data "aws_secretsmanager_secret" "this" {
  name = "${var.project_group}/${var.env}/${var.secret_id}"
}

module "iam_secret_policy_doc" {
  source  = "../../../../../modules/iam/policies/secrets_manager/policy_doc_ro_rw"
  secrets = [data.aws_secretsmanager_secret.this.id]
}

resource "aws_iam_policy" "this" {
  name   = "${var.env}-${var.project_group}-${var.policy_name}"
  policy = module.iam_secret_policy_doc.rw_policy.json
}

module "iam_role_this" {
  source            = "../../../../../modules/iam/roles/external_access_role"
  name              = var.role_name
  name_prefix       = "${var.env}-${var.project_group}"
  external_accounts = var.external_accounts
  policies_list = [
    aws_iam_policy.this.arn
  ]
}