Upgrade secret module to 1.1.1 - aws-6 compatible by akuzminsky · Pull Request #272 · infrahouse8/github-control

akuzminsky · 2026-05-04T19:16:12Z

No description provided.

github-actions · 2026-05-04T19:29:14Z

State `s3://infrahouse-github-control-state/terraform.tfstate`

Affected resources counts

Success	🟢 Add	🟡 Change	🔴 Destroy
✅	72	5	72

Affected resources by action

Action	Resources
🟡	`module.actions-runner-pem.aws_secretsmanager_secret.secret`
🟡	`module.actions-runner-pem-493370826424-uw1.aws_secretsmanager_secret.secret`
🟡	`module.anthropic_api_key.aws_secretsmanager_secret.secret`
🟡	`module.github-token.aws_secretsmanager_secret.secret`
🟡	`module.openvpn-oauth-client-id.aws_secretsmanager_secret.secret`

STDOUT

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement
 <= read (data resources)

Terraform will perform the following actions:

  # module.actions-runner-pem.data.external.secret_value will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "external" "secret_value" {
      + id      = (known after apply)
      + program = [
          + "python",
          + ".terraform/modules/actions-runner-pem/assets/get_secret.py",
          + "us-west-1",
          + "arn:aws:secretsmanager:us-west-1:303467602807:secret:action-runner-pem-20241116182707976200000001-zz0FRP",
          + "arn:aws:iam::303467602807:role/ih-tf-github-control-admin",
        ]
      + result  = (known after apply)
    }

  # module.actions-runner-pem.aws_secretsmanager_secret.secret will be updated in-place
  ~ resource "aws_secretsmanager_secret" "secret" {
        id                             = "arn:aws:secretsmanager:us-west-1:303467602807:secret:action-runner-pem-20241116182707976200000001-zz0FRP"
        name                           = "action-runner-pem-20241116182707976200000001"
      ~ policy                         = jsonencode(
          ~ {
              ~ Statement = [
                    # (2 unchanged elements hidden)
                    {
                        Action    = [
                            "secretsmanager:ValidateResourcePolicy",
                            "secretsmanager:UpdateSecretVersionStage",
                            "secretsmanager:UpdateSecret",
                            "secretsmanager:UntagResource",
                            "secretsmanager:TagResource",
                            "secretsmanager:StopReplicationToReplica",
                            "secretsmanager:RotateSecret",
                            "secretsmanager:RestoreSecret",
                            "secretsmanager:ReplicateSecretToRegions",
                            "secretsmanager:RemoveRegionsFromReplication",
                            "secretsmanager:PutSecretValue",
                            "secretsmanager:PutResourcePolicy",
                            "secretsmanager:ListSecrets",
                            "secretsmanager:DeleteSecret",
                            "secretsmanager:DeleteResourcePolicy",
                            "secretsmanager:CreateSecret",
                            "secretsmanager:CancelRotateSecret",
                            "secretsmanager:BatchGetSecretValue",
                        ]
                        Condition = {
                            ArnLike = {
                                "aws:PrincipalArn" = [
                                    "arn:aws:iam::303467602807:role/actions-runner-tester",
                                    "arn:aws:iam::303467602807:role/aws-reserved/sso.amazonaws.com/us-west-1/AWSReservedSSO_AWSAdministratorAccess_422821c726d81c14",
                                    "arn:aws:iam::303467602807:role/ih-tf-aws-control-303467602807-admin",
                                    "arn:aws:iam::303467602807:role/infrahouse-registration*",
                                    "arn:aws:iam::303467602807:role/actions-runner-*",
                                ]
                            }
                        }
                        Effect    = "Deny"
                        Principal = {
                            AWS = "*"
                        }
                        Resource  = "*"
                    },
                  ~ {
                      ~ Action    = "*" -> [
                          + "secretsmanager:ListSecrets",
                          + "secretsmanager:GetResourcePolicy",
                          + "secretsmanager:DescribeSecret",
                        ]
                      - Condition = {
                          - ArnNotLike = {
                              - "aws:PrincipalArn" = [
                                  - "arn:aws:iam::303467602807:role/ih-tf-github-control-admin",
                                  - "arn:aws:iam::303467602807:role/actions-runner-tester",
                                  - "arn:aws:iam::303467602807:role/aws-reserved/sso.amazonaws.com/us-west-1/AWSReservedSSO_AWSAdministratorAccess_422821c726d81c14",
                                  - "arn:aws:iam::303467602807:role/ih-tf-aws-control-303467602807-admin",
                                  - "arn:aws:iam::303467602807:role/infrahouse-registration*",
                                  - "arn:aws:iam::303467602807:role/actions-runner-*",
                                ]
                            }
                        }
                      ~ Effect    = "Deny" -> "Allow"
                      ~ Principal = {
                          ~ AWS = "*" -> "arn:aws:iam::303467602807:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer"
                        }
                        # (1 unchanged attribute hidden)
                    },
                  + {
                      + Action    = [
                          + "secretsmanager:ValidateResourcePolicy",
                          + "secretsmanager:UpdateSecretVersionStage",
                          + "secretsmanager:UpdateSecret",
                          + "secretsmanager:UntagResource",
                          + "secretsmanager:TagResource",
                          + "secretsmanager:StopReplicationToReplica",
                          + "secretsmanager:RotateSecret",
                          + "secretsmanager:RestoreSecret",
                          + "secretsmanager:ReplicateSecretToRegions",
                          + "secretsmanager:RemoveRegionsFromReplication",
                          + "secretsmanager:PutSecretValue",
                          + "secretsmanager:PutResourcePolicy",
                          + "secretsmanager:ListSecretVersionIds",
                          + "secretsmanager:GetSecretValue",
                          + "secretsmanager:GetRandomPassword",
                          + "secretsmanager:DeleteSecret",
                          + "secretsmanager:DeleteResourcePolicy",
                          + "secretsmanager:CreateSecret",
                          + "secretsmanager:CancelRotateSecret",
                          + "secretsmanager:BatchGetSecretValue",
                        ]
                      + Effect    = "Deny"
                      + Principal = {
                          + AWS = "arn:aws:iam::303467602807:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer"
                        }
                      + Resource  = "*"
                    },
                  + {
                      + Action    = "*"
                      + Condition = {
                          + ArnNotLike = {
                              + "aws:PrincipalArn" = [
                                  + "arn:aws:iam::303467602807:role/ih-tf-github-control-admin",
                                  + "arn:aws:iam::303467602807:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer",
                                  + "arn:aws:iam::303467602807:role/actions-runner-tester",
                                  + "arn:aws:iam::303467602807:role/aws-reserved/sso.amazonaws.com/us-west-1/AWSReservedSSO_AWSAdministratorAccess_422821c726d81c14",
                                  + "arn:aws:iam::303467602807:role/ih-tf-aws-control-303467602807-admin",
                                  + "arn:aws:iam::303467602807:role/infrahouse-registration*",
                                  + "arn:aws:iam::303467602807:role/actions-runner-*",
                                ]
                            }
                        }
                      + Effect    = "Deny"
                      + Principal = {
                          + AWS = "*"
                        }
                      + Resource  = "*"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
      ~ tags                           = {
            "account"           = "303467602807"
            "created_by_module" = "infrahouse/secret/aws"
            "environment"       = "production"
          + "module_version"    = "1.1.1"
            "owner"             = "arn:aws:iam::303467602807:role/ih-tf-github-control-admin"
            "service"           = "unknown"
        }
      ~ tags_all                       = {
          + "module_version"    = "1.1.1"
            # (6 unchanged elements hidden)
        }
        # (6 unchanged attributes hidden)
    }

  # module.actions-runner-pem-493370826424-uw1.data.external.secret_value will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "external" "secret_value" {
      + id      = (known after apply)
      + program = [
          + "python",
          + ".terraform/modules/actions-runner-pem-493370826424-uw1/assets/get_secret.py",
          + "us-west-1",
          + "arn:aws:secretsmanager:us-west-1:493370826424:secret:action-runner-pem-20250515013848516900000001-8BWS91",
          + "arn:aws:iam::493370826424:role/ih-tf-aws-control-493370826424-admin",
        ]
      + result  = (known after apply)
    }

  # module.actions-runner-pem-493370826424-uw1.aws_secretsmanager_secret.secret will be updated in-place
  ~ resource "aws_secretsmanager_secret" "secret" {
        id                             = "arn:aws:secretsmanager:us-west-1:493370826424:secret:action-runner-pem-20250515013848516900000001-8BWS91"
        name                           = "action-runner-pem-20250515013848516900000001"
      ~ tags                           = {
            "account"           = "493370826424"
            "created_by_module" = "infrahouse/secret/aws"
            "environment"       = "production"
          + "module_version"    = "1.1.1"
            "owner"             = "arn:aws:iam::493370826424:role/ih-tf-aws-control-493370826424-admin"
            "service"           = "unknown"
        }
      ~ tags_all                       = {
          + "module_version"    = "1.1.1"
            # (6 unchanged elements hidden)
        }
        # (7 unchanged attributes hidden)
    }

  # module.anthropic_api_key.data.external.secret_value will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "external" "secret_value" {
      + id      = (known after apply)
      + program = [
          + "python",
          + ".terraform/modules/anthropic_api_key/assets/get_secret.py",
          + "us-west-1",
          + "arn:aws:secretsmanager:us-west-1:303467602807:secret:ANTHROPIC_API_KEY-20251121184838178500000001-BWHWEb",
          + "arn:aws:iam::303467602807:role/ih-tf-github-control-admin",
        ]
      + result  = (known after apply)
    }

  # module.anthropic_api_key.aws_secretsmanager_secret.secret will be updated in-place
  ~ resource "aws_secretsmanager_secret" "secret" {
        id                             = "arn:aws:secretsmanager:us-west-1:303467602807:secret:ANTHROPIC_API_KEY-20251121184838178500000001-BWHWEb"
        name                           = "ANTHROPIC_API_KEY-20251121184838178500000001"
      ~ tags                           = {
            "account"           = "303467602807"
            "created_by_module" = "infrahouse/secret/aws"
            "environment"       = "production"
          ~ "module_version"    = "1.1.0" -> "1.1.1"
            "owner"             = "arn:aws:iam::303467602807:role/ih-tf-github-control-admin"
            "service"           = "unknown"
        }
      ~ tags_all                       = {
          ~ "module_version"    = "1.1.0" -> "1.1.1"
            # (6 unchanged elements hidden)
        }
        # (7 unchanged attributes hidden)
    }

  # module.github-token.data.external.secret_value will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "external" "secret_value" {
      + id      = (known after apply)
      + program = [
          + "python",
          + ".terraform/modules/github-token/assets/get_secret.py",
          + "us-west-1",
          + "arn:aws:secretsmanager:us-west-1:303467602807:secret:github-token-20250821230222362700000001-4E86hm",
          + "arn:aws:iam::303467602807:role/ih-tf-github-control-admin",
        ]
      + result  = (known after apply)
    }

  # module.github-token.aws_secretsmanager_secret.secret will be updated in-place
  ~ resource "aws_secretsmanager_secret" "secret" {
        id                             = "arn:aws:secretsmanager:us-west-1:303467602807:secret:github-token-20250821230222362700000001-4E86hm"
        name                           = "github-token-20250821230222362700000001"
      ~ tags                           = {
            "account"           = "303467602807"
            "created_by_module" = "infrahouse/secret/aws"
            "environment"       = "production"
          ~ "module_version"    = "1.0.3" -> "1.1.1"
            "owner"             = "arn:aws:iam::303467602807:role/ih-tf-github-control-admin"
            "service"           = "unknown"
        }
      ~ tags_all                       = {
          ~ "module_version"    = "1.0.3" -> "1.1.1"
            # (6 unchanged elements hidden)
        }
        # (7 unchanged attributes hidden)
    }

  # module.openvpn-oauth-client-id.data.external.secret_value will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "external" "secret_value" {
      + id      = (known after apply)
      + program = [
          + "python",
          + ".terraform/modules/openvpn-oauth-client-id/assets/get_secret.py",
          + "us-west-1",
          + "arn:aws:secretsmanager:us-west-1:303467602807:secret:openvpn-client-id-20250927133453378100000001-zCo51F",
          + "arn:aws:iam::303467602807:role/ih-tf-github-control-admin",
        ]
      + result  = (known after apply)
    }

  # module.openvpn-oauth-client-id.aws_secretsmanager_secret.secret will be updated in-place
  ~ resource "aws_secretsmanager_secret" "secret" {
        id                             = "arn:aws:secretsmanager:us-west-1:303467602807:secret:openvpn-client-id-20250927133453378100000001-zCo51F"
        name                           = "openvpn-client-id-20250927133453378100000001"
      ~ tags                           = {
            "account"           = "303467602807"
            "created_by_module" = "infrahouse/secret/aws"
            "environment"       = "production"
          ~ "module_version"    = "1.1.0" -> "1.1.1"
            "owner"             = "arn:aws:iam::303467602807:role/ih-tf-github-control-admin"
            "service"           = "unknown"
        }
      ~ tags_all                       = {
          ~ "module_version"    = "1.1.0" -> "1.1.1"
            # (6 unchanged elements hidden)
        }
        # (7 unchanged attributes hidden)
    }

  # module.repos["aws-control"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:30 +0000 UTC" -> (known after apply)
      ~ id              = "aws-control:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:30 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["aws-control-289256138624"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:25 +0000 UTC" -> (known after apply)
      ~ id              = "aws-control-289256138624:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:25 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["aws-control-303467602807"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:08 +0000 UTC" -> (known after apply)
      ~ id              = "aws-control-303467602807:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:08 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["aws-control-338531211565"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:43 +0000 UTC" -> (known after apply)
      ~ id              = "aws-control-338531211565:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:43 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["aws-control-493370826424"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:20 +0000 UTC" -> (known after apply)
      ~ id              = "aws-control-493370826424:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:20 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["cookiecutter-github-control"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:58 +0000 UTC" -> (known after apply)
      ~ id              = "cookiecutter-github-control:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:58 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["hiera-aws-sm"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:10 +0000 UTC" -> (known after apply)
      ~ id              = "hiera-aws-sm:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:10 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["homebrew-infrahouse-toolkit"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:57 +0000 UTC" -> (known after apply)
      ~ id              = "homebrew-infrahouse-toolkit:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:57 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["homebrew-infrahouse-toolkit"].github_actions_secret.secret["PAT_TOKEN"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-11 22:18:57 +0000 UTC" -> (known after apply)
      ~ id              = "homebrew-infrahouse-toolkit:PAT_TOKEN" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-11 22:18:57 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["infrahouse-com"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:11 +0000 UTC" -> (known after apply)
      ~ id              = "infrahouse-com:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:11 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["infrahouse-core"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:42 +0000 UTC" -> (known after apply)
      ~ id              = "infrahouse-core:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:42 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["infrahouse-puppet-data"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:28 +0000 UTC" -> (known after apply)
      ~ id              = "infrahouse-puppet-data:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:28 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["infrahouse-toolkit"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:36 +0000 UTC" -> (known after apply)
      ~ id              = "infrahouse-toolkit:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:36 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["infrahouse-toolkit"].github_actions_secret.secret["HOMEBREW_TAP_TOKEN"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-11 19:49:31 +0000 UTC" -> (known after apply)
      ~ id              = "infrahouse-toolkit:HOMEBREW_TAP_TOKEN" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-11 19:49:31 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["infrahouse-ubuntu-pro"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:26 +0000 UTC" -> (known after apply)
      ~ id              = "infrahouse-ubuntu-pro:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:26 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["infrahouse-website-infra"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:33 +0000 UTC" -> (known after apply)
      ~ id              = "infrahouse-website-infra:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:33 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["osv-scanner"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:12 +0000 UTC" -> (known after apply)
      ~ id              = "osv-scanner:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:12 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["prometheus-elasticsearch-exporter"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:18 +0000 UTC" -> (known after apply)
      ~ id              = "prometheus-elasticsearch-exporter:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:18 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["proxysql-sandbox"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:59 +0000 UTC" -> (known after apply)
      ~ id              = "proxysql-sandbox:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:59 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["puppet-code"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:16 +0000 UTC" -> (known after apply)
      ~ id              = "puppet-code:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:16 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["pytest-infrahouse"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:32 +0000 UTC" -> (known after apply)
      ~ id              = "pytest-infrahouse:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:32 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-actions-runner"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:35 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-actions-runner:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:35 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-actions-runner"].github_actions_secret.secret["CI_TEST_TOKEN"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2025-08-21 23:18:03 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-actions-runner:CI_TEST_TOKEN" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2025-08-21 23:18:03 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-bookstack"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:38 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-bookstack:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:38 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-ci-cd"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:37 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-ci-cd:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:37 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-cloud-init"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:23 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-cloud-init:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:23 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-cloudcraft-role"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:23 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-cloudcraft-role:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:23 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-cost-alert"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:01 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-cost-alert:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:01 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-debian-repo"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:39 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-debian-repo:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:39 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-dms"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:42 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-dms:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:42 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-ecr"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:15 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-ecr:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:15 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-ecs"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:20 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-ecs:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:20 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-elasticsearch"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:12 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-elasticsearch:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:12 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-emrserverless"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:05 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-emrserverless:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:05 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-gh-identity-provider"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:11 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-gh-identity-provider:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:11 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-gha-admin"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:34 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-gha-admin:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:34 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-github-backup"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:09 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-github-backup:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:09 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-github-backup-configuration"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:40 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-github-backup-configuration:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:40 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-github-role"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:29 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-github-role:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:29 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-guardduty-configuration"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:28 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-guardduty-configuration:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:28 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-http-redirect"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:50 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-http-redirect:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:50 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-instance-profile"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:04 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-instance-profile:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:04 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-iso27001"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:19 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-iso27001:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:19 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-jumphost"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:55 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-jumphost:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:55 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-key"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:54 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-key:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:54 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-kibana"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:25 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-kibana:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:25 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-lambda-monitored"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:27 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-lambda-monitored:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:27 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-openclaw"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:22 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-openclaw:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:22 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-openvpn"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:07 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-openvpn:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:07 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-openvpn"].github_actions_secret.secret["OPENVPN_CLIENT_SECRET"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2025-09-27 13:46:46 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-openvpn:OPENVPN_CLIENT_SECRET" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2025-09-27 13:46:46 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-org-governance"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-26 21:46:49 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-org-governance:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-26 21:46:49 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-percona-server"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:19 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-percona-server:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:19 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-pmm-ecs"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:06 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-pmm-ecs:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:06 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-postfix"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:49 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-postfix:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:49 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-pypiserver"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:38 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-pypiserver:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:38 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-registry"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:07 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-registry:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:07 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-s3-bucket"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:52 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-s3-bucket:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:52 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-secret"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:37 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-secret:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:37 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-secret-policy"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:03 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-secret-policy:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:03 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-service-network"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:21 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-service-network:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:21 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-sqs-ecs"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:41 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-sqs-ecs:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:41 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-sqs-pod"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:53 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-sqs-pod:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:53 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-state-bucket"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:24 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-state-bucket:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:24 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-state-manager"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:05 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-state-manager:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:05 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-tags-override"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:02 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-tags-override:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:02 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-tcp-pod"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:13 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-tcp-pod:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:13 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-teleport"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:24 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-teleport:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:24 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-teleport-agent"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:48 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-teleport-agent:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:48 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-terraformer"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:09 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-terraformer:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:09 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-truststore"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:06 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-truststore:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:06 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-update-dns"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:18:36 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-update-dns:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:18:36 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-website-pod"].github_actions_secret.secret["ANTHROPIC_API_KEY"] must be replaced
-/+ resource "github_actions_secret" "secret" {
      ~ created_at      = "2026-03-21 20:17:39 +0000 UTC" -> (known after apply)
      ~ id              = "terraform-aws-website-pod:ANTHROPIC_API_KEY" -> (known after apply)
      ~ plaintext_value = (sensitive value) # forces replacement
      ~ updated_at      = "2026-03-21 20:17:39 +0000 UTC" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

Plan: 72 to add, 5 to change, 72 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tf.plan

To perform exactly these actions, run the following command to apply:
    terraform apply "tf.plan"

metadata

eyJzMzovL2luZnJhaG91c2UtZ2l0aHViLWNvbnRyb2wtc3RhdGUvdGVycmFmb3JtLnRmc3RhdGUiOiB7InN1Y2Nlc3MiOiB0cnVlLCAiYWRkIjogNzIsICJjaGFuZ2UiOiA1LCAiZGVzdHJveSI6IDcyfX0=

Upgrade secret module to 1.1.1 - aws-6 compatible

7cac87d

akuzminsky temporarily deployed to production May 4, 2026 19:16 — with GitHub Actions Inactive

akuzminsky merged commit ae74b95 into main May 4, 2026
1 check passed

akuzminsky deleted the secrets branch May 4, 2026 19:30

akuzminsky temporarily deployed to production May 4, 2026 19:30 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Upgrade secret module to 1.1.1 - aws-6 compatible#272

Upgrade secret module to 1.1.1 - aws-6 compatible#272
akuzminsky merged 1 commit into
mainfrom
secrets

akuzminsky commented May 4, 2026

Uh oh!

github-actions Bot commented May 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

akuzminsky commented May 4, 2026

Uh oh!

github-actions Bot commented May 4, 2026

State s3://infrahouse-github-control-state/terraform.tfstate

Affected resources counts

Affected resources by action

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

State `s3://infrahouse-github-control-state/terraform.tfstate`