# AOMA Core Prod Secrets Manager

This Terraform root manages AWS Secrets Manager secrets for AOMA database connection details in the prod AWS account.

## Purpose

These secrets hold placeholder database connection settings for AOMA services running in the `prod` environment. They are intended to provide a consistent Secrets Manager structure for application configuration and a planned follow-up RDS Proxy integration.

## Managed secrets

- `prod/AOMA/aoma_persistence_db_secrets`
- `prod/AOMA/aoma_metadata_db_secrets`
- `prod/AOMA/aoma_export_db_secrets`
- `prod/AOMA/aoma_eom_messaging_db_secrets`
- `prod/AOMA/aoma_asset_register_db_secrets`
- `prod/AOMA/aoma_tuser_db_secrets`
- `prod/da/AmpAsperaUtil`

## Secret values

Terraform creates each secret with placeholder values from `locals.tf`. Real database names, usernames, and passwords should be populated manually in AWS Secrets Manager after the initial Terraform apply.

The `aws_secretsmanager_secret_version` resource uses `ignore_changes = [secret_string]`, so future Terraform applies will not overwrite manually updated secret values.

## RDS Proxy integration

RDS Proxy integration is planned for a follow-up change. This root only creates and maintains the Secrets Manager entries that applications or future RDS Proxy configuration can reference.

## Lifecycle protection

The `aws_secretsmanager_secret` resource uses `prevent_destroy = true` to protect secrets from accidental deletion through Terraform. If a secret must be removed, this protection should be handled intentionally as part of a dedicated change.