data "aws_iam_policy" "administrator_access" {
  arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}

data "aws_iam_policy_document" "admin_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "AWS"
      identifiers = var.admin_principals
    }
    # Enforce use of AWS username for role session name for auditing purposes
    condition {
      test     = "StringLike"
      variable = "sts:RoleSessionName"
      values = [
        "$${aws:username}"
      ]
    }
    # Enforce MFA
    condition {
      test     = "Bool"
      variable = "aws:MultiFactorAuthPresent"
      values = [
        "true",
      ]
    }
  }
}

resource "aws_iam_role" "admin" {
  name                 = "admin"
  assume_role_policy   = data.aws_iam_policy_document.admin_assume_role_policy.json
  max_session_duration = 43200
}

resource "aws_iam_role_policy_attachment" "admin_role_policy_attachment" {
  role       = aws_iam_role.admin.name
  policy_arn = data.aws_iam_policy.administrator_access.arn
}

resource "aws_iam_account_password_policy" "policy" {
  allow_users_to_change_password = true
  max_password_age               = 90
  minimum_password_length        = 16
  password_reuse_prevention      = 24
  require_lowercase_characters   = true
  require_numbers                = true
  require_uppercase_characters   = true
  require_symbols                = true
}