updating release version 2.16.27 #1568
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
production: ecr✅ Terraform Init: Plan: 0 to add, 1 to change, 0 to destroyShow summary
Show planResource actions are indicated with the following symbols:
~ update in-place
Terraform will perform the following actions:
# aws_iam_role_policy.github_docker_push will be updated in-place
~ resource "aws_iam_role_policy" "github_docker_push" {
id = "github_docker_push:github_docker_push"
name = "github_docker_push"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ policy = (sensitive value)
# (2 unchanged attributes hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: plan.tfplan
To perform exactly these actions, run the following command to apply:
terraform apply "plan.tfplan"
Show Conftest resultsWARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.api-lambda"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.google-cidr"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.heartbeat"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.pinpoint_to_sqs_sms_callbacks"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.ses_receiving_emails"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.ses_to_sqs_email_callbacks"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.sns_to_sqs_sms_callbacks"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.system_status"]
WARN - plan.json - main - Missing Common Tags: ["aws_secretsmanager_secret.api_lambda_repository_url"]
WARN - plan.json - main - Missing Common Tags: ["aws_secretsmanager_secret.google_cidr_repository_url"]
WARN - plan.json - main - Missing Common Tags: ["aws_secretsmanager_secret.heartbeat_repository_url"]
WARN - plan.json - main - Missing Common Tags: ["aws_secretsmanager_secret.pinpoint_to_sqs_sms_callbacks_repository_url"]
WARN - plan.json - main - Missing Common Tags: ["aws_secretsmanager_secret.ses_receiving_emails_repository_url"]
WARN - plan.json - main - Missing Common Tags: ["aws_secretsmanager_secret.ses_to_sqs_email_callbacks_repository_url"]
WARN - plan.json - main - Missing Common Tags: ["aws_secretsmanager_secret.sns_to_sqs_sms_callbacks_repository_url"]
WARN - plan.json - main - Missing Common Tags: ["aws_secretsmanager_secret.system_status_repository_url"]
35 tests, 19 passed, 16 warnings, 0 failures, 0 exceptions
|
production: common✅ Terraform Init: Plan: 4 to add, 23 to change, 4 to destroyShow summary
Show planResource actions are indicated with the following symbols:
~ update in-place
-/+ destroy and then create replacement
Terraform will perform the following actions:
# aws_athena_named_query.create_table_alb_logs will be updated in-place
~ resource "aws_athena_named_query" "create_table_alb_logs" {
id = "8fc8c2ae-d126-4bd9-aea7-8c3e4ee95e45"
name = "create_table_alb_logs"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ query = (sensitive value)
# (3 unchanged attributes hidden)
}
# aws_athena_named_query.create_table_all_waf_logs will be updated in-place
~ resource "aws_athena_named_query" "create_table_all_waf_logs" {
id = "c6ad95ad-bf51-4fc2-aae6-6743424c5301"
name = "WAF: create table waf_logs"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ query = (sensitive value)
# (3 unchanged attributes hidden)
}
# aws_athena_named_query.create_table_waf_logs will be updated in-place
~ resource "aws_athena_named_query" "create_table_waf_logs" {
id = "a34e2769-59e4-491d-a8cc-a3f95e18e540"
name = "WAF: create table waf_logs_lb"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ query = (sensitive value)
# (3 unchanged attributes hidden)
}
# aws_athena_named_query.create_table_waf_logs_api_lambda will be updated in-place
~ resource "aws_athena_named_query" "create_table_waf_logs_api_lambda" {
id = "da93dec8-785e-450b-881c-5540e604417c"
name = "WAF: create table waf_logs_api_lambda"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ query = (sensitive value)
# (3 unchanged attributes hidden)
}
# aws_budgets_budget.notify_global will be updated in-place
~ resource "aws_budgets_budget" "notify_global" {
id = "296255494825:notify-global-budget"
~ limit_amount = "10000.0" -> "15000"
name = "notify-global-budget"
tags = {}
# (9 unchanged attributes hidden)
# (3 unchanged blocks hidden)
}
# aws_cloudwatch_dashboard.emails[0] will be updated in-place
~ resource "aws_cloudwatch_dashboard" "emails" {
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ dashboard_body = (sensitive value)
id = "Emails"
# (2 unchanged attributes hidden)
}
# aws_cloudwatch_dashboard.sms[0] will be updated in-place
~ resource "aws_cloudwatch_dashboard" "sms" {
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ dashboard_body = (sensitive value)
id = "SMS"
# (2 unchanged attributes hidden)
}
# aws_cloudwatch_log_group.route53_resolver_query_log[0] will be updated in-place
~ resource "aws_cloudwatch_log_group" "route53_resolver_query_log" {
id = "route53/ca-central-1/296255494825/DNS/logs"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ name = (sensitive value)
tags = {
"CostCenter" = "notification-canada-ca-production"
}
# (7 unchanged attributes hidden)
}
# aws_cloudwatch_log_group.sns_deliveries[0] will be updated in-place
~ resource "aws_cloudwatch_log_group" "sns_deliveries" {
id = "sns/ca-central-1/296255494825/DirectPublishToPhoneNumber"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ name = (sensitive value)
tags = {
"CostCenter" = "notification-canada-ca-production"
}
# (7 unchanged attributes hidden)
}
# aws_cloudwatch_log_group.sns_deliveries_failures[0] will be updated in-place
~ resource "aws_cloudwatch_log_group" "sns_deliveries_failures" {
id = "sns/ca-central-1/296255494825/DirectPublishToPhoneNumber/Failure"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ name = (sensitive value)
tags = {
"CostCenter" = "notification-canada-ca-production"
}
# (7 unchanged attributes hidden)
}
# aws_cloudwatch_log_group.sns_deliveries_failures_us_west_2[0] will be updated in-place
~ resource "aws_cloudwatch_log_group" "sns_deliveries_failures_us_west_2" {
id = "sns/us-west-2/296255494825/DirectPublishToPhoneNumber/Failure"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ name = (sensitive value)
tags = {
"CostCenter" = "notification-canada-ca-production"
}
# (7 unchanged attributes hidden)
}
# aws_cloudwatch_log_group.sns_deliveries_us_west_2[0] will be updated in-place
~ resource "aws_cloudwatch_log_group" "sns_deliveries_us_west_2" {
id = "sns/us-west-2/296255494825/DirectPublishToPhoneNumber"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ name = (sensitive value)
tags = {
"CostCenter" = "notification-canada-ca-production"
}
# (7 unchanged attributes hidden)
}
# aws_cloudwatch_log_metric_filter.sns-sms-blocked-as-spam[0] will be updated in-place
~ resource "aws_cloudwatch_log_metric_filter" "sns-sms-blocked-as-spam" {
id = "sns-sms-blocked-as-spam"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ log_group_name = (sensitive value)
name = "sns-sms-blocked-as-spam"
# (1 unchanged attribute hidden)
# (1 unchanged block hidden)
}
# aws_cloudwatch_log_metric_filter.sns-sms-blocked-as-spam-us-west-2[0] will be updated in-place
~ resource "aws_cloudwatch_log_metric_filter" "sns-sms-blocked-as-spam-us-west-2" {
id = "sns-sms-blocked-as-spam-us-west-2"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ log_group_name = (sensitive value)
name = "sns-sms-blocked-as-spam-us-west-2"
# (1 unchanged attribute hidden)
# (1 unchanged block hidden)
}
# aws_cloudwatch_log_metric_filter.sns-sms-phone-carrier-unavailable[0] will be updated in-place
~ resource "aws_cloudwatch_log_metric_filter" "sns-sms-phone-carrier-unavailable" {
id = "sns-sms-phone-carrier-unavailable"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ log_group_name = (sensitive value)
name = "sns-sms-phone-carrier-unavailable"
# (1 unchanged attribute hidden)
# (1 unchanged block hidden)
}
# aws_cloudwatch_log_metric_filter.sns-sms-phone-carrier-unavailable-us-west-2[0] will be updated in-place
~ resource "aws_cloudwatch_log_metric_filter" "sns-sms-phone-carrier-unavailable-us-west-2" {
id = "sns-sms-phone-carrier-unavailable-us-west-2"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ log_group_name = (sensitive value)
name = "sns-sms-phone-carrier-unavailable-us-west-2"
# (1 unchanged attribute hidden)
# (1 unchanged block hidden)
}
# aws_cloudwatch_log_metric_filter.sns-sms-rate-exceeded[0] will be updated in-place
~ resource "aws_cloudwatch_log_metric_filter" "sns-sms-rate-exceeded" {
id = "sns-sms-rate-exceeded"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ log_group_name = (sensitive value)
name = "sns-sms-rate-exceeded"
# (1 unchanged attribute hidden)
# (1 unchanged block hidden)
}
# aws_cloudwatch_log_metric_filter.sns-sms-rate-exceeded-us-west-2[0] will be updated in-place
~ resource "aws_cloudwatch_log_metric_filter" "sns-sms-rate-exceeded-us-west-2" {
id = "sns-sms-rate-exceeded-us-west-2"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ log_group_name = (sensitive value)
name = "sns-sms-rate-exceeded-us-west-2"
# (1 unchanged attribute hidden)
# (1 unchanged block hidden)
}
# aws_route53_resolver_query_log_config.dns_query_log_config[0] will be updated in-place
~ resource "aws_route53_resolver_query_log_config" "dns_query_log_config" {
id = "rqlc-8f0f60bdbe194652"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ name = (sensitive value)
tags = {
"CostCenter" = "notification-canada-ca-production"
}
# (5 unchanged attributes hidden)
}
# aws_s3_bucket_policy.alb_log_bucket_allow_elb_account will be updated in-place
~ resource "aws_s3_bucket_policy" "alb_log_bucket_allow_elb_account" {
id = "notification-canada-ca-production-alb-logs"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ policy = (sensitive value)
# (1 unchanged attribute hidden)
}
# aws_s3_bucket_policy.sns_sms_usage_report_bucket_policy will be updated in-place
~ resource "aws_s3_bucket_policy" "sns_sms_usage_report_bucket_policy" {
id = "notification-canada-ca-production-sms-usage-logs"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ policy = (sensitive value)
# (1 unchanged attribute hidden)
}
# aws_s3_bucket_policy.sns_sms_usage_report_bucket_us_west_2_policy will be updated in-place
~ resource "aws_s3_bucket_policy" "sns_sms_usage_report_bucket_us_west_2_policy" {
id = "notification-canada-ca-production-sms-usage-west-2-logs"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ policy = (sensitive value)
# (1 unchanged attribute hidden)
}
# aws_sns_topic.notification-canada-ca-alert-general will be updated in-place
~ resource "aws_sns_topic" "notification-canada-ca-alert-general" {
id = "arn:aws:sns:ca-central-1:296255494825:alert-general"
name = "alert-general"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ policy = (sensitive value)
tags = {
"CostCenter" = "notification-canada-ca-production"
}
# (28 unchanged attributes hidden)
}
# module.notify_slack_critical.module.lambda.null_resource.archive[0] must be replaced
-/+ resource "null_resource" "archive" {
~ id = "8560614048223803944" -> (known after apply)
~ triggers = { # forces replacement
~ "timestamp" = "<WARNING: Missing lambda zip artifacts wouldn't be restored>" -> "1728324591274983800"
# (1 unchanged element hidden)
}
}
# module.notify_slack_general.module.lambda.null_resource.archive[0] must be replaced
-/+ resource "null_resource" "archive" {
~ id = "7648199536452596772" -> (known after apply)
~ triggers = { # forces replacement
~ "timestamp" = "<WARNING: Missing lambda zip artifacts wouldn't be restored>" -> "1728324583933831000"
# (1 unchanged element hidden)
}
}
# module.notify_slack_ok.module.lambda.null_resource.archive[0] must be replaced
-/+ resource "null_resource" "archive" {
~ id = "5349601137468455245" -> (known after apply)
~ triggers = { # forces replacement
~ "timestamp" = "<WARNING: Missing lambda zip artifacts wouldn't be restored>" -> "1728324591273498000"
# (1 unchanged element hidden)
}
}
# module.notify_slack_warning.module.lambda.null_resource.archive[0] must be replaced
-/+ resource "null_resource" "archive" {
~ id = "7052539562147948218" -> (known after apply)
~ triggers = { # forces replacement
~ "timestamp" = "<WARNING: Missing lambda zip artifacts wouldn't be restored>" -> "1728324591285468200"
# (1 unchanged element hidden)
}
}
Plan: 4 to add, 23 to change, 4 to destroy.
Warning: Argument is deprecated
with aws_s3_bucket.csv_bucket,
on s3.tf line 5, in resource "aws_s3_bucket" "csv_bucket":
5: resource "aws_s3_bucket" "csv_bucket" {
Use the aws_s3_bucket_server_side_encryption_configuration resource instead
(and 67 more similar warnings elsewhere)
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: plan.tfplan
To perform exactly these actions, run the following command to apply:
terraform apply "plan.tfplan"
Show Conftest resultsWARN - plan.json - main - Missing Common Tags: ["aws_athena_workgroup.ad_hoc"]
WARN - plan.json - main - Missing Common Tags: ["aws_athena_workgroup.build_tables"]
WARN - plan.json - main - Missing Common Tags: ["aws_athena_workgroup.primary"]
WARN - plan.json - main - Missing Common Tags: ["aws_athena_workgroup.support"]
WARN - plan.json - main - Missing Common Tags: ["aws_budgets_budget.notify_global"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_event_rule.aws_health[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.route53_resolver_query_log[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.sns_deliveries[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.sns_deliveries_failures[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.sns_deliveries_failures_us_west_2[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.sns_deliveries_us_west_2[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.bulk-bulk-not-being-processed-critical[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.bulk-bulk-not-being-processed-warning[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.bulk-inflights-not-being-processed-critical[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.bulk-inflights-not-being-processed-warning[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.bulk-not-being-processed-critical[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.bulk-not-being-processed-warning[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.contact-3-500-error-15-minutes-critical[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.document-download-bucket-size-warning[0]"]
WARN - plan.json... |
production: pinpoint_to_sqs_sms_callbacks✅ Terraform Init: Plan: 0 to add, 12 to change, 0 to destroyShow summary
Show planResource actions are indicated with the following symbols:
~ update in-place
<= read (data resources)
Terraform will perform the following actions:
# data.aws_iam_policy_document.pinpoint_logs will be read during apply
# (depends on a resource or a module with changes pending)
<= data "aws_iam_policy_document" "pinpoint_logs" {
+ id = (known after apply)
+ json = (known after apply)
+ minified_json = (known after apply)
+ statement {
+ actions = [
+ "logs:CreateLogStream",
+ "logs:DescribeLogStreams",
+ "logs:PutLogEvents",
]
+ effect = "Allow"
+ resources = [
+ "arn:aws:logs:ca-central-1:296255494825:log-group:sns/ca-central-1/296255494825/PinpointDirectPublishToPhoneNumber/Failure:*",
+ "arn:aws:logs:ca-central-1:296255494825:log-group:sns/ca-central-1/296255494825/PinpointDirectPublishToPhoneNumber:*",
]
}
}
# aws_cloudwatch_dashboard.pinpoint[0] will be updated in-place
~ resource "aws_cloudwatch_dashboard" "pinpoint" {
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ dashboard_body = (sensitive value)
id = "SMS-Pinpoint"
# (2 unchanged attributes hidden)
}
# aws_cloudwatch_log_group.pinpoint_deliveries will be updated in-place
~ resource "aws_cloudwatch_log_group" "pinpoint_deliveries" {
id = "sns/ca-central-1/296255494825/PinpointDirectPublishToPhoneNumber"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ name = (sensitive value)
tags = {
"CostCenter" = "notification-canada-ca-production"
}
# (7 unchanged attributes hidden)
}
# aws_cloudwatch_log_group.pinpoint_deliveries_failures will be updated in-place
~ resource "aws_cloudwatch_log_group" "pinpoint_deliveries_failures" {
id = "sns/ca-central-1/296255494825/PinpointDirectPublishToPhoneNumber/Failure"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ name = (sensitive value)
tags = {
"CostCenter" = "notification-canada-ca-production"
}
# (7 unchanged attributes hidden)
}
# aws_cloudwatch_log_metric_filter.pinpoint-sms-blocked-as-spam[0] will be updated in-place
~ resource "aws_cloudwatch_log_metric_filter" "pinpoint-sms-blocked-as-spam" {
id = "pinpoint-sms-blocked-as-spam"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ log_group_name = (sensitive value)
name = "pinpoint-sms-blocked-as-spam"
# (1 unchanged attribute hidden)
# (1 unchanged block hidden)
}
# aws_cloudwatch_log_metric_filter.pinpoint-sms-failures[0] will be updated in-place
~ resource "aws_cloudwatch_log_metric_filter" "pinpoint-sms-failures" {
id = "pinpoint-sms-failures"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ log_group_name = (sensitive value)
name = "pinpoint-sms-failures"
# (1 unchanged attribute hidden)
# (1 unchanged block hidden)
}
# aws_cloudwatch_log_metric_filter.pinpoint-sms-phone-carrier-unavailable[0] will be updated in-place
~ resource "aws_cloudwatch_log_metric_filter" "pinpoint-sms-phone-carrier-unavailable" {
id = "pinpoint-sms-phone-carrier-unavailable"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ log_group_name = (sensitive value)
name = "pinpoint-sms-phone-carrier-unavailable"
# (1 unchanged attribute hidden)
# (1 unchanged block hidden)
}
# aws_cloudwatch_log_metric_filter.pinpoint-sms-rate-exceeded[0] will be updated in-place
~ resource "aws_cloudwatch_log_metric_filter" "pinpoint-sms-rate-exceeded" {
id = "pinpoint-sms-rate-exceeded"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ log_group_name = (sensitive value)
name = "pinpoint-sms-rate-exceeded"
# (1 unchanged attribute hidden)
# (1 unchanged block hidden)
}
# aws_cloudwatch_log_metric_filter.pinpoint-sms-successes[0] will be updated in-place
~ resource "aws_cloudwatch_log_metric_filter" "pinpoint-sms-successes" {
id = "pinpoint-sms-successes"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ log_group_name = (sensitive value)
name = "pinpoint-sms-successes"
# (1 unchanged attribute hidden)
# (1 unchanged block hidden)
}
# aws_cloudwatch_log_subscription_filter.pinpoint_deliveries_ca_central_to_lambda[0] will be updated in-place
~ resource "aws_cloudwatch_log_subscription_filter" "pinpoint_deliveries_ca_central_to_lambda" {
id = "cwlsf-2187385823"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ log_group_name = (sensitive value)
name = "pinpoint_deliveries_ca_central"
# (4 unchanged attributes hidden)
}
# aws_cloudwatch_log_subscription_filter.pinpoint_deliveries_failures_ca_central_to_lambda[0] will be updated in-place
~ resource "aws_cloudwatch_log_subscription_filter" "pinpoint_deliveries_failures_ca_central_to_lambda" {
id = "cwlsf-422858666"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ log_group_name = (sensitive value)
name = "pinpoint_deliveries_failures_ca_central"
# (4 unchanged attributes hidden)
}
# aws_cloudwatch_query_definition.pinpoint-logs[0] will be updated in-place
~ resource "aws_cloudwatch_query_definition" "pinpoint-logs" {
id = "267b3b29-2a72-44e2-af14-95de8773bcfc"
~ log_group_names = [
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ (sensitive value),
]
name = "SMS / Pinpoint logs"
# (2 unchanged attributes hidden)
}
# aws_iam_policy.pinpoint_logs will be updated in-place
~ resource "aws_iam_policy" "pinpoint_logs" {
id = "arn:aws:iam::296255494825:policy/PinpointLogsPolicy"
name = "PinpointLogsPolicy"
~ policy = jsonencode(
{
- Statement = [
- {
- Action = [
- "logs:PutLogEvents",
- "logs:DescribeLogStreams",
- "logs:CreateLogStream",
]
- Effect = "Allow"
- Resource = [
- "arn:aws:logs:ca-central-1:296255494825:log-group:sns/ca-central-1/296255494825/PinpointDirectPublishToPhoneNumber:*",
- "arn:aws:logs:ca-central-1:296255494825:log-group:sns/ca-central-1/296255494825/PinpointDirectPublishToPhoneNumber/Failure:*",
]
},
]
- Version = "2012-10-17"
}
) -> (known after apply)
tags = {}
# (7 unchanged attributes hidden)
}
Plan: 0 to add, 12 to change, 0 to destroy.
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: plan.tfplan
To perform exactly these actions, run the following command to apply:
terraform apply "plan.tfplan"
Show Conftest resultsWARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.pinpoint_deliveries"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.pinpoint_deliveries_failures"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.pinpoint_to_sqs_sms_callbacks_log_group[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.lambda-image-pinpoint-delivery-receipts-errors-critical[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.lambda-image-pinpoint-delivery-receipts-errors-warning[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.logs-1-500-error-1-minute-warning-pinpoint_to_sqs_sms_callbacks-api[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.logs-10-500-error-5-minutes-critical-pinpoint_to_sqs_sms_callbacks-api[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.pinpoint-sms-blocked-as-spam-warning[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.pinpoint-sms-phone-carrier-unavailable-warning[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.pinpoint-sms-rate-exceeded-warning[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.pinpoint-sms-success-rate-critical[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.pinpoint-sms-success-rate-warning[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.total-sms-spending-critical[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.total-sms-spending-warning[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.pinpoint_logs"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.pinpoint_logs"]
35 tests, 19 passed, 16 warnings, 0 failures, 0 exceptions
|
production: heartbeat✅ Terraform Init: Plan: 0 to add, 1 to change, 0 to destroyShow summary
Show planResource actions are indicated with the following symbols:
~ update in-place
Terraform will perform the following actions:
# module.heartbeat.aws_lambda_function.this will be updated in-place
~ resource "aws_lambda_function" "this" {
id = "heartbeat"
tags = {
"CostCentre" = "notification-canada-ca-production"
"Terraform" = "true"
}
# (28 unchanged attributes hidden)
~ environment {
~ variables = {
~ "heartbeat_api_key" = (sensitive value)
# Warning: this attribute value will no longer be marked as sensitive
# after applying this change. The value is unchanged.
~ "heartbeat_base_url" = (sensitive value)
# (1 unchanged element hidden)
}
}
# (3 unchanged blocks hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: plan.tfplan
To perform exactly these actions, run the following command to apply:
terraform apply "plan.tfplan"
Show Conftest resultsWARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_event_rule.heartbeat_testing[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.heartbeat_log_group[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.logs-1-500-error-1-minute-warning-heartbeat-api[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.logs-10-500-error-5-minutes-critical-heartbeat-api[0]"]
23 tests, 19 passed, 4 warnings, 0 failures, 0 exceptions
|
production: sns_to_sqs_sms_callbacks✅ Terraform Init: Plan: 0 to add, 5 to change, 0 to destroyShow summary
Show planResource actions are indicated with the following symbols:
~ update in-place
Terraform will perform the following actions:
# module.sns_to_sqs_sms_callbacks.aws_cloudwatch_log_group.this will be updated in-place
~ resource "aws_cloudwatch_log_group" "this" {
id = "/aws/lambda/sns_to_sqs_sms_callbacks"
name = "/aws/lambda/sns_to_sqs_sms_callbacks"
~ tags = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
"Terraform" = "true"
}
~ tags_all = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
# (1 unchanged element hidden)
}
# (6 unchanged attributes hidden)
}
# module.sns_to_sqs_sms_callbacks.aws_iam_policy.non_vpc_policies[0] will be updated in-place
~ resource "aws_iam_policy" "non_vpc_policies" {
id = "arn:aws:iam::296255494825:policy/sns_to_sqs_sms_callbacks_non_vpc"
name = "sns_to_sqs_sms_callbacks_non_vpc"
~ tags = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
"Terraform" = "true"
}
~ tags_all = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
# (1 unchanged element hidden)
}
# (7 unchanged attributes hidden)
}
# module.sns_to_sqs_sms_callbacks.aws_iam_policy.policies[0] will be updated in-place
~ resource "aws_iam_policy" "policies" {
id = "arn:aws:iam::296255494825:policy/sns_to_sqs_sms_callbacks-0"
name = "sns_to_sqs_sms_callbacks-0"
~ tags = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
"Terraform" = "true"
}
~ tags_all = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
# (1 unchanged element hidden)
}
# (7 unchanged attributes hidden)
}
# module.sns_to_sqs_sms_callbacks.aws_iam_role.this will be updated in-place
~ resource "aws_iam_role" "this" {
id = "sns_to_sqs_sms_callbacks"
name = "sns_to_sqs_sms_callbacks"
~ tags = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
"Terraform" = "true"
}
~ tags_all = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
# (1 unchanged element hidden)
}
# (11 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.sns_to_sqs_sms_callbacks.aws_lambda_function.this will be updated in-place
~ resource "aws_lambda_function" "this" {
id = "sns_to_sqs_sms_callbacks"
~ tags = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
"Terraform" = "true"
}
~ tags_all = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
# (1 unchanged element hidden)
}
# (27 unchanged attributes hidden)
# (3 unchanged blocks hidden)
}
Plan: 0 to add, 5 to change, 0 to destroy.
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: plan.tfplan
To perform exactly these actions, run the following command to apply:
terraform apply "plan.tfplan"
Show Conftest resultsWARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.sns_to_sqs_sms_callbacks_log_group[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.lambda-image-sns-delivery-receipts-errors-critical[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.lambda-image-sns-delivery-receipts-errors-warning[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.logs-1-500-error-1-minute-warning-sns_to_sqs_sms_callbacks-api[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.logs-10-500-error-5-minutes-critical-sns_to_sqs_sms_callbacks-api[0]"]
24 tests, 19 passed, 5 warnings, 0 failures, 0 exceptions
|
production: ses_receiving_emails✅ Terraform Init: Plan: 0 to add, 1 to change, 0 to destroyShow summary
Show planResource actions are indicated with the following symbols:
~ update in-place
Terraform will perform the following actions:
# aws_lambda_permission.ses_receiving_emails will be updated in-place
~ resource "aws_lambda_permission" "ses_receiving_emails" {
id = "terraform-20230208143536466700000001"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ source_account = (sensitive value)
# (9 unchanged attributes hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.
Warning: Reference to undefined provider
on lambda.tf line 4, in module "ses_receiving_emails":
4: aws = aws.us-east-1
There is no explicit declaration for local provider name "aws" in
module.ses_receiving_emails, so Terraform is assuming you mean to pass a
configuration for "hashicorp/aws".
If you also control the child module, add a required_providers entry named
"aws" with the source address "hashicorp/aws".
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: plan.tfplan
To perform exactly these actions, run the following command to apply:
terraform apply "plan.tfplan"
Show Conftest resultsWARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.logs-1-500-error-1-minute-warning-ses_receiving_emails-api[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.logs-10-500-error-5-minutes-critical-ses_receiving_emails-api[0]"]
21 tests, 19 passed, 2 warnings, 0 failures, 0 exceptions
|
production: ses_to_sqs_email_callbacks✅ Terraform Init: Plan: 0 to add, 5 to change, 0 to destroyShow summary
Show planResource actions are indicated with the following symbols:
~ update in-place
Terraform will perform the following actions:
# module.ses_to_sqs_email_callbacks.aws_cloudwatch_log_group.this will be updated in-place
~ resource "aws_cloudwatch_log_group" "this" {
id = "/aws/lambda/ses_to_sqs_email_callbacks"
name = "/aws/lambda/ses_to_sqs_email_callbacks"
~ tags = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
"Terraform" = "true"
}
~ tags_all = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
# (1 unchanged element hidden)
}
# (6 unchanged attributes hidden)
}
# module.ses_to_sqs_email_callbacks.aws_iam_policy.non_vpc_policies[0] will be updated in-place
~ resource "aws_iam_policy" "non_vpc_policies" {
id = "arn:aws:iam::296255494825:policy/ses_to_sqs_email_callbacks_non_vpc"
name = "ses_to_sqs_email_callbacks_non_vpc"
~ tags = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
"Terraform" = "true"
}
~ tags_all = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
# (1 unchanged element hidden)
}
# (7 unchanged attributes hidden)
}
# module.ses_to_sqs_email_callbacks.aws_iam_policy.policies[0] will be updated in-place
~ resource "aws_iam_policy" "policies" {
id = "arn:aws:iam::296255494825:policy/ses_to_sqs_email_callbacks-0"
name = "ses_to_sqs_email_callbacks-0"
~ tags = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
"Terraform" = "true"
}
~ tags_all = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
# (1 unchanged element hidden)
}
# (7 unchanged attributes hidden)
}
# module.ses_to_sqs_email_callbacks.aws_iam_role.this will be updated in-place
~ resource "aws_iam_role" "this" {
id = "ses_to_sqs_email_callbacks"
name = "ses_to_sqs_email_callbacks"
~ tags = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
"Terraform" = "true"
}
~ tags_all = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
# (1 unchanged element hidden)
}
# (11 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.ses_to_sqs_email_callbacks.aws_lambda_function.this will be updated in-place
~ resource "aws_lambda_function" "this" {
id = "ses_to_sqs_email_callbacks"
~ tags = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
"Terraform" = "true"
}
~ tags_all = {
~ "CostCentre" = "notification-canada-ca-staging" -> "notification-canada-ca-production"
# (1 unchanged element hidden)
}
# (27 unchanged attributes hidden)
# (3 unchanged blocks hidden)
}
Plan: 0 to add, 5 to change, 0 to destroy.
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: plan.tfplan
To perform exactly these actions, run the following command to apply:
terraform apply "plan.tfplan"
Show Conftest resultsWARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.ses_to_sqs_email_callbacks_log_group[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.lambda-ses-delivery-receipts-errors-critical[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.lambda-ses-delivery-receipts-errors-warning[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.logs-1-500-error-1-minute-warning-ses_to_sqs_email_callbacks-api[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.logs-10-500-error-5-minutes-critical-ses_to_sqs_email_callbacks-500-errors-api[0]"]
24 tests, 19 passed, 5 warnings, 0 failures, 0 exceptions
|
production: eks✅ Terraform Init: Plan: 4 to add, 12 to change, 3 to destroyShow summary
Show planResource actions are indicated with the following symbols:
+ create
~ update in-place
-/+ destroy and then create replacement
Terraform will perform the following actions:
# aws_cloudwatch_dashboard.errors[0] will be updated in-place
~ resource "aws_cloudwatch_dashboard" "errors" {
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ dashboard_body = (sensitive value)
id = "Errors"
# (2 unchanged attributes hidden)
}
# aws_cloudwatch_dashboard.notify_system[0] will be updated in-place
~ resource "aws_cloudwatch_dashboard" "notify_system" {
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ dashboard_body = (sensitive value)
id = "Notify-System-Overview"
# (2 unchanged attributes hidden)
}
# aws_cloudwatch_metric_alarm.service-callback-too-many-failures-warning[0] will be created
+ resource "aws_cloudwatch_metric_alarm" "service-callback-too-many-failures-warning" {
+ actions_enabled = true
+ alarm_actions = [
+ "arn:aws:sns:ca-central-1:296255494825:alert-warning",
]
+ alarm_description = "Service reached the max number of callback retries 25 times in 5 minutes"
+ alarm_name = "service-callback-too-many-failures-warning"
+ arn = (known after apply)
+ comparison_operator = "GreaterThanOrEqualToThreshold"
+ evaluate_low_sample_count_percentiles = (known after apply)
+ evaluation_periods = 1
+ id = (known after apply)
+ metric_name = "callback-max-retry-failures"
+ namespace = "LogMetrics"
+ period = 300
+ statistic = "Sum"
+ tags_all = (known after apply)
+ threshold = 25
+ treat_missing_data = "notBreaching"
}
# aws_cloudwatch_query_definition.callback-failures[0] will be updated in-place
~ resource "aws_cloudwatch_query_definition" "callback-failures" {
id = "db0860c7-62aa-4c37-8214-bfb6b749905c"
name = "Callbacks / Callback errors by notification_id"
~ query_string = <<-EOT
fields @timestamp, @notification_id, @url, @error
| filter kubernetes.container_name like /^celery/
| filter @message like /send_delivery_status_to_service request failed for notification_id:/
- | parse @message 'send_delivery_status_to_service request failed for notification_id: * and url: * exc: *' as @notification_id, @url, @error
+ | parse @message 'send_delivery_status_to_service request failed for notification_id: * and url: * service: * exc: *' as @notification_id, @url, @service_id, @error
| limit 10000
EOT
# (2 unchanged attributes hidden)
}
# aws_cloudwatch_query_definition.callback-max-retry-failures-by-service[0] will be updated in-place
~ resource "aws_cloudwatch_query_definition" "callback-max-retry-failures-by-service" {
id = "4c82a6be-6862-447e-b369-3c2defb58d64"
name = "Callbacks / Callbacks that exceeded MaxRetries by service"
~ query_string = <<-EOT
fields @timestamp, @service_id, @callback_url, @notification_id
| filter kubernetes.container_name like /^celery/
| filter @message like /send_delivery_status_to_service has retried the max num of times for callback url/
- | parse @message 'Retry: send_delivery_status_to_service has retried the max num of times for callback url * and notification_id: * for service: *' as @callback_url, @notification_id, @service_id
+ | parse @message 'Retry: send_delivery_status_to_service has retried the max num of times for callback url * and notification_id: * service: *' as @callback_url, @notification_id, @service_id
| sort @timestamp desc
| stats count(@service_id) by @service_id, bin(30m)
| limit 10000
EOT
# (2 unchanged attributes hidden)
}
# aws_cloudwatch_query_definition.celery-errors[0] will be updated in-place
~ resource "aws_cloudwatch_query_definition" "celery-errors" {
id = "6e83dbc1-06ae-4b00-8414-75835131cbc2"
name = "Celery / Errors"
~ query_string = <<-EOT
fields @timestamp, log, kubernetes.container_name as app, kubernetes.pod_name as pod_name, @logStream
| filter kubernetes.container_name like /^celery/
- | filter @message like /ERROR\/.*Worker/ or @message like /ERROR\/MainProcess/
+ | filter @message like /ERROR\/.*Worker/ or @message like /ERROR\/MainProcess/
| sort @timestamp desc
| limit 20
EOT
# (2 unchanged attributes hidden)
}
# aws_iam_policy.parameters_csi will be updated in-place
~ resource "aws_iam_policy" "parameters_csi" {
id = "arn:aws:iam::296255494825:policy/parameters-csi-policy"
name = "parameters-csi-policy"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ policy = (sensitive value)
tags = {}
# (7 unchanged attributes hidden)
}
# aws_iam_policy.secrets_csi will be updated in-place
~ resource "aws_iam_policy" "secrets_csi" {
id = "arn:aws:iam::296255494825:policy/secrets-csi-policy"
name = "secrets-csi-policy"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ policy = (sensitive value)
tags = {}
# (7 unchanged attributes hidden)
}
# aws_kinesis_firehose_delivery_stream.firehose-waf-logs will be updated in-place
~ resource "aws_kinesis_firehose_delivery_stream" "firehose-waf-logs" {
id = "arn:aws:firehose:ca-central-1:296255494825:deliverystream/aws-waf-logs-notification-canada-ca-waf"
name = "aws-waf-logs-notification-canada-ca-waf"
tags = {
"CostCenter" = "notification-canada-ca-production"
"Terraform" = "true"
}
# (5 unchanged attributes hidden)
~ extended_s3_configuration {
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ prefix = (sensitive value)
# (10 unchanged attributes hidden)
# (2 unchanged blocks hidden)
}
# (1 unchanged block hidden)
}
# aws_secretsmanager_secret_version.pr_bot_app_id must be replaced
-/+ resource "aws_secretsmanager_secret_version" "pr_bot_app_id" {
~ arn = "arn:aws:secretsmanager:ca-central-1:296255494825:secret:PR_BOT_APP_ID-EHn56m" -> (known after apply)
~ id = "arn:aws:secretsmanager:ca-central-1:296255494825:secret:PR_BOT_APP_ID-EHn56m|terraform-20240321141403102100000007" -> (known after apply)
~ secret_string = (sensitive value) # forces replacement
~ version_id = "terraform-20240321141403102100000007" -> (known after apply)
~ version_stages = [
- "AWSCURRENT",
] -> (known after apply)
# (2 unchanged attributes hidden)
}
# aws_secretsmanager_secret_version.pr_bot_installation_id must be replaced
-/+ resource "aws_secretsmanager_secret_version" "pr_bot_installation_id" {
~ arn = "arn:aws:secretsmanager:ca-central-1:296255494825:secret:PR_BOT_INSTALLATION_ID-lLMugo" -> (known after apply)
~ id = "arn:aws:secretsmanager:ca-central-1:296255494825:secret:PR_BOT_INSTALLATION_ID-lLMugo|terraform-20240321141403102100000006" -> (known after apply)
~ secret_string = (sensitive value) # forces replacement
~ version_id = "terraform-20240321141403102100000006" -> (known after apply)
~ version_stages = [
- "AWSCURRENT",
] -> (known after apply)
# (2 unchanged attributes hidden)
}
# aws_secretsmanager_secret_version.pr_bot_private_key must be replaced
-/+ resource "aws_secretsmanager_secret_version" "pr_bot_private_key" {
~ arn = "arn:aws:secretsmanager:ca-central-1:296255494825:secret:PR_BOT_PRIVATE_KEY-IJGWmo" -> (known after apply)
~ id = "arn:aws:secretsmanager:ca-central-1:296255494825:secret:PR_BOT_PRIVATE_KEY-IJGWmo|terraform-20240321141403094600000005" -> (known after apply)
~ secret_string = (sensitive value) # forces replacement
~ version_id = "terraform-20240321141403094600000005" -> (known after apply)
~ version_stages = [
- "AWSCURRENT",
] -> (known after apply)
# (2 unchanged attributes hidden)
}
# module.sentinel_forwarder.aws_lambda_function.sentinel_forwarder will be updated in-place
~ resource "aws_lambda_function" "sentinel_forwarder" {
id = "sentinel-cloud-watch-forwarder"
~ layers = [
~ "arn:aws:lambda:ca-central-1:283582579564:layer:aws-sentinel-connector-layer:153" -> "arn:aws:lambda:ca-central-1:283582579564:layer:aws-sentinel-connector-layer:163",
]
tags = {
"CostCentre" = "notification-canada-ca-production"
}
# (28 unchanged attributes hidden)
# (4 unchanged blocks hidden)
}
# module.sentinel_forwarder.aws_lambda_permission.sentinel_forwarder_cloudwatch_log_subscription[0] will be updated in-place
~ resource "aws_lambda_permission" "sentinel_forwarder_cloudwatch_log_subscription" {
id = "AllowExecutionFromCloudWatchLogs-sentinel-cloud-watch-forwarder-0"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ source_arn = (sensitive value)
# (6 unchanged attributes hidden)
}
# module.sentinel_forwarder.aws_lambda_permission.sentinel_forwarder_cloudwatch_log_subscription[1] will be updated in-place
~ resource "aws_lambda_permission" "sentinel_forwarder_cloudwatch_log_subscription" {
id = "AllowExecutionFromCloudWatchLogs-sentinel-cloud-watch-forwarder-1"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ source_arn = (sensitive value)
# (6 unchanged attributes hidden)
}
# module.sentinel_forwarder.aws_lambda_permission.sentinel_forwarder_cloudwatch_log_subscription[2] will be updated in-place
~ resource "aws_lambda_permission" "sentinel_forwarder_cloudwatch_log_subscription" {
id = "AllowExecutionFromCloudWatchLogs-sentinel-cloud-watch-forwarder-2"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ source_arn = (sensitive value)
# (6 unchanged attributes hidden)
}
Plan: 4 to add, 12 to change, 3 to destroy.
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: plan.tfplan
To perform exactly these actions, run the following command to apply:
terraform apply "plan.tfplan"
Show Conftest resultsWARN - plan.json - main - Cloudwatch log metric pattern is invalid: ["aws_cloudwatch_log_metric_filter.celery-error[0]"]
WARN - plan.json - main - Cloudwatch log metric pattern is invalid: ["aws_cloudwatch_log_metric_filter.scanfiles-timeout[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_acm_certificate.client_vpn"]
WARN - plan.json - main - Missing Common Tags: ["aws_acm_certificate.notification-canada-ca"]
WARN - plan.json - main - Missing Common Tags: ["aws_acm_certificate.notification-canada-ca-alt[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_acmpca_certificate_authority.client_vpn"]
WARN - plan.json - main - Missing Common Tags: ["aws_alb.notification-canada-ca"]
WARN - plan.json - main - Missing Common Tags: ["aws_alb_listener.internal_alb_tls"]
WARN - plan.json - main - Missing Common Tags: ["aws_alb_listener.notification-canada-ca"]
WARN - plan.json - main - Missing Common Tags: ["aws_alb_target_group.internal_nginx_http"]
WARN - plan.json - main - Missing Common Tags: ["aws_alb_target_group.notification-canada-ca-admin"]
WARN - plan.json - main - Missing Common Tags: ["aws_alb_target_group.notification-canada-ca-api"]
WARN - plan.json - main - Missing Common Tags: ["aws_alb_target_group.notification-canada-ca-document"]
WARN - plan.json - main - Missing Common Tags: ["aws_alb_target_group.notification-canada-ca-document-api"]
WARN - plan.json - main - Missing Common Tags: ["aws_alb_target_group.notification-canada-ca-documentation"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.notification-canada-ca-eks-application-logs[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.notification-canada-ca-eks-cluster-logs[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.notification-canada-ca-eks-prometheus-logs[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.admin-evicted-pods[0]"]
WARN - plan.json - main - Missing Common... |
production: database-tools✅ Terraform Init: Plan: 1 to add, 1 to change, 1 to destroyShow summary
Show planResource actions are indicated with the following symbols:
~ update in-place
-/+ destroy and then create replacement
Terraform will perform the following actions:
# aws_ecs_service.blazer will be updated in-place
~ resource "aws_ecs_service" "blazer" {
id = "arn:aws:ecs:ca-central-1:296255494825:service/blazer/blazer"
name = "blazer"
tags = {}
~ task_definition = "arn:aws:ecs:ca-central-1:296255494825:task-definition/blazer:11" -> (known after apply)
# (15 unchanged attributes hidden)
# (3 unchanged blocks hidden)
}
# aws_ecs_task_definition.blazer must be replaced
-/+ resource "aws_ecs_task_definition" "blazer" {
~ arn = "arn:aws:ecs:ca-central-1:296255494825:task-definition/blazer:11" -> (known after apply)
~ arn_without_revision = "arn:aws:ecs:ca-central-1:296255494825:task-definition/blazer" -> (known after apply)
~ container_definitions = jsonencode(
~ [
~ {
- cpu = 0
~ image = "296255494825.dkr.ecr.ca-central-1.amazonaws.com/database-tools/blazer:7c144b4" -> "296255494825.dkr.ecr.ca-central-1.amazonaws.com/database-tools/blazer:latest"
- mountPoints = []
name = "blazer"
- volumesFrom = []
# (5 unchanged attributes hidden)
},
] # forces replacement
)
~ id = "blazer" -> (known after apply)
~ revision = 11 -> (known after apply)
- tags = {} -> null
~ tags_all = {} -> (known after apply)
# (11 unchanged attributes hidden)
}
Plan: 1 to add, 1 to change, 1 to destroy.
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: plan.tfplan
To perform exactly these actions, run the following command to apply:
terraform apply "plan.tfplan"
Show Conftest resultsWARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.blazer[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.blazer-task-unavailable[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_db_instance.database-tools"]
WARN - plan.json - main - Missing Common Tags: ["aws_db_subnet_group.database-tools-rds-subnet"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.blazer"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecs_cluster.blazer"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecs_service.blazer"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecs_task_definition.blazer"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.blazer_exection_role_parameter_policy"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.blazer_task_role_policy"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.blazer_ecs_task"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.blazer_execution_role"]
WARN - plan.json - main - Missing Common Tags: ["aws_ssm_parameter.db_tools_environment_variables"]
WARN - plan.json - main - Missing Common Tags: ["aws_ssm_parameter.notify_o11y_google_oauth_client_id"]
WARN - plan.json - main - Missing Common Tags: ["aws_ssm_parameter.notify_o11y_google_oauth_client_secret"]
WARN - plan.json - main - Missing Common Tags: ["aws_ssm_parameter.sqlalchemy_database_reader_uri"]
35 tests, 19 passed, 16 warnings, 0 failures, 0 exceptions
|
production: quicksight✅ Terraform Init: Plan: 0 to add, 4 to change, 0 to destroyShow summary
Show planResource actions are indicated with the following symbols:
~ update in-place
Terraform will perform the following actions:
# aws_cloudformation_stack.sms-usage-notifications will be updated in-place
~ resource "aws_cloudformation_stack" "sms-usage-notifications" {
id = "arn:aws:cloudformation:ca-central-1:296255494825:stack/sms-usage-notifications/948224f0-f1f6-11ee-95e1-02c03de32271"
name = "sms-usage-notifications"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ notification_arns = (sensitive value)
tags = {}
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ template_body = (sensitive value)
# (6 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# aws_iam_policy.quicksight_vpc_connection_iam will be updated in-place
~ resource "aws_iam_policy" "quicksight_vpc_connection_iam" {
id = "arn:aws:iam::296255494825:policy/quicksight-vpc-connection-iam"
name = "quicksight-vpc-connection-iam"
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ policy = (sensitive value)
tags = {}
# (7 unchanged attributes hidden)
}
# aws_quicksight_account_subscription.subscription will be updated in-place
~ resource "aws_quicksight_account_subscription" "subscription" {
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ account_name = (sensitive value)
id = "296255494825"
# (5 unchanged attributes hidden)
}
# aws_s3_object.manifest_file will be updated in-place
~ resource "aws_s3_object" "manifest_file" {
~ etag = "3696c2177cd9e1be28ff597c24b10ae0" -> "221f592f333f2fc284626cfdb8c4bc80"
id = "quicksight/s3-manifest-sms-usage.json"
tags = {}
+ version_id = (known after apply)
# (24 unchanged attributes hidden)
}
Plan: 0 to add, 4 to change, 0 to destroy.
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: plan.tfplan
To perform exactly these actions, run the following command to apply:
terraform apply "plan.tfplan"
Show Conftest resultsWARN - plan.json - main - Missing Common Tags: ["aws_cloudformation_stack.sms-usage-notifications"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.quicksight-rds"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.quicksight-s3-usage"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.quicksight_vpc_connection_ec2"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.quicksight_vpc_connection_iam"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.quicksight"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.vpc_connection_role"]
WARN - plan.json - main - Missing Common Tags: ["aws_quicksight_data_set.jobs"]
WARN - plan.json - main - Missing Common Tags: ["aws_quicksight_data_set.login_events"]
WARN - plan.json - main - Missing Common Tags: ["aws_quicksight_data_set.notifications"]
WARN - plan.json - main - Missing Common Tags: ["aws_quicksight_data_set.organisation"]
WARN - plan.json - main - Missing Common Tags: ["aws_quicksight_data_set.services"]
WARN - plan.json - main - Missing Common Tags: ["aws_quicksight_data_set.sms_usage"]
WARN - plan.json - main - Missing Common Tags: ["aws_quicksight_data_set.template-category-history"]
WARN - plan.json - main - Missing Common Tags: ["aws_quicksight_data_set.templates"]
WARN - plan.json - main - Missing Common Tags: ["aws_quicksight_data_set.users"]
WARN - plan.json - main - Missing Common Tags: ["aws_quicksight_data_source.rds"]
WARN - plan.json - main - Missing Common Tags: ["aws_quicksight_data_source.s3_sms_usage"]
WARN - plan.json - main - Missing Common Tags: ["aws_quicksight_vpc_connection.rds"]
WARN - plan.json - main - Missing Common Tags: ["aws_s3_object.manifest_file"]
39 tests, 19 passed, 20 warnings, 0 failures, 0 exceptions
|
production: lambda-api✅ Terraform Init: Plan: 1 to add, 4 to change, 1 to destroyShow summary
Show planResource actions are indicated with the following symbols:
~ update in-place
+/- create replacement and then destroy
<= read (data resources)
Terraform will perform the following actions:
# data.aws_iam_policy_document.ecr will be read during apply
# (depends on a resource or a module with changes pending)
<= data "aws_iam_policy_document" "ecr" {
+ id = (known after apply)
+ json = (known after apply)
+ minified_json = (known after apply)
+ statement {
+ actions = [
+ "ecr:GetAuthorizationToken",
]
+ effect = "Allow"
+ resources = [
+ "*",
]
+ sid = "GetAuthorizationToken"
}
+ statement {
+ actions = [
+ "ecr:BatchCheckLayerAvailability",
+ "ecr:BatchGetImage",
+ "ecr:CompleteLayerUpload",
+ "ecr:GetDownloadUrlForLayer",
+ "ecr:InitiateLayerUpload",
+ "ecr:PutImage",
+ "ecr:UploadLayerPart",
]
+ effect = "Allow"
+ resources = [
+ "arn:aws:ecr:ca-central-1:296255494825:repository/notify/api-lambda",
]
+ sid = "AllowPushPull"
}
+ statement {
+ actions = [
+ "lambda:GetAlias",
+ "lambda:GetFunction",
+ "lambda:GetFunctionConfiguration",
+ "lambda:ListAliases",
+ "lambda:ListVersionsByFunction",
+ "lambda:PublishVersion",
+ "lambda:UpdateAlias",
+ "lambda:UpdateFunctionCode",
]
+ effect = "Allow"
+ resources = [
+ "arn:aws:lambda:ca-central-1:296255494825:function:api-lambda",
]
+ sid = "PermissionsToUpdateFunction"
}
+ statement {
+ actions = [
+ "lambda:GetLayerVersion",
]
+ effect = "Allow"
+ resources = [
+ "arn:aws:lambda:ca-central-1:451483290750:layer:NewRelicPython*:*",
]
+ sid = "PermissionsToDownloadNewRelicLambdaLayers"
}
}
# aws_api_gateway_deployment.api must be replaced
+/- resource "aws_api_gateway_deployment" "api" {
~ created_date = "2024-07-30T21:06:09Z" -> (known after apply)
~ execution_arn = "arn:aws:execute-api:ca-central-1:296255494825:71oj6jax35/" -> (known after apply)
~ id = "mhtbya" -> (known after apply)
~ invoke_url = "https://71oj6jax35.execute-api.ca-central-1.amazonaws.com/" -> (known after apply)
~ triggers = { # forces replacement
~ "redeployment" = "304451798044b5fdc34090ab32a96a2473bf6afa" -> "c1c3df7a50ee1a689772094fb67e86de0dd192aa"
}
# (2 unchanged attributes hidden)
}
# aws_api_gateway_stage.api will be updated in-place
~ resource "aws_api_gateway_stage" "api" {
~ deployment_id = "mhtbya" -> (known after apply)
id = "ags-71oj6jax35-v1"
tags = {}
# (14 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# aws_iam_policy.ecr will be updated in-place
~ resource "aws_iam_policy" "ecr" {
id = "arn:aws:iam::296255494825:policy/ecr-api-lambda-access"
name = "ecr-api-lambda-access"
~ policy = jsonencode(
{
- Statement = [
- {
- Action = "ecr:GetAuthorizationToken"
- Effect = "Allow"
- Resource = "*"
- Sid = "GetAuthorizationToken"
},
- {
- Action = [
- "ecr:UploadLayerPart",
- "ecr:PutImage",
- "ecr:InitiateLayerUpload",
- "ecr:GetDownloadUrlForLayer",
- "ecr:CompleteLayerUpload",
- "ecr:BatchGetImage",
- "ecr:BatchCheckLayerAvailability",
]
- Effect = "Allow"
- Resource = "arn:aws:ecr:ca-central-1:296255494825:repository/notify/api-lambda"
- Sid = "AllowPushPull"
},
- {
- Action = [
- "lambda:UpdateFunctionCode",
- "lambda:UpdateAlias",
- "lambda:PublishVersion",
- "lambda:ListVersionsByFunction",
- "lambda:ListAliases",
- "lambda:GetFunctionConfiguration",
- "lambda:GetFunction",
- "lambda:GetAlias",
]
- Effect = "Allow"
- Resource = "arn:aws:lambda:ca-central-1:296255494825:function:api-lambda"
- Sid = "PermissionsToUpdateFunction"
},
- {
- Action = "lambda:GetLayerVersion"
- Effect = "Allow"
- Resource = "arn:aws:lambda:ca-central-1:451483290750:layer:NewRelicPython*:*"
- Sid = "PermissionsToDownloadNewRelicLambdaLayers"
},
]
- Version = "2012-10-17"
}
) -> (known after apply)
tags = {}
# (7 unchanged attributes hidden)
}
# aws_kinesis_firehose_delivery_stream.firehose-api-lambda-waf-logs will be updated in-place
~ resource "aws_kinesis_firehose_delivery_stream" "firehose-api-lambda-waf-logs" {
id = "arn:aws:firehose:ca-central-1:296255494825:deliverystream/aws-waf-logs-notification-canada-ca-api-lambda-waf"
name = "aws-waf-logs-notification-canada-ca-api-lambda-waf"
tags = {
"CostCenter" = "notification-canada-ca-production"
"Terraform" = "true"
}
# (5 unchanged attributes hidden)
~ extended_s3_configuration {
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ prefix = (sensitive value)
# (10 unchanged attributes hidden)
# (2 unchanged blocks hidden)
}
# (1 unchanged block hidden)
}
# aws_lambda_function.api will be updated in-place
~ resource "aws_lambda_function" "api" {
id = "api-lambda"
tags = {}
# (28 unchanged attributes hidden)
~ environment {
~ variables = {
# Warning: this attribute value will be marked as sensitive and will not
# display in UI output after applying this change. The value is unchanged.
~ "NEW_RELIC_ACCOUNT_ID" = (sensitive value)
# (18 unchanged elements hidden)
}
}
# (4 unchanged blocks hidden)
}
Plan: 1 to add, 4 to change, 1 to destroy.
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: plan.tfplan
To perform exactly these actions, run the following command to apply:
terraform apply "plan.tfplan"
Show Conftest resultsWARN - plan.json - main - Missing Common Tags: ["aws_api_gateway_domain_name.alt_api_lambda"]
WARN - plan.json - main - Missing Common Tags: ["aws_api_gateway_domain_name.api"]
WARN - plan.json - main - Missing Common Tags: ["aws_api_gateway_domain_name.api_lambda"]
WARN - plan.json - main - Missing Common Tags: ["aws_api_gateway_rest_api.api"]
WARN - plan.json - main - Missing Common Tags: ["aws_api_gateway_stage.api"]
WARN - plan.json - main - Missing Common Tags: ["aws_appautoscaling_target.api"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.api_gateway_log_group"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.api_lambda_log_group[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.failed-login-count-5-minute-warning[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.logs-1-error-1-minute-warning-lambda-api[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.logs-1-error-1-minute-warning-salesforce-api[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.logs-10-error-5-minutes-critical-lambda-api[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.api"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.ecr"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.api"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.api_cloudwatch[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_user.ecr-user"]
WARN - plan.json - main - Missing Common Tags: ["aws_kinesis_firehose_delivery_stream.firehose-api-lambda-waf-logs"]
WARN - plan.json - main - Missing Common Tags: ["aws_lambda_function.api"]
WARN - plan.json - main - Missing Common Tags: ["aws_secretsmanager_secret.new-relic-license-key"]
WARN - plan.json - main - Missing Common Tags: ["aws_wafv2_web_acl.api_lambda"]
WARN - plan.json - main - Missing Common Tags:... |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary | Résumé
#1551
#1554
#1562
#1564
#1565
#1566
#1560
#1569
#1570
#1571
Test instructions | Instructions pour tester la modification
Verify the plan against the new TFVars file in 1password to ensure that nothing is out of date or looks out of place compared with what was deployed previously.
Release Instructions | Instructions pour le déploiement
None.
Reviewer checklist | Liste de vérification du réviseur