provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/ows-machine-to-machine/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}


module "ows_machine_to_machine_client_secret" {
  source             = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.3.1"
  environment        = var.environment
  service_name       = var.service_name
  secret_name        = "client_secret"
  application_family = var.application_family
}

data "aws_secretsmanager_secret" "jwt_token" {
  name = "${var.environment}/${var.jwt_lambda_name}/jwt_token"
}

data "aws_secretsmanager_secret" "jwt_token_expiration" {
  name = "${var.environment}/${var.jwt_lambda_name}/jwt_token_expiration"
}

data "aws_secretsmanager_secret" "jwt_enabled_services" {
  name = "${var.environment}/${var.jwt_lambda_name}/jwt_enabled_services"
}

# ows-machine-to-machine secrets manager policy
data "aws_iam_policy_document" "ows-machine-to-machine-secrets-manager-policy-document" {
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      module.ows_machine_to_machine_client_secret.secret_arn,
      data.aws_secretsmanager_secret.jwt_token.arn,
      data.aws_secretsmanager_secret.jwt_token_expiration.arn
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]

    resources = [
      "*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:UpdateSecret",
    ]

    resources = [
      data.aws_secretsmanager_secret.jwt_enabled_services.arn
    ]
  }
}

resource "aws_iam_policy" "ows-machine-to-machine-secrets-manager-policy" {
  name   = "SecretsManager-${var.environment}-${var.service_name}-policy"
  policy = data.aws_iam_policy_document.ows-machine-to-machine-secrets-manager-policy-document.json
  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = true
  }
}