locals {
  starter_meta_databases = local.starter_remote_eks_enabled ? {
    audit = {
      database_name = "serverless_rds"
    }
    infra = {
      database_name = "serverless_infra"
    }
  } : {}
}

resource "random_password" "starter_audit_log_key" {
  count = local.starter_remote_eks_enabled ? 1 : 0

  length  = 32
  special = false
  upper   = true
  numeric = true
}

resource "random_password" "starter_cse_master_key" {
  count = local.starter_remote_eks_enabled ? 1 : 0

  length  = 32
  special = false
  upper   = true
  numeric = true
}

resource "aws_secretsmanager_secret" "starter_meta_database" {
  for_each = local.starter_meta_databases

  name                    = "cp9/${local.session_name}/starter-${each.key}-database"
  description             = "cp9 ${local.session_name} Starter ${each.key} database on the shared Dev full metadb"
  recovery_window_in_days = 0

  tags = merge(local.common_tags, {
    Name = "cp9-${local.session_name}-starter-${each.key}-database"
  })
}

resource "aws_secretsmanager_secret_version" "starter_meta_database" {
  for_each = local.starter_meta_databases

  secret_id = aws_secretsmanager_secret.starter_meta_database[each.key].id
  secret_string = jsonencode({
    host     = "premium-metadb.tidb-admin.svc.cluster.local"
    port     = 3306
    username = "root"
    password = "cp9-local"
    dbname   = each.value.database_name
  })
}

resource "aws_kms_key" "starter_audit_log" {
  count = local.starter_remote_eks_enabled ? 1 : 0

  description             = "cp9 ${local.session_name} Starter audit-log key"
  deletion_window_in_days = 7
  enable_key_rotation     = true

  tags = merge(local.common_tags, {
    Name = "cp9-${local.session_name}-starter-audit-log"
  })
}

resource "aws_kms_alias" "starter_audit_log" {
  count = local.starter_remote_eks_enabled ? 1 : 0

  name          = "alias/cp9-${local.session_name}-starter-audit-log"
  target_key_id = aws_kms_key.starter_audit_log[0].key_id
}

data "aws_kms_ciphertext" "starter_audit_log_key" {
  count = local.starter_remote_eks_enabled ? 1 : 0

  key_id    = aws_kms_key.starter_audit_log[0].arn
  plaintext = random_password.starter_audit_log_key[0].result
}

resource "aws_kms_key" "starter_cse" {
  count = local.starter_remote_eks_enabled ? 1 : 0

  description             = "cp9 ${local.session_name} Starter CSE master key"
  deletion_window_in_days = 7
  enable_key_rotation     = true

  tags = merge(local.common_tags, {
    Name = "cp9-${local.session_name}-starter-cse"
  })
}

resource "aws_kms_alias" "starter_cse" {
  count = local.starter_remote_eks_enabled ? 1 : 0

  name          = "alias/cp9-${local.session_name}-starter-cse"
  target_key_id = aws_kms_key.starter_cse[0].key_id
}

data "aws_kms_ciphertext" "starter_cse_master_key" {
  count = local.starter_remote_eks_enabled ? 1 : 0

  key_id    = aws_kms_key.starter_cse[0].arn
  plaintext = random_password.starter_cse_master_key[0].result
}