# Creates an IAM role so that splunk can trigger creation of audit reports
resource "aws_iam_role" "run_audit_report_role" {
  name = "run_audit_report_role"
  path = "/service/"

  assume_role_policy = jsonencode( 
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:${var.aws_partition}:iam::${var.c2_accounts[var.aws_partition]}:role/instance/moose-splunk-sh-instance-role"
          },
          "Action": "sts:AssumeRole"
        }
      ]
    })

  tags = merge(var.standard_tags, var.tags)
}

data "aws_iam_policy_document" "run_audit_report_policy_doc" {
    statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm-pca:CreateCertificateAuthorityAuditReport"
    ]
  }
}

resource "aws_iam_policy" "run_audit_report_policy" {
  name        = "run_audit_report_policy"
  path        = "/"
  policy      = data.aws_iam_policy_document.run_audit_report_policy_doc.json
}

resource "aws_iam_role_policy_attachment" "run_audit_report_policy_attach" {
  role       = aws_iam_role.run_audit_report_role.name
  policy_arn = aws_iam_policy.run_audit_report_policy.arn
}
