resource "aws_iam_group" "team_beta" {
  name = "team-beta"
}

resource "aws_iam_group_membership" "team_beta" {
  name  = aws_iam_group.team_beta.name
  group = aws_iam_group.team_beta.name
  users = [
    aws_iam_user.bob.name,
    aws_iam_user.beatrice.name
  ]
}

#---

resource "aws_iam_group_policy_attachment" "team_beta_has_general_access" {
  group      = aws_iam_group.team_beta.name
  policy_arn = aws_iam_policy.general_access.arn
}

#---

resource "aws_iam_policy" "team_beta_assume_role_access" {
  name   = "team-beta-assume-role-access"
  policy = data.aws_iam_policy_document.team_beta_assume_role_access.json
}

data "aws_iam_policy_document" "team_beta_assume_role_access" {
  statement {
    effect    = "Allow"
    actions   = ["sts:AssumeRole"]
    resources = [aws_iam_role.birds_family_contributor.arn]
  }
}

resource "aws_iam_group_policy_attachment" "team_beta_has_assume_role_access" {
  group      = aws_iam_group.team_beta.name
  policy_arn = aws_iam_policy.team_beta_assume_role_access.arn
}