locals {
  dwh_datasets = [
    # Marts layer
    "dws_business_operations",
    "dws_marketing",
    # "dws_finance",

    # Anls layer
    "anls_business_operations",
    "anls_marketing",
    "anls_core",
    "anls_cloud",

    # DWH layer
    "dwh_business_operations",
    "dwh_marketing",
    "dwh_cloud_platform",
  ]
}

resource "google_bigquery_dataset_iam_member" "dwh_user_readers" {
  for_each = {
    for combo in setproduct(local.dwh_datasets, var.users) :
    "${combo[0]}-${combo[1]}" => {
      dataset_id = combo[0]
      member     = combo[1]
    }
  }
  project = var.project_id
  dataset_id = each.value.dataset_id
  role       = "roles/bigquery.dataViewer"
  member     = each.value.member
}

# Create service account for reading BI datasets
resource "google_service_account" "bi_reader_service_account" {
  project      = var.project_id
  account_id   = "bi-reader-sa"
  display_name = "BI Accessor Service Account"
  description  = "Service account for BI tools to access DWH datasets"
}