#!/usr/bin/env bash
set -euo pipefail

: "${AWS_PROFILE:?AWS_PROFILE is required}"
: "${STATE_BUCKET:?STATE_BUCKET is required}"
: "${STATE_REGION:?STATE_REGION is required}"

aws_cli=(aws --profile "$AWS_PROFILE" --region "$STATE_REGION")

if ! "${aws_cli[@]}" s3api head-bucket --bucket "$STATE_BUCKET" >/dev/null 2>&1; then
  if ! create_output="$("${aws_cli[@]}" s3api create-bucket \
    --bucket "$STATE_BUCKET" \
    --create-bucket-configuration "LocationConstraint=$STATE_REGION" 2>&1)"; then
    if [[ "$create_output" != *BucketAlreadyOwnedByYou* ]]; then
      printf '%s\n' "$create_output" >&2
      exit 1
    fi
  fi
fi

"${aws_cli[@]}" s3api wait bucket-exists --bucket "$STATE_BUCKET"
"${aws_cli[@]}" s3api put-public-access-block \
  --bucket "$STATE_BUCKET" \
  --public-access-block-configuration \
  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
"${aws_cli[@]}" s3api put-bucket-ownership-controls \
  --bucket "$STATE_BUCKET" \
  --ownership-controls 'Rules=[{ObjectOwnership=BucketOwnerEnforced}]'
"${aws_cli[@]}" s3api put-bucket-versioning \
  --bucket "$STATE_BUCKET" \
  --versioning-configuration Status=Enabled
"${aws_cli[@]}" s3api put-bucket-encryption \
  --bucket "$STATE_BUCKET" \
  --server-side-encryption-configuration \
  'Rules=[{ApplyServerSideEncryptionByDefault={SSEAlgorithm=AES256},BucketKeyEnabled=true}]'
"${aws_cli[@]}" s3api put-bucket-tagging \
  --bucket "$STATE_BUCKET" \
  --tagging 'TagSet=[{Key=Environment,Value=test},{Key=ManagedBy,Value=aws-cli},{Key=Owner,Value=date-integration},{Key=Project,Value=date-integration-test},{Key=DataClassification,Value=test},{Key=usedby,Value=date-integration-terraform-state}]'

bucket_policy="$(jq -cn --arg bucket "$STATE_BUCKET" '{
  Version: "2012-10-17",
  Statement: [{
    Sid: "DenyInsecureTransport",
    Effect: "Deny",
    Principal: "*",
    Action: "s3:*",
    Resource: ["arn:aws:s3:::\($bucket)", "arn:aws:s3:::\($bucket)/*"],
    Condition: {Bool: {"aws:SecureTransport": "false"}}
  }]
}')"
"${aws_cli[@]}" s3api put-bucket-policy --bucket "$STATE_BUCKET" --policy "$bucket_policy"

account_id="$("${aws_cli[@]}" sts get-caller-identity --query Account --output text)"
if [[ "$account_id" != "118688039167" ]]; then
  echo "State bucket bootstrap used unexpected AWS account $account_id" >&2
  exit 1
fi

"${aws_cli[@]}" s3api get-public-access-block --bucket "$STATE_BUCKET" >/dev/null
"${aws_cli[@]}" s3api get-bucket-versioning --bucket "$STATE_BUCKET" \
  --query Status --output text | grep -qx Enabled
"${aws_cli[@]}" s3api get-bucket-encryption --bucket "$STATE_BUCKET" >/dev/null
"${aws_cli[@]}" s3api get-bucket-policy --bucket "$STATE_BUCKET" >/dev/null
"${aws_cli[@]}" s3api get-bucket-tagging --bucket "$STATE_BUCKET" \
  --query "TagSet[?Key=='usedby' && Value=='date-integration-terraform-state'] | length(@)" \
  --output text | grep -qx 1

echo "Terraform state bucket is ready: $STATE_BUCKET"