data "aws_iam_policy_document" "ecr_list_read_tag" {
  version = "2012-10-17"
  statement {
    sid    = "ListReadTagECR"
    effect = "Allow"
    actions = [
      "ecr:PutImageTagMutability",
      "ecr:UntagResource",
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:DescribeImages",
      "ecr:TagResource",
      "ecr:GetAuthorizationToken",
      "ecr:DescribeRepositories",
      "ecr:ListTagsForResource",
      "ecr:ListImages",
      "ecr:BatchCheckLayerAvailability"
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "ecr_list_read_tag" {
  name        = "${local.name_prefix}-ecr_list_read_tag"
  description = "List, read, and tag actions for all ECRs"
  policy      = data.aws_iam_policy_document.ecr_list_read_tag.json
}

module "octopus_server_role" {
  source      = "../../../modules/iam/roles/ec2_instance_role"
  name_prefix = local.name_prefix
  name        = "octopus-server-role"
  common_tags = local.infra_ec2_tags
  policies_list = [
    aws_iam_policy.ecr_list_read_tag.arn
  ]
}

data "aws_iam_instance_profile" "jenkins_agent" {
  name = "dev-infra-jenkins_ec2_agent_role"
}