# s3_vault.tf
resource "aws_s3_bucket" "evidence_vault" {
  bucket = "${var.project_name}-evidence-vault-${random_id.id.hex}"

  # Prevent accidental deletion
  lifecycle {
    prevent_destroy = true
  }

  tags = {
    Name        = "Forensic Evidence Vault"
    Environment = "Forensics"
    Purpose     = "Secure Evidence Storage"
  }
}

resource "random_id" "id" {
  byte_length = 4
}

# Enable Versioning (Required for Object Lock)
resource "aws_s3_bucket_versioning" "vault_versioning" {
  bucket = aws_s3_bucket.evidence_vault.id
  versioning_configuration {
    status = "Enabled"
  }
}

# Enable Object Lock (Forensic Integrity)
resource "aws_s3_bucket_object_lock_configuration" "vault_lock" {
  bucket = aws_s3_bucket.evidence_vault.id

  rule {
    default_retention {
      mode = "COMPLIANCE"
      days = var.evidence_retention_days
    }
  }
}

# Enable Server-Side Encryption
resource "aws_s3_bucket_server_side_encryption_configuration" "vault_encryption" {
  bucket = aws_s3_bucket.evidence_vault.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

# Block all public access
resource "aws_s3_bucket_public_access_block" "vault_block_public" {
  bucket = aws_s3_bucket.evidence_vault.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

output "evidence_vault_bucket_name" {
  value = aws_s3_bucket.evidence_vault.id
}