module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/iam/groups/coda/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "group_with_attachments" {
  source = "git@github.com:theorchard/terraform-iam-policies.git//modules/groups?ref=1.18.0"

  group_name = "coda"
  users = sort([
    "jraysor",
    "mrojas",
  ])
  application_families_to_access = [
    "coda",
  ]
}

# Attach ows-coda secrets access and RDS password rotation policies.
# These policies are created in prod/ows-coda/iam.tf but need a group
# to be attached to. The generic-orchard-prod-engineering-group has hit
# the AWS 10-policy limit, so this dedicated group is used instead.

data "aws_iam_policy" "engineering_secrets_access" {
  name = "prod-ows-coda-engineering-secrets-access"
}

resource "aws_iam_group_policy_attachment" "engineering_secrets_access" {
  group      = module.group_with_attachments.iam_group_name
  policy_arn = data.aws_iam_policy.engineering_secrets_access.arn
}

data "aws_iam_policy" "rds_master_password_rotation" {
  name = "prod-ows-coda-rds-master-password-rotation"
}

resource "aws_iam_group_policy_attachment" "rds_master_password_rotation" {
  group      = module.group_with_attachments.iam_group_name
  policy_arn = data.aws_iam_policy.rds_master_password_rotation.arn
}