Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
 <= read (data resources)

Terraform will perform the following actions:

  # module.actions-runner-pem-493370826424-uw1.data.external.secret_value will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "external" "secret_value" {
      + id      = (known after apply)
      + program = [
          + "python",
          + ".terraform/modules/actions-runner-pem-493370826424-uw1/assets/get_secret.py",
          + "us-west-1",
          + "arn:aws:secretsmanager:us-west-1:493370826424:secret:action-runner-pem-20250515013848516900000001-8BWS91",
          + "arn:aws:iam::493370826424:role/ih-tf-aws-control-493370826424-admin",
        ]
      + result  = (known after apply)
    }

  # module.actions-runner-pem-493370826424-uw1.aws_secretsmanager_secret.secret will be updated in-place
  ~ resource "aws_secretsmanager_secret" "secret" {
        id                             = "arn:aws:secretsmanager:us-west-1:493370826424:secret:action-runner-pem-20250515013848516900000001-8BWS91"
        name                           = "action-runner-pem-20250515013848516900000001"
      ~ policy                         = jsonencode(
          ~ {
              ~ Statement = [
                    {
                        Action    = "*"
                        Condition = {
                            ArnLike = {
                                "aws:PrincipalArn" = "arn:aws:iam::493370826424:role/ih-tf-aws-control-493370826424-admin"
                            }
                        }
                        Effect    = "Allow"
                        Principal = {
                            AWS = "*"
                        }
                        Resource  = "*"
                    },
                  ~ {
                      ~ Action    = "*" -> [
                          + "secretsmanager:ListSecrets",
                          + "secretsmanager:GetResourcePolicy",
                          + "secretsmanager:DescribeSecret",
                        ]
                      - Condition = {
                          - ArnNotLike = {
                              - "aws:PrincipalArn" = "arn:aws:iam::493370826424:role/ih-tf-aws-control-493370826424-admin"
                            }
                        }
                      ~ Effect    = "Deny" -> "Allow"
                      ~ Principal = {
                          ~ AWS = "*" -> "arn:aws:iam::493370826424:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer"
                        }
                        # (1 unchanged attribute hidden)
                    },
                  + {
                      + Action    = [
                          + "secretsmanager:ValidateResourcePolicy",
                          + "secretsmanager:UpdateSecretVersionStage",
                          + "secretsmanager:UpdateSecret",
                          + "secretsmanager:UntagResource",
                          + "secretsmanager:TagResource",
                          + "secretsmanager:StopReplicationToReplica",
                          + "secretsmanager:RotateSecret",
                          + "secretsmanager:RestoreSecret",
                          + "secretsmanager:ReplicateSecretToRegions",
                          + "secretsmanager:RemoveRegionsFromReplication",
                          + "secretsmanager:PutSecretValue",
                          + "secretsmanager:PutResourcePolicy",
                          + "secretsmanager:ListSecretVersionIds",
                          + "secretsmanager:GetSecretValue",
                          + "secretsmanager:GetRandomPassword",
                          + "secretsmanager:DeleteSecret",
                          + "secretsmanager:DeleteResourcePolicy",
                          + "secretsmanager:CreateSecret",
                          + "secretsmanager:CancelRotateSecret",
                          + "secretsmanager:BatchGetSecretValue",
                        ]
                      + Effect    = "Deny"
                      + Principal = {
                          + AWS = "arn:aws:iam::493370826424:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer"
                        }
                      + Resource  = "*"
                    },
                  + {
                      + Action    = "*"
                      + Condition = {
                          + ArnNotLike = {
                              + "aws:PrincipalArn" = [
                                  + "arn:aws:iam::493370826424:role/ih-tf-aws-control-493370826424-admin",
                                  + "arn:aws:iam::493370826424:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer",
                                ]
                            }
                        }
                      + Effect    = "Deny"
                      + Principal = {
                          + AWS = "*"
                        }
                      + Resource  = "*"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        tags                           = {
            "account"           = "493370826424"
            "created_by_module" = "infrahouse/secret/aws"
            "environment"       = "production"
            "module_version"    = "1.1.1"
            "owner"             = "arn:aws:iam::493370826424:role/ih-tf-aws-control-493370826424-admin"
            "service"           = "unknown"
        }
        # (8 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.ih_8_repos.github_repository.repo,
  on modules/local-repo/repos.tf line 4, in resource "github_repository" "repo":
   4:   has_downloads        = false

This attribute is no longer in use, but it hasn't been removed yet. It will
be removed in a future version. See
https://github.com/orgs/community/discussions/102145#discussioncomment-8351756

(and 7 more similar warnings elsewhere)

Warning: Deprecated attribute

  on .terraform/modules/actions-runner-pem-493370826424-uw1/data_sources.tf line 11, in data "external" "secret_value":
  11:     "python", "${path.module}/assets/get_secret.py", data.aws_region.current.name, aws_secretsmanager_secret.secret.id, data.aws_iam_role.caller_role.arn

The attribute "name" is deprecated. Refer to the provider documentation for
details.

(and 5 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tf.plan

To perform exactly these actions, run the following command to apply:
    terraform apply "tf.plan"
Releasing state lock. This may take a few moments...

eyJzMzovL2luZnJhaG91c2UtZ2l0aHViLWNvbnRyb2wtc3RhdGUvdGVycmFmb3JtLnRmc3RhdGUiOiB7InN1Y2Nlc3MiOiB0cnVlLCAiYWRkIjogMCwgImNoYW5nZSI6IDEsICJkZXN0cm95IjogMH19