module "multiple_secrets_with_same_settings" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = each.value
  application_family             = var.application_family
  secret_recovery_window_in_days = 30
}

# Secrets for s3 storage.
module "s3_storage_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = var.physical_location_ids

  environment                    = var.environment
  service_name                   = "${var.service_name}/${each.key}"
  secret_name                    = "STORAGE_CREDENTIALS"
  application_family             = var.application_family
  secret_recovery_window_in_days = 30
}

data "aws_iam_policy_document" "secrets_manager_storage_credential_policy_document" {
  for_each = var.physical_location_ids
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.service_name}/${each.key}/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.service_name}/${each.key}/*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]

    resources = [
      "*",
    ]
  }
}

resource "aws_iam_policy" "secrets_manager_storage_credential_policy" {
  for_each = data.aws_iam_policy_document.secrets_manager_storage_credential_policy_document

  name        = "Secretsmanager-${var.environment}-${var.service_name}-physical-location-${each.key}-policy"
  description = "Policy for accessing secrets manager storage credentials for ${var.environment} ${var.service_name} physical location ${each.key}"
  policy      = data.aws_iam_policy_document.secrets_manager_storage_credential_policy_document[each.key].json
}

# Auth0 M2M credentials for service-to-service authentication
module "encoder_m2m_secret" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//modules/auth0m2m?ref=1.6.1"

  environment        = var.environment
  service_name       = var.service_name
  application_family = var.application_family
}

data "aws_iam_policy_document" "vector_encoder_m2m_token_secrets_manager_policy_document" {
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      module.encoder_m2m_secret.jwt_access_token_secret_arn,
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]

    resources = [
      "*",
    ]
  }
}

resource "aws_iam_policy" "vector_encoder_m2m_token_secrets_manager_policy" {
  name        = format("SecretsManager-%s-%s-m2m-token-secrets-policy", var.environment, var.service_name)
  description = "temporary policy"
  policy      = data.aws_iam_policy_document.vector_encoder_m2m_token_secrets_manager_policy_document.json

  tags = {
    environment        = var.environment
    application_family = var.application_family
    service_name       = var.service_name
  }
}