locals {
  secret_list = concat([
    "${var.env}-proxy-auth0-client",
    "${var.env}-o11y-auth0-client",
    "${var.env}_o11y_agent_ram",
    "${var.env}_o11y_agent_ram_prod",
    "crossplane-provider",
    "metering-ram-key",
  ], [for acct in local.shoot_accounts : "crossplane-provider-${acct}"])
  secret_set = toset(var.region == var.source_region ? [] : local.secret_list)
}

data "alicloud_kms_secret_versions" "this" {
  for_each       = local.secret_set
  secret_name    = each.key
  enable_details = true

  provider = alicloud.source
}

resource "alicloud_kms_secret" "this" {
  for_each          = local.secret_set
  secret_name       = each.key
  secret_data       = reverse(data.alicloud_kms_secret_versions.this[each.key].versions).0.secret_data
  version_id        = "v1"
  description       = "secret copy from ${var.source_region}"
  encryption_key_id = alicloud_kms_key.this.id
  dkms_instance_id  = alicloud_kms_instance.this.id
  force_delete_without_recovery = true
}