//CONSOLE BRANDING START//

data aws_iam_policy_document "console_branding" {

  version = "2012-10-17"

  # policy_id (Optional) - An ID for the policy document.
  policy_id = "Policy1537812319356"

  statement {
    sid = "Stmt1537812316701"
    # for identity
    actions = ["s3:*"]
    # resources (Optional) - A list of resource ARNs that this statement applies to.
    # This is required by AWS if used for an IAM policy.
    resources = [
      "arn:aws:s3:::nf-console-branding-${local.deploy_environment}",
      "arn:aws:s3:::nf-console-branding-${local.deploy_environment}/*"
    ]

    principals {
      type = "AWS"
      # identifiers (Required) List of identifiers for principals.
      # When type is "AWS", these are IAM user or role ARNs. When type is "Service",
      # these are AWS Service roles e.g. lambda.amazonaws.com
      identifiers = local.identity_principals[terraform.workspace]
    }

  }

  statement {
    sid       = "AllowPublicRead"
    actions   = [
      "s3:GetObject"
    ]
    resources = [
      "arn:aws:s3:::nf-console-branding-${local.deploy_environment}/*"
    ]


    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
  }
}

resource aws_s3_bucket "console_branding" {
  bucket = "nf-console-branding-${local.deploy_environment}"
}

resource "aws_s3_bucket_policy" "console_branding_policy" {
  bucket = aws_s3_bucket.console_branding.id
  policy = data.aws_iam_policy_document.console_branding.json
}

resource "aws_s3_bucket_cors_configuration" "console_branding_cors" {
  bucket = aws_s3_bucket.console_branding.bucket

  cors_rule {
    allowed_headers = ["*"]
    allowed_methods = ["GET"]
    allowed_origins = [
        "https://${local.console_domain}",
        "https://*.${local.console_domain}",
        "https://*.${local.cloudziti_domain}",
        "https://${local.cloudziti_domain}"
    ]
  }

  cors_rule {
    allowed_headers = ["*"]
    allowed_methods = ["GET"]
    allowed_origins = ["http://localhost:4200", "http://*.localhost:4200"]
  }

}

resource "aws_s3_bucket_public_access_block" "console_branding" {
  bucket                  = aws_s3_bucket.console_branding.bucket
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = false
}

//CONSOLE BRANDING END//

//NFCONSOLE IO LOGS START//

resource aws_s3_bucket "nfconsole_io_logs" {
  bucket = "nf-console-io-${local.deploy_environment}-logs"
}

resource "aws_s3_bucket_acl" "nfconsole_io_logs_acl" {
  bucket = aws_s3_bucket.nfconsole_io_logs.id
  acl    = "log-delivery-write"
}


//NFCONSOLE IO LOGS END//

//NFCONSOLE IO STATIC START//

data aws_iam_policy_document "nfconsole" {
  version = "2012-10-17"

  statement {
    sid       = "PublicReadGetObject"
    actions   = [
      "s3:ListBucket",
      "s3:GetObject"
    ]
    resources = [
      "arn:aws:s3:::nfconsole-io-${local.deploy_environment}",
      "arn:aws:s3:::nfconsole-io-${local.deploy_environment}/*"
    ]
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
  }
}

resource aws_s3_bucket "nfconsole_io_static" {
  bucket = "nfconsole-io-${local.deploy_environment}"
}

resource "aws_s3_bucket_logging" "nfconsole_io_static_logging" {
  bucket = aws_s3_bucket.nfconsole_io_static.id

  target_bucket = aws_s3_bucket.nfconsole_io_logs.id
    target_prefix = "access-"
}

resource "aws_s3_bucket_website_configuration" "nfconsole_io_static_website_configuration" {
  bucket = aws_s3_bucket.nfconsole_io_static.bucket

  index_document {
    suffix = "index.html"
  }

  error_document {
    key = "index.html"
  }
}

resource "aws_s3_bucket_cors_configuration" "nfconsole_io_static_cors" {
  bucket = aws_s3_bucket.nfconsole_io_static.bucket

  cors_rule {
    allowed_headers = ["*"]
    allowed_methods = ["GET", "HEAD"]
    allowed_origins = [
        "https://*.${local.console_domain}",
        "https://${local.console_domain}"
    ]
    max_age_seconds = 3000

    //    expose_headers  = ["ETag"]
  }
}

resource "aws_s3_bucket_public_access_block" "nfconsole_io_static_public_block" {
  bucket                  = aws_s3_bucket.nfconsole_io_static.bucket
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = false
}

resource "aws_s3_bucket_policy" "nfconsole_io_static_policy" {
  bucket = aws_s3_bucket.nfconsole_io_static.id
  policy = data.aws_iam_policy_document.nfconsole.json
}

//NFCONSOLE IO STATIC END//