variable "region" {
  description = "Default AWS region to use"
  type        = string
  default     = "us-east-1"
}

variable "inactivate" {
  description = "Inactivate tag for IAM users"
  type        = string
  default     = "True"
}

variable "path" {
  description = "Path for IAM users"
  type        = string
  default     = "/"
}

variable "session_duration" {
  description = "Max session duration for IAM Roles"
  type        = number
  default     = 3600
}

variable "account_id" {
  description = "AWS Account Number For orch-switchboard-prod"
  type        = string
  default     = "019963779799"
}

output "account" {
  value = var.account_id
}

variable "cloudops_admin_role_tag" {
  description = "Used to tag an IAM role as CloudOps-owned"
  type        = map(string)

  default = {
    CLOPS_ADM_ROLE = "YES"
  }
}

variable "environment" {
  type    = string
  default = "prod"
}

variable "service_name" {
  type    = string
  default = "orch-switchboard"
}

variable "terrastate_bucket" {
  description = "S3 bucket name for Terraform state (used by Atlantis)"
  type        = string
  default     = "prod-orch-switchboard-terraform-state"
}

variable "lambda_function_arns_to_invoke" {
  type        = list(string)
  description = <<EOT
List of lambda function arns for which to allow Atlantis to lambda:InvokeFunction.
An example reason to grant this if Atlantis needs the ability to use the
lambda function for configuring a Secrets Manager Secret Rotation.

Do not include wildcards; this module will take care of it.
  EOT
  default     = []
}

locals {
  wildcard_lambda_function_arns_to_invoke = [
    for arn in var.lambda_function_arns_to_invoke : "${arn}:*"
  ]

  lambda_function_arns_to_invoke = length(var.lambda_function_arns_to_invoke) > 0 ? concat(
    var.lambda_function_arns_to_invoke,
    local.wildcard_lambda_function_arns_to_invoke,
  ) : ["arn:aws:lambda:*:${var.account_id}:function:*"]
}