import boto3

# Create an S3 client
s3 = boto3.client('s3')

# List all the S3 buckets in your AWS account
response = s3.list_buckets()

# Loop through each bucket and check if access logging is enabled
for bucket in response['Buckets']:
    bucket_name = bucket['Name']
    logging_enabled = False
    
    # Check if access logging is enabled for the bucket
    try:
        logging = s3.get_bucket_logging(Bucket=bucket_name)
        if 'LoggingEnabled' in logging:
            logging_enabled = True
    except:
        pass
    
    # If access logging is not enabled, enable it for the bucket
    if not logging_enabled:
        s3.put_bucket_logging(
            Bucket=bucket_name,
            BucketLoggingStatus={
                'LoggingEnabled': {
                    'TargetBucket': bucket_name,
                    'TargetPrefix': 'access-logs/'
                }
            }
        )

# Log destination bucket (must already exist or be managed in Terraform)
resource "aws_s3_bucket" "LOG_BUCKET" {
  bucket = "LOG_BUCKET_NAME" # replace with the existing log bucket name
}

# ACL on the log bucket to allow the S3 log delivery group to write logs
resource "aws_s3_bucket_acl" "log_bucket_acl" {
  bucket = aws_s3_bucket.LOG_BUCKET.id

  access_control_policy {
    owner {
      id = "LOG_BUCKET_OWNER_CANONICAL_USER_ID" # replace with the log bucket owner's canonical user ID
    }

    grant {
      grantee {
        type = "Group"
        uri  = "http://acs.amazonaws.com/groups/s3/LogDelivery"
      }
      permission = "WRITE"
    }

    grant {
      grantee {
        type = "Group"
        uri  = "http://acs.amazonaws.com/groups/s3/LogDelivery"
      }
      permission = "READ_ACP"
    }
  }
}

# Source bucket that needs server access logging enabled
resource "aws_s3_bucket" "SOURCE_BUCKET" {
  bucket = "SOURCE_BUCKET_NAME" # replace with the bucket that must have access logging enabled
}

# Enable S3 server access logging on the source bucket
resource "aws_s3_bucket_logging" "source_bucket_logging" {
  bucket = aws_s3_bucket.SOURCE_BUCKET.id

  target_bucket = aws_s3_bucket.LOG_BUCKET.id
  target_prefix = "SOURCE_BUCKET_NAME/" # replace with the actual source bucket name, if desired
}