From 5b35df24a7f7d6e75c19f9e626215d2e82c67a59 Mon Sep 17 00:00:00 2001
From: "Sven (AAMOS AI)" <sven@wavult.com>
Date: Tue, 11 Aug 2026 23:31:43 +0700
Subject: [PATCH] cibello(terraform): add lifecycle ignore_changes for
 placeholder SSM secrets

Prevent Terraform from overwriting externally-managed secret values
---
 infrastructure/terraform/secrets.tf | 36 ++++++++++++++++++++++++-----
 1 file changed, 30 insertions(+), 6 deletions(-)

diff --git a/infrastructure/terraform/secrets.tf b/infrastructure/terraform/secrets.tf
index 2df3694..08ed224 100644
--- a/infrastructure/terraform/secrets.tf
+++ b/infrastructure/terraform/secrets.tf
@@ -45,35 +45,59 @@ resource "aws_ssm_parameter" "entitlement_signing" {
 resource "aws_ssm_parameter" "gemini_api_key" {
   name  = "/cibello/prod/gemini-api-key"
   type  = "SecureString"
-  value = ""
+  value = "PLACEHOLDER_FILL_MANUALLY"
+
+  lifecycle {
+    ignore_changes = [value]
+  }
 }
 
 resource "aws_ssm_parameter" "aamos_api_key" {
   name  = "/cibello/prod/aamos-api-key"
   type  = "SecureString"
-  value = ""
+  value = "PLACEHOLDER_FILL_MANUALLY"
+
+  lifecycle {
+    ignore_changes = [value]
+  }
 }
 
 resource "aws_ssm_parameter" "apple_private_key" {
   name  = "/cibello/prod/apple-private-key"
   type  = "SecureString"
-  value = ""
+  value = "PHASE7_PLACEHOLDER"
+
+  lifecycle {
+    ignore_changes = [value]
+  }
 }
 
 resource "aws_ssm_parameter" "google_service_account_json" {
   name  = "/cibello/prod/google-service-account-json"
   type  = "SecureString"
-  value = ""
+  value = "PHASE7_PLACEHOLDER"
+
+  lifecycle {
+    ignore_changes = [value]
+  }
 }
 
 resource "aws_ssm_parameter" "smtp_pass" {
   name  = "/cibello/prod/smtp-pass"
   type  = "SecureString"
-  value = ""
+  value = "PLACEHOLDER_FILL_FROM_MAILU"
+
+  lifecycle {
+    ignore_changes = [value]
+  }
 }
 
 resource "aws_ssm_parameter" "eoc_push_token" {
   name  = "/cibello/prod/eoc-push-token"
   type  = "SecureString"
-  value = ""
+  value = "PLACEHOLDER_FILL_FROM_SERVER2"
+
+  lifecycle {
+    ignore_changes = [value]
+  }
 }