# secrets-manager

Creates AWS Secrets Manager secrets with rotation, resource policies, and cross-region replication.

Provisions any number of secrets, optionally seeds them with an initial value (change-ignored after first apply), attaches resource-based policies for cross-account access, enables automatic rotation via a caller-supplied Lambda, and replicates to additional regions. KMS encryption is applied per secret using the `security/kms` module's key ARN.

## Usage

```hcl
module "secrets" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/security/secrets-manager/aws"
  version = "0.1.0"

  secrets = {
    db_password = {
      name       = "/prod/rds/password"
      kms_key_id = module.kms.key_arn
      rotation = {
        lambda_arn    = module.rotation_lambda.arn
        rotation_days = 30
      }
    }
  }
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->
## Requirements

| Name | Version |
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.5 |
| <a name="requirement_aws"></a> [aws](#requirement_aws) | ~> 6.50 |

## Providers

| Name | Version |
| ---- | ------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | 6.50.0 |

## Resources

| Name | Type |
| ---- | ---- |
| [aws_secretsmanager_secret.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |
| [aws_secretsmanager_secret_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_policy) | resource |
| [aws_secretsmanager_secret_rotation.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_rotation) | resource |
| [aws_secretsmanager_secret_version.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |

## Inputs

| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_secrets"></a> [secrets](#input_secrets) | Map of secrets to create. secret_string and secret_binary are mutually<br/>exclusive. Leave both null to create a secret without an initial value. | <pre>map(object({<br/>    name                    = string<br/>    description             = optional(string, "")<br/>    kms_key_id              = optional(string, null)<br/>    recovery_window_in_days = optional(number, 30)<br/>    secret_string           = optional(string, null)<br/>    resource_policy         = optional(string, null)<br/>    replica_regions         = optional(list(string), [])<br/>    rotation = optional(object({<br/>      lambda_arn         = string<br/>      rotation_days      = optional(number, 30)<br/>      rotate_immediately = optional(bool, true)<br/>    }), null)<br/>  }))</pre> | `{}` | no |
| <a name="input_tags"></a> [tags](#input_tags) | Resource tags to apply to all resources | `map(string)` | `{}` | no |

## Outputs

| Name | Description |
| ---- | ----------- |
| <a name="output_secret_arns"></a> [secret_arns](#output_secret_arns) | Map of logical key to secret ARN |
| <a name="output_secret_ids"></a> [secret_ids](#output_secret_ids) | Map of logical key to secret ID |
| <a name="output_secret_names"></a> [secret_names](#output_secret_names) | Map of logical key to secret name |
<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->