code: def generate_main(config, init=False):
      """Generate the main.tf.json Terraform dict
  
      Args:
          config (CLIConfig): The loaded CLI config
          init (bool): Terraform is running in the init phase or not (optional)
  
      Returns:
          dict: main.tf.json Terraform dict
      """
      write_vars(config, region=config["global"]["account"]["region"])
  
      main_dict = infinitedict()
  
      logging_bucket, create_logging_bucket = s3_access_logging_bucket(
          config
      )
  
      state_lock_table_name = (
          "{}_streamalert_terraform_state_lock".format(
              config["global"]["account"]["prefix"]
          )
      )
      # Setup the Backend depending on the deployment phase.
      # When first setting up StreamAlert, the Terraform statefile
      # is stored locally.  After the first dependencies are created,
      # this moves to S3.
      if init:
          main_dict["terraform"]["backend"]["local"] = {
              "path": "terraform.tfstate",
          }
      else:
          terraform_bucket_name, _ = terraform_state_bucket(config)
          main_dict["terraform"]["backend"]["s3"] = {
              "bucket": terraform_bucket_name,
              "key": config["global"]
              .get("terraform", {})
              .get(
                  "state_key_name",
                  "streamalert_state/terraform.tfstate",
              ),
              "region": config["global"]["account"]["region"],
              "encrypt": True,
              "dynamodb_table": state_lock_table_name,
              "acl": "private",
              "kms_key_id": "alias/{}".format(
                  config["global"]["account"].get(
                      "kms_key_alias",
                      "{}_streamalert_secrets".format(
                          config["global"]["account"]["prefix"]
                      ),
                  )
              ),
          }
  
      # Configure initial S3 buckets
      main_dict["resource"]["aws_s3_bucket"] = {
          "streamalerts": generate_s3_bucket(
              bucket=firehose_alerts_bucket(config),
              logging=logging_bucket,
          )
      }
  
      # Configure remote state locking table
      main_dict["resource"]["aws_dynamodb_table"] = {
          "terraform_remote_state_lock": {
              "name": state_lock_table_name,
              "billing_mode": "PAY_PER_REQUEST",
              "hash_key": "LockID",
              "attribute": {"name": "LockID", "type": "S"},
              "tags": {"Name": "StreamAlert"},
          }
      }
  
      # Create bucket for S3 access logs (if applicable)
      if create_logging_bucket:
          main_dict["resource"]["aws_s3_bucket"][
              "logging_bucket"
          ] = generate_s3_bucket(
              bucket=logging_bucket,
              logging=logging_bucket,
              acl="log-delivery-write",
              lifecycle_rule={
                  "prefix": "/",
                  "enabled": True,
                  "transition": {
                      "days": 365,
                      "storage_class": "GLACIER",
                  },
              },
              sse_algorithm="AES256",  # SSE-KMS doesn't seem to work with access logs
          )
  
      (
          terraform_bucket_name,
          create_state_bucket,
      ) = terraform_state_bucket(config)
      # Create bucket for Terraform state (if applicable)
      if create_state_bucket:
          main_dict["resource"]["aws_s3_bucket"][
              "terraform_remote_state"
          ] = generate_s3_bucket(
              bucket=terraform_bucket_name, logging=logging_bucket
          )
  
      # Setup Firehose Delivery Streams
      generate_firehose(logging_bucket, main_dict, config)
  
      # Configure global resources like Firehose alert delivery and alerts table
      main_dict["module"]["globals"] = _generate_global_module(config)
  
      # KMS Key and Alias creation
      main_dict["resource"]["aws_kms_key"]["server_side_encryption"] = {
          "enable_key_rotation": True,
          "description": "StreamAlert S3 Server-Side Encryption",
          "policy": json.dumps(
              {
                  "Version": "2012-10-17",
                  "Statement": [
                      {
                          "Sid": "Enable IAM User Permissions",
                          "Effect": "Allow",
                          "Principal": {
                              "AWS": "arn:aws:iam::{}:root".format(
                                  config["global"]["account"][
                                      "aws_account_id"
                                  ]
                              )
                          },
                          "Action": "kms:*",
                          "Resource": "*",
                      },
                      {
                          "Sid": "Allow principals in the account to use the key",
                          "Effect": "Allow",
                          "Principal": "*",
                          "Action": [
                              "kms:Decrypt",
                              "kms:GenerateDataKey*",
                              "kms:Encrypt",
                          ],
                          "Resource": "*",
                          "Condition": {
                              "StringEquals": {
                                  "kms:CallerAccount": config["global"][
                                      "account"
                                  ]["aws_account_id"]
                              }
                          },
                      },
                  ],
              }
          ),
      }
      main_dict["resource"]["aws_kms_alias"][
          "server_side_encryption"
      ] = {
          "name": "alias/{}_server-side-encryption".format(
              config["global"]["account"]["prefix"]
          ),
          "target_key_id": "${aws_kms_key.server_side_encryption.key_id}",
      }
  
      main_dict["resource"]["aws_kms_key"]["streamalert_secrets"] = {
          "enable_key_rotation": True,
          "description": "StreamAlert secret management",
      }
      main_dict["resource"]["aws_kms_alias"]["streamalert_secrets"] = {
          "name": "alias/{}".format(
              config["global"]["account"].get(
                  "kms_key_alias",
                  "{}_streamalert_secrets".format(
                      config["global"]["account"]["prefix"]
                  ),
              )
          ),
          "target_key_id": "${aws_kms_key.streamalert_secrets.key_id}",
      }
  
      # Global infrastructure settings
      topic_name, create_topic = monitoring_topic_name(config)
      if create_topic:
          main_dict["resource"]["aws_sns_topic"]["monitoring"] = {
              "name": topic_name
          }
  
      return main_dict
  
imports: import json
  import os
  from streamalert.shared.config import ConfigError, firehose_alerts_bucket
  from streamalert.shared.logger import get_logger
  from streamalert.shared.utils import get_database_name, get_data_file_format
  from streamalert_cli.athena.helpers import generate_alerts_table_schema
  from streamalert_cli.helpers import check_credentials
  from streamalert_cli.terraform.common import InvalidClusterName, infinitedict, monitoring_topic_name, s3_access_logging_bucket, terraform_state_bucket
  from streamalert_cli.terraform.artifact_extractor import generate_artifact_extractor
  from streamalert_cli.terraform.alert_merger import generate_alert_merger
  from streamalert_cli.terraform.alert_processor import generate_alert_processor
  from streamalert_cli.terraform.apps import generate_apps
  from streamalert_cli.terraform.athena import generate_athena
  from streamalert_cli.terraform.cloudtrail import generate_cloudtrail
  from streamalert_cli.terraform.cloudwatch_destinations import generate_cloudwatch_destinations
  from streamalert_cli.terraform.cloudwatch_events import generate_cloudwatch_events
  from streamalert_cli.terraform.firehose import generate_firehose
  from streamalert_cli.terraform.flow_logs import generate_flow_logs
  from streamalert_cli.terraform.helpers import terraform_check
  from streamalert_cli.terraform.kinesis_events import generate_kinesis_events
  from streamalert_cli.terraform.kinesis_streams import generate_kinesis_streams
  from streamalert_cli.terraform.metrics import generate_aggregate_cloudwatch_metric_alarms, generate_aggregate_cloudwatch_metric_filters, generate_cluster_cloudwatch_metric_filters, generate_cluster_cloudwatch_metric_alarms
  from streamalert_cli.terraform.monitoring import generate_monitoring
  from streamalert_cli.terraform.rule_promotion import generate_rule_promotion
  from streamalert_cli.terraform.classifier import generate_classifier
  from streamalert_cli.terraform.rules_engine import generate_rules_engine
  from streamalert_cli.terraform.s3_events import generate_s3_events
  from streamalert_cli.terraform.scheduled_queries import generate_scheduled_queries_module_configuration
  from streamalert_cli.terraform.threat_intel_downloader import generate_threat_intel_downloader
  from streamalert_cli.utils import CLICommand
label_desc: Use image node_id 3 for calling a global function with example usage: generate_main(config, init) and returns: main_dict