provider "aws" {
  profile = var.profile
  region  = var.region_id

  default_tags {
    tags = {
      application_family = "delphi"
    }
  }
}

locals {
  aws_elb_account_id = module.elb_account_ids.elb_account_ids[var.region_id]
  allowed_roles = [
    module.cross_account_terraform_role.role.name,
    "admin"
  ]
  account_id = data.aws_caller_identity.current.account_id
}

data "aws_caller_identity" "current" {}

module "elb_account_ids" {
  source = "../../../../modules/elb_account_ids"
}

module "backend" {
  source             = "../../../../modules/backend"
  name_prefix        = var.name_prefix
  common_tags        = var.common_tags
  allowed_roles      = concat(var.allowed_roles, local.allowed_roles)
  allowed_accounts   = keys(var.admin_users)
  env_prefix         = "dev"
  aws_elb_account_id = local.aws_elb_account_id
}

module "ip_and_domain_to_block_bucket" {
  source             = "../../../../modules/s3/private_bucket_with_logs_aes256_v2"
  bucket_name        = "${var.name_prefix}-ip-and-domain-block"
  logs_bucket_id     = module.backend.logs_bucket.id
  logs_object_prefix = "dev-infra/ip-and-domain-block/"
  default_policy     = true
  common_tags = merge(
    var.common_tags,
    {
      project = "Infrastructure",
      service = "S3",
    }
  )
}

module "deployment_policies" {
  source      = "../../../../modules/iam/policies/deployment"
  name_prefix = "dev-infra"
}

module "packer_deployment_policy" {
  source      = "../../../../modules/iam/policies/packer"
  name_prefix = "dev-infra"
}

module "s3_deployment_policy" {
  source = "../../../../modules/iam/policies/s3/buckets_rw"

  name        = "s3_deploy_policy"
  name_prefix = "dev-infra"

  bucket_masks = [
    "gdb-infra-dev-ip-and-domain-block",
    "dev-infra-cross-products-documentation",
  ]
}

module "s3_read_only_policy" {
  source = "../../../../modules/iam/policies/s3/buckets_ro"

  name        = "s3_read_only_policy"
  name_prefix = "dev-infra"

  bucket_masks = [
    "dev-infra-decibel-test-data",
  ]
}

resource "aws_s3_object" "ip_addresses" {
  key     = "IOC_IP_Address_block.txt"
  bucket  = module.ip_and_domain_to_block_bucket.bucket.id
  content = ""

  lifecycle {
    ignore_changes = [
      content
    ]
  }
}

resource "aws_s3_object" "domain_names" {
  key     = "IOC_domains_block.txt"
  bucket  = module.ip_and_domain_to_block_bucket.bucket.id
  content = ""

  lifecycle {
    ignore_changes = [
      content
    ]
  }
}

module "access_policies_documents" {
  source      = "../../../../modules/iam/policies/iam_access_policies_documents"
  require_mfa = true
}

module "access_policies_documents_without_mfa" {
  source      = "../../../../modules/iam/policies/iam_access_policies_documents"
  require_mfa = false
}

module "aws_accounts_list" {
  source = "../../../../modules/iam/aws_accounts_list"
}

/**
 * IAM policy document
 * Allows assume any roles in any account
 */
module "assume_admin_role_in_any_account_policy_document" {
  source = "../../../../modules/iam/policies/assume_role_policy_document"

  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/cross_account_developer", values(module.aws_accounts_list.accounts)),
    formatlist("arn:aws:iam::%s:role/cross_account_qa", values(module.aws_accounts_list.accounts)),
    formatlist("arn:aws:iam::%s:role/cross_account_user", values(module.aws_accounts_list.accounts)),
  )
}

module "assume_admin_role_policy_document" {
  for_each = module.aws_accounts_list.accounts
  source   = "../../../../modules/iam/policies/assume_role_policy_document"

  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/cross_account_developer", [each.value]),
    formatlist("arn:aws:iam::%s:role/cross_account_support", [each.value]),
    formatlist("arn:aws:iam::%s:role/cross_account_qa", [each.value]),
    formatlist("arn:aws:iam::%s:role/cross_account_user", [each.value]),
  )
}

module "assume_developer_role_in_any_prod_account_policy_document" {
  source = "../../../../modules/iam/policies/assume_role_policy_document"

  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/cross_account_developer", values(module.aws_accounts_list.prod_accounts)),
    formatlist("arn:aws:iam::%s:role/cross_account_qa", values(module.aws_accounts_list.prod_accounts)),
    formatlist("arn:aws:iam::%s:role/cross_account_user", values(module.aws_accounts_list.prod_accounts)),
  )
}

module "assume_developer_role_in_any_dev_account_policy_document" {
  source = "../../../../modules/iam/policies/assume_role_policy_document"

  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/cross_account_developer", values(module.aws_accounts_list.dev_accounts)),
    formatlist("arn:aws:iam::%s:role/cross_account_qa", values(module.aws_accounts_list.dev_accounts)),
    formatlist("arn:aws:iam::%s:role/cross_account_user", values(module.aws_accounts_list.dev_accounts)),
  )
}

module "assume_developer_role_policy_document" {
  for_each = module.aws_accounts_list.accounts
  source   = "../../../../modules/iam/policies/assume_role_policy_document"

  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/cross_account_developer", [each.value]),
    formatlist("arn:aws:iam::%s:role/cross_account_qa", [each.value]),
    formatlist("arn:aws:iam::%s:role/cross_account_user", [each.value]),
  )
}

module "assume_support_role_in_any_prod_account_policy_document" {
  source = "../../../../modules/iam/policies/assume_role_policy_document"

  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/cross_account_support", values(module.aws_accounts_list.prod_accounts)),
    formatlist("arn:aws:iam::%s:role/cross_account_qa", values(module.aws_accounts_list.prod_accounts)),
    formatlist("arn:aws:iam::%s:role/cross_account_user", values(module.aws_accounts_list.prod_accounts)),
  )
}

module "assume_support_role_in_any_dev_account_policy_document" {
  source = "../../../../modules/iam/policies/assume_role_policy_document"

  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/cross_account_support", values(module.aws_accounts_list.dev_accounts)),
    formatlist("arn:aws:iam::%s:role/cross_account_qa", values(module.aws_accounts_list.dev_accounts)),
    formatlist("arn:aws:iam::%s:role/cross_account_user", values(module.aws_accounts_list.dev_accounts)),
  )
}

module "assume_support_role_policy_document" {
  for_each = module.aws_accounts_list.accounts
  source   = "../../../../modules/iam/policies/assume_role_policy_document"

  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/cross_account_support", [each.value]),
    formatlist("arn:aws:iam::%s:role/cross_account_qa", [each.value]),
    formatlist("arn:aws:iam::%s:role/cross_account_user", [each.value]),
  )
}

module "assume_qa_role_in_any_prod_account_policy_document" {
  source = "../../../../modules/iam/policies/assume_role_policy_document"

  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/cross_account_qa", values(module.aws_accounts_list.prod_accounts)),
    formatlist("arn:aws:iam::%s:role/cross_account_user", values(module.aws_accounts_list.prod_accounts)),
  )
}

module "assume_qa_role_in_any_dev_account_policy_document" {
  source = "../../../../modules/iam/policies/assume_role_policy_document"

  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/cross_account_qa", values(module.aws_accounts_list.dev_accounts)),
    formatlist("arn:aws:iam::%s:role/cross_account_user", values(module.aws_accounts_list.dev_accounts)),
  )
}

module "assume_qa_role_policy_document" {
  for_each = module.aws_accounts_list.accounts
  source   = "../../../../modules/iam/policies/assume_role_policy_document"

  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/cross_account_qa", [each.value]),
    formatlist("arn:aws:iam::%s:role/cross_account_user", [each.value]),
  )
}

module "assume_user_role_in_any_prod_account_policy_document" {
  source = "../../../../modules/iam/policies/assume_role_policy_document"

  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/cross_account_user", values(module.aws_accounts_list.prod_accounts)),
  )
}

module "assume_user_role_in_any_dev_account_policy_document" {
  source = "../../../../modules/iam/policies/assume_role_policy_document"

  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/cross_account_user", values(module.aws_accounts_list.dev_accounts)),
  )
}

module "assume_user_role_policy_document" {
  for_each = module.aws_accounts_list.accounts
  source   = "../../../../modules/iam/policies/assume_role_policy_document"

  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/cross_account_user", [each.value]),
  )
}

/**
 * IAM policy
 */
resource "aws_iam_policy" "self_credentials_management" {
  name        = "self_credentials_management"
  description = "Allows an IAM user to manage their own Service Specific Credentials."
  policy      = module.access_policies_documents.self_credentials_management_policy_json
}

resource "aws_iam_policy" "read_only" {
  name        = "read_only"
  description = "Provides read-only access to AWS services and resources."
  policy      = module.access_policies_documents.read_only_policy_json
}

resource "aws_iam_policy" "power_users" {
  name        = "power_users"
  description = "Provides full access to AWS services and resources, with some restrictions."
  policy      = module.access_policies_documents.power_user_policy_json
}

resource "aws_iam_policy" "terraform_policy" {
  name        = "terraform_policy"
  description = "Provides full access to AWS services and resources."
  policy      = module.access_policies_documents_without_mfa.admin_user_policy_json
}

resource "aws_iam_policy" "qa_users" {
  name        = "qa_users"
  path        = "/"
  description = "Provides read-only access to AWS services and resources with some additional permissions."
  policy      = module.access_policies_documents.qa_user_policy_json
}

resource "aws_iam_policy" "assume_admin_role_in_any_account_policy" {
  name        = "${var.name_prefix}-assume_any_admin_role"
  description = "Allows assuming admin role in any account"
  policy      = module.assume_admin_role_in_any_account_policy_document.policy_json
}

resource "aws_iam_policy" "assume_admin_role_policy" {
  for_each = module.aws_accounts_list.accounts

  name        = "${each.key}-assume_admin_role"
  description = "Allows assuming admin role in ${each.key} account"
  policy      = module.assume_admin_role_policy_document[each.key].policy_json
}

resource "aws_iam_policy" "assume_developer_role_in_any_prod_account_policy" {
  name        = "${var.name_prefix}-assume_prod_developer_role"
  description = "Allows assuming developer role in any prod account"
  policy      = module.assume_developer_role_in_any_prod_account_policy_document.policy_json
}

resource "aws_iam_policy" "assume_developer_role_in_any_dev_account_policy" {
  name        = "${var.name_prefix}-assume_dev_developer_role"
  description = "Allows assuming developer role in any dev account"
  policy      = module.assume_developer_role_in_any_dev_account_policy_document.policy_json
}

resource "aws_iam_policy" "assume_developer_role_policy" {
  for_each = module.aws_accounts_list.accounts

  name        = "${each.key}-assume_developer_role"
  description = "Allows assuming developer role in ${each.key} account"
  policy      = module.assume_developer_role_policy_document[each.key].policy_json
}

resource "aws_iam_policy" "assume_support_role_in_any_prod_account_policy" {
  name        = "${var.name_prefix}-assume_prod_support_role"
  description = "Allows assuming support role in any prod account"
  policy      = module.assume_support_role_in_any_prod_account_policy_document.policy_json
}

resource "aws_iam_policy" "assume_support_role_in_any_dev_account_policy" {
  name        = "${var.name_prefix}-assume_dev_support_role"
  description = "Allows assuming support role in any dev account"
  policy      = module.assume_support_role_in_any_dev_account_policy_document.policy_json
}

resource "aws_iam_policy" "assume_support_role_policy" {
  for_each = module.aws_accounts_list.accounts

  name        = "${each.key}-assume_support_role"
  description = "Allows assuming support role in ${each.key} account"
  policy      = module.assume_support_role_policy_document[each.key].policy_json
}

resource "aws_iam_policy" "assume_qa_role_in_any_prod_account_policy" {
  name        = "${var.name_prefix}-assume_prod_qa_role"
  description = "Allows assuming qa role in any prod account"
  policy      = module.assume_qa_role_in_any_prod_account_policy_document.policy_json
}

resource "aws_iam_policy" "assume_qa_role_in_any_dev_account_policy" {
  name        = "${var.name_prefix}-assume_dev_qa_role"
  description = "Allows assuming qa role in any dev account"
  policy      = module.assume_qa_role_in_any_dev_account_policy_document.policy_json
}

resource "aws_iam_policy" "assume_qa_role_policy" {
  for_each = module.aws_accounts_list.accounts

  name        = "${each.key}-assume_qa_role"
  description = "Allows assuming qa role in ${each.key} account"
  policy      = module.assume_qa_role_policy_document[each.key].policy_json
}

resource "aws_iam_policy" "assume_user_role_in_any_prod_account_policy" {
  name        = "${var.name_prefix}-assume_prod_user_role"
  description = "Allows assuming user role in any prod account"
  policy      = module.assume_user_role_in_any_prod_account_policy_document.policy_json
}

resource "aws_iam_policy" "assume_user_role_in_any_dev_account_policy" {
  name        = "${var.name_prefix}-assume_dev_user_role"
  description = "Allows assuming user role in any dev account"
  policy      = module.assume_user_role_in_any_dev_account_policy_document.policy_json
}

resource "aws_iam_policy" "assume_user_role_policy" {
  for_each = module.aws_accounts_list.accounts

  name        = "${each.key}-assume_user_role"
  description = "Allows assuming user role in ${each.key} account"
  policy      = module.assume_user_role_policy_document[each.key].policy_json
}

/**
 * User groups
 */
module "admins" {
  source = "../../../../modules/iam/groups/users_group"

  name = "admins"
  policies_list = [
    aws_iam_policy.assume_admin_role_in_any_account_policy.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AdministratorAccess"
  ]
}

module "developers" {
  source = "../../../../modules/iam/groups/users_group"

  name = "developers"
  policies_list = [
    aws_iam_policy.assume_developer_role_in_any_dev_account_policy.arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "developers-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "developers-prod-access"
  policies_list = [
    aws_iam_policy.assume_developer_role_in_any_prod_account_policy.arn,
  ]
}

module "qa" {
  source = "../../../../modules/iam/groups/users_group"

  name = "qa"
  policies_list = [
    aws_iam_policy.assume_qa_role_in_any_dev_account_policy.arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "qa-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "qa-prod-access"
  policies_list = [
    aws_iam_policy.assume_qa_role_in_any_prod_account_policy.arn,
  ]
}

module "users" {
  source = "../../../../modules/iam/groups/users_group"

  name = "users"
  policies_list = [
    aws_iam_policy.assume_user_role_in_any_dev_account_policy.arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "users-prod-access" {
  source = "../../../../modules/iam/groups/users_group"
  name   = "users-prod-access"
  policies_list = [
    aws_iam_policy.assume_qa_role_in_any_prod_account_policy.arn,
  ]
}

module "apollo-admins" {
  source = "../../../../modules/iam/groups/users_group"

  name = "apollo-admins"
  policies_list = [
    aws_iam_policy.assume_admin_role_policy["gdb-apollo-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "apollo-admins-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "apollo-admins-prod-access"
  policies_list = [
    aws_iam_policy.assume_admin_role_policy["gdb-apollo-prod"].arn,
  ]
}

module "apollo-developers" {
  source = "../../../../modules/iam/groups/users_group"

  name = "apollo-developers"
  policies_list = [
    aws_iam_policy.assume_developer_role_policy["gdb-apollo-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "apollo-developers-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "apollo-developers-prod-access"
  policies_list = [
    aws_iam_policy.assume_developer_role_policy["gdb-apollo-prod"].arn,
  ]
}

module "apollo-support" {
  source = "../../../../modules/iam/groups/users_group"

  name = "apollo-support"
  policies_list = [
    aws_iam_policy.assume_support_role_policy["gdb-apollo-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "apollo-support-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "apollo-prod-access-support"
  policies_list = [
    aws_iam_policy.assume_support_role_policy["gdb-apollo-prod"].arn
  ]
}

module "apollo-qa" {
  source = "../../../../modules/iam/groups/users_group"

  name = "apollo-qa"
  policies_list = [
    aws_iam_policy.assume_qa_role_policy["gdb-apollo-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "apollo-qa-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "apollo-qa-prod-access"
  policies_list = [
    aws_iam_policy.assume_qa_role_policy["gdb-apollo-prod"].arn,
  ]
}

module "apollo-users" {
  source = "../../../../modules/iam/groups/users_group"

  name = "apollo-users"
  policies_list = [
    aws_iam_policy.assume_user_role_policy["gdb-apollo-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "apollo-users-prod-access" {
  source = "../../../../modules/iam/groups/users_group"
  name   = "apollo-users-prod-access"
  policies_list = [
    aws_iam_policy.assume_user_role_policy["gdb-apollo-prod"].arn,
  ]
}

module "delphi-admins" {
  source = "../../../../modules/iam/groups/users_group"

  name = "delphi-admins"
  policies_list = [
    aws_iam_policy.assume_admin_role_policy["gdb-delphi-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "delphi-admins-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "delphi-admins-prod-access"
  policies_list = [
    aws_iam_policy.assume_admin_role_policy["gdb-delphi-prod"].arn,
  ]
}

module "delphi-developers" {
  source = "../../../../modules/iam/groups/users_group"

  name = "delphi-developers"
  policies_list = [
    aws_iam_policy.assume_developer_role_policy["gdb-delphi-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "delphi-developers-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "delphi-developers-prod-access"
  policies_list = [
    aws_iam_policy.assume_developer_role_policy["gdb-delphi-prod"].arn,
  ]
}

module "delphi-support" {
  source = "../../../../modules/iam/groups/users_group"

  name = "delphi-support"
  policies_list = [
    aws_iam_policy.assume_support_role_policy["gdb-delphi-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "delphi-support-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "delphi-support-prod-access"
  policies_list = [
    aws_iam_policy.assume_support_role_policy["gdb-delphi-prod"].arn,
  ]
}

module "delphi-qa" {
  source = "../../../../modules/iam/groups/users_group"

  name = "delphi-qa"
  policies_list = [
    aws_iam_policy.assume_qa_role_policy["gdb-delphi-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "delphi-qa-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "delphi-qa-prod-access"
  policies_list = [
    aws_iam_policy.assume_qa_role_policy["gdb-delphi-prod"].arn,
  ]
}

module "delphi-users" {
  source = "../../../../modules/iam/groups/users_group"

  name = "delphi-users"
  policies_list = [
    aws_iam_policy.assume_user_role_policy["gdb-delphi-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "delphi-users-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "delphi-users-prod-access"
  policies_list = [
    aws_iam_policy.assume_user_role_policy["gdb-delphi-prod"].arn,
  ]
}

module "artistapp-admins" {
  source = "../../../../modules/iam/groups/users_group"

  name = "artistapp-admins"
  policies_list = [
    aws_iam_policy.assume_admin_role_policy["gdb-artistapp-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "artistapp-admins-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "artistapp-admins-prod-access"
  policies_list = [
    aws_iam_policy.assume_admin_role_policy["gdb-artistapp-prod"].arn,
  ]
}

module "artistapp-developers" {
  source = "../../../../modules/iam/groups/users_group"

  name = "artistapp-developers"
  policies_list = [
    aws_iam_policy.assume_developer_role_policy["gdb-artistapp-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "artistapp-developers-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "artistapp-developers-prod-access"
  policies_list = [
    aws_iam_policy.assume_developer_role_policy["gdb-artistapp-prod"].arn,
  ]
}

module "artistapp-support" {
  source = "../../../../modules/iam/groups/users_group"

  name = "artistapp-support"
  policies_list = [
    aws_iam_policy.assume_support_role_policy["gdb-artistapp-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "artistapp-support-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "artistapp-support-prod-access"
  policies_list = [
    aws_iam_policy.assume_support_role_policy["gdb-artistapp-prod"].arn,
  ]
}

module "artistapp-qa" {
  source = "../../../../modules/iam/groups/users_group"
  name   = "artistapp-qa"
  policies_list = [
    aws_iam_policy.assume_qa_role_policy["gdb-artistapp-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "artistapp-qa-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "artistapp-qa-prod-access"
  policies_list = [
    aws_iam_policy.assume_qa_role_policy["gdb-artistapp-prod"].arn,
  ]
}

module "artistapp-users" {
  source = "../../../../modules/iam/groups/users_group"

  name = "artistapp-users"
  policies_list = [
    aws_iam_policy.assume_user_role_policy["gdb-artistapp-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "artistapp-users-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "artistapp-users-prod-access"
  policies_list = [
    aws_iam_policy.assume_user_role_policy["gdb-artistapp-prod"].arn,
  ]
}

module "databricks-admins" {
  source = "../../../../modules/iam/groups/users_group"

  name = "databricks-admins"
  policies_list = [
    aws_iam_policy.assume_admin_role_policy["gdb-databricks-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "databricks-admins-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "databricks-admins-prod-access"
  policies_list = [
    aws_iam_policy.assume_admin_role_policy["gdb-databricks-prod"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "databricks-developers" {
  source = "../../../../modules/iam/groups/users_group"

  name = "databricks-developers"
  policies_list = [
    aws_iam_policy.assume_developer_role_policy["gdb-databricks-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "databricks-developers-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "databricks-developers-prod-access"
  policies_list = [
    aws_iam_policy.assume_developer_role_policy["gdb-databricks-prod"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "databricks-support" {
  source = "../../../../modules/iam/groups/users_group"

  name = "databricks-support"
  policies_list = [
    aws_iam_policy.assume_support_role_policy["gdb-databricks-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "databricks-support-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "databricks-support-prod-access"
  policies_list = [
    aws_iam_policy.assume_support_role_policy["gdb-databricks-prod"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "databricks-qa" {
  source = "../../../../modules/iam/groups/users_group"

  name = "databricks-qa"
  policies_list = [
    aws_iam_policy.assume_qa_role_policy["gdb-databricks-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "databricks-qa-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "databricks-qa-prod-access"
  policies_list = [
    aws_iam_policy.assume_qa_role_policy["gdb-databricks-prod"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "databricks-users" {
  source = "../../../../modules/iam/groups/users_group"

  name = "databricks-users"
  policies_list = [
    aws_iam_policy.assume_user_role_policy["gdb-databricks-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "databricks-users-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "databricks-users-prod-access"
  policies_list = [
    aws_iam_policy.assume_user_role_policy["gdb-databricks-prod"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "datasci-admins" {
  source = "../../../../modules/iam/groups/users_group"

  name = "datasci-admins"
  policies_list = [
    aws_iam_policy.assume_admin_role_policy["gdb-datasci-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "datasci-developers" {
  source = "../../../../modules/iam/groups/users_group"

  name = "datasci-developers"
  policies_list = [
    aws_iam_policy.assume_developer_role_policy["gdb-datasci-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "datasci-support" {
  source = "../../../../modules/iam/groups/users_group"

  name = "datasci-support"
  policies_list = [
    aws_iam_policy.assume_support_role_policy["gdb-datasci-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "datasci-qa" {
  source = "../../../../modules/iam/groups/users_group"

  name = "datasci-qa"
  policies_list = [
    aws_iam_policy.assume_qa_role_policy["gdb-datasci-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "datasci-users" {
  source = "../../../../modules/iam/groups/users_group"

  name = "datasci-users"
  policies_list = [
    aws_iam_policy.assume_user_role_policy["gdb-datasci-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "core-admins" {
  source = "../../../../modules/iam/groups/users_group"

  name = "core-admins"
  policies_list = [
    aws_iam_policy.assume_admin_role_policy["gdb-core-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "core-admins-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "core-admins-prod-access"
  policies_list = [
    aws_iam_policy.assume_admin_role_policy["gdb-core-prod"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "core-developers" {
  source = "../../../../modules/iam/groups/users_group"

  name = "core-developers"
  policies_list = [
    aws_iam_policy.assume_developer_role_policy["gdb-core-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "core-developers-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "core-developers-prod-access"
  policies_list = [
    aws_iam_policy.assume_developer_role_policy["gdb-core-prod"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "core-support" {
  source = "../../../../modules/iam/groups/users_group"

  name = "core-support"
  policies_list = [
    aws_iam_policy.assume_support_role_policy["gdb-core-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "core-support-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "core-support-prod-access"
  policies_list = [
    aws_iam_policy.assume_support_role_policy["gdb-core-prod"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "core-qa" {
  source = "../../../../modules/iam/groups/users_group"

  name = "core-qa"
  policies_list = [
    aws_iam_policy.assume_qa_role_policy["gdb-core-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "core-qa-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "core-qa-prod-access"
  policies_list = [
    aws_iam_policy.assume_qa_role_policy["gdb-core-prod"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "core-users" {
  source = "../../../../modules/iam/groups/users_group"

  name = "core-users"
  policies_list = [
    aws_iam_policy.assume_user_role_policy["gdb-core-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "core-users-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "core-users-prod-access"
  policies_list = [
    aws_iam_policy.assume_user_role_policy["gdb-core-prod"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "prodhub-admins" {
  source = "../../../../modules/iam/groups/users_group"

  name = "prodhub-admins"
  policies_list = [
    aws_iam_policy.assume_admin_role_policy["gdb-prodhub-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "prodhub-developers" {
  source = "../../../../modules/iam/groups/users_group"

  name = "prodhub-developers"
  policies_list = [
    aws_iam_policy.assume_developer_role_policy["gdb-prodhub-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "prodhub-support" {
  source = "../../../../modules/iam/groups/users_group"

  name = "prodhub-support"
  policies_list = [
    aws_iam_policy.assume_support_role_policy["gdb-prodhub-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "prodhub-qa" {
  source = "../../../../modules/iam/groups/users_group"

  name = "prodhub-qa"
  policies_list = [
    aws_iam_policy.assume_qa_role_policy["gdb-prodhub-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "prodhub-users" {
  source = "../../../../modules/iam/groups/users_group"

  name = "prodhub-users"
  policies_list = [
    aws_iam_policy.assume_user_role_policy["gdb-prodhub-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "whitelist-admins" {
  source = "../../../../modules/iam/groups/users_group"

  name = "whitelist-admins"
  policies_list = [
    aws_iam_policy.assume_admin_role_policy["gdb-whitelist-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "whitelist-admins-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "whitelist-admins-prod-access"
  policies_list = [
    aws_iam_policy.assume_admin_role_policy["gdb-whitelist-prod"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "whitelist-developers" {
  source = "../../../../modules/iam/groups/users_group"

  name = "whitelist-developers"
  policies_list = [
    aws_iam_policy.assume_developer_role_policy["gdb-whitelist-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "whitelist-developers-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "whitelist-developers-prod-access"
  policies_list = [
    aws_iam_policy.assume_developer_role_policy["gdb-whitelist-prod"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "whitelist-support" {
  source = "../../../../modules/iam/groups/users_group"

  name = "whitelist-support"
  policies_list = [
    aws_iam_policy.assume_support_role_policy["gdb-whitelist-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "whitelist-support-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "whitelist-support-prod-access"
  policies_list = [
    aws_iam_policy.assume_support_role_policy["gdb-whitelist-prod"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "whitelist-qa" {
  source = "../../../../modules/iam/groups/users_group"

  name = "whitelist-qa"
  policies_list = [
    aws_iam_policy.assume_qa_role_policy["gdb-whitelist-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "whitelist-qa-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "whitelist-qa-prod-access"
  policies_list = [
    aws_iam_policy.assume_qa_role_policy["gdb-whitelist-prod"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "whitelist-users" {
  source = "../../../../modules/iam/groups/users_group"

  name = "whitelist-users"
  policies_list = [
    aws_iam_policy.assume_user_role_policy["gdb-whitelist-dev"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "whitelist-users-prod-access" {
  source = "../../../../modules/iam/groups/users_group"

  name = "whitelist-users-prod-access"
  policies_list = [
    aws_iam_policy.assume_user_role_policy["gdb-whitelist-prod"].arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "cross_account_deployment_role" {
  source      = "../../../../modules/iam/roles/cross_account_role"
  name        = "cross_account_deployment_role"
  common_tags = var.common_tags
  require_mfa = false
  principal_list = [
    format("arn:aws:iam::%s:role/dev-infra-jenkins_ec2_agent_role", module.aws_accounts_list.accounts["gdb-infra-dev"]),
  ]
  policies_list = [
    module.deployment_policies.combined_deployment_policy.arn,
    module.s3_deployment_policy.policy.arn,
    module.s3_read_only_policy.policy.arn,
    module.packer_deployment_policy.policy.arn,
  ]
}

module "cross_account_terraform_role" {
  source      = "../../../../modules/iam/roles/cross_account_role"
  name        = "cross_account_terraform_role"
  common_tags = var.common_tags
  require_mfa = false
  principal_list = [
    format("arn:aws:iam::%s:role/dev-infra-jenkins_ec2_terraform_agent_role", module.aws_accounts_list.accounts["gdb-infra-dev"]),
    format("arn:aws:iam::%s:role/dev-infra-atlantis_task_role", module.aws_accounts_list.accounts["gdb-infra-dev"]),
  ]
  policies_list = [aws_iam_policy.terraform_policy.arn]
}

module "cross_account_developer_role" {
  source               = "../../../../modules/iam/roles/cross_account_role"
  name                 = "cross_account_developer"
  common_tags          = var.common_tags
  require_mfa          = true
  max_session_duration = 43200
  principal_list = formatlist("arn:aws:iam::%s:root", [
    module.aws_accounts_list.accounts["gdb-infra-dev"],
    module.aws_accounts_list.accounts["the-orchard-prod"],
  ])
  policies_list = [
    aws_iam_policy.power_users.arn,
    aws_iam_policy.read_only.arn,
  ]
}

module "cross_account_qa_role" {
  source               = "../../../../modules/iam/roles/cross_account_role"
  name                 = "cross_account_qa"
  common_tags          = var.common_tags
  require_mfa          = true
  max_session_duration = 43200
  principal_list = formatlist("arn:aws:iam::%s:root", [
    module.aws_accounts_list.accounts["gdb-infra-dev"],
    module.aws_accounts_list.accounts["the-orchard-prod"],
  ])
  policies_list = [aws_iam_policy.qa_users.arn]
}

module "cross_account_user_role" {
  source               = "../../../../modules/iam/roles/cross_account_role"
  name                 = "cross_account_user"
  common_tags          = var.common_tags
  require_mfa          = true
  max_session_duration = 43200
  principal_list = formatlist("arn:aws:iam::%s:root", [
    module.aws_accounts_list.accounts["gdb-infra-dev"],
    module.aws_accounts_list.accounts["the-orchard-prod"],
  ])
  policies_list = [aws_iam_policy.read_only.arn]
}

# Table for state locks
resource "aws_dynamodb_table" "dynamodb-terraform-state-lock" {
  name         = "terraform-state-lock-dynamodb"
  hash_key     = "LockID"
  billing_mode = "PAY_PER_REQUEST"

  server_side_encryption {
    enabled     = true
    kms_key_arn = module.backend.tf_kms_key_alias.arn
  }

  attribute {
    name = "LockID"
    type = "S"
  }

  tags = merge(
    var.common_tags,
    { "Name" = "DynamoDB Terraform State Lock Table" },
  )

  lifecycle {
    ignore_changes = [server_side_encryption[0].kms_key_arn]
  }
}

# Role for Data & Analytics CRM team which should access spotify/partnermails/ in Delphi production buckets
# and their production bucket.
module "assume_delphi_prod_data_and_analytics_crm_team_role_policy_document" {
  source = "../../../../modules/iam/policies/assume_role_policy_document"
  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/data_and_analytics_crm_team_role", [module.aws_accounts_list.accounts["gdb-delphi-prod"]]),
  )
}

resource "aws_iam_policy" "assume_delphi_prod_data_and_analytics_crm_team_role_policy" {
  name        = "${var.name_prefix}-assume_delphi_prod_data_and_analytics_crm_team_role"
  path        = "/"
  description = "Allows assuming data_and_analytics_crm_team_role role in Delphi prod account."
  policy      = module.assume_delphi_prod_data_and_analytics_crm_team_role_policy_document.policy_json
}

module "data-and-analytics-crm-team-users" {
  source = "../../../../modules/iam/groups/users_group"
  name   = "data-and-analytics-crm-team-users"
  policies_list = [
    aws_iam_policy.assume_delphi_prod_data_and_analytics_crm_team_role_policy.arn,
    aws_iam_policy.assume_delphi_dev_data_and_analytics_crm_team_role_policy.arn,
    aws_iam_policy.read_only.arn,
    aws_iam_policy.self_credentials_management.arn,
  ]
}

# Role for Data & Analytics CRM team in dev for their own bucket.
module "assume_delphi_dev_data_and_analytics_crm_team_role_policy_document" {
  source = "../../../../modules/iam/policies/assume_role_policy_document"
  resources_list = concat(
    formatlist("arn:aws:iam::%s:role/dev_data_and_analytics_crm_team_role", [module.aws_accounts_list.accounts["gdb-delphi-dev"]]),
  )
}

resource "aws_iam_policy" "assume_delphi_dev_data_and_analytics_crm_team_role_policy" {
  name        = "${var.name_prefix}-assume_delphi_dev_data_and_analytics_crm_team_role"
  path        = "/"
  description = "Allows assuming data_and_analytics_crm_team_role role in Delphi prod account."
  policy      = module.assume_delphi_dev_data_and_analytics_crm_team_role_policy_document.policy_json
}

module "datatheoreme_security_audit_role" {
  source      = "../../../../modules/iam/roles/datatheoreme_security_audit"
  externam_id = var.datatheorem_externam_id
  common_tags = var.common_tags
}

module "admin_users" {
  source    = "../../../../modules/iam/aws_users"
  iam_users = var.admin_users
}

module "ecs_stopped_task_events" {
  source = "../../../../modules/ecs_task_events_logging"
}