locals {
  account_id = data.aws_caller_identity.this.account_id
  region     = data.aws_region.this.region
}

data "aws_caller_identity" "this" {}

data "aws_region" "this" {}

data "aws_iam_policy_document" "this" {
  version = "2012-10-17"
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
    resources = formatlist("arn:aws:secretsmanager:${local.region}:${local.account_id}:secret:%s", var.secrets_path)
    effect    = "Allow"
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
      "secretsmanager:ListSecrets",
      "kms:ListAliases",
    ]
    resources = ["*"]
    effect    = "Allow"
  }

  statement {
    actions = [
      "kms:Decrypt",
    ]
    resources = var.kms_keys_arns
    effect = "Allow"
    condition {
      test     = "StringEquals"
      values   = [local.account_id]
      variable = "kms:CallerAccount"
    }
    condition {
      test     = "StringEquals"
      values   = ["secretsmanager.${local.region}.amazonaws.com"]
      variable = "kms:ViaService"
    }
  }
}