resource "aws_s3_bucket" "report-bucket" {
  bucket = "nf-billing-usage-reports-${local.workspace["deploy_env_name"]}"
  force_destroy = false
  acl           = "private"
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }
  tags = {
    Name        = "Billing report storage"
    Environment = local.workspace["deploy_env_name"]
  }
}

resource "aws_s3_bucket_public_access_block" "report-bucket" {
  bucket                  = aws_s3_bucket.report-bucket.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}