locals {
  external_id_enabled = var.client_external_id == "" ? [] : ["enabled"]
}

resource "aws_iam_role" "client" {
  name                 = var.name
  description          = "Role for client aws account ${var.client_account_id}"
  max_session_duration = var.max_sessions_duration
  assume_role_policy   = data.aws_iam_policy_document.client_policy.json
  tags                 = var.common_tags
}

data "aws_iam_policy_document" "client_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    sid     = "${var.client_account_id}ClientRole"
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.client_account_id}:${var.client_iam_entity}"]
    }
    dynamic "condition" {
      for_each = local.external_id_enabled
      content {
        test     = "StringEquals"
        variable = "sts:ExternalId"
        values   = [var.client_external_id]
      }
    }
  }
}

resource "aws_iam_role_policy_attachment" "attachments" {
  count      = length(var.policies_list)
  role       = aws_iam_role.client.id
  policy_arn = var.policies_list[count.index]
}