# Allow services to assume role for cross-account AWS access to Switchboard
data "aws_iam_policy_document" "cross_account_assume_role_policy" {
  statement {
    actions = [
      "sts:AssumeRole",
    ]

    resources = [var.swb_role_arn]
  }
}

resource "aws_iam_policy" "cross_account_assume_role_policy" {
  name   = "${var.environment}-switchboard-cross-account-assume-role-policy"
  policy = data.aws_iam_policy_document.cross_account_assume_role_policy.json
}