resource "aws_s3_bucket" "report-bucket" {
  bucket = "nf-billing-usage-reports-${local.workspace["deploy_env_name"]}"
  force_destroy = false
  tags = {
    Name        = "Billing report storage"
    Environment = local.workspace["deploy_env_name"]
  }
}

# `acl` and `server_side_encryption_configuration` were deprecated on
# aws_s3_bucket in provider v4 and cannot be mixed with the standalone
# resources. "private" was the default ACL, so it is simply dropped.
resource "aws_s3_bucket_server_side_encryption_configuration" "report-bucket" {
  bucket = aws_s3_bucket.report-bucket.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_bucket_public_access_block" "report-bucket" {
  bucket                  = aws_s3_bucket.report-bucket.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}