# Scheduler Jenkins.

# Role.
data "aws_iam_role" "scheduler" {
  name = local.scheduler_role_name
}

# AssumeRole access.
resource "aws_iam_policy" "scheduler_assume_role_policy" {
  name   = "STS-${local.scheduler_role_name}-AssumeRole-policy"
  policy = data.aws_iam_policy_document.scheduler_assume_role_policy.json

  tags = {
    environment        = var.environment
    service_name       = var.scheduler_service_name
    application_family = var.application_family
  }
}

data "aws_iam_policy_document" "scheduler_assume_role_policy" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    resources = concat(
      var.scheduler_roles_to_assume,

      # Allow role to assume itself to facilitate consistency between intra-account and inter-account operations
      [data.aws_iam_role.scheduler.arn]
    )
  }
}

resource "aws_iam_role_policy_attachment" "scheduler_assume_role_policy_attachment" {
  role       = data.aws_iam_role.scheduler.id
  policy_arn = aws_iam_policy.scheduler_assume_role_policy.arn
}