variable "aws_region" {
  type    = string
  default = "us-east-1"
}

variable "environment" {
  type = string
}

variable "service_name" {
  type        = string
  description = "The name of the service. The combination of this and environment must be unique across all Atlantis instances."
  default     = "shared-atlantis"
}

variable "application_family" {
  type    = string
  default = "devops"
}

variable "atlantis_role_name" {
  type    = string
  default = "cross-account-atlantis-role"
}

variable "identifiers" {
  type    = list(string)
  default = ["arn:aws:iam::086679231553:role/shared-atlantis-task-role"]
}

variable "infra_core_identifiers" {
  type        = list(string)
  description = "List of ARNs allowed to assume the infra-core role. Includes both old and new Atlantis task roles for backwards compatibility."
  default = [
    "arn:aws:iam::086679231553:role/shared-atlantis-task-role",
    "arn:aws:iam::086679231553:role/shared-atlantis-core-task-role"
  ]
}

variable "terrastate_bucket" {
  description = "The name of the terraform state bucket"
}

variable "lambda_function_arns_to_invoke" {
  type        = list(string)
  description = <<EOT
List of lambda function arns for which to allow Atlantis to lambda:InvokeFunction.
An example reason to grant this if Atlantis needs the ability to use the
lambda function for configuring a Secrets Manager Secret Rotation.

Do not include wildcards; this module will take care of it.
  EOT
  default     = []
}

variable "external_id" {
  type        = string
  description = "The external ID to use when assuming roles in other accounts"
  default     = "KCHmf0h0hm5kUzqqLJ4SfA4HzhXXySA8"
}

variable "iam_policy_tags" {
  type = object({
    terrastate_policy           = optional(map(string), {})
    secrets_read_policy         = optional(map(string), {})
    apply_policy_part_one       = optional(map(string), {})
    apply_policy_part_two       = optional(map(string), {})
    tf_infra_core_apply_policy  = optional(map(string), {})
    kms_delete_policy           = optional(map(string), {})
    kms_reencrypt_policy        = optional(map(string), {})
    invoke_lambdas_policy       = optional(map(string), {})
  })
  description = "Tags to apply to each IAM policy resource. Each key corresponds to a policy name."
  default     = {}
}

locals {
  tags = {
    environment        = var.environment
    application_family = var.application_family
    terraformed        = true
  }

  wildcard_lambda_function_arns_to_invoke = [
    for arn in var.lambda_function_arns_to_invoke : "${arn}:*"
  ]

  lambda_function_arns_to_invoke = concat(
    var.lambda_function_arns_to_invoke,
    local.wildcard_lambda_function_arns_to_invoke,
  )
}