# user for config/aws.yml keys.
resource "aws_iam_user" "vector_encoder" {
  name = "${var.environment}-${var.service_name}"
  tags = {
    terraformed        = true
    application_family = var.application_family
    role               = "service-user"
  }
}

# Attach some pre-existing policies
data "aws_iam_policy" "pre_existing_policies" {
  for_each = toset(local.pre_existing_policy_names)
  name     = each.value
}

# Attach IAM policies to IAM user
resource "aws_iam_user_policy_attachment" "iam_user_policy_attachment" {
  for_each   = data.aws_iam_policy.pre_existing_policies
  user       = aws_iam_user.vector_encoder.name
  policy_arn = each.value.arn
}

# Attach IAM policies to IAM user
resource "aws_iam_user_policy_attachment" "iam_user_ows_request_policy_attachment" {
  user       = aws_iam_user.vector_encoder.name
  policy_arn = module.vector_encoder_service_owsrequest.policy_arn_output
}

data "aws_iam_group" "vector_group" {
  group_name = "${var.environment}-vector-group"
}

resource "aws_iam_user_group_membership" "vector_encoder_group_membership" {
  user = aws_iam_user.vector_encoder.name
  groups = [
    data.aws_iam_group.vector_group.group_name,
  ]
}