#Role that gets created in in identity account that okta uses to map AD groups to Roles in AWS
resource "aws_iam_role" "create_identity_role" {
count = "${length(var.team_name)}"
name = "${lookup(var.identity_role_name,element(var.team_name, count.index))}"
assume_role_policy = "${data.aws_iam_policy_document.trustokta.json}"
}
#Role that gets created in each of the accounts that will determine what it is a user will be able to do inside AWS
resource "aws_iam_role" "create_assume_role" {
count = "${length(var.team_name)}"
name = "${lookup(var.assume_role_name,element(var.team_name, count.index))}"
assume_role_policy = "${data.aws_iam_policy_document.trustawsaccount.json}"
}
#Policy that gets created in the identity account which tells AWS which role to assume in a different account
resource "aws_iam_policy" "create_assume_policy" {
count = "${length(var.team_name)}"
name = "${lookup(var.assume_role_name,element(var.team_name, count.index))}"
policy = "${data.template_file.network_assume.rendered}"
}
#Tie my role and policies together
resource "aws_iam_role_policy_attachment" "attach_assume_policy" {
count = "${length(var.team_name)}"
role = "${lookup(var.assume_role_name,element(var.team_name, count.index))}"
policy_arn = "${element(aws_iam_policy.create_assume_policy.*.arn, count.index)}"
}