# Role will be changed after databricks migration
module "databricks_role" {
  source = "../../../modules/iam/roles/cross_account_role"
  name   = "${local.name_prefix}-databricks_role"

  max_session_duration = 43200
  common_tags = merge(
    local.common_tags,
    {
      service                  = "Databricks",
      plat_env_project_service = "${local.aggregated_tag}_DBX"
    }
  )
  principal_list = [
    "arn:aws:iam::${module.aws_accounts_list.accounts.gdb-delphi-dev}:root",
    "arn:aws:iam::${module.aws_accounts_list.accounts.gdb-databricks-dev}:role/dev-databricks-instance",
    "arn:aws:iam::${module.aws_accounts_list.accounts.gdb-databricks-dev}:role/cross_account_developer",
    "arn:aws:iam::${module.aws_accounts_list.accounts.gdb-delphi-dev}:role/cross_account_developer",
  ]
  policies_list = [
    module.iam_map.s3_sme_data_rw.arn,
    module.iam_map.s3_env_rw.arn,
    data.aws_iam_policy.secrets-services-ro.arn,
    module.iam_map.sf_worker.arn,
    module.iam_map.es_rw.arn,
    module.iam_map.ses_sender.arn,
  ]
}