Prod Release 2023-10-03 - Take 1

[as1729]

No description provided.

[github-actions]

Report for project: terraform

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Validation Output

Success! The configuration is valid.

Terraform Plan 📖success

Show Plan

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.api.aws_ecs_task_definition.default[0] has changed
  ~ resource "aws_ecs_task_definition" "default" {
        id                       = "gost-prod-api"
+       tags                     = {}
        # (13 unchanged attributes hidden)

+       volume {
+           name = "data"

+           efs_volume_configuration {
+               file_system_id          = "fs-0b22d749517d906e0"
+               root_directory          = "/"
+               transit_encryption      = "ENABLED"
+               transit_encryption_port = 0

+               authorization_config {
+                   access_point_id = "fsap-05cdce2f27f5aab98"
                }
            }
        }
-       volume {
-           name = "data" -> null

-           efs_volume_configuration {
-               file_system_id     = "fs-0b22d749517d906e0" -> null
-               root_directory     = "/" -> null
-               transit_encryption = "ENABLED" -> null

-               authorization_config {
-                   access_point_id = "fsap-05cdce2f27f5aab98" -> null
                }
            }
        }

        # (1 unchanged block hidden)
    }

  # module.api.aws_iam_role.execution[0] has changed
  ~ resource "aws_iam_role" "execution" {
        id                    = "gost-prod-api-ECSTaskExecution-20230303023921815800000009"
        name                  = "gost-prod-api-ECSTaskExecution-20230303023921815800000009"
      ~ role_last_used        = [
          ~ {
              ~ last_used_date = "2023-09-29T21:25:32Z" -> "2023-10-03T00:27:29Z"
                # (1 unchanged element hidden)
            },
        ]
        tags                  = {}
        # (11 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.api.aws_iam_role.task[0] has changed
  ~ resource "aws_iam_role" "task" {
        id                    = "gost-prod-api-ECSTask-2023030302392200850000000a"
        name                  = "gost-prod-api-ECSTask-2023030302392200850000000a"
      ~ role_last_used        = [
          ~ {
              ~ last_used_date = "2023-09-29T20:56:42Z" -> "2023-10-02T23:59:43Z"
                # (1 unchanged element hidden)
            },
        ]
        tags                  = {}
        # (11 unchanged attributes hidden)

        # (5 unchanged blocks hidden)
    }

  # module.arpa_audit_report_security_group.aws_security_group.cbd[0] has changed
  ~ resource "aws_security_group" "cbd" {
      ~ egress                 = [
+           {
+               cidr_blocks      = [
+                   "0.0.0.0/0",
                ]
+               description      = "Allow all egress"
+               from_port        = 0
+               ipv6_cidr_blocks = [
+                   "::/0",
                ]
+               prefix_list_ids  = []
+               protocol         = "-1"
+               security_groups  = []
+               self             = false
+               to_port          = 0
            },
        ]
        id                     = "sg-07b38600b65c4fea8"
        name                   = "gost-prod-arpaauditreport--buKq-20230930003922773800000001"
        tags                   = {
            "Attributes" = "arpaauditreport"
            "Name"       = "gost-prod-arpaauditreport"
            "Namespace"  = "gost-prod"
        }
        # (8 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.api.module.efs_data_volume.module.security_group.aws_security_group.cbd[0] has changed
  ~ resource "aws_security_group" "cbd" {
        id                     = "sg-0ce0913bf308258c4"
      ~ ingress                = [
-           {
-               cidr_blocks      = []
-               description      = "Allow ingress EFS traffic"
-               from_port        = 2049
-               ipv6_cidr_blocks = []
-               prefix_list_ids  = []
-               protocol         = "tcp"
-               security_groups  = [
-                   "sg-057a2992ff2db4c2f",
                ]
-               self             = false
-               to_port          = 2049
            },
+           {
+               cidr_blocks      = []
+               description      = "Allow ingress EFS traffic"
+               from_port        = 2049
+               ipv6_cidr_blocks = []
+               prefix_list_ids  = []
+               protocol         = "tcp"
+               security_groups  = [
+                   "sg-07b38600b65c4fea8",
                ]
+               self             = false
+               to_port          = 2049
            },
            # (1 unchanged element hidden)
        ]
        name                   = "gost-prod-gost-prod-datavolume-20230403112714974000000001"
        tags                   = {
            "Name"      = "gost-prod-gost-prod-datavolume"
            "Namespace" = "gost-prod"
        }
        # (8 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
  ~ update in-place
+/- create replacement and then destroy

Terraform will perform the following actions:

  # module.api.aws_ecs_service.default[0] will be updated in-place
  ~ resource "aws_ecs_service" "default" {
        id                                 = "arn:aws:ecs:us-west-2:729134339726:service/gost-prod/gost-prod-api"
        name                               = "gost-prod-api"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-api:18" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.api.aws_ecs_task_definition.default[0] must be replaced
+/- resource "aws_ecs_task_definition" "default" {
      ~ arn                      = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-api:18" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-api" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [ # forces replacement
              ~ {
                  ~ dockerLabels           = {
                      ~ "com.datadoghq.tags.version" = "e43deb929830f5b2fef4969ac5da9f5d79761fd7" -> "8565e97f03876b84c27e9f0c4ee4fe0144b6c006"
                        # (2 unchanged elements hidden)
                    }
                  ~ environment            = [
                        # (6 unchanged elements hidden)
                        {
                            name  = "DD_SERVICE"
                            value = "gost"
                        },
                      ~ {
                            name  = "DD_VERSION"
                          ~ value = "e43deb929830f5b2fef4969ac5da9f5d79761fd7" -> "8565e97f03876b84c27e9f0c4ee4fe0144b6c006"
                        },
                        {
                            name  = "ENABLE_GRANTS_DIGEST"
                            value = "false"
                        },
                        # (9 unchanged elements hidden)
                    ]
                    name                   = "api"
-                   volumesFrom            = [] -> null
                    # (10 unchanged elements hidden)
                } # forces replacement,
              ~ {
                  ~ dockerLabels           = {
                      ~ "com.datadoghq.tags.version" = "e43deb929830f5b2fef4969ac5da9f5d79761fd7" -> "8565e97f03876b84c27e9f0c4ee4fe0144b6c006"
                        # (2 unchanged elements hidden)
                    }
                  ~ environment            = [
                        # (3 unchanged elements hidden)
                        {
                            name  = "DD_SERVICE"
                            value = "gost"
                        },
                      ~ {
                            name  = "DD_VERSION"
                          ~ value = "e43deb929830f5b2fef4969ac5da9f5d79761fd7" -> "8565e97f03876b84c27e9f0c4ee4fe0144b6c006"
                        },
                        {
                            name  = "ECS_FARGATE"
                            value = "true"
                        },
                    ]
-                   mountPoints            = [] -> null
                    name                   = "datadog"
-                   portMappings           = [] -> null
-                   volumesFrom            = [] -> null
                    # (6 unchanged elements hidden)
                } # forces replacement,
            ]
        )
      ~ id                       = "gost-prod-api" -> (known after apply)
      ~ revision                 = 18 -> (known after apply)
-       tags                     = {} -> null
        # (9 unchanged attributes hidden)

-       volume {
-           name = "data" -> null

-           efs_volume_configuration {
-               file_system_id          = "fs-0b22d749517d906e0" -> null
-               root_directory          = "/" -> null
-               transit_encryption      = "ENABLED" -> null
-               transit_encryption_port = 0 -> null

-               authorization_config {
-                   access_point_id = "fsap-05cdce2f27f5aab98" -> null
                }
            }
        }
+       volume {
+           name = "data"

+           efs_volume_configuration {
+               file_system_id     = "fs-0b22d749517d906e0"
+               root_directory     = "/"
+               transit_encryption = "ENABLED"

+               authorization_config {
+                   access_point_id = "fsap-05cdce2f27f5aab98"
                }
            }
        }

        # (1 unchanged block hidden)
    }

  # module.arpa_audit_report.aws_ecs_service.default will be updated in-place
  ~ resource "aws_ecs_service" "default" {
        id                                 = "arn:aws:ecs:us-west-2:729134339726:service/gost-prod/gost-prod-arpa_audit_report"
        name                               = "gost-prod-arpa_audit_report"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-arpa_audit_report:3" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # module.arpa_audit_report.aws_ecs_task_definition.consumer must be replaced
+/- resource "aws_ecs_task_definition" "consumer" {
      ~ arn                      = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-arpa_audit_report:3" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-arpa_audit_report" -> (known after apply)
      ~ container_definitions    = (sensitive value) # forces replacement
      ~ id                       = "gost-prod-arpa_audit_report" -> (known after apply)
-       ipc_mode                 = "" -> null
-       pid_mode                 = "" -> null
      ~ revision                 = 3 -> (known after apply)
-       tags                     = {} -> null
        # (9 unchanged attributes hidden)

-       volume {
-           name = "data" -> null

-           efs_volume_configuration {
-               file_system_id          = "fs-0b22d749517d906e0" -> null
-               root_directory          = "/" -> null
-               transit_encryption      = "ENABLED" -> null
-               transit_encryption_port = 0 -> null

-               authorization_config {
-                   access_point_id = "fsap-05cdce2f27f5aab98" -> null
                }
            }
        }
+       volume {
+           name = "data"

+           efs_volume_configuration {
+               file_system_id     = "fs-0b22d749517d906e0"
+               root_directory     = "/"
+               transit_encryption = "ENABLED"

+               authorization_config {
+                   access_point_id = "fsap-05cdce2f27f5aab98"
                }
            }
        }

        # (1 unchanged block hidden)
    }

  # module.arpa_audit_report.aws_iam_role_policy.task["send-emails"] will be created
+   resource "aws_iam_role_policy" "task" {
+       id     = (known after apply)
+       name   = "send-emails"
+       policy = jsonencode(
            {
+               Statement = [
+                   {
+                       Action    = [
+                           "SES:SendRawEmail",
+                           "SES:SendEmail",
                        ]
+                       Condition = {
+                           StringLike = {
+                               "ses:FromAddress" = [
+                                   "[email protected]",
                                ]
                            }
                        }
+                       Effect    = "Allow"
+                       Resource  = "arn:aws:ses:us-west-2:729134339726:identity/grants.usdigitalresponse.org"
+                       Sid       = "SendEmails"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       role   = "gost-prod-arpa_audit_report-Task-20230929025001117700000005"
    }

  # module.consume_grants.aws_ecs_service.default will be updated in-place
  ~ resource "aws_ecs_service" "default" {
        id                                 = "arn:aws:ecs:us-west-2:729134339726:service/gost-prod/gost-prod-consume_grants"
        name                               = "gost-prod-consume_grants"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-consume_grants:12" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # module.consume_grants.aws_ecs_task_definition.consume_grants must be replaced
+/- resource "aws_ecs_task_definition" "consume_grants" {
      ~ arn                      = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-consume_grants:12" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-west-2:729134339726:task-definition/gost-prod-consume_grants" -> (known after apply)
      ~ container_definitions    = (sensitive value) # forces replacement
      ~ id                       = "gost-prod-consume_grants" -> (known after apply)
-       ipc_mode                 = "" -> null
-       pid_mode                 = "" -> null
      ~ revision                 = 12 -> (known after apply)
-       tags                     = {} -> null
        # (9 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 4 to add, 3 to change, 3 to destroy.

Pusher: @TylerHendrickson, Action: pull_request, Workflow: Terraform CI