locals {
  s3_origin_id = "${var.env}-myS3Origin"
}

resource "aws_iam_policy" "s3imgbucket" {
  name        = "${var.env}-${var.serviceName}-imgBucketPolicy"
  description = "API access to IMG bucket"
  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:ListBucket"
      ],
      "Effect": "Allow",
      "Resource": "${aws_s3_bucket.b.arn}"
    },
    {
      "Action": [
        "s3:Put*",
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": "${aws_s3_bucket.b.arn}/*"
    }

  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "test-attach" {
  role       = "${aws_iam_role.ecs-task-role.name}"
  policy_arn = "${aws_iam_policy.s3imgbucket.arn}"
}




resource "aws_s3_bucket" "b" {
  bucket = "${var.env}-${var.serviceName}-docs"
  acl    = "private"
  versioning = {
    enabled = true
  }

  cors_rule {
    allowed_headers = ["*"]
    allowed_methods = ["PUT", "POST"]
    allowed_origins = ["*"]
    max_age_seconds = 3000
  }

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm     = "AES256"
      }
    }
  }

  tags {
    Name        = "Docs Bucket"

  }
}

data "template_file" "s3-bucket-policy-tpl" {
  template = "${file("s3-bucket-policy.json")}"
  vars {
    bucket_name = "${aws_s3_bucket.b.id}"
    origin_access_identity = "${aws_cloudfront_origin_access_identity.origin_access_identity.s3_canonical_user_id}"

  }

}


resource "aws_s3_bucket_policy" "b_policy"{
  bucket = "${aws_s3_bucket.b.id}"
  policy = "${data.template_file.s3-bucket-policy-tpl.rendered}"
}


resource "aws_cloudfront_origin_access_identity" "origin_access_identity" {
  comment = "${var.serviceName}"
}


resource "aws_cloudfront_distribution" "s3_distribution" {

  //  depends_on = ["aws_cloudfront_origin_access_identity.origin_access_identity"]
  origin {
    domain_name = "${aws_s3_bucket.b.bucket_regional_domain_name}"
    origin_id   = "${local.s3_origin_id}"

    s3_origin_config {
      origin_access_identity = "${aws_cloudfront_origin_access_identity.origin_access_identity.cloudfront_access_identity_path}"
    }
  }

  enabled             = true
  is_ipv6_enabled     = true
  comment             = "${var.serviceName} docs"

  //  logging_config {
  //    include_cookies = false
  //    bucket          = "cloudfrontlogs.s3.amazonaws.com"
  //    prefix          = "myprefix"
  //  }

  aliases = ["img-${var.serviceName}.${var.country}.${var.region}.${var.env}.meridio.co"]

  default_cache_behavior {
    allowed_methods  = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "${local.s3_origin_id}"

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }

    viewer_protocol_policy = "allow-all"
    min_ttl                = 0
    default_ttl            = 3600
    max_ttl                = 86400
  }

  # Cache behavior with precedence 0
  ordered_cache_behavior {
    path_pattern     = "/content/immutable/*"
    allowed_methods  = ["GET", "HEAD", "OPTIONS"]
    cached_methods   = ["GET", "HEAD", "OPTIONS"]
    target_origin_id = "${local.s3_origin_id}"

    forwarded_values {
      query_string = false
      headers = ["Origin"]
      cookies {
        forward = "none"
      }
    }

    min_ttl                = 0
    default_ttl            = 86400
    max_ttl                = 31536000
    compress               = true
    viewer_protocol_policy = "redirect-to-https"
  }

  # Cache behavior with precedence 1
  ordered_cache_behavior {
    path_pattern     = "/content/*"
    allowed_methods  = ["GET", "HEAD", "OPTIONS"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "${local.s3_origin_id}"

    forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
    }

    min_ttl                = 0
    default_ttl            = 3600
    max_ttl                = 86400
    compress               = true
    viewer_protocol_policy = "redirect-to-https"
  }

  price_class = "PriceClass_200"

  restrictions {

    geo_restriction {
      restriction_type = "none"
    }
  }

  tags {
    Environment = "production"
  }

  viewer_certificate {
    acm_certificate_arn = "${data.aws_acm_certificate.meridio.arn}"
    minimum_protocol_version = "TLSv1.1_2016"
    ssl_support_method = "sni-only"
  }
}

resource "aws_route53_record" "cloudfront" {
  zone_id = "${data.terraform_remote_state.network.ExternalHostedZoneId}"
  name    = "img-${var.serviceName}"
  type    = "A"

  alias {
    name                   = "${aws_cloudfront_distribution.s3_distribution.domain_name}"
    zone_id                = "${aws_cloudfront_distribution.s3_distribution.hosted_zone_id}"
    evaluate_target_health = true
  }

}

resource "aws_route53_record" "cloudfront-internal" {
  zone_id = "${data.terraform_remote_state.network.InternalHostedZoneId}"
  name    = "img-${var.serviceName}"
  type    = "A"

  alias {
    name                   = "${aws_cloudfront_distribution.s3_distribution.domain_name}"
    zone_id                = "${aws_cloudfront_distribution.s3_distribution.hosted_zone_id}"
    evaluate_target_health = true
  }

}