<commit_before>resource "aws_iam_role" "ecsInstanceRole" {
  name = "${terraform.workspace}-ecsInstanceRole"

  assume_role_policy = <<EOF
{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

}

resource "aws_iam_role_policy_attachment" "ecsInstanceRole" {
  role       = aws_iam_role.ecsInstanceRole.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"
}

data "aws_iam_policy_document" "ecs_extra" {
  statement {
    actions   = ["s3:GetObject"]
    resources = ["arn:aws:s3:::${aws_s3_bucket.config.id}/${aws_s3_bucket_object.trusted_peers.id}"]
  }
}

resource "aws_iam_policy" "ecs_extra" {
  name   = "${terraform.workspace}-ECS-extra"
  policy = data.aws_iam_policy_document.ecs_extra.json
}

resource "aws_iam_role_policy_attachment" "ecs_extra" {
  role       = aws_iam_role.ecsInstanceRole.name
  policy_arn = aws_iam_policy.ecs_extra.arn
}

resource "aws_iam_instance_profile" "ecsInstanceRole" {
  name = "${terraform.workspace}-ecsInstanceRole"
  role = aws_iam_role.ecsInstanceRole.name
}

resource "aws_iam_role" "ecsTaskExecutionRole" {
  name = "${terraform.workspace}-ecsTaskExecutionRole"

  assume_role_policy = <<EOF
{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

}

resource "aws_iam_role_policy_attachment" "ecsTaskExecutionRole" {
  role       = aws_iam_role.ecsTaskExecutionRole.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

locals {
  secrets_arn = split(":", aws_secretsmanager_secret.validator[0].arn)
}

resource "aws_iam_policy" "validator" {
  name = "${terraform.workspace}-validator"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Resource": [
        "${join(
  ":",
  slice(local.secrets_arn, 0, length(local.secrets_arn) - 1),
)}:*"
      ]
    }
  ]
}
EOF

}

resource "aws_iam_role_policy_attachment" "ecsTaskExecutionRole-secrets" {
  role       = aws_iam_role.ecsTaskExecutionRole.name
  policy_arn = aws_iam_policy.validator.arn<commit_msg>[terraform] Use aws_iam_policy_document<commit_after>data "aws_iam_policy_document" "instance-assume-role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "ecsInstanceRole" {
  name               = "${terraform.workspace}-ecsInstanceRole"
  assume_role_policy = data.aws_iam_policy_document.instance-assume-role.json
}

resource "aws_iam_role_policy_attachment" "ecsInstanceRole" {
  role       = aws_iam_role.ecsInstanceRole.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"
}

data "aws_iam_policy_document" "ecs_extra" {
  statement {
    actions   = ["s3:GetObject"]
    resources = ["arn:aws:s3:::${aws_s3_bucket.config.id}/${aws_s3_bucket_object.trusted_peers.id}"]
  }
}

resource "aws_iam_policy" "ecs_extra" {
  name   = "${terraform.workspace}-ECS-extra"
  policy = data.aws_iam_policy_document.ecs_extra.json
}

resource "aws_iam_role_policy_attachment" "ecs_extra" {
  role       = aws_iam_role.ecsInstanceRole.name
  policy_arn = aws_iam_policy.ecs_extra.arn
}

resource "aws_iam_instance_profile" "ecsInstanceRole" {
  name = "${terraform.workspace}-ecsInstanceRole"
  role = aws_iam_role.ecsInstanceRole.name
}

data "aws_iam_policy_document" "task-assume-role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "ecsTaskExecutionRole" {
  name               = "${terraform.workspace}-ecsTaskExecutionRole"
  assume_role_policy = data.aws_iam_policy_document.task-assume-role.json
}

resource "aws_iam_role_policy_attachment" "ecsTaskExecutionRole" {
  role       = aws_iam_role.ecsTaskExecutionRole.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

locals {
  secrets_arn = split(":", aws_secretsmanager_secret.validator[0].arn)
}

data "aws_iam_policy_document" "validator" {
  statement {
    actions   = ["secretsmanager:GetSecretValue"]
    resources = ["${join(":", slice(local.secrets_arn, 0, length(local.secrets_arn) - 1), )}:*"]
  }
}

resource "aws_iam_policy" "validator" {
  name   = "${terraform.workspace}-validator"
  policy = data.aws_iam_policy_document.validator.json
}

resource "aws_iam_role_policy_attachment" "ecsTaskExecutionRole-secrets" {
  role       = aws_iam_role.ecsTaskExecutionRole.name
  policy_arn = aws_iam_policy.validator.arn
{'fraction_non_alphanumeric': 0.1346658590753079, 'fraction_numerical': 0.008883504946497072, 'mean_word_length': 4.160416666666666, 'pattern_counts': {'":': 23, '<': 9, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5748764', 'n_tokens_mistral': 1820, 'n_tokens_neox': 1828, 'n_words': 223}