main.tf

terraform {
  required_version = "~> 1.4.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.0"
    }
  }
}

provider "aws" {
  alias = "dest"
  profile = local.dest_aws_profile_name
}

provider "aws" {
  alias = "src"
  profile = local.src_aws_profile_name
}

locals {
  role_name             = "test-switch-role"
  policy_name           = "test-switch-role"
  group_name            = "switch-to-${data.aws_caller_identity.dest.account_id}"
  group_membership_name = "switch-role-group-membership"
  src_aws_profile_name  = "src"
  dest_aws_profile_name = "dest"
}

data "aws_caller_identity" "dest" {
  provider = aws.dest
}

resource "aws_iam_role" "dest" {
  provider = aws.dest

  name                = local.role_name
  assume_role_policy  = data.aws_iam_policy_document.dest.json
  managed_policy_arns = ["arn:aws:iam::aws:policy/AdministratorAccess"]
}

data "aws_iam_policy_document" "dest" {
  provider = aws.dest

  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "AWS"
      identifiers = [data.aws_caller_identity.src.account_id]
    }
  }
}

data "aws_caller_identity" "src" {
  provider = aws.src
}

resource "aws_iam_policy" "src" {
  provider = aws.src

  name   = local.policy_name
  policy = data.aws_iam_policy_document.src.json
}

data "aws_iam_policy_document" "src" {
  provider = aws.src

  statement {
    actions   = ["sts:AssumeRole"]
    resources = [aws_iam_role.dest.arn]
  }
}

resource "aws_iam_group" "src" {
  provider = aws.src

  name = local.group_name
}

resource "aws_iam_group_policy_attachment" "src" {
  provider = aws.src

  group      = aws_iam_group.src.name
  policy_arn = aws_iam_policy.src.arn
}

resource "aws_iam_group_membership" "src" {
  provider = aws.src

  name = local.group_membership_name
  users = data.aws_iam_users.src.names
  group = aws_iam_group.src.name
}

data "aws_iam_users" "src" {
  provider = aws.src
}

output "account_id" {
  value = data.aws_caller_identity.dest.account_id
}

output "role" {
  value = aws_iam_role.dest.name
}