data "aws_caller_identity" "current" {}

data "aws_db_instance" "shared" {
  db_instance_identifier = var.rds_identifier
}

data "aws_acm_certificate" "shared" {
  domain      = var.certificate_domain
  statuses    = ["ISSUED"]
  most_recent = true
}

data "aws_route53_zone" "api" {
  name         = var.hosted_zone_name
  private_zone = false
}

check "identity" {
  assert {
    condition     = data.aws_caller_identity.current.account_id == var.aws_account_id
    error_message = "Refusing to inspect resources outside the expected AWS account."
  }

  assert {
    condition     = data.aws_acm_certificate.shared.arn == var.expected_certificate_arn
    error_message = "The resolved ACM certificate does not match the pinned live certificate."
  }

  assert {
    condition     = data.aws_route53_zone.api.zone_id == var.expected_hosted_zone_id
    error_message = "The resolved Route 53 zone does not match the pinned live zone."
  }
}