---
constants:
  __name: "{{ name }}_{{ __guid }}"
variables:
  name:
    desc: "Name of the IAM role."
    required: true
    group: Role Details
  assume_role_policy:
    desc: "Policy that grants an entity permission to assume the role. Provide a valid JSON policy document."
    required: true
    group: Role Details
  description:
    desc: "Description of the role."
    required: false
    group: Role Details
    default: "Managed by Resourcely"
  max_session_duration:
    desc: "Maximum session duration (in seconds) for the role."
    required: false
    group: Advanced
    default: 3600
    suggested: 3600
  path:
    desc: "Path for the IAM role."
    required: false
    group: Advanced
    default: "/"
  permissions_boundary:
    desc: "ARN of the policy that is used to set the permissions boundary for the role."
    required: false
    group: Advanced
    links_to: resource.aws_iam_policy.arn
  tags:
    group: Tags
    required: false
groups:
  Role Details:
    order: 1
    desc: "Basic details for the IAM role."
  Advanced:
    order: 2
    desc: "Advanced settings for the IAM role."
  Tags:
    order: 3
    desc: "Tags to assign to the IAM role."
---

resource "aws_iam_role" "__name" {
  name               = {{ name }}
  assume_role_policy = {{ assume_role_policy }}
  description        = {{ description }}
  max_session_duration = {{ max_session_duration }}
  path               = {{ path }}
  permissions_boundary = {{ permissions_boundary | required: false }}

  tags = {
    Name = {{ name }}
    {{# tags }}
      {{ tags.key | required: false }} = {{ tags.value | required: false }}
    {{/ tags }}
  }
}

// The role is created with the specified assume role policy.
// Tags are encouraged for resource identification and management.
// Advanced options like permissions boundary are available for enhanced security control.
//