{
  "name": "iam-role",
  "version": "1.0.0",
  "kind": "l1",
  "type": "aws:iam:role",
  "description": "IAM role primitive (engine-agnostic stack type aws:iam:role; the Terraform adapter translates to aws_iam_role).",
  "inputs": {
    "role_name": {
      "type": "string",
      "description": "The IAM role name.",
      "required": true
    },
    "assume_role_policy": {
      "type": "string",
      "description": "Assume-role policy document (JSON string).",
      "required": true
    },
    "managed_policies": {
      "type": "string",
      "description": "Comma-separated list of managed policy ARNs to attach.",
      "required": false
    },
    "region": {
      "type": "string",
      "description": "AWS region the role is created in.",
      "required": true
    }
  },
  "outputs": {
    "role_arn": {
      "type": "arn",
      "description": "The IAM role ARN."
    },
    "role_id": {
      "type": "string",
      "description": "The IAM role id."
    }
  },
  "nfrs": {
    "encryption_enabled": {
      "type": "boolean",
      "description": "Encryption is not applicable to IAM roles but included for standards compliance.",
      "default": true
    },
    "deletion_protection": {
      "type": "boolean",
      "description": "Prevent resource destruction via Terraform lifecycle prevent_destroy",
      "default": true
    }
  }
}