# terraform-secrets-manager

## Overview

This module provides functionality to create AWS secrets manager secrets and configure their properties.

This module follows a few conventions:

- Secrets will be named `var.environment/var.service_name/var.secret_name` (e.g. `qa/ows-users/DB_PASSWORD`)
- Secret values should be provided and updated out-of-band, unless module outputs or other data sources, which are not stored in source control, can be provided as inputs. Note that this may result in the value being stored in the terraform state file, which we also do not want, so please test accordingly
- Do not put secret values in plaintext when using this module

## Resources

#### The module manages the following:

- AWS Secrets Manager secrets
- (Optional) AWS KMS keys for secret-specific encryption (if not enabled, the AWS-managed encryption key will be used. Secrets are always encrypted at rest)
- (Optional) Secret replication to one or more regions
- (Optional) Secret rotation schedule, if a lambda ARN is provided
- (Default true) Configuring a lambda ARN's permission to allow the secret be rotated by the lambda. You might disable this if you are configuring the lambda ARN's permissions directly/alongside the lambda function, instead of relying on the secret to configure it. 

#### The module does not manage the following:

- Secret rotation lambdas: those should be provisioned separately, and the ARN provided as a variable to this module
- IAM access to secrets

## Workflow

### Variables

There are several variables that must be provided for the module to function properly:

```
* var.environment
* var.service_name
* var.secret_name (name of secret, minus environment and service_name)
* var.application_family (used for resource tagging)
```

``secret_recovery_window_in_days`` set to 30  days as default. 

*Because of case of lost secrets due to long holidays. 

### Automatic Rotation

#### Schedules

To use automated secrets rotation, first set `var.secret_rotation_enabled` to `true`, and then specify one of the following rotation schedules:
* Rotate every _n_ days: set `var.secret_rotation_interval_in_days` to an integer value
* Rotate according to a particular schedule: set `var.secret_rotation_schedule_expression` to a `cron()` or `rate()` expression

#### Lambda

Set the value of `var.secret_rotation_lambda_arn` to a lambda ARN

## Examples

See the `test/` directory in this repo, or the `examples/` directory in [terraform-infra](https://github.com/theorchard/terraform-infra/tree/master/examples) to see examples.