variable "aws_region" {
  description = "Commercial AWS region for the S3 origin. No region is contacted by mock tests."
  type        = string
  default     = "eu-west-1"
}

variable "bucket_name" {
  description = "Globally unique S3 bucket name. This module accepts 3–63 lowercase letters, numbers and hyphens, without dots."
  type        = string

  validation {
    condition = (
      length(var.bucket_name) >= 3 && length(var.bucket_name) <= 63 &&
      can(regex("^[a-z0-9][a-z0-9-]*[a-z0-9]$", var.bucket_name)) &&
      !startswith(var.bucket_name, "xn--") &&
      !startswith(var.bucket_name, "sthree-") &&
      !startswith(var.bucket_name, "amzn-s3-demo-") &&
      !endswith(var.bucket_name, "-s3alias") &&
      !endswith(var.bucket_name, "--ol-s3") &&
      !endswith(var.bucket_name, "--x-s3") &&
      !endswith(var.bucket_name, "--table-s3") &&
      !endswith(var.bucket_name, "-an")
    )
    error_message = "Use a valid 3–63 character S3 name with lowercase letters, digits and hyphens; reserved S3 prefixes/suffixes and dots are excluded."
  }
}

variable "site_domain" {
  description = "Existing custom hostname covered by the supplied certificate. This module does not register or configure DNS."
  type        = string

  validation {
    condition = (
      length(var.site_domain) <= 253 &&
      can(regex("^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]([a-z0-9-]{0,61}[a-z0-9])?$", var.site_domain))
    )
    error_message = "Use a lowercase DNS hostname such as static.example.com, without scheme, path, wildcard, trailing dot or IP address."
  }
}

variable "certificate_arn" {
  description = "Existing validated ACM certificate ARN in us-east-1 covering site_domain. Account ownership, issuance and DNS are not verified offline."
  type        = string

  validation {
    condition     = can(regex("^arn:aws:acm:us-east-1:[0-9]{12}:certificate/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$", var.certificate_arn))
    error_message = "CloudFront requires an ACM certificate ARN in us-east-1 with a 12-digit AWS account ID and UUID certificate ID."
  }
}