# main.tf — STR compliance fixture
# Produces zero STR policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

resource "aws_s3_bucket" "good_bucket" {
  bucket = "good-bucket"
}

# STR-001 — All four flags enabled
resource "aws_s3_bucket_public_access_block" "good_pab" {
  bucket                  = aws_s3_bucket.good_bucket.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# STR-004 — SSE configured
resource "aws_s3_bucket_server_side_encryption_configuration" "good_sse" {
  bucket = aws_s3_bucket.good_bucket.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "aws:kms"
    }
  }
}

# STR-005 + STR-002 + STR-003 + STR-006
# TLS-only deny, no public principal, no wildcard
resource "aws_s3_bucket_policy" "good_policy" {
  bucket = aws_s3_bucket.good_bucket.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "DenyNonTLS"
        Effect    = "Deny"
        Principal = "*"
        Action    = "s3:*"
        Resource = [
          "arn:aws:s3:::good-bucket",
          "arn:aws:s3:::good-bucket/*"
        ]
        Condition = {
          Bool = {
            "aws:SecureTransport" = "false"
          }
        }
      },
      {
        Sid    = "AllowScopedAccess"
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::123456789012:role/app-role"
        }
        Action   = ["s3:GetObject"]
        Resource = "arn:aws:s3:::good-bucket/*"
      }
    ]
  })
}

# STR-007 — BucketOwnerEnforced
resource "aws_s3_bucket_ownership_controls" "good_ownership" {
  bucket = aws_s3_bucket.good_bucket.id
  rule {
    object_ownership = "BucketOwnerEnforced"
  }
}