module "multiple_secrets_with_same_settings" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = each.value
  application_family             = var.application_family
  secret_recovery_window_in_days = 30
}

# Secrets for s3 storage.
module "s3_storage_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.physical_location_ids)

  environment                    = var.environment
  service_name                   = "${var.service_name}/${each.key}"
  secret_name                    = "STORAGE_CREDENTIALS"
  application_family             = var.application_family
  secret_recovery_window_in_days = 30
}

data "aws_iam_policy_document" "secrets_manager_storage_credential_policy_document" {
  for_each = toset(var.physical_location_ids)
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.service_name}/${each.key}/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.service_name}/${each.key}/*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]

    resources = [
      "*",
    ]
  }
}

resource "aws_iam_policy" "secrets_manager_storage_credential_policy" {
  for_each = data.aws_iam_policy_document.secrets_manager_storage_credential_policy_document

  name        = "Secretsmanager-${var.environment}-${var.service_name}-physical-location-${each.key}-policy"
  description = "Policy for accessing secrets manager storage credentials for ${var.environment} ${var.service_name} physical location ${each.key}"
  policy      = data.aws_iam_policy_document.secrets_manager_storage_credential_policy_document[each.key].json
}

# IAM policy to read Secrets from prod/direct_delivery/connection_info
data "aws_iam_policy_document" "delivery_spec_secret_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "secretsmanager:GetSecretValue"
    ]
    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/direct_delivery/connection_info/*"
    ]
  }
}

resource "aws_iam_policy" "secrets_manager_delivery_spec_policy" {
  name        = "Secretsmanager-${var.environment}-${var.service_name}-delivery-spec-policy"
  description = "Policy for accessing secrets manager direct_delivery/connection_info"
  policy      = data.aws_iam_policy_document.delivery_spec_secret_policy_document.json
}