Let root SSO admin run make plan/apply

[akuzminsky]

No description provided.

[github-actions]

State s3://infrahouse-github-control-state/terraform.tfstate

Affected resources counts

Success	Add	🟡 Change	Destroy
✅	0	3	0

Affected resources by action

Action	Resources
🟡	module.aws_service_infrahouse_app_gha_sandbox.aws_iam_policy.github
🟡	module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role.admin
🟡	module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_role.state-manager

STDOUT

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
 <= read (data resources)

Terraform will perform the following actions:

  # module.aws_service_infrahouse_app_gha_sandbox.data.aws_iam_policy_document.github-permissions will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_iam_policy_document" "github-permissions" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions   = [
              + "sts:AssumeRole",
            ]
          + resources = [
              + "arn:aws:iam::289256138624:role/ih-tf-aws-service-infrahouse-app-state-manager",
              + "arn:aws:iam::303467602807:role/ih-tf-aws-service-infrahouse-app-admin",
            ]
        }
    }

  # module.aws_service_infrahouse_app_gha_sandbox.aws_iam_policy.github will be updated in-place
  ~ resource "aws_iam_policy" "github" {
        id               = "arn:aws:iam::303467602807:policy/ih-tf-aws-service-infrahouse-app-github20260505170644603400000001"
        name             = "ih-tf-aws-service-infrahouse-app-github20260505170644603400000001"
      ~ policy           = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = "sts:AssumeRole"
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:iam::303467602807:role/ih-tf-aws-service-infrahouse-app-admin",
                          - "arn:aws:iam::289256138624:role/ih-tf-aws-service-infrahouse-app-state-manager",
                        ]
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        tags             = {
            "created_by_module" = "infrahouse/gha-admin/aws"
        }
        # (7 unchanged attributes hidden)
    }

  # module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role.admin will be updated in-place
  ~ resource "aws_iam_role" "admin" {
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Principal = {
                          ~ AWS = "arn:aws:iam::303467602807:role/ih-tf-aws-service-infrahouse-app-github" -> [
                              + "arn:aws:iam::990466748045:role/aws-reserved/sso.amazonaws.com/us-west-1/AWSReservedSSO_AWSAdministratorAccess_16bdbe5eb442e7ef",
                              + "arn:aws:iam::303467602807:role/ih-tf-aws-service-infrahouse-app-github",
                            ]
                        }
                        # (2 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        id                    = "ih-tf-aws-service-infrahouse-app-admin"
        name                  = "ih-tf-aws-service-infrahouse-app-admin"
        tags                  = {
            "created_by_module" = "infrahouse/gha-admin/aws"
            "module_version"    = "3.6.1"
        }
        # (11 unchanged attributes hidden)
    }

  # module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_role.state-manager will be updated in-place
  ~ resource "aws_iam_role" "state-manager" {
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Principal = {
                          ~ AWS = "arn:aws:iam::303467602807:role/ih-tf-aws-service-infrahouse-app-github" -> [
                              + "arn:aws:iam::990466748045:role/aws-reserved/sso.amazonaws.com/us-west-1/AWSReservedSSO_AWSAdministratorAccess_16bdbe5eb442e7ef",
                              + "arn:aws:iam::303467602807:role/ih-tf-aws-service-infrahouse-app-github",
                            ]
                        }
                        # (3 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        id                    = "ih-tf-aws-service-infrahouse-app-state-manager"
        name                  = "ih-tf-aws-service-infrahouse-app-state-manager"
        tags                  = {
            "created_by_module" = "infrahouse/state-manager/aws"
            "module_version"    = "1.4.2"
        }
        # (11 unchanged attributes hidden)
    }

Plan: 0 to add, 3 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.ih_8_repos.github_repository.repo,
  on modules/local-repo/repos.tf line 4, in resource "github_repository" "repo":
   4:   has_downloads        = false

This attribute is no longer in use, but it hasn't been removed yet. It will
be removed in a future version. See
https://github.com/orgs/community/discussions/102145#discussioncomment-8351756

(and 7 more similar warnings elsewhere)

Warning: Deprecated attribute

  on .terraform/modules/actions-runner-pem-493370826424-uw1/data_sources.tf line 11, in data "external" "secret_value":
  11:     "python", "${path.module}/assets/get_secret.py", data.aws_region.current.name, aws_secretsmanager_secret.secret.id, data.aws_iam_role.caller_role.arn

The attribute "name" is deprecated. Refer to the provider documentation for
details.

(and 5 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tf.plan

To perform exactly these actions, run the following command to apply:
    terraform apply "tf.plan"

metadata

eyJzMzovL2luZnJhaG91c2UtZ2l0aHViLWNvbnRyb2wtc3RhdGUvdGVycmFmb3JtLnRmc3RhdGUiOiB7InN1Y2Nlc3MiOiB0cnVlLCAiYWRkIjogMCwgImNoYW5nZSI6IDMsICJkZXN0cm95IjogMH19