# IAM role ===================================================================

resource "aws_iam_role" "this" {
  name                  = var.name
  description           = var.description
  path                  = var.path
  assume_role_policy    = var.assume_role_policy
  max_session_duration  = var.max_session_duration
  force_detach_policies = var.force_detach_policies
  permissions_boundary  = var.permissions_boundary

  tags = local.tags
}

# Managed policy attachments -------------------------------------------------

resource "aws_iam_role_policy_attachment" "this" {
  for_each = toset(var.managed_policy_arns)

  role       = aws_iam_role.this.name
  policy_arn = each.value
}

# Inline policies ------------------------------------------------------------

resource "aws_iam_role_policy" "this" {
  for_each = var.inline_policies

  name   = each.key
  role   = aws_iam_role.this.id
  policy = each.value
}

# Instance profile -----------------------------------------------------------

resource "aws_iam_instance_profile" "this" {
  for_each = var.instance_profile ? { profile = true } : {}

  name = local.instance_profile_name
  role = aws_iam_role.this.name

  tags = local.tags
}