data "aws_iam_policy_document" "browzer_bootstrapper_task_role" {
  statement {
    sid = "BrowzerBootstrapperECSTaskExecution"
    effect = "Allow"
    actions = [
      "ecr:GetAuthorizationToken",
      "ecr:BatchCheckLayerAvailability",
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "logs:CreateLogStream",
      "logs:PutLogEvents"
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "browzer_bootstrapper_service" {
  name = "browzer-bootstrapper-service"
  policy = data.aws_iam_policy_document.browzer_bootstrapper_task_role.json
}

resource "aws_iam_role" "browzer_bootstrapper_task_role" {
  name = "browzer-bootstrapper-service-task-role"
  description = "Role for Browzer Bootstrapper tasks"
  assume_role_policy = data.aws_iam_policy_document.ecs_assume_role.json
}

resource "aws_iam_role_policy_attachment" "browzer_bootstrapper_task_role_policy_attach" {
  role = aws_iam_role.browzer_bootstrapper_task_role.name
  policy_arn = aws_iam_policy.browzer_bootstrapper_service.arn
}