provider "aws" {
  region  = var.aws_region
  profile = "gdb-infra-prod"
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "gdb-infra-prod-tfstate"
    key     = "prod/datadog/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
    profile = "gdb-infra-prod"
  }
}

module "datadog_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.0.6"
  for_each = toset(var.secrets_manager_secret_names)

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = each.value
  application_family             = var.application_family
  secret_recovery_window_in_days = 30
}

module "secrets_policy" {
  source       = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/secretsmanager/secrets_list?ref=0.1.1"
  secrets      = [for secret in module.datadog_secrets : secret.secret_name]
  action_types = ["read"]
}

resource "aws_iam_policy" "datadog_secrets_access" {
  name   = "SecretsManager-${var.environment}-datadog-policy"
  policy = module.secrets_policy.policy.json

  tags = {
    environment        = var.environment
    application_family = var.application_family
    terraformed        = true
  }
}