terraform {
  required_providers {
    alicloud = {
      source  = "aliyun/alicloud"
      version = "1.261.0"
    }
  }
}

provider "alicloud" {
  profile = var.profile
}

variable "profile" {
  type = string
}

variable "assumed_role_name" {
  type = string
}

variable "controlplane_role_arns" {
  type = list(string)
}

variable "policy_document" {
  type = string # json encoded string
  default = ""
}

variable "system_policies" {
  type    = list(string)
  default = []
}

variable "custom_policies" {
  type    = list(string)
  default = []
}

variable "auto_deploy_owner_tag" {
  type = string
}

# controlplane assumes to this role
resource "alicloud_ram_role" "assumed_role" {
  role_name = var.assumed_role_name

  assume_role_policy_document = jsonencode({
    Version = "1"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          RAM = var.controlplane_role_arns
        }
        Action = "sts:AssumeRole"
      }
    ]
  })
  tags = {
    "tidbcloud-auto-deploy-owner" = var.auto_deploy_owner_tag
  }
}

resource "alicloud_ram_role_policy_attachment" "system_policy_attachments" {
  count = length(var.system_policies)

  role_name   = alicloud_ram_role.assumed_role.role_name
  policy_name = var.system_policies[count.index]
  policy_type = "System"
}

resource "alicloud_ram_role_policy_attachment" "custom_policy_attachments" {
  count = length(var.custom_policies)

  role_name   = alicloud_ram_role.assumed_role.role_name
  policy_name = var.custom_policies[count.index]
  policy_type = "Custom"
}

resource "alicloud_ram_policy" "inline_policy" {
  count = var.policy_document != "" ? 1 : 0

  policy_name     = var.assumed_role_name
  policy_document = var.policy_document
}

resource "alicloud_ram_role_policy_attachment" "inline_policy_attachment" {
  count = var.policy_document != "" ? 1 : 0

  role_name   = alicloud_ram_role.assumed_role.role_name
  policy_name = alicloud_ram_policy.inline_policy[0].policy_name
  policy_type = "Custom"
}

output "assumed_role_id" {
  value = alicloud_ram_role.assumed_role.role_id
}

output "assumed_role_name" {
  value = alicloud_ram_role.assumed_role.role_name
}

output "assumed_role_arn" {
  value = alicloud_ram_role.assumed_role.arn
}