# IAM Access Analyzer ========================================================

resource "aws_accessanalyzer_analyzer" "this" {
  analyzer_name = var.analyzer_name
  type          = var.type

  tags = local.tags
}

# Archive rules --------------------------------------------------------------

resource "aws_accessanalyzer_archive_rule" "this" {
  for_each = var.archive_rules

  analyzer_name = aws_accessanalyzer_analyzer.this.analyzer_name
  rule_name     = each.key

  dynamic "filter" {
    for_each = each.value.filter
    content {
      criteria = filter.key
      eq       = filter.value.eq
      neq      = filter.value.neq
      exists   = filter.value.exists != null ? tostring(filter.value.exists) : null
      contains = filter.value.contains
    }
  }
}