locals {
  permissions = {
    default    = "AWSRAMDefaultPermissionCertificateAuthority",
    signClient = "AWSRAMEndEntityClientAuthCertificateIssuanceCertificateAuthority",
    signServer = "AWSRAMEndEntityServerAuthCertificateIssuanceCertificateAuthority",
    signBlank  = "AWSRAMBlankEndEntityCertificateAPICSRPassthroughIssuanceCertificateAuthority",
    revoke     = "AWSRAMRevokeCertificateCertificateAuthority"
  }
}

resource "aws_ram_resource_share" "sender_share" {
  for_each = local.permissions

  provider                  = aws.owner
  name                      = "pca-${var.accepter_account}-${each.key}"
  permission_arns           = ["arn:aws:ram::aws:permission/${each.value}"]
  allow_external_principals = true
}

resource "aws_ram_resource_association" "resource" {
  for_each           = local.permissions
  provider           = aws.owner
  resource_arn       = var.resource_arn
  resource_share_arn = aws_ram_resource_share.sender_share[each.key].arn
}

resource "aws_ram_principal_association" "sender_invite" {
  for_each           = local.permissions
  depends_on         = [aws_ram_resource_association.resource]
  provider           = aws.owner
  principal          = var.accepter_account
  resource_share_arn = aws_ram_resource_share.sender_share[each.key].arn
}

resource "aws_ram_resource_share_accepter" "receiver_accept" {
  for_each  = local.permissions
  provider  = aws.accepter
  share_arn = aws_ram_principal_association.sender_invite[each.key].resource_share_arn
}