provider "aws" {
  region = var.aws_region
}

# S3 backend
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/integrations/qa-abacus-sap/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

# Moved to the qa-accounting AWS account
# module "s3_bucket" {
#   source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.10.3"

#   env                = var.environment
#   bucket_name        = var.bucket_name
#   application_family = var.application_family

#   apply_server_side_encryption_by_default = {
#     sse_algorithm = "AES256"
#   }
# }

# resource "aws_iam_user" "main" {
#   name = var.bucket_name

#   tags = {
#     terraformed = true
#     role        = "service-user"
#   }
# }

# data "aws_iam_policy_document" "s3_read_write_policy" {
#   statement {
#     actions = [
#       "s3:DeleteObject",
#       "s3:DeleteObject*",
#       "s3:GetObject",
#       "s3:GetObject*",
#       "s3:PutObject",
#       "s3:PutObject*",
#     ]

#     resources = [
#       "${module.s3_bucket.s3_bucket_arn_output}/*"
#     ]
#   }

#   statement {
#     actions = [
#       "s3:GetBucketLocation",
#       "s3:ListBucket",
#     ]

#     resources = [
#       module.s3_bucket.s3_bucket_arn_output
#     ]
#   }

#   statement {
#     actions = [
#       "s3:GetBucketLocation",
#       "s3:ListAllMyBuckets"
#     ]

#     resources = [
#       "*"
#     ]
#   }
# }

# # Create policy for read-write access to the S3 bucket
# resource "aws_iam_policy" "s3_read_write_policy" {
#   name   = "S3-${var.environment}-${var.bucket_name}-RW"
#   policy = data.aws_iam_policy_document.s3_read_write_policy.json
# }

# resource "aws_iam_user_policy_attachment" "s3_read_write_policy_attachment" {
#   user       = aws_iam_user.main.name
#   policy_arn = aws_iam_policy.s3_read_write_policy.arn
# }