AWSTemplateFormatVersion: '2010-09-09'
Description: |
  Sentasity Cost and Usage Report (CUR 1.0, Parquet)
  Creates an S3 bucket and CUR report configured for the Sentasity cost analysis pipeline.
  IMPORTANT: Must be deployed in us-east-1 (AWS requirement for CUR report definitions).

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Report Configuration"
        Parameters:
          - ReportName
    ParameterLabels:
      ReportName:
        default: "CUR report name"

Parameters:
  ReportName:
    Type: String
    Description: "Name for the Cost and Usage Report. Becomes part of the S3 path and manifest filename."
    Default: "sentasity-cur"
    AllowedPattern: ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,253}[a-zA-Z0-9]$
    ConstraintDescription: "Must be 2-255 characters: letters, numbers, and hyphens. Cannot start or end with a hyphen."

Resources:
  CURBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "sentasity-cur-${AWS::AccountId}"
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        - Key: "ManagedBy"
          Value: "Sentasity-CloudFormation"
        - Key: "Purpose"
          Value: "AWS Cost and Usage Report storage"

  CURBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref CURBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowCURServiceGetBucketAcl
            Effect: Allow
            Principal:
              Service: billingreports.amazonaws.com
            Action: s3:GetBucketAcl
            Resource: !GetAtt CURBucket.Arn
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref "AWS::AccountId"
          - Sid: AllowCURServicePutObject
            Effect: Allow
            Principal:
              Service: billingreports.amazonaws.com
            Action: s3:PutObject
            Resource: !Sub "${CURBucket.Arn}/*"
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref "AWS::AccountId"

  CURReportDefinition:
    Type: AWS::CUR::ReportDefinition
    DependsOn: CURBucketPolicy
    Properties:
      ReportName: !Ref ReportName
      TimeUnit: HOURLY
      Format: Parquet
      Compression: Parquet
      AdditionalSchemaElements:
        - RESOURCES
      S3Bucket: !Ref CURBucket
      S3Prefix: cur
      S3Region: us-east-1
      ReportVersioning: OVERWRITE_REPORT
      RefreshClosedReports: true

Outputs:
  BucketName:
    Value: !Ref CURBucket
    Description: "S3 bucket name → cur_data_sources.cur_bucket"

  ReportName:
    Value: !Ref ReportName
    Description: "CUR report name → cur_data_sources.cur_report_name"

  ReportPrefix:
    Value: cur
    Description: "S3 prefix → cur_data_sources.cur_prefix"

  AccountId:
    Value: !Ref "AWS::AccountId"
    Description: "AWS account ID → cur_data_sources.bucket_account_id"
