terraform {
  required_version = ">= 1.11.0, < 2.0.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

variable "name" { type = string }
resource "aws_s3_bucket" "this" {
  bucket        = var.name
  force_destroy = false
  lifecycle { prevent_destroy = true }
}
resource "aws_s3_bucket_versioning" "this" {
  bucket = aws_s3_bucket.this.id
  versioning_configuration { status = "Enabled" }
}
resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
  bucket = aws_s3_bucket.this.id
  rule {
    apply_server_side_encryption_by_default { sse_algorithm = "AES256" }
  }
}
resource "aws_s3_bucket_public_access_block" "this" {
  bucket                  = aws_s3_bucket.this.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}
resource "aws_s3_bucket_ownership_controls" "this" {
  bucket = aws_s3_bucket.this.id
  rule { object_ownership = "BucketOwnerEnforced" }
}
resource "aws_s3_bucket_policy" "this" {
  bucket = aws_s3_bucket.this.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Deny"
      Principal = "*"
      Action    = "s3:*"
      Resource  = [aws_s3_bucket.this.arn, "${aws_s3_bucket.this.arn}/*"]
      Condition = { Bool = { "aws:SecureTransport" = "false" } }
    }]
  })
  depends_on = [aws_s3_bucket_public_access_block.this]
}
output "name" {
  value = aws_s3_bucket.this.id
  depends_on = [
    aws_s3_bucket_versioning.this,
    aws_s3_bucket_server_side_encryption_configuration.this,
    aws_s3_bucket_public_access_block.this,
    aws_s3_bucket_ownership_controls.this,
    aws_s3_bucket_policy.this,
    aws_s3_bucket_lifecycle_configuration.this,
  ]
}
output "arn" {
  value = aws_s3_bucket.this.arn
  depends_on = [
    aws_s3_bucket_versioning.this,
    aws_s3_bucket_server_side_encryption_configuration.this,
    aws_s3_bucket_public_access_block.this,
    aws_s3_bucket_ownership_controls.this,
    aws_s3_bucket_policy.this,
    aws_s3_bucket_lifecycle_configuration.this,
  ]
}

variable "control_plane" {
  type    = bool
  default = false
}
resource "aws_s3_bucket_lifecycle_configuration" "this" {
  bucket = aws_s3_bucket.this.id
  rule {
    id     = "abandoned-uploads"
    status = "Enabled"
    filter {}
    abort_incomplete_multipart_upload { days_after_initiation = 7 }
  }
  dynamic "rule" {
    for_each = var.control_plane ? [1] : []
    content {
      id     = "geoip-noncurrent"
      status = "Enabled"
      filter { prefix = "control/geoip/" }
      noncurrent_version_expiration { noncurrent_days = 1 }
      abort_incomplete_multipart_upload { days_after_initiation = 1 }
    }
  }
  dynamic "rule" {
    for_each = var.control_plane ? [1] : []
    content {
      id     = "db-reads-expire"
      status = "Enabled"
      filter { prefix = "db-reads/" }
      expiration { days = 1 }
      noncurrent_version_expiration { noncurrent_days = 1 }
      abort_incomplete_multipart_upload { days_after_initiation = 1 }
    }
  }
  dynamic "rule" {
    for_each = var.control_plane ? [1] : []
    content {
      id     = "db-reads-delete-markers"
      status = "Enabled"
      filter { prefix = "db-reads/" }
      expiration { expired_object_delete_marker = true }
    }
  }
  depends_on = [aws_s3_bucket_versioning.this]
}