resource "aws_iam_role" "this" {
  name        = "${var.name_prefix}_user_role"
  description = "AWS Transfer server user role"

  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
        "Effect": "Allow",
        "Principal": {
            "Service": "transfer.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
        }
    ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "this" {
  for_each   = var.role_policy_attachments
  role       = aws_iam_role.this.id
  policy_arn = each.value
}

resource "aws_transfer_user" "this" {
  server_id      = var.server_id
  user_name      = var.user_name
  role           = aws_iam_role.this.arn
  home_directory = var.home_directory

  tags = var.tags
}

resource "aws_transfer_ssh_key" "this" {
  count     = length(var.public_keys)
  body      = var.public_keys[count.index]
  server_id = var.server_id
  user_name = aws_transfer_user.this.user_name
}