resource "kubernetes_config_map" "aws-auth" {
  data = {
    "mapRoles" = jsonencode([
      {
        rolearn  = "arn:aws:iam::554998489284:role/ampp-EKS-worker-node-Role"
        username = "system:node:{{EC2PrivateDNSName}}"
        groups   = ["system:bootstrappers", "system:nodes"]
      },
      {
        rolearn  = "arn:aws:iam::476717493283:user/ccshr-eks-admin"
        username = "EKSAdmin"
        groups   = ["system:masters"]
      },
      {
        rolearn  = "arn:aws:iam::554998489284:role/ReadOnlyExtern"
        username = "infosec-ro"
        groups   = ["eks-readonly"]
      },
      {
        rolearn  = "arn:aws:iam::554998489284:role/ampp-amp-eks-developer"
        username = "dev-ro"
        groups   = ["system:masters"]
      },
      {
        rolearn  = "arn:aws:iam::554998489284:role/ampp-github-actions-role"
        username = "dev-ro"
        groups   = ["system:masters"]
      },
      {
        rolearn  = "arn:aws:iam::554998489284:role/cross-account-atlantis-role"
        username = "atlantis"
        groups   = ["system:masters"]
      },
      {
        rolearn  = "arn:aws:iam::086679231553:role/cross-account-atlantis-role"
        username = "atlantis"
        groups   = ["system:masters"]
      },
      {
        rolearn  = "arn:aws:iam::554998489284:role/EKSFargatePodExecutionRole"
        username = "system:node:{{SessionName}}"
        groups   = ["system:bootstrappers", "system:nodes", "system:node-proxier"]
      }
    ])

    "mapUsers" = jsonencode([
      {
        userarn  = "arn:aws:iam::476717493283:user/clshrd-jenkins"
        username = "clshrd-jenkins"
        groups   = ["system:masters"]
      },
      {
        userarn  = "arn:aws:iam::554998489284:user/ampp-jenkins"
        username = "jenkins"
        groups   = ["system:masters"]
      }
    ])
  }

  metadata {
    name      = "aws-auth"
    namespace = "kube-system"
  }

  lifecycle {
    ignore_changes = [data["mapRoles"], data["mapUsers"]]
  }
}