


  lifecycle_rules_options_noncurrent_version_transition = [
    {
      prefix        = "DataAnalyticsDept/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
     {
      prefix        = "credentials/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
     {
      prefix        = "filedrop/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
     {
      prefix        = "test/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
    {
      prefix        = "etl/acquisitions/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
    {
      prefix        = "etl/ad_hoc/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
    {
      prefix        = "etl/marketshare/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
    {
      prefix        = "etl/store/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
    {
      prefix        = "etl/videoservices/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
  ]

  lifecycle_rules_options_current_version_transition = [
    {
      prefix        = "DataAnalyticsDept/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
     {
      prefix        = "credentials/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
     {
      prefix        = "filedrop/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
     {
      prefix        = "test/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
    {
      prefix        = "etl/acquisitions/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
    {
      prefix        = "etl/ad_hoc/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
    {
      prefix        = "etl/marketshare/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
    {
      prefix        = "etl/store/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
    {
      prefix        = "etl/videoservices/"
      enabled       = true
      days          = 180
      storage_class = "GLACIER"
    },
  ]

  lifecycle_rules_abort_incomplete_multipart_upload_days = [
    {
      prefix  = ""
      enabled = true
      days    = 7
    },
  ]
}

data "aws_iam_group" "prod_dolby_atmos_packager_alpha_manager_group" {
  group_name = "prod-dolby-atmos-packager-alpha-manager"
}

resource "aws_iam_group_policy_attachment" "prod_datalytics_managers_iam_policy_attachment" {
  group      = data.aws_iam_group.prod_dolby_atmos_packager_alpha_manager_group.group_name
  policy_arn = aws_iam_policy.prod_datalytics_managers_policy.arn
}

data "aws_iam_policy_document" "prod_datalytics_managers_permissions" {
  statement {
    sid = "AllowUserToSeeBucketList"
    actions = [
      "s3:ListAllMyBuckets",
    ]
    effect    = "Allow"
    resources = ["*"]
  }

  statement {
    effect = "Allow"

    actions = [
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:GetObject*",
      "s3:ListBucket*",
      "s3:ListMultipartUploadParts"
    ]

    resources = [
      "${module.prod_datalytics_bucket.s3_bucket_arn_output}/filedrop/ops/hides/*"
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "s3:ListBucket",
      "s3:ListBucketVersions",
      "s3:GetBucketLocation",
      "s3:GetBucketVersioning",
    ]

    resources = [
      module.prod_datalytics_bucket.s3_bucket_arn_output
    ]

  }
}

resource "aws_iam_policy" "prod_datalytics_managers_policy" {
  name        = "${var.environment}-datalytics-policy"
  policy      = data.aws_iam_policy_document.prod_datalytics_managers_permissions.json
  description = "Provides granular upload access to prod-datalytics bucket."
}