resource "minio_s3_bucket" "this" {
  for_each = var.service.buckets
  bucket   = each.key
  acl      = "private"
}

resource "minio_s3_bucket_versioning" "this" {
  for_each = { for name, b in var.service.buckets : name => b if b.versioning }
  bucket   = minio_s3_bucket.this[each.key].bucket

  versioning_configuration {
    status = "Enabled"
  }
}

resource "minio_ilm_policy" "this" {
  for_each = var.service.buckets
  bucket   = minio_s3_bucket.this[each.key].bucket

  rule {
    id     = "clean-rule-1"
    status = "Enabled"
    dynamic "noncurrent_expiration" {
      for_each = each.value.versioning ? [1] : []
      content {
        days = "${each.value.noncurrent_days}d"
      }
    }
    expired_object_delete_marker = each.value.versioning
    abort_incomplete_multipart_upload {
      days_after_initiation = "3d"
    }
  }
}

resource "minio_iam_user" "this" {
  name = var.service.name
}

resource "minio_iam_policy" "get_upd_del_policy" {
  name = var.service.name
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow",
      Action = ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
      Resource = [
        for bucket in minio_s3_bucket.this : "arn:aws:s3:::${bucket.bucket}/*"
      ]
      },
      {
        Effect = "Allow",
        Action = ["s3:ListBucket"],
        Resource = [
          for bucket in minio_s3_bucket.this : "arn:aws:s3:::${bucket.bucket}"
        ]
    }]
  })
}

resource "minio_iam_user_policy_attachment" "this" {
  user_name   = minio_iam_user.this.name
  policy_name = minio_iam_policy.get_upd_del_policy.name
}

resource "minio_iam_service_account" "this" {
  target_user = minio_iam_user.this.name
  description = "keys of ${var.service.name}"

  depends_on = [minio_iam_user_policy_attachment.this]
}