locals {
  secret_list = concat([
    var.env == "prod" ? "o11y-prod-ram": "o11y-dev-staging-ram",
  ])
  secret_set  = toset(var.region == var.source_region ? [] : local.secret_list)
}

data "alicloud_kms_secret_versions" "this" {
  for_each       = local.secret_set
  secret_name    = each.key
  enable_details = true

  provider = alicloud.source
}

resource "alicloud_kms_secret" "this" {
  for_each                    = local.secret_set
  secret_name                 = each.key
  secret_data                 = data.alicloud_kms_secret_versions.this[each.key].versions.0.secret_data
  version_id                  = "v1"
  description                 = "secret copy from ${var.source_region}"
  encryption_key_id           = alicloud_kms_key.this.id
  dkms_instance_id            = alicloud_kms_instance.this.id
  force_delete_without_recovery = true
}