data "aws_cloudfront_log_delivery_canonical_user_id" "cloudfront" {}

data "aws_canonical_user_id" "current" {}

data "aws_iam_policy_document" "s3_origin" {
  for_each = local.s3_cdn_map

  statement {
    sid    = "AllowCloudFrontOAI"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = [aws_cloudfront_origin_access_identity.origin_access_identity[each.key].iam_arn]
    }
    actions   = ["s3:GetObject"]
    resources = ["${each.value.s3_bucket_arn}/*"]
  }
}

data "aws_iam_policy_document" "cdn_logs_enforce_ssl" {
  for_each = local.cdn_map
  statement {
    sid       = "DenyIfNotUsingSecureTransport"
    effect    = "Deny"
    resources = ["${aws_s3_bucket.cdn_logs[each.value.name].arn}/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}