shoc-backend/terraform/secrets.tf

resource "random_password" "jwt" {
  length  = 64
  special = false
}

resource "random_id" "webhook_secret" {
  byte_length = 32
}

resource "aws_secretsmanager_secret" "jwt" {
  name                    = local.jwt_secret_name
  description             = "JWT signing secret for shoc-backend-tf-poc. Rotate the secret version out of band; Terraform ignores later value changes."
  recovery_window_in_days = 0

  depends_on = [terraform_data.account_guard]
}

resource "aws_secretsmanager_secret_version" "jwt" {
  secret_id     = aws_secretsmanager_secret.jwt.id
  secret_string = random_password.jwt.result

  lifecycle {
    ignore_changes = [secret_string]
  }
}

resource "aws_secretsmanager_secret" "webhook" {
  name                    = local.webhook_secret_name
  description             = "Work-order webhook HMAC keyset for shoc-backend-tf-poc. Do not use the prod ingest ARN."
  recovery_window_in_days = 0

  depends_on = [terraform_data.account_guard]
}

resource "aws_secretsmanager_secret_version" "webhook" {
  secret_id = aws_secretsmanager_secret.webhook.id
  secret_string = jsonencode({
    keys = [
      {
        kid    = "tf-poc"
        secret = random_id.webhook_secret.hex
      }
    ]
  })

  lifecycle {
    ignore_changes = [secret_string]
  }
}