resource "aws_directory_service_directory" "myad"{
    count = var.directory_count
    name = var.dir_domain_name[count.index]
    password = aws_secretsmanager_secret.smasterad[count.index].secret_string
}

vpc_settings {
    vpc_id = var.vpc_id
    subnets_ids = flatten([data.aws_subnet.data_subnets_ids.*.id])
}


resource "random_password" "password" {
  count=var.dir_count
  length = 30
  special=false
  override_special = "!#$%&*()-_=+[]{}<>:?"
}

resource "aws_secretsmanager_secret" "smasterad" {
    count = var.dir_count
    name = var.secret_name[count.index]
    lifecycle {
      ignore_changes = [name]
    }
}

resource "aws_secretsmanager_secret_version" "adsecret" {
    count=var.dir_count
    name=var.secret_name[count.index]
    secret_string = <<EOF
    {
        "username": "admin"
        "password": "${random_password.password[count.index].result}
    }
EOF
   lifecycle {
       ignore_changes = [secret_id, secret_string]
   }
}

resource "aws_secretsmanager_secret_policy" "secret_policy" {
    count = var.dir_count
    secret_arn = aws_secretsmanager_secret.smasterad[count.index].secret_arn
    policy = <<POLICY
{
    "Version:"2012-10-17",
    "Statement": [
        {
            "Action": [
                "secretsmanager:DescribeSecret",
                "secretsmanager:GetSecretValue",
                "secretsmanager:ListSecrets"
            ],
            "Effect":"Allow",
            "Principal":{
                "Aws:"arn:aws:iam::id:role/yourec2role"
            },
            "Resource": "*"
        }
    ]
}
POLICY
    lifecycle {
      ignore_changes=[secret_arn,policy]
    }
}