Dev deployments

[jarrod-lowe]

No description provided.

[github-actions]

Terraform plan in terraform/environment/wildsea
With backend config: bucket=terraform-state-021891603679 key=primary/terraform.tfstate region=ap-southeast-2

With variables

environment       = "primary"
saml_metadata_url = (sensitive value)

Plan: 9 to add, 0 to change, 1 to destroy. Changes to Outputs.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
-   destroy
 <= read (data resources)

Terraform will perform the following actions:

  # aws_dynamodb_table.table will be destroyed
  # (because aws_dynamodb_table.table is not in configuration)
-   resource "aws_dynamodb_table" "table" {
-       arn                         = "arn:aws:dynamodb:ap-southeast-2:021891603679:table/Wildsea-primary" -> null
-       billing_mode                = "PAY_PER_REQUEST" -> null
-       deletion_protection_enabled = true -> null
-       hash_key                    = "PK" -> null
-       id                          = "Wildsea-primary" -> null
-       name                        = "Wildsea-primary" -> null
-       range_key                   = "SK" -> null
-       read_capacity               = 0 -> null
-       stream_enabled              = false -> null
-       table_class                 = "STANDARD" -> null
-       tags                        = {
-           "Name" = "Wildsea-primary"
        } -> null
-       tags_all                    = {
-           "Application" = "Wildsea-primary"
-           "Name"        = "Wildsea-primary"
        } -> null
-       write_capacity              = 0 -> null
#        (3 unchanged attributes hidden)

-       attribute {
-           name = "PK" -> null
-           type = "S" -> null
        }
-       attribute {
-           name = "SK" -> null
-           type = "S" -> null
        }

-       point_in_time_recovery {
-           enabled = true -> null
        }

-       ttl {
-           enabled        = false -> null
#            (1 unchanged attribute hidden)
        }
    }

  # module.wildsea.data.aws_iam_policy_document.cognito_assume will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "cognito_assume" {
+       id            = (known after apply)
+       json          = (known after apply)
+       minified_json = (known after apply)

+       statement {
+           actions = [
+               "sts:AssumeRoleWithWebIdentity",
            ]
+           effect  = "Allow"

+           condition {
+               test     = "ForAnyValue:StringLike"
+               values   = [
+                   "authenticated",
                ]
+               variable = "cognito-identity.amazonaws.com:amr"
            }
+           condition {
+               test     = "StringEquals"
+               values   = [
+                   (known after apply),
                ]
+               variable = "cognito-identity.amazonaws.com:aud"
            }

+           principals {
+               identifiers = [
+                   "cognito-identity.amazonaws.com",
                ]
+               type        = "Federated"
            }
        }
    }

  # module.wildsea.aws_cognito_identity_pool.cognito will be created
+   resource "aws_cognito_identity_pool" "cognito" {
+       allow_classic_flow               = false
+       allow_unauthenticated_identities = false
+       arn                              = (known after apply)
+       id                               = (known after apply)
+       identity_pool_name               = "Wildsea-primary"
+       tags_all                         = {
+           "Application" = "Wildsea-primary"
        }

+       cognito_identity_providers {
+           client_id               = (known after apply)
+           provider_name           = (known after apply)
+           server_side_token_check = true
        }
    }

  # module.wildsea.aws_cognito_identity_pool_roles_attachment.cognito will be created
+   resource "aws_cognito_identity_pool_roles_attachment" "cognito" {
+       id               = (known after apply)
+       identity_pool_id = (known after apply)
+       roles            = (known after apply)
    }

  # module.wildsea.aws_cognito_user_pool.cognito will be created
+   resource "aws_cognito_user_pool" "cognito" {
+       arn                        = (known after apply)
+       creation_date              = (known after apply)
+       custom_domain              = (known after apply)
+       deletion_protection        = "INACTIVE"
+       domain                     = (known after apply)
+       email_verification_message = (known after apply)
+       email_verification_subject = (known after apply)
+       endpoint                   = (known after apply)
+       estimated_number_of_users  = (known after apply)
+       id                         = (known after apply)
+       last_modified_date         = (known after apply)
+       mfa_configuration          = "OFF"
+       name                       = "Wildsea-primary"
+       sms_verification_message   = (known after apply)
+       tags_all                   = {
+           "Application" = "Wildsea-primary"
        }

+       admin_create_user_config {
+           allow_admin_create_user_only = true
        }

+       password_policy (known after apply)

+       sms_configuration (known after apply)

+       verification_message_template (known after apply)
    }

  # module.wildsea.aws_cognito_user_pool_client.cognito will be created
+   resource "aws_cognito_user_pool_client" "cognito" {
+       access_token_validity                         = (known after apply)
+       allowed_oauth_flows                           = [
+           "code",
+           "implicit",
        ]
+       allowed_oauth_flows_user_pool_client          = true
+       allowed_oauth_scopes                          = [
+           "openid",
        ]
+       auth_session_validity                         = (known after apply)
+       callback_urls                                 = [
+           "https://TODO",
        ]
+       client_secret                                 = (sensitive value)
+       default_redirect_uri                          = (known after apply)
+       enable_propagate_additional_user_context_data = (known after apply)
+       enable_token_revocation                       = (known after apply)
+       explicit_auth_flows                           = [
+           "ALLOW_REFRESH_TOKEN_AUTH",
+           "ALLOW_USER_PASSWORD_AUTH",
+           "ALLOW_USER_SRP_AUTH",
        ]
+       generate_secret                               = true
+       id                                            = (known after apply)
+       id_token_validity                             = (known after apply)
+       logout_urls                                   = [
+           "https://TODO",
        ]
+       name                                          = "Wildsea-primary"
+       prevent_user_existence_errors                 = (known after apply)
+       read_attributes                               = (known after apply)
+       refresh_token_validity                        = (known after apply)
+       supported_identity_providers                  = [
+           "COGNITO",
        ]
+       user_pool_id                                  = (known after apply)
+       write_attributes                              = (known after apply)
    }

  # module.wildsea.aws_cognito_user_pool_domain.cognito will be created
+   resource "aws_cognito_user_pool_domain" "cognito" {
+       aws_account_id                  = (known after apply)
+       cloudfront_distribution         = (known after apply)
+       cloudfront_distribution_arn     = (known after apply)
+       cloudfront_distribution_zone_id = (known after apply)
+       domain                          = "wildsea-primary"
+       id                              = (known after apply)
+       s3_bucket                       = (known after apply)
+       user_pool_id                    = (known after apply)
+       version                         = (known after apply)
    }

  # module.wildsea.aws_dynamodb_table.table will be created
+   resource "aws_dynamodb_table" "table" {
+       arn                         = (known after apply)
+       billing_mode                = "PAY_PER_REQUEST"
+       deletion_protection_enabled = true
+       hash_key                    = "**"
+       id                          = (known after apply)
+       name                        = "Wildsea-primary"
+       range_key                   = "**"
+       read_capacity               = (known after apply)
+       stream_arn                  = (known after apply)
+       stream_label                = (known after apply)
+       stream_view_type            = (known after apply)
+       tags                        = {
+           "Name" = "Wildsea-primary"
        }
+       tags_all                    = {
+           "Application" = "Wildsea-primary"
+           "Name"        = "Wildsea-primary"
        }
+       write_capacity              = (known after apply)

+       attribute {
+           name = "PK"
+           type = "S"
        }
+       attribute {
+           name = "SK"
+           type = "S"
        }

+       point_in_time_recovery {
+           enabled = true
        }

+       server_side_encryption (known after apply)

+       ttl (known after apply)
    }

  # module.wildsea.aws_iam_policy.cognito will be created
+   resource "aws_iam_policy" "cognito" {
+       arn              = (known after apply)
+       attachment_count = (known after apply)
+       id               = (known after apply)
+       name             = "Wildsea-primary-user"
+       name_prefix      = (known after apply)
+       path             = "/"
+       policy           = jsonencode(
            {
+               Statement = [
+                   {
+                       Action   = "cognito-identity:GetCredentialsForIdentity"
+                       Effect   = "Allow"
+                       Resource = "*"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       policy_id        = (known after apply)
+       tags_all         = {
+           "Application" = "Wildsea-primary"
        }
    }

  # module.wildsea.aws_iam_role.cognito will be created
+   resource "aws_iam_role" "cognito" {
+       arn                   = (known after apply)
+       assume_role_policy    = (known after apply)
+       create_date           = (known after apply)
+       force_detach_policies = false
+       id                    = (known after apply)
+       managed_policy_arns   = (known after apply)
+       max_session_duration  = 3600
+       name                  = "Wildsea-primary-user"
+       name_prefix           = (known after apply)
+       path                  = "/"
+       tags_all              = {
+           "Application" = "Wildsea-primary"
        }
+       unique_id             = (known after apply)

+       inline_policy (known after apply)
    }

  # module.wildsea.aws_iam_role_policy_attachment.cognito will be created
+   resource "aws_iam_role_policy_attachment" "cognito" {
+       id         = (known after apply)
+       policy_arn = (known after apply)
+       role       = "Wildsea-primary-user"
    }

Plan: 9 to add, 0 to change, 1 to destroy.

Changes to Outputs:
-   login_domain = "Wildsea-primary.auth.ap-southeast-2.amazonaws.com" -> null

❌ Error applying plan in Environment Main - Apply #19