resource "google_service_account" "this" {
  account_id   = var.gcp_service_account_name
  display_name = var.gcp_service_account_name
  description  = var.gcp_service_account_description
}

resource "google_project_iam_member" "this" {
  count   = length(var.gcp_service_account_roles)
  project = var.project_id
  member  = "serviceAccount:${google_service_account.this.email}"
  role    = var.gcp_service_account_roles[count.index]
}

resource "google_service_account_key" "this" {
  service_account_id = google_service_account.this.name
}

resource "aws_secretsmanager_secret" "this" {
  name       = var.aws_secret_name
  kms_key_id = var.aws_kms_id
  tags       = var.common_tags

  recovery_window_in_days = 0
}

resource "aws_secretsmanager_secret_version" "this" {
  secret_id     = aws_secretsmanager_secret.this.id
  secret_string = base64decode(google_service_account_key.this.private_key)
}