resource "aws_s3_bucket" "cluster_certificates_storage" {
  count = local.persona == "premium" ? 1 : 0

  bucket        = local.cluster_certificates_storage_bucket
  force_destroy = true

  tags = merge(local.common_tags, {
    Name = local.cluster_certificates_storage_bucket
  })
}

resource "aws_s3_bucket_public_access_block" "cluster_certificates_storage" {
  count = local.persona == "premium" ? 1 : 0

  bucket                  = aws_s3_bucket.cluster_certificates_storage[0].id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_server_side_encryption_configuration" "cluster_certificates_storage" {
  count = local.persona == "premium" ? 1 : 0

  bucket = aws_s3_bucket.cluster_certificates_storage[0].id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_object" "session_product_ca" {
  count = local.persona == "premium" && local.session_product_pca_enabled ? 1 : 0

  bucket       = aws_s3_bucket.cluster_certificates_storage[0].id
  key          = "ca.pem"
  content      = aws_acmpca_certificate.session_product_root[0].certificate
  content_type = "application/x-pem-file"

  tags = local.common_tags
}