provider "aws" {
    region = "ap-southeast-2"
}

data "aws_caller_identity" "current" {}

resource "aws_launch_template" "launch" {
  name_prefix   = "launch"
  image_id      = "ami-0f8ffaadf3dbd5c08"
  instance_type = "t2.micro"
}

resource "aws_autoscaling_group" "asg" {
  availability_zones = ["ap-southeast-2a"]
  desired_capacity   = 0
  max_size           = 1
  min_size           = 0
  service_linked_role_arn = "${aws_iam_service_linked_role.role.arn}"
  launch_template {
    id      = "${aws_launch_template.launch.id}"
    version = "$$Latest"
  }
}

resource "aws_iam_service_linked_role" "role" {
  aws_service_name = "autoscaling.amazonaws.com"
  custom_suffix = "linkedrole"
}

resource "aws_kms_key" "kms" {
  description             = "KMS key 1"
  deletion_window_in_days = 10
  policy = <<EOF
{
    "Id": "key-consolepolicy-3",
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Enable IAM User Permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        },
            {
        "Sid": "Allow use of the CMK",
        "Effect": "Allow",
        "Principal": {
            "AWS": [
                "${aws_iam_service_linked_role.role.arn}"
            ]
        },
        "Action": [
            "kms:Encrypt",
            "kms:Decrypt",
            "kms:ReEncrypt*",
            "kms:GenerateDataKey*",
            "kms:DescribeKey"
        ],
        "Resource": "*"
    },
    {
        "Sid": "Allow attachment of persistent resources",
        "Effect": "Allow",
        "Principal": {
            "AWS": [
                "${aws_iam_service_linked_role.role.arn}"
            ]
        },
        "Action": [
            "kms:CreateGrant"
        ],
        "Resource": "*",
        "Condition": {
            "Bool": {
                "kms:GrantIsForAWSResource": true
            }
        }
    }
    ]
}
  EOF
}