module "kms_secrets_manager" {
  source        = "../../modules/kms/secrets_kms"
  env_prefix    = local.env_prefix
  project_group = local.project_group
  region        = var.aws_region_id
  common_tags = merge(
    local.common_tags,
    {
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_SCRT"
    }
  )
}

module "auth0_backups_kms_policy" {
  source = "../../modules/backend/kms_policy"

  account_id             = local.account_id
  allowed_admin_accounts = var.auth0_backup_allowed_users
  allowed_admin_roles    = var.auth0_backup_allowed_roles
}

resource "aws_kms_key" "auth0_backups_kms_key" {
  description         = "KMS key for Auth0 backups bucket."
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = module.auth0_backups_kms_policy.kms_policy_json
}

resource "aws_kms_alias" "auth0_backups_kms_alias" {
  name          = "alias/auth0_backups"
  target_key_id = aws_kms_key.auth0_backups_kms_key.key_id
}

module "splunk_packages_kms_policy" {
  source = "../../modules/backend/kms_policy"

  account_id             = local.account_id
  allowed_admin_accounts = var.splunk_packages_allowed_users
  allowed_admin_roles    = var.splunk_packages_allowed_roles
}

resource "aws_kms_key" "splunk_packages_kms_key" {
  description         = "KMS key for Splunk packages bucket."
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = module.splunk_packages_kms_policy.kms_policy_json
}

resource "aws_kms_alias" "splunk_packages_kms_alias" {
  name          = "alias/splunk_packages"
  target_key_id = aws_kms_key.splunk_packages_kms_key.key_id
}

module "admin_only_kms_policy" {
  source = "../../modules/backend/kms_policy"

  account_id             = local.account_id
  allowed_admin_accounts = var.admin_only_allowed_users
  allowed_admin_roles    = var.admin_only_allowed_roles
}

resource "aws_kms_key" "admin_only_kms_key" {
  description         = "Key which usage is restricted only to specific users in account."
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = module.admin_only_kms_policy.kms_policy_json
}

resource "aws_kms_alias" "admin_only_kms_alias" {
  name          = "alias/admins_only_key"
  target_key_id = aws_kms_key.admin_only_kms_key.key_id
}