module "role-mdr_iam_admin" {
  source = "./modules/saml_linked_role"

  name                  = "mdr_iam_admin"
  account_friendly_name = aws_iam_account_alias.alias.account_alias
  path                  = "/user/"
  assume_role_policy    = local.assume_role_policy
  okta_app_id           = data.okta_app.awsapp.id
}

resource "aws_iam_role_policy_attachment" "mdr_iam_admin_IAMFullAccess" {
  role       = module.role-mdr_iam_admin.name
  policy_arn = "arn:${local.aws_partition}:iam::aws:policy/IAMFullAccess"
}

resource "aws_iam_role_policy_attachment" "mdr_iam_admin-iam_admin_kms" {
  role       = module.role-mdr_iam_admin.name
  policy_arn = aws_iam_policy.iam_admin_kms.arn
}