output "serviceonly_key" {
  description = "Service-only key object"
  value       = aws_kms_key.secrets_serviceonly_key
}

output "general_key" {
  description = "General key object"
  value       = aws_kms_key.secrets_general_key
}

output "maintenance_root_key" {
  value = aws_kms_key.secrets_maintenance_root_key
}

output "maintenance_common_key" {
  value = aws_kms_key.secrets_maintenance_common_key
}

output "serviceonly_alias" {
  description = "Service-only alias arn"
  value       = aws_kms_alias.secrets_serviceonly_alias.arn
}

output "maintenance_common_alias" {
  description = "Maintenance common alias arn"
  value       = aws_kms_alias.secrets_maintenance_common_alias.arn
}

output "maintenance_root_alias" {
  description = "Maintenance root alias arn"
  value       = aws_kms_alias.secrets_maintenance_root_alias.arn
}

output "general_alias" {
  description = "Service-only alias arn"
  value       = aws_kms_alias.secrets_general_alias.arn
}

output "secrets_services_ro_policy" {
  description = "IAM policy for services which need readonly access to secrets"
  value       = aws_iam_policy.secrets_services_ro
}

output "secrets_services_rw_policy" {
  description = "IAM policy for services which need write access to secrets"
  value       = aws_iam_policy.secrets_services_rw
}

output "secrets_users_ro_policy" {
  description = "IAM policy for users which need read access to secrets"
  value       = aws_iam_policy.secrets_users_ro
}

output "secrets_users_rw_policy" {
  description = "IAM policy for users which need write access to secrets"
  value       = aws_iam_policy.secrets_users_rw
}

output "secrets_deployment_ro_policy" {
  description = "IAM policy for users which need read access to secrets"
  value       = aws_iam_policy.secrets_deployment_ro
}

output "secrets_rotation_rw_policy" {
  description = "IAM policy for users which need write access to secrets"
  value       = aws_iam_policy.secrets_rotation_rw
}

output "kms_management_policy" {
  description = "IAM policy for managing CMK created by this module."
  value       = aws_iam_policy.kms_management
}