Prod Release 2023-09-29 - Take 1

[as1729]

No description provided.

[github-actions]

Report for project: terraform

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Validation Output

Success! The configuration is valid.

Terraform Plan 📖success

Show Plan

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.api.aws_ecs_task_definition.default[0] has changed
  ~ resource "aws_ecs_task_definition" "default" {
        id                       = "gost-prod-api"
+       tags                     = {}
        # (13 unchanged attributes hidden)

+       volume {
+           name = "data"

+           efs_volume_configuration {
+               file_system_id          = "fs-0b22d749517d906e0"
+               root_directory          = "/"
+               transit_encryption      = "ENABLED"
+               transit_encryption_port = 0

+               authorization_config {
+                   access_point_id = "fsap-05cdce2f27f5aab98"
                }
            }
        }
-       volume {
-           name = "data" -> null

-           efs_volume_configuration {
-               file_system_id     = "fs-0b22d749517d906e0" -> null
-               root_directory     = "/" -> null
-               transit_encryption = "ENABLED" -> null

-               authorization_config {
-                   access_point_id = "fsap-05cdce2f27f5aab98" -> null
                }
            }
        }

        # (1 unchanged block hidden)
    }

  # module.api.aws_iam_role.execution[0] has changed
  ~ resource "aws_iam_role" "execution" {
        id                    = "gost-prod-api-ECSTaskExecution-20230303023921815800000009"
        name                  = "gost-prod-api-ECSTaskExecution-20230303023921815800000009"
      ~ role_last_used        = [
          ~ {
              ~ last_used_date = "2023-09-29T02:23:00Z" -> "2023-09-29T14:56:41Z"
                # (1 unchanged element hidden)
            },
        ]
        tags                  = {}
        # (11 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.api.aws_iam_role.task[0] has changed
  ~ resource "aws_iam_role" "task" {
        id                    = "gost-prod-api-ECSTask-2023030302392200850000000a"
        name                  = "gost-prod-api-ECSTask-2023030302392200850000000a"
      ~ role_last_used        = [
          ~ {
              ~ last_used_date = "2023-09-29T02:22:59Z" -> "2023-09-29T14:56:28Z"
                # (1 unchanged element hidden)
            },
        ]
        tags                  = {}
        # (11 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.api.module.grants_scraper.aws_iam_role.default[0] has changed
  ~ resource "aws_iam_role" "default" {
        id                    = "gost-prod-grants_scraper-2023030302392250420000000b"
        name                  = "gost-prod-grants_scraper-2023030302392250420000000b"
      ~ role_last_used        = [
          ~ {
              ~ last_used_date = "2023-09-28T05:36:22Z" -> "2023-09-29T05:36:22Z"
                # (1 unchanged element hidden)
            },
        ]
        tags                  = {}
        # (12 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
  ~ update in-place
+/- create replacement and then destroy
 <= read (data resources)

Terraform will perform the following actions:

  # aws_iam_role_policy.api_task-publish_to_arpa_audit_report_queue will be created
+   resource "aws_iam_role_policy" "api_task-publish_to_arpa_audit_report_queue" {
+       id          = (known after apply)
+       name        = (known after apply)
+       name_prefix = "send-arpa-audit-report-requests"
+       policy      = jsonencode(
            {
+               Statement = [
+                   {
+                       Action   = "sqs:SendMessage"
+                       Effect   = "Allow"
+                       Resource = "arn:aws:sqs:us-west-2:729134339726:gost-prod-arpa_audit_report-20230929025001117500000004"
+                       Sid      = "AllowPublishToQueue"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       role        = "gost-prod-api-ECSTask-2023030302392200850000000a"
    }

  # module.api.aws_ecs_service.default[0] will be updated in-place
  ~ resource "aws_ecs_service" "default" {
        id                                 = "arn:aws:ecs:us-west-2:729134339726:service/gost-prod/gost-prod-api"
        name                               = "gost-prod-api"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-api:16" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.api.aws_ecs_task_definition.default[0] must be replaced
+/- resource "aws_ecs_task_definition" "default" {
      ~ arn                      = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-api:16" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-api" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [ # forces replacement
              ~ {
                  ~ dockerLabels           = {
                      ~ "com.datadoghq.tags.version" = "abb9fdfeb394ea55930fd6f8fc2c142637472e77" -> "b7fe2c1991fb52affe1d5fafcd0eb592691ecfb8"
                        # (2 unchanged elements hidden)
                    }
                  ~ environment            = [
                        # (6 unchanged elements hidden)
                        {
                            name  = "DD_SERVICE"
                            value = "gost"
                        },
                      ~ {
                            name  = "DD_VERSION"
                          ~ value = "abb9fdfeb394ea55930fd6f8fc2c142637472e77" -> "b7fe2c1991fb52affe1d5fafcd0eb592691ecfb8"
                        },
                        {
                            name  = "ENABLE_GRANTS_DIGEST"
                            value = "true"
                        },
                        # (9 unchanged elements hidden)
                    ]
                    name                   = "api"
-                   volumesFrom            = [] -> null
                    # (10 unchanged elements hidden)
                } # forces replacement,
              ~ {
                  ~ dockerLabels           = {
                      ~ "com.datadoghq.tags.version" = "abb9fdfeb394ea55930fd6f8fc2c142637472e77" -> "b7fe2c1991fb52affe1d5fafcd0eb592691ecfb8"
                        # (2 unchanged elements hidden)
                    }
                  ~ environment            = [
                        # (3 unchanged elements hidden)
                        {
                            name  = "DD_SERVICE"
                            value = "gost"
                        },
                      ~ {
                            name  = "DD_VERSION"
                          ~ value = "abb9fdfeb394ea55930fd6f8fc2c142637472e77" -> "b7fe2c1991fb52affe1d5fafcd0eb592691ecfb8"
                        },
                        {
                            name  = "ECS_FARGATE"
                            value = "true"
                        },
                    ]
-                   mountPoints            = [] -> null
                    name                   = "datadog"
-                   portMappings           = [] -> null
-                   volumesFrom            = [] -> null
                    # (6 unchanged elements hidden)
                } # forces replacement,
            ]
        )
      ~ id                       = "gost-prod-api" -> (known after apply)
      ~ revision                 = 16 -> (known after apply)
-       tags                     = {} -> null
        # (9 unchanged attributes hidden)

-       volume {
-           name = "data" -> null

-           efs_volume_configuration {
-               file_system_id          = "fs-0b22d749517d906e0" -> null
-               root_directory          = "/" -> null
-               transit_encryption      = "ENABLED" -> null
-               transit_encryption_port = 0 -> null

-               authorization_config {
-                   access_point_id = "fsap-05cdce2f27f5aab98" -> null
                }
            }
        }
+       volume {
+           name = "data"

+           efs_volume_configuration {
+               file_system_id     = "fs-0b22d749517d906e0"
+               root_directory     = "/"
+               transit_encryption = "ENABLED"

+               authorization_config {
+                   access_point_id = "fsap-05cdce2f27f5aab98"
                }
            }
        }

        # (1 unchanged block hidden)
    }

  # module.arpa_audit_report.aws_ecs_service.default will be updated in-place
  ~ resource "aws_ecs_service" "default" {
        id                                 = "arn:aws:ecs:us-west-2:729134339726:service/gost-prod/gost-prod-arpa_audit_report"
        name                               = "gost-prod-arpa_audit_report"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-arpa_audit_report:1" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # module.arpa_audit_report.aws_ecs_task_definition.consumer must be replaced
+/- resource "aws_ecs_task_definition" "consumer" {
      ~ arn                      = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-arpa_audit_report:1" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-arpa_audit_report" -> (known after apply)
      ~ container_definitions    = (sensitive value) # forces replacement
      ~ id                       = "gost-prod-arpa_audit_report" -> (known after apply)
-       ipc_mode                 = "" -> null
-       pid_mode                 = "" -> null
      ~ revision                 = 1 -> (known after apply)
-       tags                     = {} -> null
        # (9 unchanged attributes hidden)

-       volume {
-           name = "data" -> null

-           efs_volume_configuration {
-               file_system_id          = "fs-0b22d749517d906e0" -> null
-               root_directory          = "/" -> null
-               transit_encryption      = "ENABLED" -> null
-               transit_encryption_port = 0 -> null

-               authorization_config {
-                   access_point_id = "fsap-05cdce2f27f5aab98" -> null
                }
            }
        }
+       volume {
+           name = "data"

+           efs_volume_configuration {
+               file_system_id     = "fs-0b22d749517d906e0"
+               root_directory     = "/"
+               transit_encryption = "ENABLED"

+               authorization_config {
+                   access_point_id = "fsap-05cdce2f27f5aab98"
                }
            }
        }

        # (1 unchanged block hidden)
    }

  # module.consume_grants.aws_ecs_service.default will be updated in-place
  ~ resource "aws_ecs_service" "default" {
        id                                 = "arn:aws:ecs:us-west-2:729134339726:service/gost-prod/gost-prod-consume_grants"
        name                               = "gost-prod-consume_grants"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-consume_grants:10" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # module.consume_grants.aws_ecs_task_definition.consume_grants must be replaced
+/- resource "aws_ecs_task_definition" "consume_grants" {
      ~ arn                      = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-consume_grants:10" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-consume_grants" -> (known after apply)
      ~ container_definitions    = (sensitive value) # forces replacement
      ~ id                       = "gost-prod-consume_grants" -> (known after apply)
-       ipc_mode                 = "" -> null
-       pid_mode                 = "" -> null
      ~ revision                 = 10 -> (known after apply)
-       tags                     = {} -> null
        # (9 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.api.module.grants_scraper.data.aws_iam_policy_document.permissions[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "permissions" {
+       id   = (known after apply)
+       json = (known after apply)

+       statement {
+           actions   = [
+               "ecs:RunTask",
            ]
+           effect    = "Allow"
+           resources = [
+               (known after apply),
            ]
+           sid       = "AllowRunTask"

+           condition {
+               test     = "ArnLike"
+               values   = [
+                   "arn:aws:ecs:us-west-2:729134339726:cluster/gost-prod",
                ]
+               variable = "ecs:cluster"
            }
        }
+       statement {
+           actions   = [
+               "iam:PassRole",
            ]
+           effect    = "Allow"
+           resources = [
+               "arn:aws:iam::729134339726:role/gost-prod-api-ECSTask-2023030302392200850000000a",
+               "arn:aws:iam::729134339726:role/gost-prod-api-ECSTaskExecution-20230303023921815800000009",
            ]
+           sid       = "AllowSchedulerPassRoleToExecutionRole"
        }
    }

  # module.api.module.grants_scraper.aws_iam_role_policy.default[0] will be updated in-place
  ~ resource "aws_iam_role_policy" "default" {
        id     = "gost-prod-grants_scraper-2023030302392250420000000b:terraform-20230303024046969200000014"
        name   = "terraform-20230303024046969200000014"
      ~ policy = jsonencode(
            {
-               Statement = [
-                   {
-                       Action    = "ecs:RunTask"
-                       Condition = {
-                           ArnLike = {
-                               "ecs:cluster" = "arn:aws:ecs:us-west-2:729134339726:cluster/gost-prod"
                            }
                        }
-                       Effect    = "Allow"
-                       Resource  = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-api:*"
-                       Sid       = "AllowRunTask"
                    },
-                   {
-                       Action   = "iam:PassRole"
-                       Effect   = "Allow"
-                       Resource = [
-                           "arn:aws:iam::729134339726:role/gost-prod-api-ECSTaskExecution-20230303023921815800000009",
-                           "arn:aws:iam::729134339726:role/gost-prod-api-ECSTask-2023030302392200850000000a",
                        ]
-                       Sid      = "AllowSchedulerPassRoleToExecutionRole"
                    },
                ]
-               Version   = "2012-10-17"
            }
        ) -> (known after apply)
        # (1 unchanged attribute hidden)
    }

  # module.api.module.grants_scraper.aws_scheduler_schedule.default[0] will be updated in-place
  ~ resource "aws_scheduler_schedule" "default" {
        id                           = "default/gost-prod-grants_scraper-20230303024046967600000013"
        name                         = "gost-prod-grants_scraper-20230303024046967600000013"
        # (10 unchanged attributes hidden)

      ~ target {
            # (3 unchanged attributes hidden)

          ~ ecs_parameters {
                tags                    = {}
              ~ task_definition_arn     = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-api:16" -> (known after apply)
                # (8 unchanged attributes hidden)

                # (1 unchanged block hidden)
            }

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

Plan: 4 to add, 5 to change, 3 to destroy.

Pusher: @as1729, Action: pull_request, Workflow: Terraform CI