provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "prod-royaltyshare-terraform-state"
    key     = "prod/iam/users/terraform.tfstate"
    region  = "us-west-2"
    encrypt = "true"
  }
}

# Note: it is critically important that these users be added to the generic-orchard-prod-group group
resource "aws_iam_user" "users" {
  for_each = { for user in var.users : user.username => user }

  #checkov:skip=ORCD_AWS_12: False positive (SYS-22585)
  name = each.value.username

  tags = {
    terraformed          = true
    name                 = each.value.name
    email                = each.value.email
    role                 = each.value.role
    company              = each.value.company
    manager              = each.value.manager
  } 
}

# Create Administrators group
resource "aws_iam_group" "administrators" {
  name = "Administrators"
}

# Add users to Administrators group
resource "aws_iam_group_membership" "administrators_membership" {
  name  = "administrators-membership"
  group = aws_iam_group.administrators.name
  users = [for user in aws_iam_user.users : user.name]
}

# Attach AdministratorAccess policy to the Administrators group
resource "aws_iam_group_policy_attachment" "admin_policy" {
  #checkov:skip=CKV_AWS_274: this is intentionally attached to the Administrators group
  group      = aws_iam_group.administrators.name
  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}