resource "aws_iam_policy" "web_auth_policies" {
  for_each = data.aws_iam_policy_document.web_auth_policies

  name        = "MWAA-${local.environment_name}-airflow-web-auth-policy-for-${each.key}-role"
  description = "MWAA web UI authentication policy for ${local.environment_name} environment's ${each.key} role"
  policy      = each.value.json
  tags        = local.tags
}

data "aws_iam_policy_document" "web_auth_policies" {
  for_each = toset(var.airflow_create_iam_policies_for_roles_web_auth)

  statement {
    effect    = "Allow"
    actions   = ["airflow:CreateWebLoginToken"]
    resources = [format("arn:aws:airflow:%s:%s:role/%s/%s", var.aws_region, data.aws_caller_identity.current.account_id, local.environment_name, each.value)]
  }
}