# Exports bucket: raw/ (incoming), analytics/ (Parquet), meta/ (JSON),
# athena-results/, grafana-config/. RETAIN equivalent: no force_destroy.

resource "aws_s3_bucket" "exports" {
  bucket = local.exports_bucket_name

  tags = {
    Purpose = "APM WO export snapshots and Grafana config"
  }
}

resource "aws_s3_bucket_public_access_block" "exports" {
  bucket = aws_s3_bucket.exports.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_ownership_controls" "exports" {
  bucket = aws_s3_bucket.exports.id

  rule {
    object_ownership = "BucketOwnerEnforced"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "exports" {
  bucket = aws_s3_bucket.exports.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_bucket_lifecycle_configuration" "exports" {
  bucket = aws_s3_bucket.exports.id

  rule {
    id     = "expire-raw-exports"
    status = "Enabled"

    filter {
      prefix = "raw/"
    }

    expiration {
      days = 90
    }
  }

  rule {
    id     = "expire-athena-results"
    status = "Enabled"

    filter {
      prefix = "athena-results/"
    }

    expiration {
      days = 30
    }
  }

  rule {
    id     = "abort-incomplete-multipart"
    status = "Enabled"

    filter {}

    abort_incomplete_multipart_upload {
      days_after_initiation = 7
    }
  }
}

data "aws_iam_policy_document" "exports" {
  statement {
    sid    = "DenyInsecureTransport"
    effect = "Deny"

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    actions = ["s3:*"]
    resources = [
      aws_s3_bucket.exports.arn,
      "${aws_s3_bucket.exports.arn}/*",
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }
}

resource "aws_s3_bucket_policy" "exports" {
  bucket = aws_s3_bucket.exports.id
  policy = data.aws_iam_policy_document.exports.json

  depends_on = [aws_s3_bucket_public_access_block.exports]
}

# Drop-folder identity. Access keys are created out of band
# (aws iam create-access-key) and stored in the local apm-wo-drop profile.
resource "aws_iam_user" "drop_uploader" {
  name = "apm-wo-drop-uploader"
  path = "/tf-managed/"
}

data "aws_iam_policy_document" "drop_uploader" {
  statement {
    sid       = "PutRawExportsOnly"
    effect    = "Allow"
    actions   = ["s3:PutObject"]
    resources = ["${aws_s3_bucket.exports.arn}/raw/*"]
  }
}

resource "aws_iam_user_policy" "drop_uploader" {
  # checkov:skip=CKV_AWS_40: Drop-folder identity is an IAM user by design (local launchd profile). Policy is s3:PutObject on raw/* only.
  name   = "PutRawExportsOnly"
  user   = aws_iam_user.drop_uploader.name
  policy = data.aws_iam_policy_document.drop_uploader.json
}