data "aws_iam_policy_document" "assume_shared_atlantis_cross_account_access" {
  statement {
    sid     = "AllowAssumeRole"
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    resources = [
      "arn:aws:iam::*:role/cross-account-atlantis-role",
      "arn:aws:iam::*:role/cross-account-atlantis-tf-infra-core-role"
    ]
  }
}

resource "aws_iam_policy" "assume_shared_atlantis_cross_account_access" {
  name        = "${var.environment}-${var.service_name}-cross-account-access"
  description = "Allows assume shared atlantis cross-account roles."
  policy      = data.aws_iam_policy_document.assume_shared_atlantis_cross_account_access.json
}

module "cross_account_access" {
  source            = "git@github.com:theorchard/terraform-atlantis.git//modules?ref=3.4.52"
  environment       = "shared"
  terrastate_bucket = "shared-orcd-terraform-state"
}