locals {
  slz_secrets_set = toset([
    "admin/auth0",
    "IST_S3",
    "IST_S3_other",
    "api/auth0",
    "api/clients_list",
    "apple",
    "gras_db",
    "linkfire",
    "sme_max",
    "spotify",
    "spotify_v2",
    "theorchard_amazon",
    "uow_monitoring",
    "vevo",
    "youtubereporting",
    "admin/general",
    "brandwatch/google_sheets_config",
    "brandwatch/bw_config",
    "partnerize_apple",
    "partnerize_spotify",
  ])
  slz_rotated_secrets_set = toset([
    "storage/pg_proxy/reader",
    "storage/pg_proxy/user",
  ])
}

resource "aws_secretsmanager_secret" "slz_secrets" {
  for_each   = local.slz_secrets_set
  name       = "${local.secrets_name_prefix}/slz/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )

  lifecycle {
    ignore_changes = [description]
  }
}

resource "aws_secretsmanager_secret" "slz_rotated_secrets" {
  for_each   = local.slz_rotated_secrets_set
  name       = "${local.secrets_name_prefix}/slz/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )

  lifecycle {
    ignore_changes = [description]
  }
}

resource "aws_secretsmanager_secret_rotation" "slz_rotated_secrets" {
  for_each            = local.slz_rotated_secrets_set
  secret_id           = aws_secretsmanager_secret.slz_rotated_secrets[each.value].id
  rotation_lambda_arn = local.rotation_lambda_arn

  rotation_rules {
    automatically_after_days = 90
  }
}