const rootZone = new aws.route53.Zone(tldName, {
    name: tldName,
	comment: 'HostedZone created by Route53 Registrar'
}, {
	import: tldZoneId
});

const allowedTargetArns = [
	rootZone.arn
]

const allowedActions = [
	"route53:ChangeResourceRecordSets",
	"route53:CreateHostedZone",
	"route53:DeleteHostedZone",
	"route53:GetChange",
	"route53:GetHostedZone",
	"route53:ListHostedZones",
	"route53:ListResourceRecordSets",
	"route53:UpdateHostedZoneComment"
]

const allowedSourceArns = adminStack.getOutput('crossAccountPermissionPolicyTargets');

const crossAccountAccessRole = new aws.iam.Role(pre('cross-acct-role'), {
    assumeRolePolicy: allowedSourceArns.apply(sourceArns => { 
		return JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: {
                AWS: sourceArns
            },
            Action: "sts:AssumeRole"
        }]
    })
})});

const crossAccountAccessPolicy = new aws.iam.Policy(pre('cross-acct-policy'), {
	policy: pulumi.all(allowedTargetArns).apply(targetArns => {
		return JSON.stringify({
			"Version": "2012-10-17",
			"Statement": [
				{
					"Effect": "Allow",
					"Action": allowedActions,
					"Resource": targetArns
				}
			]
		})
	})
});

const policyAttachment = new aws.iam.RolePolicyAttachment(pre('cross-acct-attach'), {
    role: crossAccountAccessRole.name,
    policyArn: crossAccountAccessPolicy.arn
});