# Give permissions to the Atlantis IAM role for creating opensearch indices
data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/cross-account-atlantis-role"
      ]
    }
  }
}
resource "aws_iam_role" "es_index_role" {
  description        = "IAM role for Atlantis to manage ${var.domain_name} indices in ${var.environment} environment"
  name               = "${var.environment}-${var.domain_name}-index-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

# Attach opensearch RW policy to this role
data "aws_iam_policy" "opensearch_default_rw_policy" {
  arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/Elasticsearch-${var.environment}-${var.domain_name}-RW-policy"
}
resource "aws_iam_role_policy_attachment" "opensearch_rw_policy_attach_to_index_role" {
  role       = aws_iam_role.es_index_role.name
  policy_arn = data.aws_iam_policy.opensearch_default_rw_policy.arn
}


# Create all Indexes on this domain.
data "aws_opensearch_domain" "music_graph_domain" {
  domain_name = "${var.environment}-${var.domain_name}"
}

# Set up provider with correct role to assume
provider "opensearch" {
  url                 = "https://${data.aws_opensearch_domain.music_graph_domain.endpoint}"
  healthcheck         = false
  aws_assume_role_arn = aws_iam_role.es_index_role.arn
}