module "revoke_keys_role" {
  source      = "../../../modules/iam/roles/lambda_role"
  name_prefix = local.name_prefix
  name        = "revoke_keys_role"
  common_tags = local.common_tags
  policies_list = [
    aws_iam_policy.revoke_keys_role_policy.arn,
  ]
}

resource "aws_iam_policy" "revoke_keys_role_policy" {
  name        = "${local.name_prefix}-revokekeysrolepolicy"
  description = "Added ability to list users, groups and access keys, and also ability to revoke and delete access keys."
  policy      = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "iam:DeleteAccessKey",
        "iam:GetAccessKeyLastUsed",
        "iam:UpdateAccessKey",
        "iam:ListUsers",
        "iam:ListGroups",
        "iam:GetGroup",
        "iam:ListAccessKeys"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
EOF
}