import {
    to = opensearch_role.default_role
    id = "default_role"
}

# Default role for allowing IAM users on the application_family to access Dashboards and more
resource "opensearch_role" "default_role" {
  role_name   = "default_role"
  description = "Default role for all IAM based users."

  cluster_permissions = ["*"]

  index_permissions {
    index_patterns  = ["*"]
    allowed_actions = ["*"]
  }

  tenant_permissions {
    tenant_patterns = ["global_tenant"]
    allowed_actions = ["kibana_all_write"]
  }

}

resource "opensearch_roles_mapping" "default_role_mapping" {
  role_name   = resource.opensearch_role.default_role.role_name
  description = "Give all users default_role."
  users = [
    "*",
    "arn:aws:iam::437795906767:user/jbertran",
    "arn:aws:iam::437795906767:user/rshield",
    "arn:aws:iam::437795906767:user/nlittmann",
    "arn:aws:iam::437795906767:user/yostapyuk",
    "arn:aws:iam::437795906767:user/amontoya",
  ]
}