seahaven-ap/terraform/secrets.tf

resource "aws_secretsmanager_secret" "google_oidc" {
  name        = "seahaven-ap/google-oidc"
  description = "Google OIDC client credentials for seahaven-ap Cognito. Value is written outside Terraform."
}

resource "aws_secretsmanager_secret" "database" {
  name        = "seahaven-ap/database"
  description = "Aurora master credentials for seahaven-ap"
}

resource "aws_secretsmanager_secret_version" "database" {
  secret_id = aws_secretsmanager_secret.database.id
  secret_string = jsonencode({
    username = "seahaven"
    password = random_password.db.result
  })
}

resource "random_password" "db" {
  length  = 32
  special = false
}