variable "group_name" {
  type        = string
  description = "Name of IAM group"
}

variable "users" {
  type        = list(string)
  description = "List of users in this IAM group"
}

variable "application_families_to_access" {
  type        = list(string)
  description = "List of application families to which this group will receive access"
}

variable "iam_roles_to_access" {
  type        = list(string)
  description = "List of IAM role ARNs to grant access to users in this group"
  default     = null
}

variable "rbac_application_families_to_access" {
  type        = list(string)
  description = "List of application families for which RBAC resource-access policies will be looked up and attached. Defaults to empty — RBAC is opt-in."
  default     = []
}

locals {
  abac_policies_to_attach = [
    for policy_combination in setproduct(var.application_families_to_access, ["part-1", "part-2", ]) : {
      policy_name = "ABAC-${policy_combination[0]}-tag-access-policy-${policy_combination[1]}"
    }
  ]
  rbac_policies_to_attach = [
    for policy_combination in setproduct(var.rbac_application_families_to_access, ["part-1", ]) : {
      policy_name = "RBAC-${policy_combination[0]}-resource-access-policy-${policy_combination[1]}"
    }
  ]
}