# KMS Keys
module "kms_secrets_manager" {
  source = "../../modules/kms/secrets_kms_v2"

  env_prefix    = local.env_prefix
  project_group = local.project_group
  region        = var.aws_region_id

  common_tags = merge(
    local.common_tags,
    {
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_SCRT"
    }
  )
}

module "jenkins_kms_secrets_manager" {
  source = "../../modules/kms/secrets_kms"

  env_prefix    = "jenkins"
  project_group = local.project_group
  region        = var.aws_region_id

  common_tags = merge(
    local.common_tags,
    {
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_SCRT"
    }
  )
}

module "auth0_terraform_kms_policy" {
  source = "../../modules/backend/kms_policy"

  account_id             = local.account_id
  allowed_admin_accounts = var.auth0_state_allowed_users
  allowed_admin_roles    = var.auth0_state_allowed_roles
}

resource "aws_kms_key" "auth0_terraform_kms_key" {
  description         = "KMS key for Auth0 terraform bucket."
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = module.auth0_terraform_kms_policy.kms_policy_json
}

resource "aws_kms_alias" "auth0_terraform_kms_alias" {
  name          = "alias/auth0_terraform"
  target_key_id = aws_kms_key.auth0_terraform_kms_key.key_id
}

module "auth0_backups_kms_policy" {
  source = "../../modules/backend/kms_policy"

  account_id             = local.account_id
  allowed_admin_accounts = var.auth0_backup_allowed_users
  allowed_admin_roles    = var.auth0_backup_allowed_roles
}

resource "aws_kms_key" "auth0_backups_kms_key" {
  description         = "KMS key for Auth0 backups bucket."
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = module.auth0_backups_kms_policy.kms_policy_json
}

resource "aws_kms_alias" "auth0_backups_kms_alias" {
  name          = "alias/auth0_backups"
  target_key_id = aws_kms_key.auth0_backups_kms_key.key_id
}

data "aws_kms_alias" "default_ebs" {
  name = "alias/default_ebs"
}