mock_provider "aws" {}

variables {
  name                  = "carloku-ie-fence-writer"
  deployment_bucket_arn = "arn:aws:s3:::deployment"
}

run "root_bootstrap_only" {
  command = plan
  assert {
    condition     = jsondecode(aws_iam_role.writer.assume_role_policy).Statement[0].Principal.AWS == aws_iam_user.bootstrap.arn
    error_message = "Only the dedicated root bootstrap principal may assume the writer role."
  }
  assert {
    condition     = jsondecode(aws_iam_user_policy.assume.policy).Statement[0].Resource == aws_iam_role.writer.arn
    error_message = "The bootstrap user may assume only its box writer role."
  }
  assert {
    condition     = jsondecode(aws_iam_role_policy.fences.policy).Statement[0].Resource == "arn:aws:s3:::deployment/control/box-fences/*"
    error_message = "The writer role must be restricted to fence creation."
  }
  assert {
    condition     = jsondecode(aws_iam_role_policy.fences.policy).Statement[0].Condition.StringEquals["s3:if-none-match"] == "*"
    error_message = "A fence write must be create-only."
  }
  assert {
    condition = jsonencode([
      for s in jsondecode(aws_iam_role_policy.fences.policy).Statement : s.Action
    ]) == jsonencode(["s3:PutObject", "s3:GetObject"])
    error_message = "Fence roles must grant no delete, tagging or unrelated service action."
  }
  assert {
    condition = length(jsondecode(aws_iam_user_policy.assume.policy).Statement) == 1 && jsondecode(aws_iam_user_policy.assume.policy).Statement[0].Action == "sts:AssumeRole"
    error_message = "The bootstrap identity must hold only its one assume-role grant."
  }

}