{% set config = merged_configs.get('aws_iam_role', {}) %}
{% set comments = compliance_comments.get('aws_iam_role', []) %}
# ------------------------------------------------------------------------------
# IAM Role
# ------------------------------------------------------------------------------
{% for comment in comments %}
# {{ comment }}
{% endfor %}

resource "aws_iam_role" "this" {
  name        = "{{ config.get('name', project_id ~ '-role') }}"
  description = "{{ config.get('description', 'Managed by ComplyForm') }}"
  path        = "{{ config.get('path', '/') }}"

  max_session_duration = {{ config.get('max_session_duration', 3600) }}

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "{{ config.get('trusted_service', 'ec2.amazonaws.com') }}"
        }
        {% if config.get('require_external_id') %}
        Condition = {
          StringEquals = {
            "sts:ExternalId" = "{{ config.require_external_id }}"
          }
        }
        {% endif %}
      }
    ]
  })

  # Permissions boundary
  {% if config.get('permissions_boundary') %}
  permissions_boundary = "{{ config.permissions_boundary }}"
  {% endif %}

  tags = {
    Name      = "{{ config.get('name', project_id ~ '-role') }}"
    ManagedBy = "complyform"
  }
}
