locals {
  distribution_domain = "${var.video_assets_bucket_name}.s3.amazonaws.com"
  s3_origin_path      = "/thumbnails"
  s3_origin_id        = "${var.video_assets_bucket_name}${local.s3_origin_path}"
}

data "aws_wafv2_web_acl" "waf" {
  name  = "${var.environment}-orcd-cloudfront-waf-block"
  scope = "CLOUDFRONT"
}

resource "aws_cloudfront_origin_access_identity" "thumbnails_origin_access_identity" {
  comment = "access-identity-${local.distribution_domain}"
}

resource "aws_cloudfront_distribution" "thumbnails_distribution" {
  comment         = "Distribution for video thumbnails: ${var.distribution_alias}"
  aliases         = [var.distribution_alias]
  enabled         = true
  is_ipv6_enabled = true
  http_version    = "http2"
  price_class     = "PriceClass_All"
  web_acl_id      = data.aws_wafv2_web_acl.waf.arn

  origin {
    domain_name = local.distribution_domain
    origin_id   = local.s3_origin_id
    origin_path = local.s3_origin_path

    s3_origin_config {
      origin_access_identity = aws_cloudfront_origin_access_identity.thumbnails_origin_access_identity.cloudfront_access_identity_path
    }
  }

  default_cache_behavior {
    target_origin_id       = local.s3_origin_id
    viewer_protocol_policy = var.viewer_protocol_policy
    allowed_methods        = var.allowed_methods
    cached_methods         = var.cached_methods
    default_ttl            = var.default_ttl
    min_ttl                = 0
    max_ttl                = 31536000
    compress               = true
    trusted_signers        = ["self"]

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    acm_certificate_arn      = var.acm_certificate_arn
    ssl_support_method       = "sni-only"
    minimum_protocol_version = var.minimum_protocol_version
  }

  logging_config {
    include_cookies = true
    bucket          = var.logging_bucket
    prefix          = var.logging_prefix
  }
}

data "aws_iam_policy_document" "thumbnails_s3_policy_document" {
  statement {
    actions   = ["s3:GetObject"]
    resources = ["arn:aws:s3:::${var.video_assets_bucket_name}${local.s3_origin_path}/*"]

    principals {
      type        = "AWS"
      identifiers = [aws_cloudfront_origin_access_identity.thumbnails_origin_access_identity.iam_arn]
    }
  }
}

resource "aws_s3_bucket_policy" "thumbnails_s3_bucket_policy" {
  bucket = var.video_assets_bucket_name
  policy = data.aws_iam_policy_document.thumbnails_s3_policy_document.json
}