provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/iam/users/orchard/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

# Note: it is critically important that these users be added to the generic-orchard-prod-group group
resource "aws_iam_user" "users" {
  for_each = { for user in var.users : user.username => user }

  #checkov:skip=ORCD_AWS_12: False positive (SYS-22585)
  name = each.value.username

  tags = {
    terraformed          = true
    name                 = each.value.name
    email                = each.value.email
    role                 = each.value.role
    company              = each.value.company
    manager              = each.value.manager
    watchdog_enabled     = "always"
    notification_enabled = "always"
  }

  lifecycle {
    ignore_changes = [tags["Deactivated"]]
  }
}

data "aws_iam_group" "generic_orchard_group" {
  group_name = "generic-orchard-prod-group"
}

resource "aws_iam_group_membership" "generic_orchard_group_membership" {
  name  = "generic-orchard-prod-group-membership"
  group = data.aws_iam_group.generic_orchard_group.group_name
  users = [for user in aws_iam_user.users : user.name]
}