resource "opensearch_role" "index_manager_role" {
  role_name   = "index_manager_role"
  description = "Index Manager role for IAM based users."

  cluster_permissions = [
    "cluster_all",
    # explicitly grant these as they seem to be missing after granting cluster_all.
    "indices:data/read/scroll",
    "indices:data/read/search",
    "indices:data/write/bulk",
    "indices:data/write/reindex",
    "indices:admin/template/get",
    ]

  index_permissions {
    index_patterns  = ["*"]
    allowed_actions = ["indices_all"]
  }

  tenant_permissions {
    tenant_patterns = ["global_tenant"]
    allowed_actions = ["kibana_all_write"]
  }

}

resource "opensearch_roles_mapping" "index_manager_role_mapping" {
  role_name   = resource.opensearch_role.index_manager_role.role_name
  description = "Give for reindex acces."
  users = [
    "arn:aws:iam::437795906767:user/jdiaz",
  ]
}