Files
Cibello-app/infrastructure/terraform/secrets.tf
T
Sven (AAMOS AI) 5b35df24a7 cibello(terraform): add lifecycle ignore_changes for placeholder SSM secrets
Prevent Terraform from overwriting externally-managed secret values
2026-08-11 23:31:43 +07:00

104 lines
2.1 KiB
Terraform

resource "random_password" "db_password" {
length = 32
special = false
}
resource "random_password" "jwt_access" {
length = 64
special = false
}
resource "random_password" "jwt_refresh" {
length = 64
special = false
}
resource "random_password" "entitlement_signing" {
length = 64
special = false
}
resource "aws_ssm_parameter" "db_password" {
name = "/cibello/prod/db-password"
type = "SecureString"
value = random_password.db_password.result
}
resource "aws_ssm_parameter" "jwt_access" {
name = "/cibello/prod/jwt-access"
type = "SecureString"
value = random_password.jwt_access.result
}
resource "aws_ssm_parameter" "jwt_refresh" {
name = "/cibello/prod/jwt-refresh"
type = "SecureString"
value = random_password.jwt_refresh.result
}
resource "aws_ssm_parameter" "entitlement_signing" {
name = "/cibello/prod/entitlement-signing"
type = "SecureString"
value = random_password.entitlement_signing.result
}
resource "aws_ssm_parameter" "gemini_api_key" {
name = "/cibello/prod/gemini-api-key"
type = "SecureString"
value = "PLACEHOLDER_FILL_MANUALLY"
lifecycle {
ignore_changes = [value]
}
}
resource "aws_ssm_parameter" "aamos_api_key" {
name = "/cibello/prod/aamos-api-key"
type = "SecureString"
value = "PLACEHOLDER_FILL_MANUALLY"
lifecycle {
ignore_changes = [value]
}
}
resource "aws_ssm_parameter" "apple_private_key" {
name = "/cibello/prod/apple-private-key"
type = "SecureString"
value = "PHASE7_PLACEHOLDER"
lifecycle {
ignore_changes = [value]
}
}
resource "aws_ssm_parameter" "google_service_account_json" {
name = "/cibello/prod/google-service-account-json"
type = "SecureString"
value = "PHASE7_PLACEHOLDER"
lifecycle {
ignore_changes = [value]
}
}
resource "aws_ssm_parameter" "smtp_pass" {
name = "/cibello/prod/smtp-pass"
type = "SecureString"
value = "PLACEHOLDER_FILL_FROM_MAILU"
lifecycle {
ignore_changes = [value]
}
}
resource "aws_ssm_parameter" "eoc_push_token" {
name = "/cibello/prod/eoc-push-token"
type = "SecureString"
value = "PLACEHOLDER_FILL_FROM_SERVER2"
lifecycle {
ignore_changes = [value]
}
}