# RAM Resource Shares ==========================================================

# Resource shares ----------------------------------------------------------------
# permission_arns is set directly here — AWS RAM has no separate "permission
# association" resource; a share's custom permissions are an attribute of the
# share itself, not a per-ARN association like resources/principals.

resource "aws_ram_resource_share" "this" {
  for_each = var.resource_shares

  name                      = local.share_names[each.key]
  allow_external_principals = each.value.allow_external_principals
  permission_arns           = each.value.permission_arns

  tags = merge(var.tags, each.value.tags, local.module_tags, {
    Name          = local.share_names[each.key]
    resource-type = "ram-share"
  })
}

# Resource associations -----------------------------------------------------------

resource "aws_ram_resource_association" "this" {
  for_each = local.resource_association_map

  resource_arn       = each.value.arn
  resource_share_arn = aws_ram_resource_share.this[each.value.share_key].arn
}

# Principal associations -----------------------------------------------------------

resource "aws_ram_principal_association" "this" {
  for_each = local.principal_association_map

  principal          = each.value.principal
  resource_share_arn = aws_ram_resource_share.this[each.value.share_key].arn
}