# Create S3 bucket with server-side encryption enabled
resource "aws_s3_bucket" "bucket" {
  provider = aws
  bucket   = "${var.env}-${var.bucket_name}"
  acl      = "private"
  region   = "us-east-1"

  versioning {
    enabled = true
  }

  dynamic "lifecycle_rule" {
    for_each = var.lifecycle_rules_options
    content {
      prefix  = lifecycle_rule.value["prefix"]
      enabled = lifecycle_rule.value["enabled"]

      noncurrent_version_transition {
        days          = lifecycle_rule.value["days"]
        storage_class = lifecycle_rule.value["storage_class"]
      }
    }
  }

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = aws_kms_key.kms_key.arn
        sse_algorithm     = "aws:kms"
      }
    }
  }

  logging {
    target_bucket = "prod-orcd-s3-logs"
    target_prefix = "s3/${var.env}-${var.bucket_name}/accesslogs"
  }

  tags = {
    environment = var.env
    terraformed = "true"
  }
}

# Blocks all public access to the S3 bucket
resource "aws_s3_bucket_public_access_block" "public_access_block" {
  bucket = aws_s3_bucket.bucket.id

  block_public_acls       = true
  ignore_public_acls      = true
  block_public_policy     = true
  restrict_public_buckets = true
}

# Creates the KMS key
resource "aws_kms_key" "kms_key" {

  tags = {
    environment = var.env
    terraformed = "true"
  }
}

resource "aws_kms_alias" "kms_alias" {
  name          = "alias/${var.env}-${var.kms_key_name}"
  target_key_id = aws_kms_key.kms_key.key_id
}

# Data resource for read-only policy to the S3 bucket
data "aws_iam_policy_document" "s3_read_only_policy" {
  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket"
    ]

    resources = [
      "${aws_s3_bucket.bucket.arn}/*"
    ]
  }

  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets"
    ]

    resources = [
      "*"
    ]
  }
}

# Creates policy for read-only access to the S3 bucket
resource "aws_iam_policy" "s3_read_only_policy" {
  name   = "S3-${var.env}-${var.bucket_name}-read-only"
  policy = data.aws_iam_policy_document.s3_read_only_policy.json
}