data "aws_iam_policy_document" "datatheorem_apigw" {
  version = "2012-10-17"
  statement {
    sid    = "APIGatewayAllowGet"
    effect = "Allow"
    actions = [
      "apigateway:GET"
    ]
    resources = [
      "*"
    ]
  }
}

resource "aws_iam_policy" "datatheorem_apigw" {
  name        = "DataTheorem-APIGateway-SecurityAudit"
  path        = "/"
  description = "Allows Read access to ApiGateway."
  policy      = data.aws_iam_policy_document.datatheorem_apigw.json
}

module "datatheorem_role" {
  source             = "../client_role"
  name               = var.name
  client_account_id  = var.aws_account_id
  client_iam_entity  = "root"
  client_external_id = var.externam_id
  common_tags = merge(
    var.common_tags,
    {
      project = "DataTheorem",
      service = "IAM",
    }
  )
  policies_list = [
    aws_iam_policy.datatheorem_apigw.arn,
    "arn:aws:iam::aws:policy/SecurityAudit"
  ]
}