variable "custom_suffix" {
  default     = null
  description = "Additional string appended to the role names that support custom suffixes"
}

variable "ami_kms_key_arn" {
  description = "The ARN of the KMS Key used to encrypt the AMI"
  type        = string
}

data "aws_caller_identity" "current" {}

# Grant the Auto Scaling role access to the KMS keys used to encrypt the AMIs
resource "aws_kms_grant" "kms_asg_grant" {
  name              = "kms-asg-grant-account-ami-${var.custom_suffix}"
  key_id            = var.ami_kms_key_arn
  grantee_principal = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/${aws_iam_service_linked_role.autoscaling_service.name}"
  operations = [
    "Encrypt",
    "Decrypt",
    "ReEncryptFrom",
    "ReEncryptTo",
    "GenerateDataKey",
    "GenerateDataKeyWithoutPlaintext",
    "DescribeKey",
    "CreateGrant"
  ]
}

# Auto Scaling service-linked role
resource "aws_iam_service_linked_role" "autoscaling_service" {
  aws_service_name = "autoscaling.amazonaws.com"
  custom_suffix    = var.custom_suffix
  description      = "Allows EC2 Auto Scaling to use or manage AWS services and resources on your behalf."
}