terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  backend "s3" {}
}
provider "aws" {
  region = "us-west-2"
}

variable "eks_oidc" {
  type = string
}

variable "env" {
  type = string
}


variable "logical_region_name" {
  type = string
}

variable "controlplane_account" {
  type = string
}

variable "auto_deploy_owner_tag" {
  type = string
}

module "cert-manager" {
  source = "../../modules/controlplane"

  controlplane_account = var.controlplane_account
  oidc                 = var.eks_oidc
  role_name            = "${var.env}-${var.logical_region_name}-cert-manager"
  service_account      = "cert-manager"
  // The policy is copied from https://cert-manager.io/docs/configuration/acme/dns01/route53/#set-up-an-iam-role
  policy_document = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = "route53:GetChange"
        Resource = "arn:aws:route53:::change/*"
      },
      {
        Effect = "Allow"
        Action = [
          "route53:ChangeResourceRecordSets",
          "route53:ListResourceRecordSets"
        ]
        Resource = "arn:aws:route53:::hostedzone/*"
      },
      {
        Effect   = "Allow"
        Action   = "route53:ListHostedZonesByName"
        Resource = "*"
      },
    ]
  })
  auto_deploy_owner_tag = var.auto_deploy_owner_tag
}

output "role_arn" {
  value = module.cert-manager.controlplane_role_arn
}