#S3 bucket for codebuild output
resource "aws_s3_bucket" "artifacts" {
  bucket        = "xdr-codebuild-artifacts"
  force_destroy = true
  acl           = "private"

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = aws_kms_key.s3_codebuild_artifacts.arn
        sse_algorithm     = "aws:kms"
      }
    }
  }
}

resource "aws_s3_bucket_policy" "artifacts" {
  bucket = aws_s3_bucket.artifacts.id
  policy =<<POLICY
{
  "Id": "Policy1532015005972",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1532015002611",
      "Action": [
        "s3:GetObject",
        "s3:GetObjectVersion"
      ],
      "Effect": "Allow",
      "Resource": "${aws_s3_bucket.artifacts.arn}/*",
      "Principal": {
        "AWS": [
          "arn:aws-us-gov:iam::738800754746:root",
          "arn:aws-us-gov:iam::721817724804:root"
        ]
      }
    }
  ]
}
POLICY
}