// zrok-billing service
resource "aws_s3_bucket" "alb_log" {
  bucket = format("%s-zrok-%s",local.workspace["log_bucket_name"],local.workspace["deploy_environment"])
  tags = local.cost_tags
}



#127311923021 - is the us-east-1 Elastic Load Balancing Account ID
resource "aws_s3_bucket_policy" "alb_log_policy" {
  bucket = aws_s3_bucket.alb_log.id

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS":"arn:aws:iam::127311923021:root"
      },
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::${aws_s3_bucket.alb_log.bucket}/AWSLogs/*"
    },
    {
        "Sid": "AWSConsoleStmt-1582207188380",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::127311923021:root"
        },
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::${aws_s3_bucket.alb_log.bucket}/AWSLogs/*/*"
    },
    {
        "Sid": "AWSLogDeliveryWrite",
        "Effect": "Allow",
        "Principal": {
            "Service": "delivery.logs.amazonaws.com"
        },
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::${aws_s3_bucket.alb_log.bucket}/AWSLogs/*/*",
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": "bucket-owner-full-control"
            }
        }
    },
    {
        "Sid": "AWSLogDeliveryAclCheck",
        "Effect": "Allow",
        "Principal": {
            "Service": "delivery.logs.amazonaws.com"
        },
        "Action": "s3:GetBucketAcl",
        "Resource": "arn:aws:s3:::${aws_s3_bucket.alb_log.bucket}"
    }
  ]
}
POLICY
}