# AOMA Core Dev/Stage Secrets Manager

This Terraform root manages AWS Secrets Manager secrets for AOMA database connection details in the dev AWS account.

## Purpose

These secrets hold placeholder database connection settings for AOMA services running in the `dev` and `stage` environments. They are intended to provide a consistent Secrets Manager structure for application configuration and a planned follow-up RDS Proxy integration.

## Managed secrets

- `dev/AOMA/aoma_persistence_db_secrets`
- `stage/AOMA/aoma_persistence_db_secrets`
- `dev/AOMA/aoma_metadata_db_secrets`
- `stage/AOMA/aoma_metadata_db_secrets`
- `dev/AOMA/aoma_export_db_secrets`
- `stage/AOMA/aoma_export_db_secrets`
- `dev/AOMA/aoma_eom_messaging_db_secrets`
- `stage/AOMA/aoma_eom_messaging_db_secrets`
- `dev/AOMA/aoma_asset_register_db_secrets`
- `stage/AOMA/aoma_asset_register_db_secrets`
- `dev/AOMA/aoma_tuser_db_secrets`
- `stage/AOMA/aoma_tuser_db_secrets`
- `dev/da/AmpAsperaUtil`
- `stage/da/AmpAsperaUtil`

## Secret values

Terraform creates each secret with placeholder values from `locals.tf`. Real database names, usernames, and passwords should be populated manually in AWS Secrets Manager after the initial Terraform apply.

The `aws_secretsmanager_secret_version` resource uses `ignore_changes = [secret_string]`, so future Terraform applies will not overwrite manually updated secret values.

## RDS Proxy integration

RDS Proxy integration is planned for a follow-up change. This root only creates and maintains the Secrets Manager entries that applications or future RDS Proxy configuration can reference.

## Lifecycle protection

The `aws_secretsmanager_secret` resource uses `prevent_destroy = true` to protect secrets from accidental deletion through Terraform. If a secret must be removed, this protection should be handled intentionally as part of a dedicated change.