resource "aws_secretsmanager_secret" "aoma_database_secrets" {
  for_each = local.secrets

  name        = each.key
  description = each.value.description

  tags = merge(
    local.common_secret_tags,
    {
      environment = each.value.environment
    }
  )

  lifecycle {
    prevent_destroy = true
  }
}

resource "aws_secretsmanager_secret_version" "aoma_database_secrets_values" {
  for_each = local.secrets

  secret_id     = aws_secretsmanager_secret.aoma_database_secrets[each.key].id
  secret_string = jsonencode(each.value.secret_value)

  lifecycle {
    ignore_changes = [secret_string]
  }
}