# Trust policy document for cross-account access with external ID
data "aws_iam_policy_document" "readonly-cross-account-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::968898580625:root"]
    }

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["17e60953-fb1d-4342-93b8-8d27d9cc1ef6"]
    }
  }
}

# IAM Role with cross-account access and external ID requirement
resource "aws_iam_role" "readonly-cross-account-role" {
  assume_role_policy    = data.aws_iam_policy_document.readonly-cross-account-role-trust-policy.json
  description           = "Cross-account role with ReadOnlyAccess for external AWS account"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess"
  ]
  max_session_duration = var.session_duration
  name                 = "readonly-cross-account-role"
  path                 = var.path
}