data "aws_caller_identity" "current" { }

data "aws_partition" "current" { }

resource "aws_iam_role" "this" {
  path               = var.path
  assume_role_policy = var.assume_role_policy
  name               = var.name
  max_session_duration = var.max_session_duration
}

resource "okta_group" "this" {

  # aws#ModelClient-Test#IAMFullAccess#449047653882
  name = format("%s#%s#%s#%s",
                data.aws_partition.current.partition,
                var.account_friendly_name,
                var.name,
                data.aws_caller_identity.current.account_id)
}

resource "okta_app_group_assignment" "this" {

  group_id = okta_group.this.id
  app_id   = var.okta_app_id
  lifecycle {
    ignore_changes = [ priority ]
  }
}
