data "aws_iam_group" "sony_infosec_auditors" {
  group_name = "sony-gsirt"
}

# AssumeRole from aws prod account to other aws accounts.
data "aws_iam_policy_document" "sony_infosec_auditors_sts_assume_role_policy_document" {
    statement {
        sid       = "AllowAssumeRole"
        effect    = "Allow"
        actions   = ["sts:AssumeRole"]
        resources = [
          "arn:aws:iam::086679231553:role/sony-infosec-auditors",
          "arn:aws:iam::591204808501:role/sony-infosec-auditors",
          "arn:aws:iam::031099521156:role/sony-infosec-auditors",
          "arn:aws:iam::989790945997:role/sony-infosec-auditors",
          "arn:aws:iam::375914681009:role/sony-infosec-auditors",
          "arn:aws:iam::285943604611:role/sony-infosec-auditors",
          "arn:aws:iam::737325105821:role/sony-infosec-auditors",
          "arn:aws:iam::619719722105:role/sony-infosec-auditors",
          "arn:aws:iam::926734670777:role/sony-infosec-auditors",
        ]
    }
}

resource "aws_iam_policy" "sony_infosec_auditors_sts_assume_role_policy" {
  name        = "sony-infosec-auditors-sts-assume-role-policy"
  description = "sony-infosec-auditors-sts-assume-role-policy"
  policy      = data.aws_iam_policy_document.sony_infosec_auditors_sts_assume_role_policy_document.json
}

resource "aws_iam_group_policy_attachment" "sony_infosec_auditors_sts_assume_role_policy_attachment" {
  group      = data.aws_iam_group.sony_infosec_auditors.group_name
  policy_arn = aws_iam_policy.sony_infosec_auditors_sts_assume_role_policy.arn
}