resource "aws_iam_group" "team_alpha" {
  name = "team-alpha"
}

resource "aws_iam_group_membership" "team_alpha" {
  name  = aws_iam_group.team_alpha.name
  group = aws_iam_group.team_alpha.name
  users = [
    aws_iam_user.alice.name,
    aws_iam_user.alex.name
  ]
}

#---

resource "aws_iam_group_policy_attachment" "team_alpha_has_general_access" {
  group      = aws_iam_group.team_alpha.name
  policy_arn = aws_iam_policy.general_access.arn
}

#---

resource "aws_iam_policy" "team_alpha_assume_role_access" {
  name   = "team-alpha-assume-role-access"
  policy = data.aws_iam_policy_document.team_alpha_assume_role_access.json
}

data "aws_iam_policy_document" "team_alpha_assume_role_access" {
  statement {
    effect    = "Allow"
    actions   = ["sts:AssumeRole"]
    resources = [aws_iam_role.fruits_family_contributor.arn]
  }
}

resource "aws_iam_group_policy_attachment" "team_alpha_has_assume_role_access" {
  group      = aws_iam_group.team_alpha.name
  policy_arn = aws_iam_policy.team_alpha_assume_role_access.arn
}