# Default role for allowing IAM users on the application_family to access Dashboards and more
resource "opensearch_role" "default_role" {
  role_name   = "default_role"
  description = "Default role for all IAM based users."

  cluster_permissions = ["*"]

  index_permissions {
    index_patterns  = ["*"]
    allowed_actions = ["*"]
  }

  tenant_permissions {
    tenant_patterns = ["global_tenant"]
    allowed_actions = ["kibana_all_write"]
  }
}


resource "opensearch_roles_mapping" "default_role_mapping" {
  role_name   = resource.opensearch_role.default_role.role_name
  description = "Give all users default_role."
  users = [
    "*"
  ]
}