# Opensearch Internal Users
import {
  to = opensearch_user.pp_readonly
  id = var.generic_readonly_user
}

resource "opensearch_user" "pp_readonly" {
  username = var.generic_readonly_user
  # Imported users don't include the password_hash attribute, it can be added for a password reset
  backend_roles = [
    "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.environment}-cross-account-opensearch-role",
  ]
}

import {
  to = opensearch_user.kc_es_sink_pdelabel
  id = var.kc_os_sink_user
}

resource "opensearch_user" "kc_es_sink_pdelabel" {
  username = var.kc_os_sink_user
  # Imported users don't include the password_hash attribute, it can be added for a password reset
  backend_roles = [""]
}


# Users to import to then be deleted / not used
import {
    to = opensearch_user.tf_user_role
    id = "tf-user-role"
}

resource "opensearch_user" "tf_user_role" {
    # This user is used by the Terraform provider, but we can change this to only use
    # a Backend Role (IAM role) mapped to the all_access and security_manager internal roles
    # This user will be deleted.
    username     = "tf-user-role"
    # Imported users don't include the password_hash attribute, it can be added for a password reset
    backend_roles = [
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/prod-pp-es-index-role"
    ]
}

import {
    to = opensearch_user.uuid_user
    id = "f9e99cb6-bf9b-f140-c6b4-63ae59fbaad5"
}

resource "opensearch_user" "uuid_user" {
    # User is not used anywhere, will be deleted
    username = "f9e99cb6-bf9b-f140-c6b4-63ae59fbaad5"
    # Imported users don't include the password_hash attribute, it can be added for a password reset
}