# Permission sets ============================================================

resource "aws_ssoadmin_permission_set" "this" {
  for_each = var.permission_sets

  name             = each.value.name
  description      = each.value.description
  instance_arn     = var.sso_instance_arn
  session_duration = each.value.session_duration
  relay_state      = each.value.relay_state

  tags = local.tags
}

# Inline policies ------------------------------------------------------------

resource "aws_ssoadmin_permission_set_inline_policy" "this" {
  for_each = {
    for k, v in var.permission_sets : k => v
    if v.inline_policy != null
  }

  instance_arn       = var.sso_instance_arn
  permission_set_arn = aws_ssoadmin_permission_set.this[each.key].arn
  inline_policy      = each.value.inline_policy
}

# AWS managed policy attachments ---------------------------------------------

resource "aws_ssoadmin_managed_policy_attachment" "this" {
  for_each = local.managed_policy_map

  instance_arn       = var.sso_instance_arn
  permission_set_arn = aws_ssoadmin_permission_set.this[each.value.ps_key].arn
  managed_policy_arn = each.value.policy_arn
}

# Customer managed policy attachments ----------------------------------------

resource "aws_ssoadmin_customer_managed_policy_attachment" "this" {
  for_each = local.customer_policy_map

  instance_arn       = var.sso_instance_arn
  permission_set_arn = aws_ssoadmin_permission_set.this[each.value.ps_key].arn

  customer_managed_policy_reference {
    name = each.value.name
    path = each.value.path
  }
}

# Assignments ================================================================

resource "aws_ssoadmin_account_assignment" "this" {
  for_each = local.assignment_map

  instance_arn       = var.sso_instance_arn
  permission_set_arn = aws_ssoadmin_permission_set.this[each.value.permission_set_key].arn
  target_id          = each.value.account_id
  target_type        = "AWS_ACCOUNT"
  principal_id       = each.value.principal_id
  principal_type     = each.value.principal_type
}