---
constants:
  __name: "{{ name }}_{{ __guid }}"
variables:
  name:
    desc: "Name of the S3 bucket. Must be globally unique."
    required: true
    group: Bucket Details
  acl:
    desc: "Canned ACL to apply. Defaults to 'private'."
    required: false
    group: Access Control
    default: "private"
  versioning_enabled:
    desc: "Enable versioning on the bucket."
    required: false
    group: Versioning
    default: true
  enable_server_side_encryption:
    desc: "Enable server-side encryption."
    required: false
    group: Encryption
    default: true
  logging_bucket:
    desc: "S3 bucket to send access logs to."
    required: false
    group: Logging
    links_to: resource.aws_s3_bucket.id
  logging_prefix:
    desc: "Prefix for access log objects."
    required: false
    group: Logging
    default: "logs/"
  tags:
    group: Tags
    required: false
groups:
  Bucket Details:
    order: 1
    desc: "Basic details for the S3 bucket."
  Access Control:
    order: 2
    desc: "Access control settings for the bucket."
  Versioning:
    order: 3
    desc: "Versioning settings for the bucket."
  Encryption:
    order: 4
    desc: "Encryption settings for the bucket."
  Logging:
    order: 5
    desc: "Logging settings for the bucket."
  Tags:
    order: 6
    desc: "Tags to assign to the bucket."
---

resource "aws_s3_bucket" "__name" {
  bucket = {{ name }}
  acl    = {{ acl }}

  versioning {
    enabled = {{ versioning_enabled }}
  }

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }

  logging {
    target_bucket = {{ logging_bucket | required: false }}
    target_prefix = {{ logging_prefix | required: false }}
  }

  tags = {
    Name = {{ name }}
    {{# tags }}
      {{ tags.key | required: false }} = {{ tags.value | required: false }}
    {{/ tags }}
  }
}