locals {
  # Default ECS task trust policy when none is supplied (adapter previously hardcoded this).
  assume_role_policy = var.assume_role_policy != null ? var.assume_role_policy : jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ecs-tasks.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })

  # Default inline ECR+logs policy when no managed_policies supplied (adapter previously hardcoded this).
  managed_policy_arns = var.managed_policies != null ? split(",", var.managed_policies) : []

  inline_policy = var.managed_policies == null ? {
    name = "ecr-logs"
    policy = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Effect = "Allow"
          Action = [
            "ecr:GetDownloadUrlForLayer",
            "ecr:BatchGetImage",
            "ecr:GetAuthorizationToken",
            "ecr:BatchCheckLayerAvailability"
          ]
          Resource = "*"
        },
        {
          Effect = "Allow"
          Action = [
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:PutLogEvents"
          ]
          Resource = "*"
        }
      ]
    })
  } : null
}