# Provider determines the method (AWS) and some basic provider properties
module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
}

provider "aws" {
  region = var.region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.region
  alias   = "dev"
  profile = "dev"

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations - of the form ${var.environment}-${var.service_name}-state
terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/rds-backup/terraform.tfstate"
    region  = "us-east-1"
    encrypt = true
  }
}

data "aws_caller_identity" "current" {}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=1.4.0"

  environment = var.environment
}

# Multiple lambdas will need this policy in order to assume backup role in one or many accounts
data "aws_iam_policy_document" "assume_cross_account_backup_role_policy_document" {
  statement {
    actions = [
      "sts:AssumeRole",
    ]

    resources = [
      for backup_target in var.account_ids_to_back_up :
      "arn:aws:iam::${backup_target["account_id"]}:role/${var.cross_account_backup_role_name}"
    ]
  }
}

resource "aws_iam_policy" "assume_cross_account_backup_role_policy" {
  name        = "STS-${var.environment}-${var.service_name}-assume-cross-account-backup-role-policy"
  description = "STS-${var.environment}-${var.service_name}-assume-cross-account-backup-role-policy"
  policy      = data.aws_iam_policy_document.assume_cross_account_backup_role_policy_document.json
}