resource "aws_iam_group" "group" {
  name = var.group_name
}

resource "aws_iam_group_membership" "group_membership" {
  name  = "group-membership"
  group = aws_iam_group.group.name
  users = var.users
}

# Get data sources for all application family policies to which this group should have access
data "aws_iam_policy" "application_family_abac_policies" {
  for_each = {
    for policy in local.abac_policies_to_attach : policy.policy_name => policy
  }
  name = each.value.policy_name
}

data "aws_iam_policy" "application_family_rbac_policies" {
  for_each = {
    for policy in local.rbac_policies_to_attach : policy.policy_name => policy
  }
  name = each.value.policy_name
}

# Attach the ABAC and RBAC policies
resource "aws_iam_group_policy_attachment" "abac_policy_attachments" {
  for_each = {
    for policy in local.abac_policies_to_attach : policy.policy_name => policy
  }
  group      = aws_iam_group.group.name
  policy_arn = data.aws_iam_policy.application_family_abac_policies[each.value.policy_name].arn
}

resource "aws_iam_group_policy_attachment" "rbac_policy_attachments" {
  for_each = {
    for policy in local.rbac_policies_to_attach : policy.policy_name => policy
  }
  group      = aws_iam_group.group.name
  policy_arn = data.aws_iam_policy.application_family_rbac_policies[each.value.policy_name].arn
}

data "aws_iam_policy_document" "role_access_policy" {
  count = var.iam_roles_to_access == null ? 0 : 1

  statement {
    actions = [
      "sts:AssumeRole",
    ]

    resources = var.iam_roles_to_access
  }
}

resource "aws_iam_group_policy" "role_access_policy" {
  count = var.iam_roles_to_access == null ? 0 : 1

  name   = "${var.group_name}-role-access-policy"
  group  = aws_iam_group.group.name
  policy = data.aws_iam_policy_document.role_access_policy[0].json
}