data "aws_secretsmanager_secret" "this" {
  for_each = toset(var.secrets)
  name     = each.value
}

data "aws_kms_key" "this" {
  for_each = toset([for k, v in data.aws_secretsmanager_secret.this : v.kms_key_id])
  key_id   = each.value
}

locals {
  key_to_secrets_map = {
    for k, v in data.aws_kms_key.this : v.arn => [for s in data.aws_secretsmanager_secret.this : s.arn if s.kms_key_id == k]
  }
}

data "aws_iam_policy_document" "read_policy" {
  statement {
    sid = "AllowReadSecret"
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
    ]
    resources = [for k, v in data.aws_secretsmanager_secret.this : v.arn]
  }

  dynamic "statement" {
    for_each = local.key_to_secrets_map
    content {
      sid = "AllowKMSActions"
      actions = [
        "kms:Decrypt",
        "kms:DescribeKey",
      ]
      resources = [
        statement.key
      ]
      condition {
        test     = "StringLike"
        variable = strcontains("alias/aws/secretsmanager", statement.key) ? "kms:EncryptionContext:aws:secretsmanager:SecretARN" : "kms:EncryptionContext:SecretARN"
        values   = statement.value
      }
    }
  }
}

data "aws_iam_policy_document" "read_write_policy" {
  statement {
    sid = "AllowRWSecret"
    actions = [
      "secretsmanager:UpdateSecretVersionStage",
      "secretsmanager:PutSecretValue",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
    ]
    resources = [for k, v in data.aws_secretsmanager_secret.this : v.arn]
  }

  dynamic "statement" {
    for_each = local.key_to_secrets_map
    content {
      sid = "AllowKMSActions"
      actions = [
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:DescribeKey",
      ]
      resources = [
        statement.key
      ]
      condition {
        test     = "StringLike"
        variable = strcontains("alias/aws/secretsmanager", statement.key) ? "kms:EncryptionContext:aws:secretsmanager:SecretARN" : "kms:EncryptionContext:SecretARN"
        values   = statement.value
      }
    }
  }
}