resource "aws_dsql_cluster" "main" {
  deletion_protection_enabled = false
  force_destroy               = true

  tags = {
    Name = "${var.environment}-${var.service_name}"
  }
}

locals {
  dsql_endpoint           = "${aws_dsql_cluster.main.identifier}.dsql.${var.aws_region}.on.aws"
  dsql_token_expires_in_s = 900
}

data "aws_iam_policy_document" "dsql_admin" {
  statement {
    sid       = "DsqlDbConnectAdmin"
    actions   = ["dsql:DbConnectAdmin"]
    resources = [aws_dsql_cluster.main.arn]
  }
}

resource "aws_iam_policy" "dsql_admin" {
  name        = "DSQL-${var.environment}-${var.service_name}-admin"
  description = "DbConnectAdmin access to the ${var.environment} resonance-engine DSQL cluster"
  policy      = data.aws_iam_policy_document.dsql_admin.json
}