###### s3 ######
resource "aws_s3_bucket" "s3_athena_for_cloudfront" {
  bucket = "inugami-techlab-hugo-athena"
}

# オブジェクト所有者を「バケット所有者の強制」にすることでACLの無効化
resource "aws_s3_bucket_ownership_controls" "s3_athena_for_cloudfront" {
  bucket = aws_s3_bucket.s3_athena_for_cloudfront.id

  rule {
    object_ownership = "ObjectWriter"
  }
}

# パブリックアクセスをブロック
resource "aws_s3_bucket_public_access_block" "s3_athena_for_cloudfront" {
  bucket = aws_s3_bucket.s3_athena_for_cloudfront.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# バージョニング設定
resource "aws_s3_bucket_versioning" "s3_athena_for_cloudfront" {
  bucket = aws_s3_bucket.s3_athena_for_cloudfront.id

  versioning_configuration {
    status = "Enabled"
  }
}

# s3側での暗号化
resource "aws_s3_bucket_server_side_encryption_configuration" "s3_athena_for_cloudfront" {
  bucket = aws_s3_bucket.s3_athena_for_cloudfront.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

# lifecycleの設定
resource "aws_s3_bucket_lifecycle_configuration" "s3_athena_for_cloudfront" {
  bucket = aws_s3_bucket.s3_athena_for_cloudfront.id

  rule {
    id     = "cloudfront_log"
    status = "Enabled"

    expiration {
      days = 1095
    }

    transition {
      ## オブジェクトが作成されてからSTANDARD_IAに移行するまでの日数。
      days          = 30
      storage_class = "STANDARD_IA"
    }

    transition {
      days          = 90
      storage_class = "GLACIER"
    }

    noncurrent_version_expiration {
      noncurrent_days = 365
    }

    noncurrent_version_transition {
      noncurrent_days = 30
      storage_class   = "STANDARD_IA"
    }

    noncurrent_version_transition {
      noncurrent_days = 60
      storage_class   = "GLACIER"
    }

    abort_incomplete_multipart_upload {
      days_after_initiation = "7"
    }
  }
}

###### athena ######
resource "aws_athena_workgroup" "s3_athena_for_cloudfront" {
  name = "s3_athena_for_cloudfront"

  configuration {
    enforce_workgroup_configuration    = true
    publish_cloudwatch_metrics_enabled = false
    result_configuration {
      output_location = "s3://${aws_s3_bucket.s3_athena_for_cloudfront.id}/athena-result/"
    }
  }
}

## データベース作成
resource "aws_athena_database" "s3_athena_for_cloudfront" {
  name   = "s3_athena_for_cloudfront"
  bucket = aws_s3_bucket.s3_cloudfront_log.bucket
}

## データベース内にテーブルを作成する
data "template_file" "create_table_sql" {
  template = file("${path.module}/create-table.sql.tpl")
  vars = {
    athena_database_name = aws_athena_database.s3_athena_for_cloudfront.id
    athena_table_name    = "cloudfront_logs"
    log_bucket_name      = aws_s3_bucket.s3_cloudfront_log.id
  }
}

resource "aws_athena_named_query" "create_table" {
  name        = "Create table"
  description = "テーブルを作成"
  workgroup   = aws_athena_workgroup.s3_athena_for_cloudfront.id
  database    = aws_athena_database.s3_athena_for_cloudfront.id
  query       = data.template_file.create_table_sql.rendered
}

CREATE EXTERNAL TABLE IF NOT EXISTS s3_athena_for_cloudfront.cloudfront_logs (
  `date` DATE,
  time STRING,
  location STRING,
  bytes BIGINT,
  request_ip STRING,
  method STRING,
  host STRING,
  uri STRING,
  status INT,
  referrer STRING,
  user_agent STRING,
  query_string STRING,
  cookie STRING,
  result_type STRING,
  request_id STRING,
  host_header STRING,
  request_protocol STRING,
  request_bytes BIGINT,
  time_taken FLOAT,
  xforwarded_for STRING,
  ssl_protocol STRING,
  ssl_cipher STRING,
  response_result_type STRING,
  http_version STRING,
  fle_status STRING,
  fle_encrypted_fields INT,
  c_port INT,
  time_to_first_byte FLOAT,
  x_edge_detailed_result_type STRING,
  sc_content_type STRING,
  sc_content_len BIGINT,
  sc_range_start BIGINT,
  sc_range_end BIGINT
)
ROW FORMAT DELIMITED 
FIELDS TERMINATED BY '\t'
LOCATION 's3://(cloudfront_logのバケット)/'
TBLPROPERTIES ( 'skip.header.line.count'='2' )

SELECT * FROM "s3_athena_for_cloudfront"."cloudfront_logs" limit 10;