data "aws_iam_policy_document" "admin_user_mfa" {
  count = var.require_mfa ? 1 : 0

  statement {
    sid = "AllowEverything"

    effect = "Allow"

    actions = [
      "*",
    ]

    resources = [
      "*",
    ]

    condition {
      test     = "BoolIfExists"
      variable = "aws:MultiFactorAuthPresent"

      values = [
        true
      ]
    }
  }
}

data "aws_iam_policy_document" "admin_user" {
  count = var.require_mfa ? 0 : 1

  statement {
    sid = "AllowEverything"

    effect = "Allow"

    actions = [
      "*",
    ]

    resources = [
      "*",
    ]
  }
}