# Creates/updates the o11y agent-writer IAM roles (trust policies included) for
# this logical region before the regional server is deployed.
#
# Deliberately has NO finalizer: the agent-writer roles are additive by design
# and are reused when a region is re-provisioned, so they are exempt from the
# "destroy everything" rule.
module "static-principal-access" {
  source     = "../../modules/app"
  depends_on = [module.o11y-dataplane-cd]

  workflow = "o11y-static-principal-access.yaml"
  gh_repo  = "tidbcloud/observability"
  gh_ref   = "main"
  parameters = {
    git-ref        = "main"
    env            = var.env
    vendor         = "aws"
    logical-region = var.logical_region_name
    dry-run        = "false"
  }
  wait_workflow_success = true
}