provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/orcdbucket/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

data "aws_s3_bucket" "bucket" {
  bucket = var.bucket_name
}

data "aws_lambda_function" "event_notification_function" {
  function_name = var.event_notification_function_name
}

resource "aws_s3_object" "statement_attachments_keep" {
  bucket  = data.aws_s3_bucket.bucket.id
  key     = "qa-statement-attachments/.keep"
  content = ""
}

resource "aws_s3_bucket_notification" "event_notification_configuration" {
  bucket = data.aws_s3_bucket.bucket.id

  lambda_function {
    lambda_function_arn = data.aws_lambda_function.event_notification_function.arn
    events              = ["s3:ObjectCreated:*"]
    filter_prefix       = "qa-statement-attachments/"
  }

  depends_on = [aws_lambda_permission.allow_s3_invoke]
}

resource "aws_lambda_permission" "allow_s3_invoke" {
  statement_id  = "AllowExecutionFromS3Bucket"
  action        = "lambda:InvokeFunction"
  function_name = data.aws_lambda_function.event_notification_function.function_name
  principal     = "s3.amazonaws.com"
  source_arn    = data.aws_s3_bucket.bucket.arn
  source_account = data.aws_caller_identity.current.account_id
}

resource "aws_s3_bucket_lifecycle_configuration" "bucket" {
  bucket = data.aws_s3_bucket.bucket.id

  rule {
    id     = "helpcenter/"
    status = "Enabled"

    filter {
      prefix = "helpcenter/"
    }

    expiration {
      days = 1
    }

    noncurrent_version_expiration {
      noncurrent_days = 1
    }

    abort_incomplete_multipart_upload {
      days_after_initiation = 1
    }
  }

  rule {
    id     = "cleanup-stale-statement-attachment-uploads"
    status = "Enabled"

    # Size filter spares the 0-byte .keep file from expiration.
    filter {
      and {
        prefix                   = "qa-statement-attachments/"
        object_size_greater_than = 0
        object_size_less_than    = 5497558138880 # 5 TB, S3 max object size
      }
    }

    expiration {
      days = 30
    }

    noncurrent_version_expiration {
      noncurrent_days = 30
    }
  }

  rule {
    id     = "qa-orcdbucket-noncurrent-to-glacier"
    status = "Enabled"

    filter {}

    noncurrent_version_transition {
      noncurrent_days = 30
      storage_class   = "GLACIER"
    }
  }

  rule {
    id     = "abort-incomplete-multipart-uploads"
    status = "Enabled"

    filter {}

    abort_incomplete_multipart_upload {
      days_after_initiation = 7
    }
  }
}