resource "aws_s3_bucket" "s3" {
  bucket = "acdl-spike-bucket"
  versioning {
    enabled = true
  }
}

output "bucket_arn" {
  value = aws_s3_bucket.s3.arn
}

output "bucket_name" {
  value = aws_s3_bucket.s3.id
}

output "bucket_regional_domain_name" {
  value = aws_s3_bucket.s3.bucket_regional_domain_name
}

resource "aws_cloudfront_distribution" "cloudfront-distribution" {
  origin {
    domain_name = aws_s3_bucket.s3.bucket_regional_domain_name
    origin_access_control = aws_cloudfront_origin_access_control.cloudfront-originaccesscontrol.id
    s3_origin_config {}
  }
  enabled = true
  default_cache_behavior {
    viewer_protocol_policy = "redirect-to-https"
    target_origin_id = "cloudfront-distribution"
    min_ttl = 0
    default_ttl = 3600
    max_ttl = 86400
    allowed_methods = ["GET", "HEAD"]
    cached_methods = ["GET", "HEAD"]
  }
  price_class = "PriceClass_100"
  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }
  viewer_certificate {
    cloudfront_default_certificate = true
  }
  web_acl_id = aws_wafv2_web_acl.waf.arn
}

output "distribution_arn" {
  value = aws_cloudfront_distribution.cloudfront-distribution.arn
}

output "distribution_domain_name" {
  value = aws_cloudfront_distribution.cloudfront-distribution.domain_name
}

resource "aws_cloudfront_origin_access_control" "cloudfront-originaccesscontrol" {
  name = "acdl-oac"
  origin_access_control_origin_type = "s3"
  origin_access_control_signing_behavior = "always"
}

output "oac_id" {
  value = aws_cloudfront_origin_access_control.cloudfront-originaccesscontrol.id
}

resource "aws_wafv2_web_acl" "waf" {
  name = "acdl-waf"
  scope = "cloudfront"
  default_action {
    allow {}
  }
  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name = "acdl-waf-metrics"
    sampled_requests_enabled = true
  }
  rules {
    name = "aws-managed-rules"
    priority = 0
    override_action {
      none {}
    }
    statement {
      managed_rule_group_statement {
        name = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name = "aws-managed-rules-metrics"
      sampled_requests_enabled = true
    }
  }
}

output "web_acl_arn" {
  value = aws_wafv2_web_acl.waf.arn
}