terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/datadog/engineering-role/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

# Grantable (non-restricted) Datadog permissions, as name -> id.
data "datadog_permissions" "all" {}

locals {
  # Resolve allowlist names to IDs; unknown names are dropped (see unresolved_permissions output).
  resolved_permissions = {
    for name in local.granted_permissions :
    name => data.datadog_permissions.all.permissions[name]
    if contains(keys(data.datadog_permissions.all.permissions), name)
  }
}

resource "datadog_role" "engineering" {
  name = var.role_name

  # Keeps default/restricted read permissions; only grantable ones are added.
  dynamic "permission" {
    for_each = local.resolved_permissions
    content {
      id = permission.value
    }
  }
}