# Secrets for s3 storage.
module "s3_storage_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = var.physical_location_ids

  environment                    = var.environment
  service_name                   = "${var.service_name}/${each.key}"
  secret_name                    = "STORAGE_CREDENTIALS"
  application_family             = var.application_family
  secret_recovery_window_in_days = 30
}

data "aws_iam_policy_document" "secrets_manager_storage_credential_policy_document" {
  for_each = var.physical_location_ids
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.service_name}/${each.key}/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.service_name}/${each.key}/*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]

    resources = [
      "*",
    ]
  }
}

resource "aws_iam_policy" "secrets_manager_storage_credential_policy" {
  for_each = data.aws_iam_policy_document.secrets_manager_storage_credential_policy_document

  name        = "Secretsmanager-${var.environment}-${var.service_name}-physical-location-${each.key}-policy"
  description = "Policy for accessing secrets manager storage credentials for ${var.environment} ${var.service_name} physical location ${each.key}"
  policy      = data.aws_iam_policy_document.secrets_manager_storage_credential_policy_document[each.key].json
}