provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "backup-orcd-terraform-state"
    key     = "backup/ecr/replication/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

resource "aws_ecr_registry_policy" "replication" {
  policy = data.aws_iam_policy_document.replication_policy.json 
}

data "aws_iam_policy_document" "replication_policy" {
  statement {
    actions = [
      "ecr:ReplicateImage",
      "ecr:CreateRepository"
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::${var.shared_account_id}:root"
      ]
    }

    resources = ["arn:aws:ecr:${var.aws_region}:${data.aws_caller_identity.current.account_id}:repository/*"]
  }
}