package aws

func NewRolePolicy(statements ...PolicyStatement) *PolicyDocument {
	return &PolicyDocument{
		Version:   PolicyVersion,
		Statement: statements,
	}
}

func NewAssumeRoleWithWebIdentityPolicy(idProvider string, condition StatementCondition) *PolicyDocument {
	return &PolicyDocument{
		Version: PolicyVersion,
		Statement: []PolicyStatement{{
			Action: []string{"sts:AssumeRoleWithWebIdentity"},
			Principal: &PolicyPrincipal{
				Federated: idProvider,
			},
			Effect:    StatementEffectAllow,
			Condition: condition,
		}},
	}
}

func NewGoogleIdentityPolicy(aud string) *PolicyDocument {
	return NewAssumeRoleWithWebIdentityPolicy(GoogleOIDCURL,
		NewGoogleOIDCCondition(aud))
}

func NewGoogleOIDCCondition(aud string) StatementCondition {
	return StatementCondition{
		StringEquals: map[string]string{
			GoogleOIDCAudKey: aud,
		},
	}
}