# This file holds shared secrets for SWF/ETL ingestion jobs.

# create secrets:
# env/swf-shared-jenkins/JENKINS_API_TOKEN

module "shared_jenkins_secrets" {
  source             = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each           = toset(local.shared_jenkins_secrets)
  environment        = var.environment
  service_name       = local.shared_jenkins_secret_service_name
  secret_name        = each.value
  application_family = var.application_family
}

data "aws_iam_policy_document" "shared_jenkins_secrets_policy" {
  statement {
    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
    ]
    effect    = "Allow"
    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${local.shared_jenkins_secret_service_name}/*",
    ]
  }
}

resource "aws_iam_policy" "shared_jenkins_secrets_policy_document" {
  name   = local.shared_jenkins_secrets_policy_name
  policy = data.aws_iam_policy_document.shared_jenkins_secrets_policy.json
}