provider "aws" {
  region = "us-east-1"
  alias  = "dev"

  assume_role {
    role_arn     = var.dev_role_arn
    session_name = var.dev_role_session_name
  }

  default_tags {
    tags = module.default_tags.tags
  }
}

module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = "dev"
  application_family = "devops"
  service_name       = "cross-account-replication"
  team_name          = "devops"
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/terraform-s3/test/cross-account-replication/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "dev" {
  provider = aws.dev
}

module "source_bucket_default_encryption" {
  providers = {
    aws = aws.dev
  }

  source = "../../../modules/s3_bucket"

  env                = "dev"
  bucket_name        = "terraform-s3-x-account-replication"
  application_family = "devops"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  apply_replication_configuration = [{
    prefix                            = ""
    enabled                           = true
    delete_marker_replication_enabled = false
    destination_bucket                = module.destination_bucket_default_encryption.s3_bucket_name_output
    storage_class                     = "STANDARD"
  }]
}

module "destination_bucket_default_encryption" {
  source = "../../../modules/s3_bucket"

  env                = "qa"
  bucket_name        = "terraform-s3-x-account-replication"
  application_family = "devops"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  apply_replication_destination_configuration = [{
    replication_source_iam_role_arn = module.source_bucket_default_encryption.s3_replication_role_arn_output
  }]
}

module "source_bucket_kms_encryption" {
  providers = {
    aws = aws.dev
  }

  source = "../../../modules/s3_bucket"

  env                = "dev"
  bucket_name        = "terraform-s3-x-account-replication-kms"
  application_family = "devops"
  kms_key_enabled    = true
  kms_key_name       = "terraform-s3-x-account-replication"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "aws:kms"
  }

  apply_replication_configuration = [{
    prefix                            = ""
    enabled                           = true
    delete_marker_replication_enabled = false
    destination_bucket                = module.destination_bucket_kms_encryption.s3_bucket_name_output
    storage_class                     = "STANDARD"
    replicate_kms_encrypted_objects   = true
    replica_kms_key_arn               = module.destination_bucket_kms_encryption.s3_kms_encryption_key_arn_output
  }]
}

module "destination_bucket_kms_encryption" {
  source = "../../../modules/s3_bucket"

  env                = "qa"
  bucket_name        = "terraform-s3-x-account-replication-kms"
  application_family = "devops"
  kms_key_enabled    = true
  kms_key_name       = "terraform-s3-x-account-replication"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "aws:kms"
  }

  apply_replication_destination_configuration = [{
    replication_source_iam_role_arn = module.source_bucket_kms_encryption.s3_replication_role_arn_output
    grant_kms_access                = true
  }]
}

module "source_bucket_kms_encryption_bucket_key" {
  providers = {
    aws = aws.dev
  }

  source = "../../../modules/s3_bucket"

  env                = "dev"
  bucket_name        = "terraform-s3-x-account-replication-bk"
  application_family = "devops"
  kms_key_enabled    = true
  kms_key_name       = "terraform-s3-x-account-replication-bk"
  bucket_key_enabled = true

  apply_server_side_encryption_by_default = {
    sse_algorithm = "aws:kms"
  }

  apply_replication_configuration = [{
    prefix                            = ""
    enabled                           = true
    delete_marker_replication_enabled = false
    destination_bucket                = module.destination_bucket_kms_encryption_bucket_key.s3_bucket_name_output
    storage_class                     = "STANDARD"
    replicate_kms_encrypted_objects   = true
    replica_kms_key_arn               = module.destination_bucket_kms_encryption_bucket_key.s3_kms_encryption_key_arn_output
  }]
}

module "destination_bucket_kms_encryption_bucket_key" {
  source = "../../../modules/s3_bucket"

  env                = "qa"
  bucket_name        = "terraform-s3-x-account-replication-bk"
  application_family = "devops"
  kms_key_enabled    = true
  kms_key_name       = "terraform-s3-x-account-replication-bk"
  bucket_key_enabled = true

  apply_server_side_encryption_by_default = {
    sse_algorithm = "aws:kms"
  }

  apply_replication_destination_configuration = [{
    replication_source_iam_role_arn = module.source_bucket_kms_encryption_bucket_key.s3_replication_role_arn_output
    grant_kms_access                = true
  }]
}