resource "postgresql_role" "pd_etldb_admin" {
  name            = "pd_etldb_admin"
  login           = true
  create_database = true
  create_role     = true

  roles = [
    "rds_superuser",
    postgresql_role.pd_etldb_owner.name
  ]
}

resource "postgresql_role" "pd_etldb_owner" {
  name            = "pd_etldb_owner"
  login           = true
  create_database = true
  create_role     = false

  roles = [
    postgresql_role.pd_etldb_reader.name,
    postgresql_role.pd_etldb_user.name,
  ]
}

resource "postgresql_role" "pd_etldb_user" {
  name  = "pd_etldb_user"
  login = true
}

resource "postgresql_role" "pd_etldb_user_iam" {
  name  = "pd_etldb_user_iam"
  login = true

  roles = [
    "rds_iam",
    postgresql_role.pd_etldb_user.name,
  ]
}

resource "postgresql_role" "pd_etldb_reader" {
  name  = "pd_etldb_reader"
  login = true
}

resource "postgresql_role" "pd_etldb_reader_iam" {
  name  = "pd_etldb_reader_iam"
  login = true

  roles = [
    "rds_iam",
    postgresql_role.pd_etldb_reader.name,
  ]
}

resource "postgresql_role" "reader" {
  for_each = toset(var.readers)
  name  = each.value
  login = true

  roles = [
    postgresql_role.pd_etldb_reader.name,
  ]
}