seahaven-ap/terraform/secrets.tf

resource "aws_secretsmanager_secret" "google_oidc" {
  name        = "seahaven-ap/google-oidc"
  description = "Google OIDC client credentials for seahaven-ap Cognito. Value is written outside Terraform."
}

# Placeholder so the first apply has an AWSCURRENT version to read. Replace the
# value in Secrets Manager; Terraform will not write this placeholder back.
resource "aws_secretsmanager_secret_version" "google_oidc" {
  secret_id = aws_secretsmanager_secret.google_oidc.id
  secret_string = jsonencode({
    client_id     = "replace-me"
    client_secret = "replace-me"
  })

  lifecycle {
    ignore_changes = [secret_string]
  }
}

resource "aws_secretsmanager_secret" "database" {
  name        = "seahaven-ap/database"
  description = "Aurora master credentials for seahaven-ap"
}

resource "aws_secretsmanager_secret_version" "database" {
  secret_id = aws_secretsmanager_secret.database.id
  secret_string = jsonencode({
    username = "seahaven"
    password = random_password.db.result
  })
}

resource "random_password" "db" {
  length  = 32
  special = false
}