data "aws_iam_policy_document" "cost_explore_ro_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "ce:DescribeCostCategoryDefinition",
      "ce:GetRightsizingRecommendation",
      "ce:GetCostAndUsage",
      "ce:GetSavingsPlansUtilization",
      "ce:GetReservationPurchaseRecommendation",
      "ce:ListCostCategoryDefinitions",
      "ce:GetCostForecast",
      "ce:GetReservationUtilization",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetDimensionValues",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetCostAndUsageWithResources",
      "ce:GetReservationCoverage",
      "ce:GetSavingsPlansCoverage",
      "ce:GetTags",
      "ce:GetUsageForecast",
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "cost_explore_ro_policy" {
  name        = "cost-explore-ro"
  description = "The policy for Cloud compliance tool."
  policy      = data.aws_iam_policy_document.cost_explore_ro_policy_document.json
}

data "aws_iam_policy" "read_only_access" {
  name = "ReadOnlyAccess"
}

data "aws_iam_policy_document" "cross_account_assume_role_policy" {

  statement {
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::943540511943:role/ReadOnlyInfoSec"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "cross_account_infosec_ro_role" {
  name               = "cross_account_infosec_ro_role"
  description        = "cross-account InfoSec RO role"
  assume_role_policy = data.aws_iam_policy_document.cross_account_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "cross_account_infosec_ro_role_ro_policy" {
  policy_arn = data.aws_iam_policy.read_only_access.arn
  role       = aws_iam_role.cross_account_infosec_ro_role.name
}

resource "aws_iam_role_policy_attachment" "cross_account_infosec_ro_role_cost_explorer_ro" {
  policy_arn = aws_iam_policy.cost_explore_ro_policy.arn
  role       = aws_iam_role.cross_account_infosec_ro_role.name
}