mock_provider "aws" {
  mock_data "aws_ec2_instance_type_offerings" { defaults = { locations = ["eu-west-1a", "eu-west-1b"] } }
  mock_data "aws_region" { defaults = { region = "eu-west-1" } }
  mock_data "aws_availability_zones" { defaults = { names = ["eu-west-1a", "eu-west-1b"] } }
  mock_data "aws_ami" { defaults = { id = "ami-0123456789abcdef0" } }
  mock_resource "aws_s3_bucket" { defaults = { arn = "arn:aws:s3:::mock-test-bucket", id = "mock-test-bucket" } }
  mock_resource "aws_iam_role" { defaults = { arn = "arn:aws:iam::123456789012:role/test" } }
}

variables { name = "test-bucket" }
run "storage_security" {
  assert {
    condition     = jsondecode(aws_s3_bucket_policy.this.policy).Statement[0].Effect == "Deny" && jsondecode(aws_s3_bucket_policy.this.policy).Statement[0].Condition.Bool["aws:SecureTransport"] == "false" && jsondecode(aws_s3_bucket_policy.this.policy).Statement[0].Principal == "*"
    error_message = "Require TLS for all bucket access."
  }
  assert {
    condition     = length(aws_s3_bucket_lifecycle_configuration.this.rule) == 1 && one(aws_s3_bucket_lifecycle_configuration.this.rule).abort_incomplete_multipart_upload[0].days_after_initiation == 7
    error_message = "Data buckets must retain database versions and clean abandoned uploads only."
  }
  command = plan
  assert {
    condition     = aws_s3_bucket_versioning.this.versioning_configuration[0].status == "Enabled" && !aws_s3_bucket.this.force_destroy
    error_message = "Retain object versions and refuse non-empty bucket destruction."
  }
  assert {
    condition     = aws_s3_bucket_public_access_block.this.block_public_acls && aws_s3_bucket_public_access_block.this.block_public_policy && aws_s3_bucket_public_access_block.this.ignore_public_acls && aws_s3_bucket_public_access_block.this.restrict_public_buckets
    error_message = "All S3 public access controls must remain enabled."
  }
  assert {
    condition     = one(aws_s3_bucket_server_side_encryption_configuration.this.rule).apply_server_side_encryption_by_default[0].sse_algorithm == "AES256"
    error_message = "Encrypt stored objects."
  }
}

run "control_cleanup" {
  command = plan
  variables { control_plane = true }
  assert {
    condition     = length(aws_s3_bucket_lifecycle_configuration.this.rule) == 4
    error_message = "Control buckets need the Platform cleanup rules."
  }
  assert {
    condition     = alltrue([for r in aws_s3_bucket_lifecycle_configuration.this.rule : r.expiration[0].days == 1 && r.noncurrent_version_expiration[0].noncurrent_days == 1 if r.id == "db-reads-expire"])
    error_message = "Forwarded database reads must expire current and old versions."
  }
}