resource "vault_kubernetes_auth_backend_role" "this" {
  for_each = var.roles

  audience                         = one(each.value.audiences)
  backend                          = var.backend
  bound_service_account_names      = each.value.service_account_names
  bound_service_account_namespaces = each.value.service_account_namespaces
  role_name                        = each.key
  token_policies                   = each.value.token_policies
  token_ttl                        = each.value.token_ttl
}