module "secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(concat(var.secrets_manager_secret_names, var.dsp_secret_names))

  application_family = var.application_family
  environment        = var.environment
  service_name       = var.service_name
  secret_name        = each.value
}

data "aws_iam_policy_document" "encryption_keys_read_policy_document" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:*:*:secret:${local.encryption_keys_secret_name}-*",
    ]
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

resource "aws_iam_policy" "encryption_keys_read_policy" {
  name        = "SecretsManager-${var.environment}-${var.service_name}-encryption-keys-RO"
  description = "Read-only access to the ENCRYPTION_KEYS secret for ${var.service_name}"
  policy      = data.aws_iam_policy_document.encryption_keys_read_policy_document.json
}

data "aws_iam_policy_document" "encryption_keys_write_policy_document" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:*:*:secret:${local.encryption_keys_secret_name}-*",
    ]
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:PutSecretValue",
      "secretsmanager:UpdateSecret",
      "secretsmanager:UpdateSecretVersionStage",
    ]
  }
}

resource "aws_iam_policy" "encryption_keys_write_policy" {
  name        = "SecretsManager-${var.environment}-${var.service_name}-encryption-keys-RW"
  description = "Read-write access to the ENCRYPTION_KEYS secret for ${var.service_name}"
  policy      = data.aws_iam_policy_document.encryption_keys_write_policy_document.json
}

data "aws_iam_policy_document" "dsp_secrets_read_policy_document" {
  statement {
    effect = "Allow"
    resources = [
      for name in var.dsp_secret_names :
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.service_name}/${name}-*"
    ]
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

resource "aws_iam_policy" "dsp_secrets_read_policy" {
  name        = "SecretsManager-${var.environment}-${var.service_name}-dsp-secrets-RO"
  description = "Read-only access to DSP integration client secrets for ${var.service_name}"
  policy      = data.aws_iam_policy_document.dsp_secrets_read_policy_document.json
}