variable "aws_region" {
  description = "AWS region."
  type        = string
  default     = "us-east-1"
}

variable "environment" {
  description = "Available values: dev, qa, prod."
  type        = string
  default     = "prod"
}

variable "service_name" {
  description = "Service name for resources."
  type        = string
  default     = "rds-refresh"
}

variable "application_family" {
  description = "Application family to which this project belongs."
  type        = string
  default     = "devops"
}

variable "trusted_principals" {
  description = "List of IAM users or roles which can assume the RDS backup role."
  type        = list(string)
  default = [
    "arn:aws:iam::086679231553:role/lambda-shared-lambda-rds-refresh-delete-intermediate-snapshots",
    "arn:aws:iam::086679231553:role/lambda-shared-lambda-rds-refresh-get-db-info",
    "arn:aws:iam::086679231553:role/shared-rds-refresh-create-shareable-snapshot-task-role",
    "arn:aws:iam::086679231553:role/shared-rds-refresh-sfn-role",
  ]
}

variable "role_session_duration" {
  description = "Session duration in seconds for the backup role."
  type        = number
  default     = 3600
}

variable "external_restore_accounts" {
  description = "External accounts that RDS backups can be restored to."
  type        = list(string)
  default     = ["103233932089"]
}

variable "external_ids" {
  description = "External IDs for the trust policy."
  type        = list(string)
  default     = [
    "QNUoYXgqXSvhyCN7BzaxJM8fEL313SNz",
    "arn:aws:states:us-east-1:086679231553:stateMachine:shared-rds-refresh-state-machine"
  ]
}

locals {
  tags = {
    environment        = var.environment
    application_family = var.application_family
    project            = var.service_name
    terraformed        = true
  }
  restore_accounts              = concat([data.aws_caller_identity.current.account_id], var.external_restore_accounts)
  external_restore_account_arns = [for account in var.external_restore_accounts : "arn:aws:iam::${account}:root"]
}