terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  backend "s3" {}
}
variable "account" {
  type = string
}
variable "env" {
  type = string
}
variable "logical_region_name" {
  type = string
}
variable "controlplane_role_arns" {
  type = list(string)
}

provider "aws" {
  region  = "us-west-2"
  profile = var.account
}

module "region-server" {
  source = "../../modules/dataplane"

  assumed_role_name = "${var.env}-${var.logical_region_name}-dp4drs"
  # allow region-server and crossplane-aws-provider to assume
  controlplane_role_arns = var.controlplane_role_arns
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "autoscaling:*",
          "ebs:*",
          "ec2:*",
          "eks:*",
          "elasticloadbalancing:*",
          "iam:*",
          "kms:*",
          "lambda:*",
          "route53:*",
          "s3:*",
          "secretsmanager:*",
          "tag:*",
        ]
        Effect   = "Allow"
        Resource = "*"
      }
    ]
  })
}