Ore/terraform gh action #6

or4dx · 2025-07-19T11:28:57Z

This pull request introduces a comprehensive observability module for the BitBlock Starter Pack, focusing on cost monitoring, logging, and dashboards. It includes new configurations, dashboards, and documentation to enhance cloud-native application monitoring and cost transparency. Below are the most important changes grouped by theme:

Observability Documentation and Structure

Added a detailed README.md in the observability folder to outline the module's purpose, folder structure, quick start guide, use cases, and best practices.

Cost Monitoring Enhancements

Added cloud-cost-alerts.yaml with Prometheus alert rules for cloud cost anomalies, such as monthly budget exceedance and daily spend spikes.
Introduced cloud-cost-billing.json Grafana dashboard for visualizing cloud cost trends, provider breakdowns, and top services by cost.
Added Kubernetes-specific cost monitoring with k8s-kube-cost-alerts.yaml for alerts on namespace overspending and cost anomalies.
Created kube-cost.json Grafana dashboard for Kubernetes cost analytics, including namespace costs, resource efficiency metrics, and savings opportunities.

Logging Observability

Introduced loki-config.yaml and promtail-config.yaml for setting up Loki and Promtail for log aggregation and parsing. [1] [2]
Added sample configurations for structured logging in sample-logback.xml (Java) and sample-nginx.conf (NGINX). [1] [2]
Created grafana-logs-dashboard.json Grafana dashboard for visualizing logs, including application, NGINX, and error logs.
Added log parsing patterns in grok-patterns.md and json-parse-pattern.md for common formats like NGINX and JSON. [1] [2]

Minor Changes

Updated the name of the CI workflow in .github/workflows/dashboards.yml to remove a special character.

Copilot

Pull Request Overview

This pull request expands the observability module by introducing comprehensive tracing capabilities and numerous technical metrics to complement the existing cost monitoring, logging, and dashboards. The changes focus on providing end-to-end observability through distributed tracing and a comprehensive set of sample metrics for testing and development purposes.

Adds distributed tracing infrastructure with OpenTelemetry Collector and Grafana Tempo configurations
Introduces extensive sample Prometheus metrics covering technical, business, and security use cases
Includes tracing documentation, parsers, and visualization components
Updates CI workflow naming to remove special character

Reviewed Changes

Copilot reviewed 40 out of 47 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tracing/	Complete tracing module with collector configs, exporters, parsers, dashboards, and documentation
metrics/grafana-stack/technical/technical_metrics/	Comprehensive set of sample Prometheus metrics for various technical monitoring scenarios
metrics/grafana-stack/business/business_metrics/	Sample business metrics for CLV, conversion rates, user journey analytics
logging/grafana-stack/	Enhanced logging configurations and documentation
.github/workflows/dashboards.yml	Minor workflow name update

Comments suppressed due to low confidence (1)

bit-blocks-starter/observability/metrics/grafana-stack/prometheus.yml:70

The job name 'fake-/market-perf-local' contains an invalid forward slash character. Job names should use valid characters only. Consider renaming to 'fake-market-perf-local'.

  - job_name: 'fake-/market-perf-local'

github-actions · 2025-07-19T11:30:32Z

🧾 Terraform Plan for `sec_kms`

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.kms_advanced.aws_kms_alias.this will be created
  + resource "aws_kms_alias" "this" {
      + arn            = (known after apply)
      + id             = (known after apply)
      + name           = "alias/app-secrets-key"
      + name_prefix    = (known after apply)
      + target_key_arn = (known after apply)
      + target_key_id  = (known after apply)
    }

  # module.kms_advanced.aws_kms_grant.this[0] will be created
  + resource "aws_kms_grant" "this" {
      + grant_id          = (known after apply)
      + grant_token       = (known after apply)
      + grantee_principal = "arn:aws:iam::123456789012:role/app-server"
      + id                = (known after apply)
      + key_id            = (known after apply)
      + name              = "AppServerAccess"
      + operations        = [
          + "Decrypt",
          + "Encrypt",
        ]
      + retire_on_delete  = false

      + constraints {
          + encryption_context_equals = {
              + "App" = "Finance"
            }
        }
    }

  # module.kms_advanced.aws_kms_key.this will be created
  + resource "aws_kms_key" "this" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + deletion_window_in_days            = 7
      + description                        = "KMS key for encrypting application secrets"
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = true
      + policy                             = (known after apply)
      + tags_all                           = (known after apply)
    }

  # module.kms_basic.aws_kms_alias.this will be created
  + resource "aws_kms_alias" "this" {
      + arn            = (known after apply)
      + id             = (known after apply)
      + name           = "alias/basic-key"
      + name_prefix    = (known after apply)
      + target_key_arn = (known after apply)
      + target_key_id  = (known after apply)
    }

  # module.kms_basic.aws_kms_key.this will be created
  + resource "aws_kms_key" "this" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + deletion_window_in_days            = 30
      + description                        = "A simple KMS key"
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = false
      + policy                             = (known after apply)
      + tags_all                           = (known after apply)
    }

Plan: 5 to add, 0 to change, 0 to destroy.

Warning: Argument is deprecated

  with provider["registry.terraform.io/hashicorp/aws"],
  on providers.tf line 7, in provider "aws":
   7:   s3_force_path_style         = true

Use s3_use_path_style instead.

(and one more similar warning elsewhere)

Warning: Attribute Deprecated

  with provider["registry.terraform.io/hashicorp/aws"],
  on providers.tf line 7, in provider "aws":
   7:   s3_force_path_style         = true

Use s3_use_path_style instead.

(and one more similar warning elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

github-actions · 2025-07-19T11:30:36Z

🧾 Terraform Plan for `sec_ebs_snapshot_guard`

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.advanced_snapshot_guard.aws_cloudwatch_event_rule.public_snapshot_alert will be created
  + resource "aws_cloudwatch_event_rule" "public_snapshot_alert" {
      + arn            = (known after apply)
      + description    = "Alerts on creation or modification of public EBS snapshots."
      + event_bus_name = "default"
      + event_pattern  = jsonencode(
            {
              + detail      = {
                  + eventName         = [
                      + "ModifySnapshotAttribute",
                    ]
                  + eventSource       = [
                      + "ec2.amazonaws.com",
                    ]
                  + requestParameters = {
                      + attributeType = [
                          + "createVolumePermission",
                        ]
                      + operationType = [
                          + "add",
                        ]
                    }
                }
              + detail-type = [
                  + "AWS API Call via CloudTrail",
                ]
              + source      = [
                  + "aws.ec2",
                ]
            }
        )
      + id             = (known after apply)
      + is_enabled     = true
      + name           = "advanced-ebs-guard-public-snapshot-alert"
      + name_prefix    = (known after apply)
      + tags_all       = (known after apply)
    }

  # module.advanced_snapshot_guard.aws_cloudwatch_event_target.sns_alert will be created
  + resource "aws_cloudwatch_event_target" "sns_alert" {
      + arn            = (known after apply)
      + event_bus_name = "default"
      + id             = (known after apply)
      + rule           = "advanced-ebs-guard-public-snapshot-alert"
      + target_id      = "SnapshotAlertSNS"
    }

  # module.advanced_snapshot_guard.aws_dlm_lifecycle_policy.snapshot_retention_policy will be created
  + resource "aws_dlm_lifecycle_policy" "snapshot_retention_policy" {
      + arn                = (known after apply)
      + description        = "EBS Snapshot retention and auto-deletion"
      + execution_role_arn = (known after apply)
      + id                 = (known after apply)
      + state              = "ENABLED"
      + tags_all           = (known after apply)

      + policy_details {
          + policy_type        = "EBS_SNAPSHOT_MANAGEMENT"
          + resource_locations = (known after apply)
          + resource_types     = [
              + "VOLUME",
            ]
          + target_tags        = {
              + "SnapshotManaged" = "true"
            }

          + schedule {
              + copy_tags = true
              + name      = "DailySnapshotRetention"

              + create_rule {
                  + interval      = 12
                  + interval_unit = "HOURS"
                  + location      = (known after apply)
                  + times         = [
                      + "00:00",
                    ]
                }

              + retain_rule {
                  + count = 14
                }
            }
        }
    }

  # module.advanced_snapshot_guard.aws_iam_policy.snapshot_encryption_policy will be created
  + resource "aws_iam_policy" "snapshot_encryption_policy" {
      + arn         = (known after apply)
      + description = "Policy enforcing EBS snapshot encryption."
      + id          = (known after apply)
      + name        = "advanced-ebs-guard-snapshot-encryption"
      + name_prefix = (known after apply)
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "ec2:CreateSnapshot",
                          + "ec2:CreateSnapshots",
                        ]
                      + Condition = {
                          + StringNotEqualsIfExists = {
                              + "ec2:Encrypted" = "true"
                            }
                        }
                      + Effect    = "Deny"
                      + Resource  = "*"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags_all    = (known after apply)
    }

  # module.advanced_snapshot_guard.aws_iam_role.dlm_role will be created
  + resource "aws_iam_role" "dlm_role" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "dlm.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "advanced-ebs-guard-dlm-role"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + role_last_used        = (known after apply)
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.advanced_snapshot_guard.aws_iam_role_policy_attachment.dlm_policy_attachment will be created
  + resource "aws_iam_role_policy_attachment" "dlm_policy_attachment" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AWSDataLifecycleManagerServiceRole"
      + role       = "advanced-ebs-guard-dlm-role"
    }

  # module.advanced_snapshot_guard.aws_sns_topic.snapshot_alerts_topic will be created
  + resource "aws_sns_topic" "snapshot_alerts_topic" {
      + arn                         = (known after apply)
      + content_based_deduplication = false
      + fifo_topic                  = false
      + id                          = (known after apply)
      + name                        = "advanced-ebs-guard-snapshot-alerts"
      + name_prefix                 = (known after apply)
      + owner                       = (known after apply)
      + policy                      = (known after apply)
      + signature_version           = (known after apply)
      + tags_all                    = (known after apply)
      + tracing_config              = (known after apply)
    }

  # module.advanced_snapshot_guard.aws_sns_topic_subscription.alert_email[0] will be created
  + resource "aws_sns_topic_subscription" "alert_email" {
      + arn                             = (known after apply)
      + confirmation_timeout_in_minutes = 1
      + confirmation_was_authenticated  = (known after apply)
      + endpoint                        = "security-team@example.com"
      + endpoint_auto_confirms          = false
      + filter_policy_scope             = (known after apply)
      + id                              = (known after apply)
      + owner_id                        = (known after apply)
      + pending_confirmation            = (known after apply)
      + protocol                        = "email"
      + raw_message_delivery            = false
      + topic_arn                       = (known after apply)
    }

  # module.advanced_snapshot_guard.aws_sns_topic_subscription.alert_email[1] will be created
  + resource "aws_sns_topic_subscription" "alert_email" {
      + arn                             = (known after apply)
      + confirmation_timeout_in_minutes = 1
      + confirmation_was_authenticated  = (known after apply)
      + endpoint                        = "compliance@example.com"
      + endpoint_auto_confirms          = false
      + filter_policy_scope             = (known after apply)
      + id                              = (known after apply)
      + owner_id                        = (known after apply)
      + pending_confirmation            = (known after apply)
      + protocol                        = "email"
      + raw_message_delivery            = false
      + topic_arn                       = (known after apply)
    }

  # module.basic_snapshot_guard.aws_cloudwatch_event_rule.public_snapshot_alert will be created
  + resource "aws_cloudwatch_event_rule" "public_snapshot_alert" {
      + arn            = (known after apply)
      + description    = "Alerts on creation or modification of public EBS snapshots."
      + event_bus_name = "default"
      + event_pattern  = jsonencode(
            {
              + detail      = {
                  + eventName         = [
                      + "ModifySnapshotAttribute",
                    ]
                  + eventSource       = [
                      + "ec2.amazonaws.com",
                    ]
                  + requestParameters = {
                      + attributeType = [
                          + "createVolumePermission",
                        ]
                      + operationType = [
                          + "add",
                        ]
                    }
                }
              + detail-type = [
                  + "AWS API Call via CloudTrail",
                ]
              + source      = [
                  + "aws.ec2",
                ]
            }
        )
      + id             = (known after apply)
      + is_enabled     = true
      + name           = "basic-ebs-guard-public-snapshot-alert"
      + name_prefix    = (known after apply)
      + tags_all       = (known after apply)
    }

  # module.basic_snapshot_guard.aws_cloudwatch_event_target.sns_alert will be created
  + resource "aws_cloudwatch_event_target" "sns_alert" {
      + arn            = (known after apply)
      + event_bus_name = "default"
      + id             = (known after apply)
      + rule           = "basic-ebs-guard-public-snapshot-alert"
      + target_id      = "SnapshotAlertSNS"
    }

  # module.basic_snapshot_guard.aws_dlm_lifecycle_policy.snapshot_retention_policy will be created
  + resource "aws_dlm_lifecycle_policy" "snapshot_retention_policy" {
      + arn                = (known after apply)
      + description        = "EBS Snapshot retention and auto-deletion"
      + execution_role_arn = (known after apply)
      + id                 = (known after apply)
      + state              = "ENABLED"
      + tags_all           = (known after apply)

      + policy_details {
          + policy_type        = "EBS_SNAPSHOT_MANAGEMENT"
          + resource_locations = (known after apply)
          + resource_types     = [
              + "VOLUME",
            ]
          + target_tags        = {
              + "SnapshotManaged" = "true"
            }

          + schedule {
              + copy_tags = true
              + name      = "DailySnapshotRetention"

              + create_rule {
                  + interval      = 24
                  + interval_unit = "HOURS"
                  + location      = (known after apply)
                  + times         = [
                      + "00:00",
                    ]
                }

              + retain_rule {
                  + count = 7
                }
            }
        }
    }

  # module.basic_snapshot_guard.aws_iam_policy.snapshot_encryption_policy will be created
  + resource "aws_iam_policy" "snapshot_encryption_policy" {
      + arn         = (known after apply)
      + description = "Policy enforcing EBS snapshot encryption."
      + id          = (known after apply)
      + name        = "basic-ebs-guard-snapshot-encryption"
      + name_prefix = (known after apply)
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "ec2:CreateSnapshot",
                          + "ec2:CreateSnapshots",
                        ]
                      + Condition = {
                          + StringNotEqualsIfExists = {
                              + "ec2:Encrypted" = "true"
                            }
                        }
                      + Effect    = "Deny"
                      + Resource  = "*"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags_all    = (known after apply)
    }

  # module.basic_snapshot_guard.aws_iam_role.dlm_role will be created
  + resource "aws_iam_role" "dlm_role" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "dlm.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "basic-ebs-guard-dlm-role"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + role_last_used        = (known after apply)
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.basic_snapshot_guard.aws_iam_role_policy_attachment.dlm_policy_attachment will be created
  + resource "aws_iam_role_policy_attachment" "dlm_policy_attachment" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AWSDataLifecycleManagerServiceRole"
      + role       = "basic-ebs-guard-dlm-role"
    }

  # module.basic_snapshot_guard.aws_sns_topic.snapshot_alerts_topic will be created
  + resource "aws_sns_topic" "snapshot_alerts_topic" {
      + arn                         = (known after apply)
      + content_based_deduplication = false
      + fifo_topic                  = false
      + id                          = (known after apply)
      + name                        = "basic-ebs-guard-snapshot-alerts"
      + name_prefix                 = (known after apply)
      + owner                       = (known after apply)
      + policy                      = (known after apply)
      + signature_version           = (known after apply)
      + tags_all                    = (known after apply)
      + tracing_config              = (known after apply)
    }

  # module.basic_snapshot_guard.aws_sns_topic_subscription.alert_email[0] will be created
  + resource "aws_sns_topic_subscription" "alert_email" {
      + arn                             = (known after apply)
      + confirmation_timeout_in_minutes = 1
      + confirmation_was_authenticated  = (known after apply)
      + endpoint                        = "alerts@example.com"
      + endpoint_auto_confirms          = false
      + filter_policy_scope             = (known after apply)
      + id                              = (known after apply)
      + owner_id                        = (known after apply)
      + pending_confirmation            = (known after apply)
      + protocol                        = "email"
      + raw_message_delivery            = false
      + topic_arn                       = (known after apply)
    }

Plan: 17 to add, 0 to change, 0 to destroy.

Warning: Argument is deprecated

  with provider["registry.terraform.io/hashicorp/aws"],
  on providers.tf line 7, in provider "aws":
   7:   s3_force_path_style         = true

Use s3_use_path_style instead.

(and one more similar warning elsewhere)

Warning: Attribute Deprecated

  with provider["registry.terraform.io/hashicorp/aws"],
  on providers.tf line 7, in provider "aws":
   7:   s3_force_path_style         = true

Use s3_use_path_style instead.

(and one more similar warning elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

github-actions · 2025-07-19T11:30:37Z

🧾 Terraform Plan for `sec_ssm_baseline`

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.sec_ssm_baseline_advanced.aws_ssm_association.patching will be created
  + resource "aws_ssm_association" "patching" {
      + apply_only_at_cron_interval      = false
      + arn                              = (known after apply)
      + association_id                   = (known after apply)
      + automation_target_parameter_name = "InstanceId"
      + compliance_severity              = "HIGH"
      + document_version                 = "$LATEST"
      + id                               = (known after apply)
      + name                             = "PatchingAssociation-bluebit-hardened-config"
      + parameters                       = (known after apply)
      + schedule_expression              = "cron(0 3 ? * SUN *)"

      + targets {
          + key    = "InstanceIds"
          + values = [
              + "i-0abcdef1234567890",
              + "i-0987654321fedcba0",
            ]
        }
    }

  # module.sec_ssm_baseline_advanced.aws_ssm_association.secure_config will be created
  + resource "aws_ssm_association" "secure_config" {
      + apply_only_at_cron_interval = false
      + arn                         = (known after apply)
      + association_id              = (known after apply)
      + document_version            = "$LATEST"
      + id                          = (known after apply)
      + name                        = "SecureConfigAssociation-bluebit-hardened-config"
      + parameters                  = (known after apply)

      + targets {
          + key    = "InstanceIds"
          + values = [
              + "i-0abcdef1234567890",
              + "i-0987654321fedcba0",
            ]
        }
    }

  # module.sec_ssm_baseline_advanced.aws_ssm_document.baseline_config will be created
  + resource "aws_ssm_document" "baseline_config" {
      + arn              = (known after apply)
      + created_date     = (known after apply)
      + default_version  = (known after apply)
      + description      = (known after apply)
      + document_format  = "JSON"
      + document_type    = "Command"
      + document_version = (known after apply)
      + hash             = (known after apply)
      + hash_type        = (known after apply)
      + id               = (known after apply)
      + latest_version   = (known after apply)
      + name             = "bluebit-hardened-config"
      + owner            = (known after apply)
      + parameter        = (known after apply)
      + platform_types   = (known after apply)
      + schema_version   = (known after apply)
      + status           = (known after apply)
      + tags_all         = (known after apply)
    }

  # module.sec_ssm_baseline_advanced.aws_ssm_patch_baseline.this will be created
  + resource "aws_ssm_patch_baseline" "this" {
      + approved_patches                  = [
          + "patch-xyz-2024",
        ]
      + approved_patches_compliance_level = "UNSPECIFIED"
      + arn                               = (known after apply)
      + id                                = (known after apply)
      + name                              = "bluebit-prod-baseline"
      + operating_system                  = "AMAZON_LINUX_2"
      + rejected_patches_action           = (known after apply)
      + tags                              = {
          + "Compliance"  = "CIS"
          + "Environment" = "production"
          + "Module"      = "sec_ssm_baseline"
          + "Owner"       = "security-team"
        }
      + tags_all                          = {
          + "Compliance"  = "CIS"
          + "Environment" = "production"
          + "Module"      = "sec_ssm_baseline"
          + "Owner"       = "security-team"
        }

      + approval_rule {
          + approve_after_days  = 3
          + compliance_level    = "HIGH"
          + enable_non_security = true

          + patch_filter {
              + key    = "CLASSIFICATION"
              + values = [
                  + "Security",
                  + "Bugfix",
                ]
            }
          + patch_filter {
              + key    = "SEVERITY"
              + values = [
                  + "Critical",
                  + "Important",
                  + "Medium",
                ]
            }
        }
    }

  # module.sec_ssm_baseline_basic.aws_ssm_association.patching will be created
  + resource "aws_ssm_association" "patching" {
      + apply_only_at_cron_interval      = false
      + arn                              = (known after apply)
      + association_id                   = (known after apply)
      + automation_target_parameter_name = "InstanceId"
      + compliance_severity              = "HIGH"
      + document_version                 = "$LATEST"
      + id                               = (known after apply)
      + name                             = "PatchingAssociation-bluebit-secure-config"
      + parameters                       = (known after apply)
      + schedule_expression              = "rate(7 days)"

      + targets {
          + key    = "InstanceIds"
          + values = [
              + "i-0123456789abcdef0",
            ]
        }
    }

  # module.sec_ssm_baseline_basic.aws_ssm_association.secure_config will be created
  + resource "aws_ssm_association" "secure_config" {
      + apply_only_at_cron_interval = false
      + arn                         = (known after apply)
      + association_id              = (known after apply)
      + document_version            = "$LATEST"
      + id                          = (known after apply)
      + name                        = "SecureConfigAssociation-bluebit-secure-config"
      + parameters                  = (known after apply)

      + targets {
          + key    = "InstanceIds"
          + values = [
              + "i-0123456789abcdef0",
            ]
        }
    }

  # module.sec_ssm_baseline_basic.aws_ssm_document.baseline_config will be created
  + resource "aws_ssm_document" "baseline_config" {
      + arn              = (known after apply)
      + created_date     = (known after apply)
      + default_version  = (known after apply)
      + description      = (known after apply)
      + document_format  = "JSON"
      + document_type    = "Command"
      + document_version = (known after apply)
      + hash             = (known after apply)
      + hash_type        = (known after apply)
      + id               = (known after apply)
      + latest_version   = (known after apply)
      + name             = "bluebit-secure-config"
      + owner            = (known after apply)
      + parameter        = (known after apply)
      + platform_types   = (known after apply)
      + schema_version   = (known after apply)
      + status           = (known after apply)
      + tags_all         = (known after apply)
    }

  # module.sec_ssm_baseline_basic.aws_ssm_patch_baseline.this will be created
  + resource "aws_ssm_patch_baseline" "this" {
      + approved_patches_compliance_level = "UNSPECIFIED"
      + arn                               = (known after apply)
      + id                                = (known after apply)
      + name                              = "baseline-linux"
      + operating_system                  = "AMAZON_LINUX_2"
      + rejected_patches_action           = (known after apply)
      + tags                              = {
          + "Environment" = "dev"
          + "Owner"       = "ops"
        }
      + tags_all                          = {
          + "Environment" = "dev"
          + "Owner"       = "ops"
        }

      + approval_rule {
          + approve_after_days  = 7
          + compliance_level    = "CRITICAL"
          + enable_non_security = false

          + patch_filter {
              + key    = "CLASSIFICATION"
              + values = [
                  + "Security",
                ]
            }
          + patch_filter {
              + key    = "SEVERITY"
              + values = [
                  + "Critical",
                  + "Important",
                ]
            }
        }
    }

Plan: 8 to add, 0 to change, 0 to destroy.

Warning: Argument is deprecated

  with provider["registry.terraform.io/hashicorp/aws"],
  on providers.tf line 7, in provider "aws":
   7:   s3_force_path_style         = true

Use s3_use_path_style instead.

(and one more similar warning elsewhere)

Warning: Attribute Deprecated

  with provider["registry.terraform.io/hashicorp/aws"],
  on providers.tf line 7, in provider "aws":
   7:   s3_force_path_style         = true

Use s3_use_path_style instead.

(and one more similar warning elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

github-actions · 2025-07-19T11:30:38Z

🧾 Terraform Plan for `sec_backup_policy_enforcer`

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.backup_policy_advanced.aws_backup_plan.main_plan will be created
  + resource "aws_backup_plan" "main_plan" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + name     = "critical_rpo_rto_plan"
      + tags     = {
          + "Compliance"  = "SOC2"
          + "Environment" = "Critical"
        }
      + tags_all = {
          + "Compliance"  = "SOC2"
          + "Environment" = "Critical"
        }
      + version  = (known after apply)

      + rule {
          + completion_window        = 180
          + enable_continuous_backup = false
          + recovery_point_tags      = {
              + "BackupFrequency" = "Weekly"
              + "Compliance"      = "SOC2"
              + "Environment"     = "Critical"
            }
          + rule_name                = "WeeklyFullBackup"
          + schedule                 = "cron(0 3 ? * SUN *)"
          + start_window             = 60
          + target_vault_name        = "critical_workloads_vault"

          + lifecycle {
              + delete_after = 180
            }
        }
      + rule {
          + completion_window        = 180
          + enable_continuous_backup = false
          + recovery_point_tags      = {
              + "BackupFrequency" = "Daily"
              + "Compliance"      = "SOC2"
              + "Environment"     = "Critical"
            }
          + rule_name                = "DailyBackupRule"
          + schedule                 = "cron(0 1 * * ? *)"
          + start_window             = 60
          + target_vault_name        = "critical_workloads_vault"

          + lifecycle {
              + delete_after = 90
            }
        }
    }

  # module.backup_policy_advanced.aws_backup_selection.selection_by_tags will be created
  + resource "aws_backup_selection" "selection_by_tags" {
      + iam_role_arn  = (known after apply)
      + id            = (known after apply)
      + name          = "TagBasedSelection"
      + not_resources = (known after apply)
      + plan_id       = (known after apply)

      + selection_tag {
          + key   = "Backup"
          + type  = "STRINGEQUALS"
          + value = "Enabled"
        }
    }

  # module.backup_policy_advanced.aws_backup_vault.main_vault will be created
  + resource "aws_backup_vault" "main_vault" {
      + arn             = (known after apply)
      + force_destroy   = false
      + id              = (known after apply)
      + kms_key_arn     = (known after apply)
      + name            = "critical_workloads_vault"
      + recovery_points = (known after apply)
      + tags            = {
          + "Compliance"  = "SOC2"
          + "Environment" = "Critical"
        }
      + tags_all        = {
          + "Compliance"  = "SOC2"
          + "Environment" = "Critical"
        }
    }

  # module.backup_policy_advanced.aws_backup_vault_notifications.vault_notifications[0] will be created
  + resource "aws_backup_vault_notifications" "vault_notifications" {
      + backup_vault_arn    = (known after apply)
      + backup_vault_events = [
          + "BACKUP_JOB_COMPLETED",
          + "RESTORE_JOB_COMPLETED",
        ]
      + backup_vault_name   = "critical_workloads_vault"
      + id                  = (known after apply)
      + sns_topic_arn       = "arn:aws:sns:us-east-1:123456789012:BackupNotifications"
    }

  # module.backup_policy_advanced.aws_iam_role.backup_role will be created
  + resource "aws_iam_role" "backup_role" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "backup.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "critical_rpo_rto_plan_role"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + role_last_used        = (known after apply)
      + tags                  = {
          + "Compliance"  = "SOC2"
          + "Environment" = "Critical"
        }
      + tags_all              = {
          + "Compliance"  = "SOC2"
          + "Environment" = "Critical"
        }
      + unique_id             = (known after apply)
    }

  # module.backup_policy_advanced.aws_iam_role_policy_attachment.backup_policy_attach will be created
  + resource "aws_iam_role_policy_attachment" "backup_policy_attach" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
      + role       = "critical_rpo_rto_plan_role"
    }

  # module.backup_policy_advanced.aws_kms_alias.backup_key_alias will be created
  + resource "aws_kms_alias" "backup_key_alias" {
      + arn            = (known after apply)
      + id             = (known after apply)
      + name           = "alias/critical_backup_encryption_key"
      + name_prefix    = (known after apply)
      + target_key_arn = (known after apply)
      + target_key_id  = (known after apply)
    }

  # module.backup_policy_advanced.aws_kms_key.backup_key will be created
  + resource "aws_kms_key" "backup_key" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + deletion_window_in_days            = 10
      + description                        = "KMS key for backup vault encryption"
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = (known after apply)
      + policy                             = (known after apply)
      + tags                               = {
          + "Compliance"  = "SOC2"
          + "Environment" = "Critical"
        }
      + tags_all                           = {
          + "Compliance"  = "SOC2"
          + "Environment" = "Critical"
        }
    }

  # module.backup_policy_basic.aws_backup_plan.main_plan will be created
  + resource "aws_backup_plan" "main_plan" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + name     = "production_backup_plan"
      + tags     = {
          + "Environment" = "Production"
          + "Owner"       = "OpsTeam"
        }
      + tags_all = {
          + "Environment" = "Production"
          + "Owner"       = "OpsTeam"
        }
      + version  = (known after apply)

      + rule {
          + completion_window        = 180
          + enable_continuous_backup = false
          + recovery_point_tags      = {
              + "BackupFrequency" = "Daily"
              + "Environment"     = "Production"
              + "Owner"           = "OpsTeam"
            }
          + rule_name                = "DailyBackupRule"
          + schedule                 = "cron(0 2 * * ? *)"
          + start_window             = 60
          + target_vault_name        = "production_backup_vault"

          + lifecycle {
              + delete_after = 35
            }
        }
    }

  # module.backup_policy_basic.aws_backup_selection.selection_by_tags will be created
  + resource "aws_backup_selection" "selection_by_tags" {
      + iam_role_arn  = (known after apply)
      + id            = (known after apply)
      + name          = "TagBasedSelection"
      + not_resources = (known after apply)
      + plan_id       = (known after apply)

      + selection_tag {
          + key   = "Backup"
          + type  = "STRINGEQUALS"
          + value = "Enabled"
        }
    }

  # module.backup_policy_basic.aws_backup_vault.main_vault will be created
  + resource "aws_backup_vault" "main_vault" {
      + arn             = (known after apply)
      + force_destroy   = false
      + id              = (known after apply)
      + kms_key_arn     = (known after apply)
      + name            = "production_backup_vault"
      + recovery_points = (known after apply)
      + tags            = {
          + "Environment" = "Production"
          + "Owner"       = "OpsTeam"
        }
      + tags_all        = {
          + "Environment" = "Production"
          + "Owner"       = "OpsTeam"
        }
    }

  # module.backup_policy_basic.aws_iam_role.backup_role will be created
  + resource "aws_iam_role" "backup_role" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "backup.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "production_backup_plan_role"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + role_last_used        = (known after apply)
      + tags                  = {
          + "Environment" = "Production"
          + "Owner"       = "OpsTeam"
        }
      + tags_all              = {
          + "Environment" = "Production"
          + "Owner"       = "OpsTeam"
        }
      + unique_id             = (known after apply)
    }

  # module.backup_policy_basic.aws_iam_role_policy_attachment.backup_policy_attach will be created
  + resource "aws_iam_role_policy_attachment" "backup_policy_attach" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
      + role       = "production_backup_plan_role"
    }

  # module.backup_policy_basic.aws_kms_alias.backup_key_alias will be created
  + resource "aws_kms_alias" "backup_key_alias" {
      + arn            = (known after apply)
      + id             = (known after apply)
      + name           = "alias/backup_vault_key"
      + name_prefix    = (known after apply)
      + target_key_arn = (known after apply)
      + target_key_id  = (known after apply)
    }

  # module.backup_policy_basic.aws_kms_key.backup_key will be created
  + resource "aws_kms_key" "backup_key" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + deletion_window_in_days            = 10
      + description                        = "KMS key for backup vault encryption"
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = (known after apply)
      + policy                             = (known after apply)
      + tags                               = {
          + "Environment" = "Production"
          + "Owner"       = "OpsTeam"
        }
      + tags_all                           = {
          + "Environment" = "Production"
          + "Owner"       = "OpsTeam"
        }
    }

Plan: 15 to add, 0 to change, 0 to destroy.

Warning: Argument is deprecated

  with provider["registry.terraform.io/hashicorp/aws"],
  on providers.tf line 7, in provider "aws":
   7:   s3_force_path_style         = true

Use s3_use_path_style instead.

(and one more similar warning elsewhere)

Warning: Attribute Deprecated

  with provider["registry.terraform.io/hashicorp/aws"],
  on providers.tf line 7, in provider "aws":
   7:   s3_force_path_style         = true

Use s3_use_path_style instead.

(and one more similar warning elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

github-actions · 2025-07-19T11:30:38Z

🧾 Terraform Plan for `sec_secretmanager_baseline`

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.advanced_secret.aws_cloudwatch_metric_alarm.secret_access_alarm[0] will be created
  + resource "aws_cloudwatch_metric_alarm" "secret_access_alarm" {
      + actions_enabled                       = true
      + alarm_actions                         = [
          + "arn:aws:sns:us-east-1:123456789012:SecretAlerts",
        ]
      + alarm_description                     = "Alarm triggered on secret access frequency."
      + alarm_name                            = "my-secret-advanced-access-alert"
      + arn                                   = (known after apply)
      + comparison_operator                   = "GreaterThanThreshold"
      + dimensions                            = (known after apply)
      + evaluate_low_sample_count_percentiles = (known after apply)
      + evaluation_periods                    = 1
      + id                                    = (known after apply)
      + metric_name                           = "GetSecretValue"
      + namespace                             = "AWS/SecretsManager"
      + period                                = 300
      + statistic                             = "Sum"
      + tags_all                              = (known after apply)
      + threshold                             = 5
      + treat_missing_data                    = "missing"
    }

  # module.advanced_secret.aws_iam_role.lambda_exec will be created
  + resource "aws_iam_role" "lambda_exec" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "lambda.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "my-secret-advanced-lambda-exec-role"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + role_last_used        = (known after apply)
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.advanced_secret.aws_iam_role_policy_attachment.lambda_policy_attach will be created
  + resource "aws_iam_role_policy_attachment" "lambda_policy_attach" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      + role       = "my-secret-advanced-lambda-exec-role"
    }

  # module.advanced_secret.aws_kms_alias.secrets_key_alias will be created
  + resource "aws_kms_alias" "secrets_key_alias" {
      + arn            = (known after apply)
      + id             = (known after apply)
      + name           = "alias/secretsmanager-key"
      + name_prefix    = (known after apply)
      + target_key_arn = (known after apply)
      + target_key_id  = (known after apply)
    }

  # module.advanced_secret.aws_kms_key.secrets_encryption will be created
  + resource "aws_kms_key" "secrets_encryption" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + deletion_window_in_days            = 7
      + description                        = "KMS key for Secrets Manager encryption"
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = (known after apply)
      + policy                             = (known after apply)
      + tags_all                           = (known after apply)
    }

  # module.advanced_secret.aws_lambda_function.secret_rotation_lambda[0] will be created
  + resource "aws_lambda_function" "secret_rotation_lambda" {
      + architectures                  = (known after apply)
      + arn                            = (known after apply)
      + filename                       = "./lambda_rotation_function.zip"
      + function_name                  = "my-secret-advanced-rotation"
      + handler                        = "lambda_function.lambda_handler"
      + id                             = (known after apply)
      + invoke_arn                     = (known after apply)
      + last_modified                  = (known after apply)
      + memory_size                    = 128
      + package_type                   = "Zip"
      + publish                        = false
      + qualified_arn                  = (known after apply)
      + qualified_invoke_arn           = (known after apply)
      + reserved_concurrent_executions = -1
      + role                           = (known after apply)
      + runtime                        = "python3.10"
      + signing_job_arn                = (known after apply)
      + signing_profile_version_arn    = (known after apply)
      + skip_destroy                   = false
      + source_code_hash               = "hGWjSDO1UNV30UPiBrLs0/pGRZ52dKdxyVCD3I55Rig="
      + source_code_size               = (known after apply)
      + tags_all                       = (known after apply)
      + timeout                        = 3
      + version                        = (known after apply)

      + environment {
          + variables = {
              + "DB_HOST" = "db.example.com"
            }
        }
    }

  # module.advanced_secret.aws_secretsmanager_secret.secret will be created
  + resource "aws_secretsmanager_secret" "secret" {
      + arn                            = (known after apply)
      + description                    = "Production database password"
      + force_overwrite_replica_secret = false
      + id                             = (known after apply)
      + kms_key_id                     = (known after apply)
      + name                           = "my-secret-advanced"
      + name_prefix                    = (known after apply)
      + policy                         = (known after apply)
      + recovery_window_in_days        = 30
      + rotation_enabled               = (known after apply)
      + rotation_lambda_arn            = (known after apply)
      + tags                           = {
          + "Environment" = "Prod"
          + "ManagedBy"   = "Terraform"
        }
      + tags_all                       = {
          + "Environment" = "Prod"
          + "ManagedBy"   = "Terraform"
        }
    }

  # module.advanced_secret.aws_secretsmanager_secret_rotation.rotation[0] will be created
  + resource "aws_secretsmanager_secret_rotation" "rotation" {
      + id                  = (known after apply)
      + rotation_enabled    = (known after apply)
      + rotation_lambda_arn = (known after apply)
      + secret_id           = (known after apply)

      + rotation_rules {
          + automatically_after_days = 15
        }
    }

  # module.basic_secret.aws_iam_role.lambda_exec will be created
  + resource "aws_iam_role" "lambda_exec" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "lambda.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "my-secret-basic-lambda-exec-role"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + role_last_used        = (known after apply)
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.basic_secret.aws_iam_role_policy_attachment.lambda_policy_attach will be created
  + resource "aws_iam_role_policy_attachment" "lambda_policy_attach" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      + role       = "my-secret-basic-lambda-exec-role"
    }

  # module.basic_secret.aws_kms_alias.secrets_key_alias will be created
  + resource "aws_kms_alias" "secrets_key_alias" {
      + arn            = (known after apply)
      + id             = (known after apply)
      + name           = "alias/secretsmanager-key"
      + name_prefix    = (known after apply)
      + target_key_arn = (known after apply)
      + target_key_id  = (known after apply)
    }

  # module.basic_secret.aws_kms_key.secrets_encryption will be created
  + resource "aws_kms_key" "secrets_encryption" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + deletion_window_in_days            = 7
      + description                        = "KMS key for Secrets Manager encryption"
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = (known after apply)
      + policy                             = (known after apply)
      + tags_all                           = (known after apply)
    }

  # module.basic_secret.aws_secretsmanager_secret.secret will be created
  + resource "aws_secretsmanager_secret" "secret" {
      + arn                            = (known after apply)
      + description                    = "Managed by Terraform"
      + force_overwrite_replica_secret = false
      + id                             = (known after apply)
      + kms_key_id                     = (known after apply)
      + name                           = "my-secret-basic"
      + name_prefix                    = (known after apply)
      + policy                         = (known after apply)
      + recovery_window_in_days        = 30
      + rotation_enabled               = (known after apply)
      + rotation_lambda_arn            = (known after apply)
      + tags                           = {
          + "Environment" = "Prod"
        }
      + tags_all                       = {
          + "Environment" = "Prod"
        }
    }

Plan: 13 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

github-actions · 2025-07-19T11:34:08Z

🧾 Terraform Plan for `iam_audit`

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.iam_audit.aws_accessanalyzer_analyzer.default[0] will be created
  + resource "aws_accessanalyzer_analyzer" "default" {
      + analyzer_name = "bluebit-prod-access-analyzer"
      + arn           = (known after apply)
      + id            = (known after apply)
      + tags          = {
          + "Compliance"  = "yes"
          + "Environment" = "production"
          + "Owner"       = "cloud-team"
          + "Project"     = "iam-security"
        }
      + tags_all      = {
          + "Compliance"  = "yes"
          + "Environment" = "production"
          + "Owner"       = "cloud-team"
          + "Project"     = "iam-security"
        }
      + type          = "ACCOUNT"
    }

  # module.iam_audit.aws_athena_database.iam_audit[0] will be created
  + resource "aws_athena_database" "iam_audit" {
      + bucket        = "bluebit-prod-iam-logs"
      + force_destroy = false
      + id            = (known after apply)
      + name          = "iam_audit_db"
    }

  # module.iam_audit.aws_athena_workgroup.iam_audit[0] will be created
  + resource "aws_athena_workgroup" "iam_audit" {
      + arn           = (known after apply)
      + force_destroy = false
      + id            = (known after apply)
      + name          = "bluebit-prod-audit-workgroup"
      + state         = "ENABLED"
      + tags_all      = (known after apply)

      + configuration {
          + enforce_workgroup_configuration    = true
          + publish_cloudwatch_metrics_enabled = true
          + requester_pays_enabled             = false

          + result_configuration {
              + output_location = "s3://bluebit-prod-iam-logs/results/"
            }
        }
    }

  # module.iam_audit.aws_config_config_rule.iam_root_access[0] will be created
  + resource "aws_config_config_rule" "iam_root_access" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + name     = "iam-root-access"
      + rule_id  = (known after apply)
      + tags_all = (known after apply)

      + source {
          + owner             = "AWS"
          + source_identifier = "IAM_ROOT_ACCESS_KEY_CHECK"
        }
    }

  # module.iam_audit.aws_config_config_rule.iam_user_unused_credentials[0] will be created
  + resource "aws_config_config_rule" "iam_user_unused_credentials" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + name     = "iam-user-unused-credentials"
      + rule_id  = (known after apply)
      + tags_all = (known after apply)

      + source {
          + owner             = "AWS"
          + source_identifier = "IAM_USER_UNUSED_CREDENTIALS_CHECK"
        }
    }

  # module.iam_audit.aws_iam_role.auditor[0] will be created
  + resource "aws_iam_role" "auditor" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = [
                              + "arn:aws:iam::111122223333:role/SecurityTeam",
                              + "arn:aws:iam::444455556666:role/Auditor",
                            ]
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "bluebit-prod-readonly-auditor"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + role_last_used        = (known after apply)
      + tags                  = {
          + "Compliance"  = "yes"
          + "Environment" = "production"
          + "Owner"       = "cloud-team"
          + "Project"     = "iam-security"
        }
      + tags_all              = {
          + "Compliance"  = "yes"
          + "Environment" = "production"
          + "Owner"       = "cloud-team"
          + "Project"     = "iam-security"
        }
      + unique_id             = (known after apply)
    }

  # module.iam_audit.aws_iam_role_policy_attachment.readonly[0] will be created
  + resource "aws_iam_role_policy_attachment" "readonly" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
      + role       = "bluebit-prod-readonly-auditor"
    }

  # module.iam_audit.aws_s3_bucket.iam_logs[0] will be created
  + resource "aws_s3_bucket" "iam_logs" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "bluebit-prod-iam-logs"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = true
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags                        = {
          + "Compliance"  = "yes"
          + "Environment" = "production"
          + "Owner"       = "cloud-team"
          + "Project"     = "iam-security"
        }
      + tags_all                    = {
          + "Compliance"  = "yes"
          + "Environment" = "production"
          + "Owner"       = "cloud-team"
          + "Project"     = "iam-security"
        }
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)
    }

  # module.iam_audit.aws_s3_bucket_public_access_block.iam_logs[0] will be created
  + resource "aws_s3_bucket_public_access_block" "iam_logs" {
      + block_public_acls       = true
      + block_public_policy     = true
      + bucket                  = (known after apply)
      + id                      = (known after apply)
      + ignore_public_acls      = true
      + restrict_public_buckets = true
    }

  # module.iam_audit_basic.aws_accessanalyzer_analyzer.default[0] will be created
  + resource "aws_accessanalyzer_analyzer" "default" {
      + analyzer_name = "bluebit-basic-access-analyzer"
      + arn           = (known after apply)
      + id            = (known after apply)
      + tags          = {
          + "Environment" = "dev"
          + "Owner"       = "bluebit"
        }
      + tags_all      = {
          + "Environment" = "dev"
          + "Owner"       = "bluebit"
        }
      + type          = "ACCOUNT"
    }

  # module.iam_audit_basic.aws_config_config_rule.iam_root_access[0] will be created
  + resource "aws_config_config_rule" "iam_root_access" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + name     = "iam-root-access"
      + rule_id  = (known after apply)
      + tags_all = (known after apply)

      + source {
          + owner             = "AWS"
          + source_identifier = "IAM_ROOT_ACCESS_KEY_CHECK"
        }
    }

  # module.iam_audit_basic.aws_config_config_rule.iam_user_unused_credentials[0] will be created
  + resource "aws_config_config_rule" "iam_user_unused_credentials" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + name     = "iam-user-unused-credentials"
      + rule_id  = (known after apply)
      + tags_all = (known after apply)

      + source {
          + owner             = "AWS"
          + source_identifier = "IAM_USER_UNUSED_CREDENTIALS_CHECK"
        }
    }

  # module.iam_audit_basic.aws_iam_role.auditor[0] will be created
  + resource "aws_iam_role" "auditor" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = [
                              + "arn:aws:iam::123456789012:role/SecurityAuditor",
                            ]
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "bluebit-basic-readonly-auditor"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + role_last_used        = (known after apply)
      + tags                  = {
          + "Environment" = "dev"
          + "Owner"       = "bluebit"
        }
      + tags_all              = {
          + "Environment" = "dev"
          + "Owner"       = "bluebit"
        }
      + unique_id             = (known after apply)
    }

  # module.iam_audit_basic.aws_iam_role_policy_attachment.readonly[0] will be created
  + resource "aws_iam_role_policy_attachment" "readonly" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
      + role       = "bluebit-basic-readonly-auditor"
    }

Plan: 14 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

github-actions · 2025-07-19T11:34:09Z

🧾 Terraform Plan for `iam_group`

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.test_group_advanced["administrators"].aws_iam_group.this will be created
  + resource "aws_iam_group" "this" {
      + arn       = (known after apply)
      + id        = (known after apply)
      + name      = "Administrators"
      + path      = "/user_groups/administrators/"
      + unique_id = (known after apply)
    }

  # module.test_group_advanced["administrators"].aws_iam_group_membership.this will be created
  + resource "aws_iam_group_membership" "this" {
      + group = "Administrators"
      + id    = (known after apply)
      + name  = "Administrators-membership"
      + users = [
          + "Oreoluwa",
        ]
    }

  # module.test_group_advanced["administrators"].aws_iam_group_policy_attachment.this[0] will be created
  + resource "aws_iam_group_policy_attachment" "this" {
      + group      = "Administrators"
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
    }

  # module.test_group_advanced["cloud"].aws_iam_group.this will be created
  + resource "aws_iam_group" "this" {
      + arn       = (known after apply)
      + id        = (known after apply)
      + name      = "Cloud"
      + path      = "/user_groups/cloud/"
      + unique_id = (known after apply)
    }

  # module.test_group_advanced["cloud"].aws_iam_group_membership.this will be created
  + resource "aws_iam_group_membership" "this" {
      + group = "Cloud"
      + id    = (known after apply)
      + name  = "Cloud-membership"
      + users = [
          + "Charlie",
          + "Dave",
        ]
    }

  # module.test_group_advanced["development"].aws_iam_group.this will be created
  + resource "aws_iam_group" "this" {
      + arn       = (known after apply)
      + id        = (known after apply)
      + name      = "Development"
      + path      = "/user_groups/development/"
      + unique_id = (known after apply)
    }

  # module.test_group_advanced["development"].aws_iam_group_membership.this will be created
  + resource "aws_iam_group_membership" "this" {
      + group = "Development"
      + id    = (known after apply)
      + name  = "Development-membership"
      + users = [
          + "Alice",
          + "Bob",
        ]
    }

  # module.test_group_basic["administrators"].aws_iam_group.this will be created
  + resource "aws_iam_group" "this" {
      + arn       = (known after apply)
      + id        = (known after apply)
      + name      = "Administrators"
      + path      = "/user_groups/administrators/"
      + unique_id = (known after apply)
    }

  # module.test_group_basic["administrators"].aws_iam_group_membership.this will be created
  + resource "aws_iam_group_membership" "this" {
      + group = "Administrators"
      + id    = (known after apply)
      + name  = "Administrators-membership"
      + users = [
          + "Oreoluwa",
        ]
    }

  # module.test_group_basic["administrators"].aws_iam_group_policy_attachment.this[0] will be created
  + resource "aws_iam_group_policy_attachment" "this" {
      + group      = "Administrators"
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
    }

  # module.test_group_basic["cloud"].aws_iam_group.this will be created
  + resource "aws_iam_group" "this" {
      + arn       = (known after apply)
      + id        = (known after apply)
      + name      = "Cloud"
      + path      = "/user_groups/cloud/"
      + unique_id = (known after apply)
    }

  # module.test_group_basic["cloud"].aws_iam_group_membership.this will be created
  + resource "aws_iam_group_membership" "this" {
      + group = "Cloud"
      + id    = (known after apply)
      + name  = "Cloud-membership"
      + users = [
          + "Charlie",
          + "Dave",
        ]
    }

  # module.test_group_basic["development"].aws_iam_group.this will be created
  + resource "aws_iam_group" "this" {
      + arn       = (known after apply)
      + id        = (known after apply)
      + name      = "Development"
      + path      = "/user_groups/development/"
      + unique_id = (known after apply)
    }

  # module.test_group_basic["development"].aws_iam_group_membership.this will be created
  + resource "aws_iam_group_membership" "this" {
      + group = "Development"
      + id    = (known after apply)
      + name  = "Development-membership"
      + users = [
          + "Alice",
          + "Bob",
        ]
    }

Plan: 14 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

github-actions · 2025-07-19T11:34:09Z

🧾 Terraform Plan for `sec_inspector`

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.inspector_advanced.aws_inspector2_delegated_admin_account.this[0] will be created
  + resource "aws_inspector2_delegated_admin_account" "this" {
      + account_id          = "123456789012"
      + id                  = (known after apply)
      + relationship_status = (known after apply)
    }

  # module.inspector_advanced.aws_inspector2_organization_configuration.this[0] will be created
  + resource "aws_inspector2_organization_configuration" "this" {
      + id                        = (known after apply)
      + max_account_limit_reached = (known after apply)

      + auto_enable {
          + ec2    = true
          + ecr    = true
          + lambda = true
        }
    }

  # module.inspector_basic.aws_inspector2_enabler.this[0] will be created
  + resource "aws_inspector2_enabler" "this" {
      + account_ids    = [
          + "111122223333",
          + "444455556666",
        ]
      + id             = (known after apply)
      + resource_types = [
          + "EC2",
          + "ECR",
        ]
    }

Plan: 3 to add, 0 to change, 0 to destroy.

Warning: Argument is deprecated

  with provider["registry.terraform.io/hashicorp/aws"],
  on providers.tf line 7, in provider "aws":
   7:   s3_force_path_style         = true

Use s3_use_path_style instead.

(and one more similar warning elsewhere)

Warning: Attribute Deprecated

  with provider["registry.terraform.io/hashicorp/aws"],
  on providers.tf line 7, in provider "aws":
   7:   s3_force_path_style         = true

Use s3_use_path_style instead.

(and one more similar warning elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

github-actions · 2025-07-19T11:34:10Z

🧾 Terraform Plan for `gov_audit`

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.gov_audit_advanced.aws_config_configuration_aggregator.org_aggregator[0] will be created
  + resource "aws_config_configuration_aggregator" "org_aggregator" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + name     = "org-aggregator"
      + tags_all = (known after apply)

      + organization_aggregation_source {
          + all_regions = true
          + role_arn    = "arn:aws:iam::123456789012:role/AggregatorRole"
        }
    }

  # module.gov_audit_advanced.aws_config_configuration_recorder.this[0] will be created
  + resource "aws_config_configuration_recorder" "this" {
      + id       = (known after apply)
      + name     = "config-recorder"
      + role_arn = "arn:aws:iam::123456789012:role/ConfigRecorderRole"

      + recording_group {
          + all_supported                 = true
          + include_global_resource_types = true
        }
    }

  # module.gov_audit_advanced.aws_config_configuration_recorder_status.this[0] will be created
  + resource "aws_config_configuration_recorder_status" "this" {
      + id         = (known after apply)
      + is_enabled = true
      + name       = "config-recorder"
    }

  # module.gov_audit_advanced.aws_config_delivery_channel.this[0] will be created
  + resource "aws_config_delivery_channel" "this" {
      + id             = (known after apply)
      + name           = "config-delivery-channel"
      + s3_bucket_name = "central-audit-logs"
    }

  # module.gov_audit_advanced.aws_guardduty_detector.this[0] will be created
  + resource "aws_guardduty_detector" "this" {
      + account_id                   = (known after apply)
      + arn                          = (known after apply)
      + enable                       = true
      + finding_publishing_frequency = (known after apply)
      + id                           = (known after apply)
      + tags_all                     = (known after apply)
    }

  # module.gov_audit_advanced.aws_guardduty_organization_admin_account.this[0] will be created
  + resource "aws_guardduty_organization_admin_account" "this" {
      + admin_account_id = "123456789012"
      + id               = (known after apply)
    }

  # module.gov_audit_advanced.aws_s3_bucket_lifecycle_configuration.log_lifecycle[0] will be created
  + resource "aws_s3_bucket_lifecycle_configuration" "log_lifecycle" {
      + bucket = "log-archive-bucket"
      + id     = (known after apply)

      + rule {
          + id     = "ArchiveConfigLogs"
          + status = "Enabled"

          + filter {
            }

          + transition {
              + days          = 30
              + storage_class = "GLACIER"
            }
        }
    }

  # module.gov_audit_advanced.aws_securityhub_account.this[0] will be created
  + resource "aws_securityhub_account" "this" {
      + arn                       = (known after apply)
      + auto_enable_controls      = true
      + control_finding_generator = "SECURITY_CONTROL"
      + enable_default_standards  = true
      + id                        = (known after apply)
    }

  # module.gov_audit_advanced.aws_securityhub_organization_admin_account.this[0] will be created
  + resource "aws_securityhub_organization_admin_account" "this" {
      + admin_account_id = "123456789012"
      + id               = (known after apply)
    }

  # module.gov_audit_advanced.aws_securityhub_standards_subscription.this["aws-foundational-security-best-practices"] will be created
  + resource "aws_securityhub_standards_subscription" "this" {
      + id            = (known after apply)
      + standards_arn = "arn:aws:securityhub:::ruleset/aws-foundational-security-best-practices/v/1.0.0"
    }

  # module.gov_audit_advanced.aws_securityhub_standards_subscription.this["cis-aws-foundations-benchmark"] will be created
  + resource "aws_securityhub_standards_subscription" "this" {
      + id            = (known after apply)
      + standards_arn = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.0.0"
    }

  # module.gov_audit_advanced.aws_sns_topic_subscription.audit_notify[0] will be created
  + resource "aws_sns_topic_subscription" "audit_notify" {
      + arn                             = (known after apply)
      + confirmation_timeout_in_minutes = 1
      + confirmation_was_authenticated  = (known after apply)
      + endpoint                        = "compliance@example.com"
      + endpoint_auto_confirms          = false
      + filter_policy_scope             = (known after apply)
      + id                              = (known after apply)
      + owner_id                        = (known after apply)
      + pending_confirmation            = (known after apply)
      + protocol                        = "email"
      + raw_message_delivery            = false
      + topic_arn                       = "arn:aws:sns:us-east-1:123456789012:audit-topic"
    }

  # module.gov_audit_basic.aws_config_configuration_recorder.this[0] will be created
  + resource "aws_config_configuration_recorder" "this" {
      + id       = (known after apply)
      + name     = "config-recorder"
      + role_arn = "arn:aws:iam::123456789012:role/AWSConfigRole"

      + recording_group {
          + all_supported                 = true
          + include_global_resource_types = true
        }
    }

  # module.gov_audit_basic.aws_config_configuration_recorder_status.this[0] will be created
  + resource "aws_config_configuration_recorder_status" "this" {
      + id         = (known after apply)
      + is_enabled = true
      + name       = "config-recorder"
    }

  # module.gov_audit_basic.aws_config_delivery_channel.this[0] will be created
  + resource "aws_config_delivery_channel" "this" {
      + id             = (known after apply)
      + name           = "config-delivery-channel"
      + s3_bucket_name = "my-basic-audit-bucket"
    }

  # module.gov_audit_basic.aws_guardduty_detector.this[0] will be created
  + resource "aws_guardduty_detector" "this" {
      + account_id                   = (known after apply)
      + arn                          = (known after apply)
      + enable                       = true
      + finding_publishing_frequency = (known after apply)
      + id                           = (known after apply)
      + tags_all                     = (known after apply)
    }

Plan: 16 to add, 0 to change, 0 to destroy.

Warning: Argument is deprecated

  with provider["registry.terraform.io/hashicorp/aws"],
  on providers.tf line 7, in provider "aws":
   7:   s3_force_path_style         = true

Use s3_use_path_style instead.

(and one more similar warning elsewhere)

Warning: Attribute Deprecated

  with provider["registry.terraform.io/hashicorp/aws"],
  on providers.tf line 7, in provider "aws":
   7:   s3_force_path_style         = true

Use s3_use_path_style instead.

(and one more similar warning elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

github-actions · 2025-07-19T11:34:10Z

🧾 Terraform Plan for `iam_role`

module.github_actions_role.data.aws_iam_policy_document.assume_role: Reading...
module.iam_role.data.aws_iam_policy_document.assume_role: Reading...
module.eks_irsa_role.data.aws_iam_policy_document.assume_role: Reading...
module.iam_role.data.aws_iam_policy_document.assume_role: Read complete after 0s [id=1423484585]
module.github_actions_role.data.aws_iam_policy_document.assume_role: Read complete after 0s [id=2487025436]
module.eks_irsa_role.data.aws_iam_policy_document.assume_role: Read complete after 0s [id=1995518740]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.eks_irsa_role.aws_iam_role.this will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Federated = "arn:aws:iam::111222334343:oidc-provider/https://oidc.eks.us-west-2.amazonaws.com/id/EXAMPLE1234567890"
                        }
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "eks-irsa-myapp"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + role_last_used        = (known after apply)
      + tags                  = {
          + "App"         = "myapp"
          + "Environment" = "prod"
        }
      + tags_all              = {
          + "App"         = "myapp"
          + "Environment" = "prod"
        }
      + unique_id             = (known after apply)
    }

  # module.eks_irsa_role.aws_iam_role_policy.inline["eks-irsa-inline"] will be created
  + resource "aws_iam_role_policy" "inline" {
      + id     = (known after apply)
      + name   = "eks-irsa-inline"
      + policy = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "s3:GetObject",
                          + "s3:PutObject",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:s3:::myapp-bucket/*"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + role   = "eks-irsa-myapp"
    }

  # module.eks_irsa_role.aws_iam_role_policy_attachment.managed["arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"] will be created
  + resource "aws_iam_role_policy_attachment" "managed" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
      + role       = "eks-irsa-myapp"
    }

  # module.github_actions_role.aws_iam_role.this will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Condition = {
                          + StringEquals = {
                              + "token.actions.githubusercontent.com:sub" = "repo:bluebit/myrepo:*"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Federated = "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
                        }
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "github-deploy-role"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + role_last_used        = (known after apply)
      + tags                  = {
          + "Environment" = "staging"
          + "Owner"       = "bluebit"
        }
      + tags_all              = {
          + "Environment" = "staging"
          + "Owner"       = "bluebit"
        }
      + unique_id             = (known after apply)
    }

  # module.github_actions_role.aws_iam_role_policy.inline["github-actions-deploy"] will be created
  + resource "aws_iam_role_policy" "inline" {
      + id     = (known after apply)
      + name   = "github-actions-deploy"
      + policy = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "s3:*",
                          + "cloudfront:CreateInvalidation",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + role   = "github-deploy-role"
    }

  # module.github_actions_role.aws_iam_role_policy_attachment.managed["arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"] will be created
  + resource "aws_iam_role_policy_attachment" "managed" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
      + role       = "github-deploy-role"
    }

  # module.iam_role.aws_iam_instance_profile.this[0] will be created
  + resource "aws_iam_instance_profile" "this" {
      + arn         = (known after apply)
      + create_date = (known after apply)
      + id          = (known after apply)
      + name        = "example-role-profile"
      + name_prefix = (known after apply)
      + path        = "/"
      + role        = "example-role"
      + tags_all    = (known after apply)
      + unique_id   = (known after apply)
    }

  # module.iam_role.aws_iam_role.this will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "arn:aws:iam::123456789012:root"
                        }
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "example-role"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + permissions_boundary  = "arn:aws:iam::123456789012:policy/ExamplePermissionsBoundary"
      + role_last_used        = (known after apply)
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.iam_role.aws_iam_role_policy.inline["custom-policy"] will be created
  + resource "aws_iam_role_policy" "inline" {
      + id     = (known after apply)
      + name   = "custom-policy"
      + policy = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "s3:ListBucket",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "*",
                        ]
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + role   = "example-role"
    }

  # module.iam_role.aws_iam_role_policy_attachment.managed["arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"] will be created
  + resource "aws_iam_role_policy_attachment" "managed" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
      + role       = "example-role"
    }

Plan: 10 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

github-actions · 2025-07-19T11:34:11Z

🧾 Terraform Plan for `gov_accessanalyzer`

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.iam_access_analyzer.aws_accessanalyzer_analyzer.this[0] will be created
  + resource "aws_accessanalyzer_analyzer" "this" {
      + analyzer_name = "prod-access-analyzer"
      + arn           = (known after apply)
      + id            = (known after apply)
      + tags          = {
          + "Env"     = "prod"
          + "Project" = "GovernanceBooster"
        }
      + tags_all      = {
          + "Env"     = "prod"
          + "Project" = "GovernanceBooster"
        }
      + type          = "ACCOUNT"
    }

  # module.iam_access_analyzer_advanced.aws_accessanalyzer_analyzer.this[0] will be created
  + resource "aws_accessanalyzer_analyzer" "this" {
      + analyzer_name = "org-analyzer"
      + arn           = (known after apply)
      + id            = (known after apply)
      + tags          = {
          + "Environment" = "production"
          + "Team"        = "security"
        }
      + tags_all      = {
          + "Environment" = "production"
          + "Team"        = "security"
        }
      + type          = "ORGANIZATION"
    }

  # module.iam_access_analyzer_advanced.aws_accessanalyzer_archive_rule.this[0] will be created
  + resource "aws_accessanalyzer_archive_rule" "this" {
      + analyzer_name = "org-analyzer"
      + id            = (known after apply)
      + rule_name     = "suppress-public-s3"

      + filter {
          + contains = (known after apply)
          + criteria = "isPublic"
          + eq       = [
              + "true",
            ]
          + exists   = (known after apply)
          + neq      = (known after apply)
        }
      + filter {
          + contains = (known after apply)
          + criteria = "resourceType"
          + eq       = [
              + "AWS::S3::Bucket",
            ]
          + exists   = (known after apply)
          + neq      = (known after apply)
        }
    }

  # module.iam_access_analyzer_advanced.aws_cloudwatch_event_rule.access_analyzer_findings[0] will be created
  + resource "aws_cloudwatch_event_rule" "access_analyzer_findings" {
      + arn            = (known after apply)
      + description    = "Capture IAM Access Analyzer findings"
      + event_bus_name = "default"
      + event_pattern  = jsonencode(
            {
              + detail-type = [
                  + "Access Analyzer Finding",
                ]
              + source      = [
                  + "aws.access-analyzer",
                ]
            }
        )
      + id             = (known after apply)
      + is_enabled     = true
      + name           = "access-analyzer-findings"
      + name_prefix    = (known after apply)
      + tags_all       = (known after apply)
    }

  # module.iam_access_analyzer_advanced.aws_cloudwatch_event_target.send_to_sns[0] will be created
  + resource "aws_cloudwatch_event_target" "send_to_sns" {
      + arn            = (known after apply)
      + event_bus_name = "default"
      + id             = (known after apply)
      + rule           = "access-analyzer-findings"
      + target_id      = "sns"
    }

  # module.iam_access_analyzer_advanced.aws_config_config_rule.s3_public_block[0] will be created
  + resource "aws_config_config_rule" "s3_public_block" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + name     = "s3-bucket-public-read-prohibited"
      + rule_id  = (known after apply)
      + tags_all = (known after apply)

      + source {
          + owner             = "AWS"
          + source_identifier = "S3_BUCKET_PUBLIC_READ_PROHIBITED"
        }
    }

  # module.iam_access_analyzer_advanced.aws_config_configuration_recorder.this[0] will be created
  + resource "aws_config_configuration_recorder" "this" {
      + id       = (known after apply)
      + name     = "config"
      + role_arn = (known after apply)
    }

  # module.iam_access_analyzer_advanced.aws_config_delivery_channel.this[0] will be created
  + resource "aws_config_delivery_channel" "this" {
      + id             = (known after apply)
      + name           = "default"
      + s3_bucket_name = "my-config-log-bucket"
    }

  # module.iam_access_analyzer_advanced.aws_iam_role.config_role[0] will be created
  + resource "aws_iam_role" "config_role" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "config.amazonaws.com"
                        }
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "config-recorder-role"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + role_last_used        = (known after apply)
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.iam_access_analyzer_advanced.aws_s3_bucket.config_logs[0] will be created
  + resource "aws_s3_bucket" "config_logs" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "my-config-log-bucket"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)
    }

  # module.iam_access_analyzer_advanced.aws_sns_topic.this[0] will be created
  + resource "aws_sns_topic" "this" {
      + arn                         = (known after apply)
      + content_based_deduplication = false
      + fifo_topic                  = false
      + id                          = (known after apply)
      + name                        = "access-analyzer-alerts"
      + name_prefix                 = (known after apply)
      + owner                       = (known after apply)
      + policy                      = (known after apply)
      + signature_version           = (known after apply)
      + tags_all                    = (known after apply)
      + tracing_config              = (known after apply)
    }

  # module.iam_access_analyzer_advanced.aws_sns_topic_subscription.email[0] will be created
  + resource "aws_sns_topic_subscription" "email" {
      + arn                             = (known after apply)
      + confirmation_timeout_in_minutes = 1
      + confirmation_was_authenticated  = (known after apply)
      + endpoint                        = "security@example.com"
      + endpoint_auto_confirms          = false
      + filter_policy_scope             = (known after apply)
      + id                              = (known after apply)
      + owner_id                        = (known after apply)
      + pending_confirmation            = (known after apply)
      + protocol                        = "email"
      + raw_message_delivery            = false
      + topic_arn                       = (known after apply)
    }

Plan: 12 to add, 0 to change, 0 to destroy.

Warning: Argument is deprecated

  with provider["registry.terraform.io/hashicorp/aws"],
  on providers.tf line 7, in provider "aws":
   7:   s3_force_path_style         = true

Use s3_use_path_style instead.

(and one more similar warning elsewhere)

Warning: Attribute Deprecated

  with provider["registry.terraform.io/hashicorp/aws"],
  on providers.tf line 7, in provider "aws":
   7:   s3_force_path_style         = true

Use s3_use_path_style instead.

(and one more similar warning elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

or4dx added 2 commits July 19, 2025 12:48

Added observability files for cost monitoring

59fa03e

Added observability tracing and logging files

1a0a9e3

or4dx requested a review from Copilot July 19, 2025 11:29

Copilot AI reviewed Jul 19, 2025

View reviewed changes

Fixed error in job_name

188d94f

or4dx merged commit 13aa69d into main Jul 19, 2025
6 of 29 checks passed

Ore/terraform gh action #6

Ore/terraform gh action #6

Uh oh!

Conversation

or4dx commented Jul 19, 2025

Observability Documentation and Structure

Cost Monitoring Enhancements

Logging Observability

Minor Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

github-actions bot commented Jul 19, 2025

🧾 Terraform Plan for sec_kms

Uh oh!

github-actions bot commented Jul 19, 2025

🧾 Terraform Plan for sec_ebs_snapshot_guard

Uh oh!

github-actions bot commented Jul 19, 2025

🧾 Terraform Plan for sec_ssm_baseline

Uh oh!

github-actions bot commented Jul 19, 2025

🧾 Terraform Plan for sec_backup_policy_enforcer

Uh oh!

github-actions bot commented Jul 19, 2025

🧾 Terraform Plan for sec_secretmanager_baseline

Uh oh!

Uh oh!

github-actions bot commented Jul 19, 2025

🧾 Terraform Plan for iam_audit

Uh oh!

github-actions bot commented Jul 19, 2025

🧾 Terraform Plan for iam_group

Uh oh!

github-actions bot commented Jul 19, 2025

🧾 Terraform Plan for sec_inspector

Uh oh!

github-actions bot commented Jul 19, 2025

🧾 Terraform Plan for gov_audit

Uh oh!

github-actions bot commented Jul 19, 2025

🧾 Terraform Plan for iam_role

Uh oh!

github-actions bot commented Jul 19, 2025

🧾 Terraform Plan for gov_accessanalyzer

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

🧾 Terraform Plan for `sec_kms`

🧾 Terraform Plan for `sec_ebs_snapshot_guard`

🧾 Terraform Plan for `sec_ssm_baseline`

🧾 Terraform Plan for `sec_backup_policy_enforcer`

🧾 Terraform Plan for `sec_secretmanager_baseline`

🧾 Terraform Plan for `iam_audit`

🧾 Terraform Plan for `iam_group`

🧾 Terraform Plan for `sec_inspector`

🧾 Terraform Plan for `gov_audit`

🧾 Terraform Plan for `iam_role`

🧾 Terraform Plan for `gov_accessanalyzer`