# Jenkins on-prem osx agent will use this iam user.
resource "aws_iam_user" "mobile_user" {
  name = "${var.environment}-${var.service_name}-user"
  tags = {
    terraformed        = true
    application_family = var.application_family
    role               = "service-user"
  }
}

# Attach mobile s3 policy to prod-orcd-mobile iam user.
resource "aws_iam_user_policy_attachment" "jenkins_mobile_deploy_role_policy_attachment" {
  user       = aws_iam_user.mobile_user.name
  policy_arn = aws_iam_policy.s3_read_write_policy.arn
}

# Purpose-specific group for mobile S3 users. Permission requirements are too narrow
# to grant access to entire application_family
resource "aws_iam_group" "mobile_s3_read_users" {
  name = "${var.environment}-mobile-s3-read-users"
}

resource "aws_iam_group_membership" "mobile_s3_read_users_membership" {
  name = "${var.environment}-mobile-s3-read-users-membership"

  users = [
    "tkharitonova",
  ]

  group = aws_iam_group.mobile_s3_read_users.name
}

resource "aws_iam_group_policy_attachment" "mobile_s3_read_users_iam_policy_attachment" {
  group      = aws_iam_group.mobile_s3_read_users.name
  policy_arn = module.mobile_binaries_s3_bucket.s3_read_only_policy_arn_output
}