data "aws_iam_policy_document" "tdms_policy_document" {
  statement {
    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
    resources = ["*"]
  }

  statement {
    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy"
    ]

    resources = [
      "arn:aws:iam::*:role/DeepSecurity"
    ]
  }
}

resource "aws_iam_policy" "tdms_policy" {
  name        = "DeepSecurity"
  description = "Trend Micro Deep Security policy"
  policy      = data.aws_iam_policy_document.tdms_policy_document.json
}

resource "aws_iam_role" "tdms_role" {
  name               = "DeepSecurity"
  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::147995105371:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "5A18A657-3216-B30E-4879-4403F379A09D"
        }
      }
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "tdms_role_policy" {
  policy_arn = aws_iam_policy.tdms_policy.arn
  role       = aws_iam_role.tdms_role.id
}