main.tf

# ── Keystone: the attachable access entity profile ─────────────────────────────
# The AAEP (infraAttEntityP) is a fabric access-policy object; its id is the
# Distinguished Name uni/infra/attentp-{name}. It has no parent DN — it sits
# directly under uni/infra. `name` is immutable — a change forces a new AAEP.
resource "aci_attachable_access_entity_profile" "this" {
  name = var.attachable_access_entity_profile.name

  annotation  = var.attachable_access_entity_profile.annotation
  name_alias  = var.attachable_access_entity_profile.name_alias
  description = var.attachable_access_entity_profile.description
  owner_key   = var.attachable_access_entity_profile.owner_key
  owner_tag   = var.attachable_access_entity_profile.owner_tag

  # ACI metadata lists (tagAnnotation / tagTag). Accepted as {key = value} maps for
  # ergonomics and converted to the provider's {key, value} object shape. Left
  # unmanaged (null) when empty so the module never fights provider-computed state.
  annotations = length(var.attachable_access_entity_profile.annotations) > 0 ? [
    for k, v in var.attachable_access_entity_profile.annotations : { key = k, value = v }
  ] : null
  tags = length(var.attachable_access_entity_profile.tags) > 0 ? [
    for k, v in var.attachable_access_entity_profile.tags : { key = k, value = v }
  ] : null

  # Typed relations (infraRsDomP, migrated resource shape) to physical/VMM/L3/FC
  # domains, by DN. Empty leaves the relation set unmanaged (null) rather than an
  # empty list, so the module never fights provider-computed state.
  relation_to_domains = length(var.attachable_access_entity_profile.relation_to_domains) > 0 ? [
    for d in var.attachable_access_entity_profile.relation_to_domains : {
      target_dn  = d.target_dn
      annotation = d.annotation
    }
  ] : null
}

# ── Child: the "default" access-generic container ────────────────────────────────
# aci_access_generic (infraGeneric) is a singleton child of the AAEP — the ACI
# object model fixes its name to "default", so it is never exposed as a variable.
# Modeled via for_each over a 0-or-1-entry map (never count) so the resource is
# only created when the caller explicitly asks for it; most callers never need
# to, since domain relations are already managed on the keystone above.
resource "aci_access_generic" "this" {
  for_each = var.access_generic == null ? {} : { "default" = var.access_generic }

  attachable_access_entity_profile_dn = aci_attachable_access_entity_profile.this.id
  name                                = "default"

  annotation  = each.value.annotation
  description = each.value.description
  name_alias  = each.value.name_alias
}