# Terraform-infra: Provisioning Integration Test Secrets

Before proceeding, ask the user for the following. The answers determine the secret names you will add.

1. **What is the service name prefix?** (e.g. `GRAPHQL_USER`, `CONTENT_REVIEWER`) — the SCREAMING_SNAKE_CASE name of the service being tested.

2. **What is the suite app name?** (e.g. `TEST`, `APP`) — combined with the service prefix, this becomes `<SERVICE_NAME>_<SUITE_APP_NAME>_APP_AUTH0_CREDENTIALS`. There is one Auth0 credentials secret per app.

3. **What user personas need secrets?** List the full persona identifiers including the service prefix (e.g. `CONTENT_REVIEWER_PP`, `CONTENT_REVIEWER_PROFILE`) — each becomes `<FULL_PERSONA>_USER_CREDENTIALS`.

---

Integration test secrets for each service live under `qa/<service-name>/integration-test/` or `qa/<service-name>/integration-tests/` in the `theorchard/terraform-infra` repo. Check which variant exists for your service before proceeding.

There are two cases:

- **The directory already exists** — just add a name to the secret list in `variables.tf`.
- **The directory doesn't exist yet** — create it as `integration-test` (not `integration-tests`) and add both `main.tf` and `variables.tf` from the templates below.

## Case A: Directory already exists — add a secret

While you're here, check whether `versions.tf` exists in the directory. If it doesn't, create it using the template in Case B below.

In `qa/<service-name>/integration-test/variables.tf`, add your new secret name to `secrets_manager_secret_names`. Each entry becomes a Secrets Manager secret at the path `qa/<service_name>/<SECRET_NAME>` (where `service_name` is the value of the `service_name` variable in that file, typically `<service>-integration-test`).

```hcl
variable "secrets_manager_secret_names" {
  description = "List of secrets manager secrets to create"
  type        = list(string)
  default = [
    "EXISTING_SECRET_ONE",
    "EXISTING_SECRET_TWO",
    "MY_NEW_SECRET_NAME",   # <-- add this
  ]
}
```

**Example**: theorchard/terraform-infra#26688 adds a new secret for the graphql-user SEAT admin test user:

```hcl
default = [
  "GRAPHQL_USER_TEST_USER_CREDENTIALS",
  "GRAPHQL_USER_TEST_APP_AUTH0_CREDENTIALS",
  "GRAPHQL_USER_TEST_SEAT_ADMIN_USER_CREDENTIALS",  # <-- new user added here
]
```

Prefer the full-prefix naming style (e.g. `GRAPHQL_USER_TEST_SEAT_ADMIN_USER_CREDENTIALS`) over short names (e.g. `SEAT_ADMIN_PASSWORD`) — it makes the secret's origin unambiguous when browsing Secrets Manager.

## Case B: Directory doesn't exist yet — create it from scratch

You need to create three files. Use the templates below, substituting your service name throughout.

**`qa/<service-name>/integration-test/main.tf`**

```hcl
provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/<service-name>/integration-test/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "integration_test_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = each.value
  application_family             = var.application_family
  secret_recovery_window_in_days = 30

  additional_tags = {
    secret_type = "integration-tests"
  }
}

data "aws_iam_policy_document" "secrets_manager_policy_document" {
  statement {
    effect = "Allow"

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.service_name}/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.service_name}/*",
    ]
  }
}

# Assume role policy used by Jenkins scheduler agent role
data "aws_iam_policy_document" "jenkins_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::437795906767:role/prod-jenkins-aws-pipeline-agent",
      ]
    }
  }
}

# SecretManager Access Policy
resource "aws_iam_policy" "secrets_manager_policy" {
  name   = "SecretManager-${var.environment}-${var.service_name}-policy"
  policy = data.aws_iam_policy_document.secrets_manager_policy_document.json
}

# Jenkins agents will assume this role in order to access SecretManager
resource "aws_iam_role" "jenkins_invoke_role" {
  name               = "${var.environment}-${var.service_name}-role"
  assume_role_policy = data.aws_iam_policy_document.jenkins_assume_role_policy.json
}

# Attach SecretManager access policy to Jenkins role.
resource "aws_iam_role_policy_attachment" "integration_secret_manager_policy_attachment" {
  role       = aws_iam_role.jenkins_invoke_role.id
  policy_arn = aws_iam_policy.secrets_manager_policy.arn
}
```

**`qa/<service-name>/integration-test/variables.tf`**

```hcl
variable "aws_region" {
  default     = "us-east-1"
  description = "Which AWS region to spin up the environment in"
}

variable "environment" {
  description = "Available values:  dev, qa, prod."
  default     = "qa"
}

variable "service_name" {
  default = "<service-name>-integration-test"
}

variable "application_family" {
  default = "<application-family>"  # e.g. "user-platform", "permissions-platform"
}

variable "secrets_manager_secret_names" {
  description = "List of secrets manager secrets to create"
  type        = list(string)
  default = [
    "MY_FIRST_SECRET_NAME",
  ]
}
```

**`qa/<service-name>/integration-test/versions.tf`**

Before creating this file, check [https://releases.hashicorp.com/terraform/](https://releases.hashicorp.com/terraform/) for the latest stable version — skip any releases tagged with `alpha`, `beta`, or `rc`. Use that version in place of the placeholder below:

```hcl
terraform {
  required_version = "<latest-stable-version>"
}
```

Note that `service_name` is set to `<service-name>-integration-test` (with the `-integration-test` suffix), not just the bare service name. This means secrets are stored at `qa/<service-name>-integration-test/<SECRET_NAME>` — make sure your test code uses that same path when loading them.

See theorchard/terraform-infra#25404 for a real example of bootstrapping this from scratch.