resource "aws_s3_bucket" "this" {
  for_each      = var.buckets
  bucket        = each.value.name
  force_destroy = false

  tags = merge(var.service_tags, {
    Name = each.value.name
  })
}

resource "aws_s3_bucket_versioning" "this" {
  for_each   = var.buckets
  bucket     = aws_s3_bucket.this[each.key].id
  depends_on = [aws_s3_bucket.this]

  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
  for_each   = var.buckets
  bucket     = aws_s3_bucket.this[each.key].id
  depends_on = [aws_s3_bucket.this]

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
    bucket_key_enabled = true
  }
}

resource "aws_s3_bucket_ownership_controls" "this" {
  for_each   = var.buckets
  bucket     = aws_s3_bucket.this[each.key].id
  depends_on = [aws_s3_bucket.this]

  rule {
    object_ownership = "BucketOwnerPreferred"
  }
}

resource "aws_s3_bucket_public_access_block" "this" {
  for_each                = var.buckets
  bucket                  = aws_s3_bucket.this[each.key].id
  block_public_acls       = true
  ignore_public_acls      = true
  block_public_policy     = true
  restrict_public_buckets = true
}

data "aws_iam_policy_document" "enforce_ssl" {
  for_each = var.buckets

  statement {
    sid     = "DenyNonSSL"
    effect  = "Deny"
    actions = ["s3:*"]

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    resources = [
      aws_s3_bucket.this[each.key].arn,
      "${aws_s3_bucket.this[each.key].arn}/*",
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }
}

resource "aws_s3_bucket_policy" "this" {
  for_each   = var.buckets
  bucket     = aws_s3_bucket.this[each.key].id
  policy     = data.aws_iam_policy_document.enforce_ssl[each.key].json
  depends_on = [aws_s3_bucket_public_access_block.this]
}