# ---------------------------------------------------------------------------
# AgentCore Gateway support (task T4). Terraform's AgentCore coverage lags, so the
# Gateway + target themselves are created by scripts/agentcore_setup.sh via
# `aws bedrock-agentcore-control`. What IS declarative here is the IAM role the
# Gateway assumes to invoke the RAG tool Lambda -- kept in Terraform so it is
# tagged, auditable, and torn down with the rest of the stack.
# ---------------------------------------------------------------------------

resource "aws_iam_role" "agentcore_gateway" {
  name = "${local.name}-gateway-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "bedrock-agentcore.amazonaws.com" }
      Action    = "sts:AssumeRole"
      Condition = {
        StringEquals = { "aws:SourceAccount" = data.aws_caller_identity.current.account_id }
      }
    }]
  })
  tags = local.cloud_tag # the Gateway is a cloud-zone component
}

resource "aws_iam_role_policy" "agentcore_gateway" {
  name = "${local.name}-gateway-policy"
  role = aws_iam_role.agentcore_gateway.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      # The Gateway only needs to invoke the one RAG tool Lambda.
      Effect   = "Allow"
      Action   = ["lambda:InvokeFunction"]
      Resource = [aws_lambda_function.rag.arn]
    }]
  })
}

data "aws_caller_identity" "current" {}

output "gateway_role_arn" { value = aws_iam_role.agentcore_gateway.arn }