provider "aws" {
  region  = "us-east-1"
  profile = "cu-cs-sandbox" # Name of the AWS CLI profile to use
  version = "~> 2.20"
}

data "aws_caller_identity" "current" {}

data "aws_iam_policy_document" "saml-assume-role-policy" {
  statement {
    actions = ["sts:AssumeRoleWithSAML"]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:saml-provider/cornell_idp"]
    }

    condition {
      test     = "StringEquals"
      variable = "SAML:aud"

      values = [
        "https://signin.aws.amazon.com/saml"
      ]
    }
  }
}

resource "aws_iam_policy" "example-policy" {
  name        = "example-policy"
  description = "example policy"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "ec2:Describe*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
EOF
}


resource "aws_iam_role" "example-role" {
  name               = "shib-example"
  assume_role_policy = "${data.aws_iam_policy_document.saml-assume-role-policy.json}"
}

resource "aws_iam_role_policy_attachment" "example-policy-attach" {
  role       = "${aws_iam_role.example-role.name}"
  policy_arn = "${aws_iam_policy.example-policy.arn}"
}

resource "aws_iam_role_policy_attachment" "managed-policy-attach" {
  role       = "${aws_iam_role.example-role.name}"
  policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
}