#
#####################################
##           Gherkin               ##
#####################################
# Rule Identifier:
#    S3_BUCKET_REPLICATION_ENABLED
#
# Description:
#   Checks whether the Amazon S3 buckets have cross-region replication enabled.
#
# Reports on:
#    AWS::S3::Bucket
#
# Evaluates:
#    AWS CloudFormation
#
# Rule Parameters:
#    NA
#
# Scenarios:
# a) SKIP: when there are no S3 resource present
# b) PASS: when all S3 resources replication configuration set status is set to Enabled
# c) FAIL: when all S3 resources have Versioning Configuration status property not set or set to Suspended
# d) SKIP: when metadata includes the suppression for rule S3_BUCKET_REPLICATION_ENABLED

#
# Select all S3 resources from incoming template (payload)
#

let s3_buckets_replication_enabled = Resources.*[ Type == 'AWS::S3::Bucket'
  Metadata.guard.SuppressedRules not exists or
  Metadata.guard.SuppressedRules.* != "S3_BUCKET_REPLICATION_ENABLED"
]

rule S3_BUCKET_REPLICATION_ENABLED when %s3_buckets_replication_enabled !empty {
  %s3_buckets_replication_enabled.Properties.ReplicationConfiguration exists
  <<
    Violation: S3 Bucket replication should be enabled.
    Fix: Set S3 Bucket ReplicationConfiguration to another S3 Bucket.
  >>
    ## TODO regex to identify cross-region
}