resource "aws_iam_user" "lke-external-dns" {
  name = "lke-external-dns"
}

resource "aws_iam_access_key" "lke-external-dns" {
  user = aws_iam_user.lke-external-dns.name
}

resource "aws_iam_user_policy" "lke-external-dns" {
  name   = "route-53"
  user   = aws_iam_user.lke-external-dns.name
  policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "route53:ChangeResourceRecordSets"
            ],
            "Resource": [
                "arn:aws:route53:::hostedzone/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "route53:ListHostedZones",
                "route53:ListResourceRecordSets"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}
EOF
}