provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = "devops"
  service_name       = "terraform-s3-qa"
  team_name          = "devops"
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/terraform-s3/test/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "s3_bucket_with_aes256" {
  source = "../../../modules/s3_bucket"

  env                = var.environment
  bucket_name        = "${var.bucket_prefix}-aes256-enc"
  application_family = "test"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  s3_read_only_policy = true
}

module "s3_bucket_with_kms" {
  source = "../../../modules/s3_bucket"

  env                = var.environment
  bucket_name        = "${var.bucket_prefix}-kms-enc"
  application_family = "test"

  kms_key_enabled  = true
  kms_key_name     = "${var.bucket_prefix}-kms-key"
  kms_key_required = true

  apply_server_side_encryption_by_default = {
    sse_algorithm = "aws:kms"
  }
}

module "s3_bucket_with_lifecycle_configuration" {
  source = "../../../modules/s3_bucket"

  env                = var.environment
  bucket_name        = "${var.bucket_prefix}-lifecycle-conf"
  application_family = "test"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  # Add Lifecyle blocks if you want to enable lifecycle policies.
  lifecycle_rules_options_noncurrent_version_transition = [
    {
      prefix        = "folder_name1" # Using "" will lifecyle the whole bucket.
      enabled       = true
      days          = 30
      storage_class = "GLACIER"
    },
    {
      prefix        = "folder_name2"
      enabled       = true
      days          = 90
      storage_class = "DEEP_ARCHIVE"
    },
  ]

  lifecycle_rules_options_current_version_transition = [
    {
      prefix        = "folder_name1" # Using "" will lifecyle the whole bucket.
      enabled       = true
      days          = 40
      storage_class = "GLACIER"
    },
    {
      prefix        = "folder_name2"
      enabled       = true
      days          = 100
      storage_class = "DEEP_ARCHIVE"
    },
  ]

  lifecycle_rules_options_noncurrent_version_expiration = [
    {
      prefix  = "folder_name1" # Using "" will lifecyle the whole bucket.
      enabled = true
      days    = 50
    },
    {
      prefix  = "folder_name2"
      enabled = true
      days    = 200
    },
  ]

  lifecycle_rules_options_current_version_expiration = [
    {
      prefix  = "folder_name1" # Using "" will lifecyle the whole bucket.
      enabled = true
      days    = 50
    },
    {
      prefix  = "folder_name2"
      enabled = true
      days    = 300
    },
  ]

  lifecycle_rules_abort_incomplete_multipart_upload_days = [
    {
      prefix  = "folder_name1" # Using "" will lifecyle the whole bucket.
      enabled = true
      days    = 7
    },
    {
      prefix  = "folder_name2"
      enabled = true
      days    = 7
    },
  ]
}

module "s3_bucket_with_cors" {
  source = "../../../modules/s3_bucket"

  env                = var.environment
  bucket_name        = "${var.bucket_prefix}-cors-conf"
  application_family = "test"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  bucket_cors_rule = [
    {
      allowed_headers = ["*"]
      allowed_methods = ["PUT", "POST"]
      allowed_origins = [
        "https://podcast.theorchard.com",
        "https://sonymusic.theorchard.com"
      ]
      expose_headers  = ["ETag"]
      max_age_seconds = 3000
    },
  ]
}

module "s3_replication_source_bucket" {
  source = "../../../modules/s3_bucket"

  env                = var.environment
  bucket_name        = "${var.bucket_prefix}-repl-src"
  application_family = "test"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  apply_replication_configuration = [{
    prefix                            = ""
    destination_bucket                = module.s3_replication_destination_bucket.s3_bucket_name_output
    storage_class                     = "STANDARD"
    enabled                           = true
    delete_marker_replication_enabled = true
  }]
}

module "s3_replication_destination_bucket" {
  source = "../../../modules/s3_bucket"

  env                = var.environment
  bucket_name        = "${var.bucket_prefix}-repl-dst"
  application_family = "test"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}

module "s3_bucket_with_custom_policy" {
  source = "../../../modules/s3_bucket"

  env                = var.environment
  bucket_name        = "${var.bucket_prefix}-custom-policy"
  application_family = "test"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  s3_read_only_policy = true

  bucket_policy_overrides = [
    data.aws_iam_policy_document.custom_policy_document.json,
  ]
}

data "aws_iam_policy_document" "custom_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "s3:ListBucket",
      "s3:GetObject",
    ]
    principals {
      type        = "AWS"
      identifiers = [data.aws_caller_identity.current.account_id]
    }
    resources = [
      module.s3_bucket_with_custom_policy.s3_bucket_arn_output,
      "${module.s3_bucket_with_custom_policy.s3_bucket_arn_output}/*",
    ]
  }
}

module "s3_bucket_with_access_logging_disabled" {
  source = "../../../modules/s3_bucket"

  env                = var.environment
  bucket_name        = "${var.bucket_prefix}-logging-disabled"
  application_family = "test"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  access_logging_enabled = false
}