##############THE ROLE FOR EACH GROUP
resource "aws_iam_role" "iam_role_auth_prod" {
  name = "auth-kibana-prod-${terraform.workspace}"
assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity"
    }
  ]
}
EOF
}
resource "aws_iam_role" "iam_role_auth_dev" {
  name = "auth-kibana-dev-${terraform.workspace}"
assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity"
    }
  ]
}
EOF
}
################## USER GROUPS WITH ATTACHED ROLES
resource "aws_cognito_user_group" "cognito_user_group_auth_prod" {
  name         = "auth-kibana-prod-${terraform.workspace}"
  user_pool_id = "${aws_cognito_user_pool.kibana.id}"
  description  = "Managed by Terraform"
  precedence   = 1
  role_arn     = "${aws_iam_role.iam_role_auth_prod.arn}"
}
resource "aws_cognito_user_group" "cognito_user_group_auth_dev" {
  name         = "auth-kibana-dev-${terraform.workspace}"
  user_pool_id = "${aws_cognito_user_pool.kibana.id}"
  description  = "Managed by Terraform"
  precedence   = 1
  role_arn     = "${aws_iam_role.iam_role_auth_dev.arn}"
}
######### CREATE USERPOOL AND IDENTITY POOL
resource "aws_cognito_user_pool" "kibana" {
  name                     = "kibana user pool"
  auto_verified_attributes = ["email"]
admin_create_user_config = {
    allow_admin_create_user_only = true
  }
schema {
    attribute_data_type = "String"
    name                = "email"
    required            = true
  }
lifecycle {
    ignore_changes = [
      "schema",
    ]
  }
alias_attributes = ["email"]
}
resource "aws_cognito_user_pool_domain" "kibana" {
  domain       = "glabs-kibana"
  user_pool_id = "${aws_cognito_user_pool.kibana.id}"
lifecycle {
    ignore_changes = [
      "user_pool_id",
    ]
  }
}
resource "aws_cognito_identity_pool" "kibana" {
  identity_pool_name               = "kibana pool"
  allow_unauthenticated_identities = false
  lifecycle {
    ignore_changes = [
      "cognito_identity_providers",
    ]
  }
}