resource "aws_s3_bucket" "output" {
  bucket = var.output_bucket
}

resource "aws_s3_bucket_public_access_block" "output" {
  bucket                  = aws_s3_bucket.output.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_server_side_encryption_configuration" "output" {
  bucket = aws_s3_bucket.output.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "aws:kms"
    }
  }
}

# Notification on the EXISTING input bucket: an inbound *.pdf upload invokes the
# trigger Lambda. Terraform manages this bucket's notification configuration, so
# any pre-existing notifications on qubera-docs would be replaced.
resource "aws_s3_bucket_notification" "input" {
  bucket = data.aws_s3_bucket.input.id

  lambda_function {
    lambda_function_arn = aws_lambda_function.trigger.arn
    events              = ["s3:ObjectCreated:*"]
    filter_prefix       = var.input_prefix
    filter_suffix       = ".pdf"
  }

  depends_on = [aws_lambda_permission.s3_invoke]
}