resource "aws_kms_key" "secret" {
  description             = var.name
  enable_key_rotation     = true
  deletion_window_in_days = 30

  tags = merge(var.service_tags, {
    Name = var.name
  })
}

resource "aws_kms_alias" "secret" {
  name          = "alias/${var.name}"
  target_key_id = aws_kms_key.secret.id
}

resource "aws_secretsmanager_secret" "secret" {
  name        = var.name
  description = var.description
  kms_key_id  = aws_kms_key.secret.arn
  tags = merge(
    var.service_tags, {
      Name = var.name
  })
}

resource "aws_secretsmanager_secret_version" "secret" {
  secret_id     = aws_secretsmanager_secret.secret.id
  secret_string = var.secret_string
}

resource "aws_secretsmanager_secret_rotation" "secret" {
  count = var.rotation_lambda_arn != null ? 1 : 0

  secret_id           = aws_secretsmanager_secret.secret.id
  rotation_lambda_arn = var.rotation_lambda_arn

  rotation_rules {
    automatically_after_days = var.rotation_days
  }
}