provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  alias  = "aws_us_west_2"
  region = "us-west-2"

  default_tags {
    tags = module.default_tags.tags
  }
}

module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = "dev"
  application_family = "devops"
  service_name       = "terraform-s3-dev"
  team_name          = "devops"
}


# S3 backend
terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/service-name/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"

  }
}

data "aws_canonical_user_id" "current" {}
/* 
# Assume role policy covering each role's service identifier
data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "Service"

      identifiers = [
        "s3.amazonaws.com",
      ]
    }
  }
}

# We would use the module output for the source bucket, but
# it would create a circular dependency
data "aws_iam_policy_document" "s3_replication_policy" {
  statement {
    actions = [
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
    ]

    resources = [
      "arn:aws:s3:::${var.bucket_name}",
    ]
  }

  statement {
    actions = [
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTagging",
    ]

    resources = [
      "arn:aws:s3:::${var.bucket_name}/*",
    ]
  }

  statement {
    actions = [
      "s3:ReplicateObject",
      "s3:ReplicateDelete",
      "s3:ReplicateTags",
      "s3:GetObjectVersionTagging",
    ]

    resources = [
      "${module.s3_destination_bucket.s3_bucket_arn_output}/*",
    ]
  }
}

resource "aws_iam_role" "s3_replication_role" {
  name               = "dev-s3-test-replication-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

resource "aws_iam_policy" "s3_replication_policy" {
  name   = "S3-dev-s3-test-replication-policy"
  policy = data.aws_iam_policy_document.s3_replication_policy.json
}

resource "aws_iam_role_policy_attachment" "s3_replication_policy_attachment" {
  role       = aws_iam_role.s3_replication_role.id
  policy_arn = aws_iam_policy.s3_replication_policy.arn
} */

module "s3_destination_bucket" {
  source = "../../../modules/s3_bucket"

  env                = "dev"
  bucket_name        = "orcd-replication-destination"
  application_family = "abc"
  additional_tags = {
    "user_supplied_tag_1" = "some_project",
    "user_supplied_tag_2" = "orchard"
  }

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}

module "s3_bucket" {
  source = "../../../modules/s3_bucket"

  env                = "dev"
  bucket_name        = var.bucket_name
  application_family = "abc"
  additional_tags = {
    "user_supplied_tag_1" = "some_project",
    "user_supplied_tag_2" = "orchard"
  }

  # To enable KMS
  #kms_key_enabled = true
  #kms_key_name = "test"

  apply_server_side_encryption_by_default = {

    # Uncomment if using KMS
    #kms_master_key_id = module.s3_bucket.s3_kms_encryption_key_id_output
    #sse_algorithm     = "aws:kms"

    sse_algorithm = "AES256"
  }

  # Add Lifecyle blocks if you want to enable lifecycle policies.
  lifecycle_rules_options_noncurrent_version_transition = [
    {
      prefix        = "folder_name1" # Using "" will lifecyle the whole bucket.
      enabled       = true
      days          = 30
      storage_class = "GLACIER"
    },
    {
      prefix        = "folder_name2"
      enabled       = true
      days          = 90
      storage_class = "DEEP_ARCHIVE"
    },
  ]

  lifecycle_rules_options_current_version_transition = [
    {
      prefix        = "folder_name1" # Using "" will lifecyle the whole bucket.
      enabled       = true
      days          = 40
      storage_class = "GLACIER"
    },
    {
      prefix        = "folder_name2"
      enabled       = true
      days          = 100
      storage_class = "DEEP_ARCHIVE"
    },
  ]

  lifecycle_rules_options_noncurrent_version_expiration = [
    {
      prefix  = "folder_name1" # Using "" will lifecyle the whole bucket.
      enabled = true
      days    = 50
    },
    {
      prefix  = "folder_name2"
      enabled = true
      days    = 200
    },
  ]

  lifecycle_rules_options_current_version_expiration = [
    {
      prefix  = "folder_name1" # Using "" will lifecyle the whole bucket.
      enabled = true
      days    = 50
    },
    {
      prefix  = "folder_name2"
      enabled = true
      days    = 300
    },
  ]

  lifecycle_rules_abort_incomplete_multipart_upload_days = [
    {
      prefix  = "folder_name1" # Using "" will lifecyle the whole bucket.
      enabled = true
      days    = 7
    },
    {
      prefix  = "folder_name2"
      enabled = true
      days    = 7
    },
  ]

  lifecycle_rules_expired_object_delete_markers_expiration = [
    {
      prefix  = "" # Using "" will lifecyle the whole bucket.
      enabled = true
    },
  ]

  apply_replication_configuration = [{
    prefix                            = ""
    destination_bucket                = module.s3_destination_bucket.s3_bucket_name_output
    delete_marker_replication_enabled = false
    storage_class                     = "STANDARD"
    enabled                           = true
  }]

  storage_lens_configuration = {
    enabled = true
  }
}

module "s3_bucket_region_test" {
  source = "../../../modules/s3_bucket"
  providers = {
    aws = aws.aws_us_west_2
  }

  env                   = "dev"
  bucket_name           = "region-test-bucket"
  custom_logging_bucket = "elasticbeanstalk-us-west-2-103233932089"

  application_family = "abc"
  additional_tags = {
    "user_supplied_tag_1" = "some_project",
    "user_supplied_tag_2" = "orchard"
  }

  apply_server_side_encryption_by_default = {

    sse_algorithm = "AES256"
  }
}

module "s3_bucket_acl_test" {
  source = "../../../modules/s3_bucket"

  env                = "dev"
  bucket_name        = "acl-grants-test-bucket"
  application_family = "abc"
  additional_tags = {
    "user_supplied_tag_1" = "some_project",
    "user_supplied_tag_2" = "orchard"
  }

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  acl_policy_grants = [
    {
      id         = data.aws_canonical_user_id.current.id
      type       = "CanonicalUser"
      permission = "READ_ACP"
    },
    {
      id         = data.aws_canonical_user_id.current.id
      type       = "CanonicalUser"
      permission = "READ"
    },
    {
      id         = data.aws_canonical_user_id.current.id
      type       = "CanonicalUser"
      permission = "WRITE"
    },
    {
      id         = data.aws_canonical_user_id.current.id
      type       = "CanonicalUser"
      permission = "WRITE_ACP"
    }
  ]
}

module "s3_bucket_read_only_policy_test" {
  source = "../../../modules/s3_bucket"

  env                 = "dev"
  bucket_name         = "read-only-policy-bucket"
  s3_read_only_policy = true

  application_family = "abc"
  additional_tags = {
    "user_supplied_tag_1" = "some_project",
    "user_supplied_tag_2" = "orchard"
  }

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}

module "s3_bucket_additional_inventories" {
  source = "../../../modules/s3_bucket"

  env         = "dev"
  bucket_name = "tf-additional-inventories-test"

  application_family = "abc"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  additional_inventory_configurations = {
    "testing-1-2-3-rule" = {
      destination_bucket_arn   = "arn:aws:s3:::pde-inventory-us-east-1"
      destination_prefix       = "terraform-module-test"
      filter_prefix            = "test/"
      format                   = "ORC"
      frequency                = "Weekly"
      included_object_versions = "Current"
      optional_fields = [
        "ETag"
      ]
    }
  }
}

module "s3_disable_default_inventory" {
  source = "../../../modules/s3_bucket"

  env                       = "dev"
  bucket_name               = "tf-disable-default-inventory-test"
  default_inventory_enabled = false
  application_family        = "abc"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}

module "source_bucket_replication_helper" {
  source = "../../../modules/s3_bucket"

  env                = "dev"
  bucket_name        = "terraform-s3-x-account-replication-helper"
  application_family = "devops"

  replication_helper_allowed = true

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}

module "enable_guardduty_malware_protection_for_s3" {
  source = "../../../modules/s3_bucket"

  env                = "dev"
  bucket_name        = "enable-guardduty-malware-protection-for-s3"
  application_family = "devops"

  enable_guardduty_malware_protection = true

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}