variable "role_name" {
  type        = string
  description = "Name of IAM role"
}

variable "application_families_to_access" {
  type        = list(string)
  description = "List of application families to which this role will receive access"
  default     = []
}

variable "additional_policies_to_attach" {
  type        = set(string)
  description = "A set of additional policy names to attach in addition to the application-family specific policies"
  default = [
    "orchard-shared-engineering-read-policy",
    "orchard-shared-engineering-iam-access-policy",
  ]
}

variable "assume_role_principals" {
  type        = list(string)
  description = "The list of principals which will be allowed to assume this role (provided the principal also has an IAM policy which allows the action)"
  default = [
    "arn:aws:iam::437795906767:root",
  ]
}

variable "iam_roles_to_access" {
  type        = list(string)
  description = "List of IAM role ARNs to grant this role assume access to."
  default     = null
}

variable "max_session_duration" {
  type        = number
  description = "The max role session duration in seconds"
  default     = 43200
}

locals {
  abac_policies_to_attach = [
    for policy_combination in setproduct(var.application_families_to_access, ["part-1", "part-2", ]) : {
      policy_name = "ABAC-${policy_combination[0]}-tag-access-policy-${policy_combination[1]}"
    }
  ]
  rbac_policies_to_attach = [
    for policy_combination in setproduct(var.application_families_to_access, ["part-1", ]) : {
      policy_name = "RBAC-${policy_combination[0]}-resource-access-policy-${policy_combination[1]}"
    }
  ]
}