module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "shared-orcd-terraform-state"
    key     = "shared/prod/pde-services-metadata/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "s3_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.14.1"

  env                = var.environment
  bucket_name        = var.service_name
  application_family = var.application_family

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  bucket_policy_overrides = [
    data.aws_iam_policy_document.s3_policy.json,
  ]
}

data "aws_iam_policy_document" "s3_policy" {
  statement {
    actions   = ["s3:GetObject*"]
    resources = ["${module.s3_bucket.s3_bucket_arn_output}/*"]

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    condition {
      test     = "StringEquals"
      values   = var.resource_org_paths
      variable = "aws:ResourceOrgPaths"
    }

    condition {
      test     = "StringEquals"
      values   = [var.principal_org_id]
      variable = "aws:PrincipalOrgID"
    }
  }

  statement {
    actions   = ["s3:ListBucket"]
    resources = [module.s3_bucket.s3_bucket_arn_output]

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    condition {
      test     = "StringEquals"
      values   = var.resource_org_paths
      variable = "aws:ResourceOrgPaths"
    }

    condition {
      test     = "StringEquals"
      values   = [var.principal_org_id]
      variable = "aws:PrincipalOrgID"
    }
  }

  statement {
    actions   = ["s3:PutObject*"]
    resources = ["${module.s3_bucket.s3_bucket_arn_output}/*"]

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    condition {
      test     = "StringEquals"
      values   = var.resource_org_paths
      variable = "aws:ResourceOrgPaths"
    }

    condition {
      test     = "StringEquals"
      values   = [var.principal_org_id]
      variable = "aws:PrincipalOrgID"
    }

    condition {
      variable = "aws:PrincipalArn"
      test     = "StringLike"
      values   = var.rw_principal_arn_patterns
    }
  }

  # Allow PutObject for dev environment
  statement {
    actions   = ["s3:PutObject*"]
    resources = ["${module.s3_bucket.s3_bucket_arn_output}/dev/*"]

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    condition {
      test     = "StringEquals"
      values   = var.resource_org_paths
      variable = "aws:ResourceOrgPaths"
    }

    condition {
      test     = "StringEquals"
      values   = [var.principal_org_id]
      variable = "aws:PrincipalOrgID"
    }
  }
}