<commit_before>provider "aws" {
  profile = "${var.aws_profile}"
  region  = "${var.aws_region}"
}

output "account_name" {
  value = "${var.account_name}"
}

output "technical_contact" {
  value = "${var.technical_contact}"
}

output "ssh_key_name" {
  value = "${var.ssh_key_name}"
}

resource "aws_iam_user" "admin" {
  count = "${length(split(",",var.admin_users))}"
  path  = "/nubis/admin/"
  name  = "${element(split(",",var.admin_users), count.index)}"
}

resource "aws_iam_role_policy" "admin" {
    count = "${length(split(",",var.admin_users))}"
    name = "${element(split(",",var.admin_users), count.index)}"

    role = "${element(aws_iam_role.admin.*.id, count.index)}"
    policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "*",
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
EOF
}

resource "aws_iam_role" "admin" {
    count = "${length(split(",",var.admin_users))}" 
    path  = "/nubis/admin/"
    name = "${element(split(",",var.admin_users), count.index)}"
    assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal" : { "AWS" : "${element(aws_iam_user.admin.*.arn, count.index)}" },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_iam_access_key" "admins" {
  count = "${length(split(",",var.admin_users))}"
  user  = "${element(aws_iam_user.admin.*.name, count.index)}"
}

resource "aws_iam_group" "admins" {
  name = "Administrators"
  path = "/nubis/admin/"
}

resource "aws_iam_group" "nacl_admins" {
  name = "NACLAdministrators"
  path = "/nubis/"
}

resource "aws_iam_group" "read_only_users" {
  name = "ReadOnlyUsers"
  path = "/nubis/"
}

resource "aws_iam_policy_attachment" "read_only" {
  name       = "read-only-attachments"
  groups     = ["${aws_iam_group.read_only_users.name}"]
  policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"<commit_msg>Add a readonly IAM role intended for Nubis Admins<commit_after>provider "aws" {
  profile = "${var.aws_profile}"
  region  = "${var.aws_region}"
}

output "account_name" {
  value = "${var.account_name}"
}

output "technical_contact" {
  value = "${var.technical_contact}"
}

output "ssh_key_name" {
  value = "${var.ssh_key_name}"
}

resource "aws_iam_user" "admin" {
  count = "${length(split(",",var.admin_users))}"
  path  = "/nubis/admin/"
  name  = "${element(split(",",var.admin_users), count.index)}"
}

resource "aws_iam_role_policy" "admin" {
    count = "${length(split(",",var.admin_users))}"
    name = "${element(split(",",var.admin_users), count.index)}"

    role = "${element(aws_iam_role.admin.*.id, count.index)}"
    policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "*",
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
EOF
}

resource "aws_iam_role" "admin" {
    count = "${length(split(",",var.admin_users))}" 
    path  = "/nubis/admin/"
    name = "${element(split(",",var.admin_users), count.index)}"
    assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal" : { "AWS" : "${element(aws_iam_user.admin.*.arn, count.index)}" },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_iam_role" "readonly" {
    count = 1
    path  = "/nubis/admin/"
    name = "readonly"
    assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal" : { "AWS" : [ ${join(",", formatlist("\"%s\"", aws_iam_user.admin.*.arn))} ]},
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_iam_access_key" "admins" {
  count = "${length(split(",",var.admin_users))}"
  user  = "${element(aws_iam_user.admin.*.name, count.index)}"
}

resource "aws_iam_group" "admins" {
  name = "Administrators"
  path = "/nubis/admin/"
}

resource "aws_iam_group" "nacl_admins" {
  name = "NACLAdministrators"
  path = "/nubis/"
}

resource "aws_iam_group" "read_only_users" {
  name = "ReadOnlyUsers"
  path = "/nubis/"
}

resource "aws_iam_policy_attachment" "read_only" {
  name       = "read-only-attachments"
  groups     = ["${aws_iam_group.read_only_users.name}"]
  roles      = ["${aws_iam_role.readonly.name}"]
  policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
{'fraction_non_alphanumeric': 0.2077741786210088, 'fraction_numerical': 0.00948634891254049, 'mean_word_length': 3.6785714285714284, 'pattern_counts': {'":': 25, '<': 13, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '900164', 'n_tokens_mistral': 1692, 'n_tokens_neox': 1656, 'n_words': 258}