data.tf

data "aws_caller_identity" "this" {}
data "aws_region" "this" {}
data "aws_partition" "current" {}

data "aws_iam_policy_document" "bucket" {
  count = var.enable_vpc_flow_logs ? 1 : 0

  statement {
    sid = "AWSLogDeliveryWrite"

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }

    actions = [
      "s3:PutObject"
    ]

    resources = [
      "${local.arn_format}:s3:::${local.vpc_flow_logs_bucket}/*"
    ]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"

      values = [
        "bucket-owner-full-control"
      ]
    }
  }

  statement {
    sid = "AWSLogDeliveryAclCheck"

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }

    actions = [
      "s3:GetBucketAcl"
    ]

    resources = [
      "${local.arn_format}:s3:::${local.vpc_flow_logs_bucket}"
    ]
  }

  statement {
    sid     = "ForceSSLOnlyAccess"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "${local.arn_format}:s3:::${local.vpc_flow_logs_bucket}/*",
      "${local.arn_format}:s3:::${local.vpc_flow_logs_bucket}"
    ]

    principals {
      identifiers = ["*"]
      type        = "*"
    }

    condition {
      test     = "Bool"
      values   = ["false"]
      variable = "aws:SecureTransport"
    }

  }
}