data "aws_iam_policy" "secrets-rotation-rw" {
  arn = "${local.policy_base_arn}-secrets-rotation-rw"
}

data "aws_kms_key" "secrets_maintenance_root_key" {
  key_id = "alias/${local.env_prefix}/${local.project_group}/secrets_maintenance_root"
}

data "aws_kms_key" "secrets_maintenance_common_key" {
  key_id = "alias/${local.env_prefix}/${local.project_group}/secrets_maintenance_common"
}

module "secrets_rotator_role" {
  source      = "../../../modules/iam/roles/lambda_role"
  name_prefix = local.name_prefix
  name        = "secrets_rotator_role"
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Lambda",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_LMB"
    }
  )
  policies_list = [
    data.aws_iam_policy.logging.arn,
    data.aws_iam_policy.secrets-rotation-rw.arn,
  ]

  allow_execution_inside_vpc = true
}

locals {
  maintenance_root_secrets_without_autorotate = [
    "SLACK_TOKEN",
  ]
  maintenance_common_secrets_without_autorotate = []
  maintenance_root_secrets = [
    "main_admin",
    "slz_admin",
    "workflowdb_admin",
    "pd_etldb_admin",
  ]
  maintenance_common_secrets = [
    "chartmetric_owner",
    "slz_owner",
    "slz_owner2",
    "main_owner",
    "workflowdb_owner",
    "pd_etldb_owner",
  ]
  rotation_lambda_arn = "arn:aws:lambda:${var.aws_region_id}:${local.account_id}:function:${local.name_prefix}-secrets-rotator-${local.project_group}-${local.env_prefix}"
}

resource "aws_secretsmanager_secret" "maintenance_root_secrets_without_autorotate" {
  for_each   = toset(local.maintenance_root_secrets_without_autorotate)
  name       = "maintenance/root/${local.secrets_name_prefix}/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_maintenance_root_key.id
  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "maintenance_common_secrets_without_autorotate" {
  for_each   = toset(local.maintenance_common_secrets_without_autorotate)
  name       = "maintenance/common/${local.secrets_name_prefix}/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_maintenance_common_key.id
  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "maintenance_root_secrets" {
  for_each   = toset(local.maintenance_root_secrets)
  name       = "maintenance/root/${local.secrets_name_prefix}/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_maintenance_root_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret_rotation" "maintenance_root_secrets" {
  for_each            = toset(local.maintenance_root_secrets)
  secret_id           = aws_secretsmanager_secret.maintenance_root_secrets[each.value].id
  rotation_lambda_arn = local.rotation_lambda_arn

  rotation_rules {
    automatically_after_days = 90
  }
}

resource "aws_secretsmanager_secret" "maintenance_common_secrets" {
  for_each   = toset(local.maintenance_common_secrets)
  name       = "maintenance/common/${local.secrets_name_prefix}/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_maintenance_common_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret_rotation" "maintenance_common_secrets" {
  for_each            = toset(local.maintenance_common_secrets)
  secret_id           = aws_secretsmanager_secret.maintenance_common_secrets[each.value].id
  rotation_lambda_arn = local.rotation_lambda_arn

  rotation_rules {
    automatically_after_days = 90
  }
}