locals {
  db_secrets = [
    "pg/main_db/datadog",
    "pg/workflowdb/datadog",
    "pg/slz/datadog",
  ]
  rotated_db_secrets  = var.secrets_rotation ? local.db_secrets : []
  rotation_lambda_arn = "arn:aws:lambda:${var.aws_region_id}:${local.account_id}:function:${local.name_prefix}-secrets-rotator-${local.project_group}-${var.env_prefix}"
}

resource "aws_secretsmanager_secret" "datadog_db_users" {
  for_each   = toset(local.db_secrets)
  name       = "${local.secrets_name_prefix}/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_general_key.id

  tags = { plat_env_project_service = "${local.aggregated_tag}_SCRT" }
}

resource "aws_secretsmanager_secret_rotation" "datadog_db_users" {
  for_each            = toset(local.rotated_db_secrets)
  secret_id           = aws_secretsmanager_secret.datadog_db_users[each.value].id
  rotation_lambda_arn = local.rotation_lambda_arn

  rotation_rules {
    automatically_after_days = 90
  }
}