{% if service.settings.custom_headers %}
{% set parsed_svc_headers = service.settings.custom_headers %}
resource "aws_cloudfront_response_headers_policy" "{{ service.instance_name }}" {
    name = "{{ service.instance_name }}"

    {% if parsed_svc_headers.custom_headers %}
    custom_headers_config {
        {% for header in parsed_svc_headers.custom_headers %}
        items {
            header = "{{ header.name }}"
            value = "{{ header.value }}"
            override = true
        }
        {% endfor %}
    }
    {% endif %}

    {% if parsed_svc_headers.cors_config.headers %}
    cors_config {
        {% if parsed_svc_headers.cors_config.allow_credentials %}
        access_control_allow_credentials = true
        {% endif %}

        {% if parsed_svc_headers.cors_config.allow_headers %}
        access_control_allow_headers {
            items = [
                {% for header in parsed_svc_headers.cors_config.allow_headers %}
                "{{ header }}",
                {% endfor %}
            ]
        }
        {% endif %}

        {% if parsed_svc_headers.cors_config.allow_methods %}
        access_control_allow_methods {
            items = [
                {% for method in parsed_svc_headers.cors_config.allow_methods %}
                "{{ method }}",
                {% endfor %}
            ]
        }
        {% endif %}

        {% if parsed_svc_headers.cors_config.allow_origins %}
        access_control_allow_origins {
            items = [
                {% for origin in parsed_svc_headers.cors_config.allow_origins %}
                "{{ origin }}",
                {% endfor %}
            ]
        }
        {% endif %}

        {% if parsed_svc_headers.cors_config.expose_headers %}
        access_control_expose_headers {
            items = [
                {% for header in parsed_svc_headers.cors_config.expose_headers %}
                "{{ header }}",
                {% endfor %}
            ]
        }
        {% endif %}

        {% if parsed_svc_headers.cors_config.max_age %}
        access_control_max_age_sec = {{ parsed_svc_headers.cors_config.max_age }}
        {% endif %}

        origin_override = true
    }
    {% endif %}

    {% if parsed_svc_headers.security_config %}
    security_headers_config {
        {% if parsed_svc_headers.security_config.content_security_policy %}
        content_security_policy {
            content_security_policy = "{{ parsed_svc_headers.security_config.content_security_policy }}"
            override = true
        }
        {% endif %}

        {% if parsed_svc_headers.security_config.content_type_options %}
        content_type_options {
            override = true
        }
        {% endif %}

        {% if parsed_svc_headers.security_config.frame_option %}
        frame_options {
            frame_option = "{{ parsed_svc_headers.security_config.frame_option }}"
            override = true
        }
        {% endif %}

        {% if parsed_svc_headers.security_config.referrer_policy %}
        referrer_policy {
            referrer_policy = "{{ parsed_svc_headers.security_config.referrer_policy }}"
            override = true
        }
        {% endif %}

        {% if parsed_svc_headers.security_config.strict_transport_security %}
        strict_transport_security {
            {% if parsed_svc_headers.security_config.strict_transport_security.max_age %}
            access_control_max_age_sec = {{ parsed_svc_headers.security_config.strict_transport_security.max_age }}
            {% endif %}

            {% if parsed_svc_headers.security_config.strict_transport_security.include_subdomains %}
            include_subdomains = true
            {% endif %}

            {% if parsed_svc_headers.security_config.strict_transport_security.preload %}
            preload = true
            {% endif %}

            override = true
        }
        {% endif %}

        {% if parsed_svc_headers.security_config.xss_protection %}
        xss_protection {
            {% if parsed_svc_headers.security_config.xss_protection.mode_block %}
            mode_block = true
            {% endif %}

            {% if parsed_svc_headers.security_config.xss_protection.enabled %}
            protection = true
            {% else %}
            protection = false
            {% endif %}

            {% if parsed_svc_headers.security_config.xss_protection.report_uri %}
            report_uri = "{{ parsed_svc_headers.security_config.xss_protection.report_uri }}"
            {% endif %}

            override = true
        }
        {% endif %}
    }
    {% endif %}
}
{% endif %}

resource "aws_s3_bucket" "{{ service.instance_name }}_website" {
    bucket = "{{ service.instance_name }}-website"
    force_destroy = true
}

resource "aws_s3_bucket_website_configuration" "{{ service.instance_name }}_website" {
    bucket = "${aws_s3_bucket.{{ service.instance_name }}_website.id}"

    index_document {
        suffix = "index.html"
    }

    error_document {
        key = "{{ service.settings.url_path.lstrip('/') }}index.html"
    }
}

resource "aws_s3_bucket_ownership_controls" "{{ service.instance_name }}_website" {
    bucket = "${aws_s3_bucket.{{ service.instance_name }}_website.id}"
    rule {
        object_ownership = "ObjectWriter"
    }
}

resource "aws_s3_bucket_public_access_block" "{{ service.instance_name }}_website" {
  bucket = "${aws_s3_bucket.{{ service.instance_name }}_website.id}"

  block_public_acls       = false
  block_public_policy     = false
  ignore_public_acls      = false
  restrict_public_buckets = false
}

resource "aws_s3_bucket_acl" "{{ service.instance_name }}_website" {
    bucket = "${aws_s3_bucket.{{ service.instance_name }}_website.id}"
    acl = "public-read"

    depends_on = [
        aws_s3_bucket.{{ service.instance_name }}_website,
        aws_s3_bucket_public_access_block.{{ service.instance_name }}_website,
        aws_s3_bucket_ownership_controls.{{ service.instance_name }}_website,
    ]
}

{% if service.settings.cors and service.settings.cors.allowed_origins %}
resource "aws_s3_bucket_cors_configuration" "{{ service.instance_name }}_website" {
  bucket = "${aws_s3_bucket.{{ service.instance_name }}_website.id}"

  cors_rule {
    allowed_methods = ["GET"]
    allowed_origins = [{% for origin in service.settings.cors.allowed_origins %}"{{ origin }}"{% if not loop.last %}, {% endif %}{% endfor %}]
  }
}
{% endif %}
