locals {
  node_data = merge({
    run_list = [
      "role[${var.chef_role}]"
    ]
  }, var.node_attributes)
}

data "aws_iam_policy_document" "download-chef-keys" {
  statement {
    effect    = "Allow"
    actions   = ["s3:ListBucket"]
    resources = ["arn:aws:s3:::${var.s3_chef_bucket}"]
  }

  statement {
    effect    = "Allow"
    actions   = ["s3:GetObject"]
    resources = ["arn:aws:s3:::${var.s3_chef_bucket}/*"]
  }
}

resource "aws_iam_policy" "download-chef-keys" {
  name_prefix = "download-chef-keys"
  policy      = data.aws_iam_policy_document.download-chef-keys.json
}

resource "aws_iam_policy_attachment" "dl_chef_keys_attachement" {
  name       = "download-chef-keys-attachment"
  roles      = [var.aws_iam_role_id]
  policy_arn = aws_iam_policy.download-chef-keys.arn
}