provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/iam/groups/trusted-advisor/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "aws_accounts_map" {
  source = "git@github.com:theorchard/terraform-aws-accounts-map.git?ref=1.2.0"
}

data "aws_iam_policy" "trusted_advisor_attachment_policy" {
  arn = "arn:aws:iam::${module.aws_accounts_map.orcd_accounts["orcd-prod"]}:policy/orchard-trusted-advisor-access-policy"
}

resource "aws_iam_group_policy_attachment" "trusted_advisor_attachment_policy_attachment" {
  group      = module.group_with_attachments.iam_group_name
  policy_arn = data.aws_iam_policy.trusted_advisor_attachment_policy.arn
}

module "group_with_attachments" {
  source = "git@github.com:theorchard/terraform-iam-policies.git//modules/groups?ref=1.5.5"

  group_name = "trusted-advisor"
  users = [
    "amccown",
  ]
  application_families_to_access = []
  iam_roles_to_access            = formatlist("arn:aws:iam::%s:role/trusted-advisor-role", values(module.aws_accounts_map["all_accounts"]))
}