# Secrets ====================================================================

resource "aws_secretsmanager_secret" "this" {
  for_each = var.secrets

  name                    = each.value.name
  description             = each.value.description
  kms_key_id              = each.value.kms_key_id
  recovery_window_in_days = each.value.recovery_window_in_days

  dynamic "replica" {
    for_each = toset(each.value.replica_regions)
    content {
      region     = replica.value
      kms_key_id = each.value.kms_key_id
    }
  }

  tags = local.tags
}

# Secret versions (initial value) --------------------------------------------

resource "aws_secretsmanager_secret_version" "this" {
  for_each = {
    for k, v in var.secrets : k => v
    if v.secret_string != null
  }

  secret_id     = aws_secretsmanager_secret.this[each.key].id
  secret_string = each.value.secret_string

  lifecycle {
    ignore_changes = [secret_string]
  }
}

# Resource policies ----------------------------------------------------------

resource "aws_secretsmanager_secret_policy" "this" {
  for_each = local.secrets_with_policy

  secret_arn = aws_secretsmanager_secret.this[each.key].arn
  policy     = each.value.resource_policy
}

# Rotation -------------------------------------------------------------------

resource "aws_secretsmanager_secret_rotation" "this" {
  for_each = local.secrets_with_rotation

  secret_id           = aws_secretsmanager_secret.this[each.key].id
  rotation_lambda_arn = each.value.rotation.lambda_arn
  rotate_immediately  = each.value.rotation.rotate_immediately

  rotation_rules {
    automatically_after_days = each.value.rotation.rotation_days
  }
}