Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
 <= read (data resources)

Terraform will perform the following actions:

  # module.aws_service_infrahouse_app.github_actions_variable.aws_default_region will be created
  + resource "github_actions_variable" "aws_default_region" {
      + created_at    = (known after apply)
      + id            = (known after apply)
      + repository    = "aws-service-infrahouse-app"
      + updated_at    = (known after apply)
      + value         = jsonencode(
            {
              + sandbox = "us-west-1"
            }
        )
      + variable_name = "AWS_DEFAULT_REGION"
    }

  # module.aws_service_infrahouse_app.github_actions_variable.role_admin will be created
  + resource "github_actions_variable" "role_admin" {
      + created_at    = (known after apply)
      + id            = (known after apply)
      + repository    = "aws-service-infrahouse-app"
      + updated_at    = (known after apply)
      + value         = (known after apply)
      + variable_name = "ROLE_ADMIN"
    }

  # module.aws_service_infrahouse_app.github_actions_variable.role_github will be created
  + resource "github_actions_variable" "role_github" {
      + created_at    = (known after apply)
      + id            = (known after apply)
      + repository    = "aws-service-infrahouse-app"
      + updated_at    = (known after apply)
      + value         = (known after apply)
      + variable_name = "ROLE_GITHUB"
    }

  # module.aws_service_infrahouse_app.github_actions_variable.role_state_manager will be created
  + resource "github_actions_variable" "role_state_manager" {
      + created_at    = (known after apply)
      + id            = (known after apply)
      + repository    = "aws-service-infrahouse-app"
      + updated_at    = (known after apply)
      + value         = (known after apply)
      + variable_name = "ROLE_STATE_MANAGER"
    }

  # module.aws_service_infrahouse_app.github_actions_variable.state_bucket will be created
  + resource "github_actions_variable" "state_bucket" {
      + created_at    = (known after apply)
      + id            = (known after apply)
      + repository    = "aws-service-infrahouse-app"
      + updated_at    = (known after apply)
      + value         = "infrahouse-github-control-aws-service-infrahouse-app"
      + variable_name = "STATE_BUCKET"
    }

  # module.aws_service_infrahouse_app.github_branch_default.main will be created
  + resource "github_branch_default" "main" {
      + branch     = "main"
      + etag       = (known after apply)
      + id         = (known after apply)
      + rename     = false
      + repository = "aws-service-infrahouse-app"
    }

  # module.aws_service_infrahouse_app.github_repository.this will be created
  + resource "github_repository" "this" {
      + allow_auto_merge            = false
      + allow_merge_commit          = true
      + allow_rebase_merge          = true
      + allow_squash_merge          = true
      + allow_update_branch         = true
      + archived                    = false
      + default_branch              = (known after apply)
      + delete_branch_on_merge      = true
      + description                 = "AWS infrastructure for the InfraHouse product app"
      + etag                        = (known after apply)
      + full_name                   = (known after apply)
      + git_clone_url               = (known after apply)
      + has_downloads               = true
      + has_issues                  = true
      + has_projects                = true
      + has_wiki                    = true
      + html_url                    = (known after apply)
      + http_clone_url              = (known after apply)
      + id                          = (known after apply)
      + merge_commit_message        = "PR_TITLE"
      + merge_commit_title          = "MERGE_MESSAGE"
      + name                        = "aws-service-infrahouse-app"
      + node_id                     = (known after apply)
      + primary_language            = (known after apply)
      + private                     = (known after apply)
      + repo_id                     = (known after apply)
      + squash_merge_commit_message = "COMMIT_MESSAGES"
      + squash_merge_commit_title   = "COMMIT_OR_PR_TITLE"
      + ssh_clone_url               = (known after apply)
      + svn_url                     = (known after apply)
      + topics                      = (known after apply)
      + visibility                  = "private"
      + vulnerability_alerts        = true
      + web_commit_signoff_required = false

      + security_and_analysis (known after apply)

      + template {
          + include_all_branches = false
          + owner                = "infrahouse"
          + repository           = "terraform-root-template"
        }
    }

  # module.aws_service_infrahouse_app.github_repository_environment.cd["sandbox"] will be created
  + resource "github_repository_environment" "cd" {
      + can_admins_bypass   = true
      + environment         = "live-sandbox"
      + id                  = (known after apply)
      + prevent_self_review = false
      + repository          = "aws-service-infrahouse-app"
    }

  # module.aws_service_infrahouse_app.github_repository_environment.ci["sandbox"] will be created
  + resource "github_repository_environment" "ci" {
      + can_admins_bypass   = true
      + environment         = "continuous-integration-sandbox"
      + id                  = (known after apply)
      + prevent_self_review = false
      + repository          = "aws-service-infrahouse-app"
    }

  # module.aws_service_infrahouse_app.github_repository_file.codeowners[0] will be created
  + resource "github_repository_file" "codeowners" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = "main"
      + commit_message               = "Update CODEOWNERS"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            # This file is managed by Terraform in github-control repository
            # Do not edit this file, all changes will be overwritten
            
            * @infrahouse/developers
            environments/*/releases.auto.tfvars @infrahouse/admins
            .github/workflows/** @infrahouse/admins
        EOT
      + file                         = ".github/CODEOWNERS"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_file.releases_auto_tfvars["sandbox"] will be created
  + resource "github_repository_file" "releases_auto_tfvars" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = "main"
      + commit_message               = "Add releases.auto.tfvars for sandbox environment"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            # Release-managed values — bumped by CI pipelines or release managers.
            # This file is owned by the service repo, not github-control.
            docker_image_tag = "latest"
        EOT
      + file                         = "environments/sandbox/releases.auto.tfvars"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_file.secrets_scanner[0] will be created
  + resource "github_repository_file" "secrets_scanner" {
      + autocreate_branch_source_sha = (known after apply)
      + commit_message               = "Add secrets-scanner.yml workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            # This file is managed by Terraform in github-control repository
            # Do not edit this file, all changes will be overwritten
            ---
            name: Leaked Secrets Scan
            on:  # yamllint disable-line rule:truthy
              pull_request:
              merge_group:
                branches: [main]
            
            jobs:
              TruffleHog:
                runs-on: ubuntu-latest
                steps:
                  - name: Checkout code
                    uses: actions/checkout@v6
                    with:
                      fetch-depth: 0
                  - name: TruffleHog OSS
                    uses: trufflesecurity/trufflehog@main
                    with:
                      path: ./
                      base: ${{ github.event.repository.default_branch }}
                      head: HEAD
                      extra_args: --only-verified
        EOT
      + file                         = ".github/workflows/secrets-scanner.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_file.terraform_drift[0] will be created
  + resource "github_repository_file" "terraform_drift" {
      + autocreate_branch_source_sha = (known after apply)
      + commit_message               = "Add terraform-drift.yml workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            ---
            name: "Terraform Drift Detection"
            
            on:  # yamllint disable-line rule:truthy
              workflow_call:
                inputs:
                  env:
                    type: "string"
                    required: true
            
            permissions:
              id-token: "write"  # This is required for requesting the JWT
              contents: "write"
              pull-requests: "write"
              issues: "write"  # Required to create and apply labels
            
            concurrency:
              group: "terraform-drift-${{ inputs.env }}"
              cancel-in-progress: false
            
            jobs:
              terraform-drift:
                name: "Terraform Drift Detection"
                runs-on: ubuntu-24.04
                environment: "continuous-integration-${{ inputs.env }}"
                timeout-minutes: 15
                env:
                  GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
                  REGION_JSON: "${{ vars.AWS_DEFAULT_REGION }}"
            
                defaults:
                  run:
                    shell: "bash"
                    working-directory: "environments/${{ inputs.env }}"
            
                steps:
                  - name: "Checkout"
                    uses: "actions/checkout@v6"
            
                  - name: "Extract Variables"
                    id: "extract_vars"
                    env:
                      REGION_JSON_CONTENT: ${{ env.REGION_JSON }}
                      TARGET_ENV: ${{ inputs.env }}
                    run: |
                      REGION=$(echo "$REGION_JSON_CONTENT" | jq -r ".${TARGET_ENV}")
                      echo "REGION=$REGION" >> "$GITHUB_OUTPUT"
            
                  - name: "Configure AWS Credentials"
                    uses: "aws-actions/configure-aws-credentials@v6"
                    with:
                      role-to-assume: "${{ vars.ROLE_GITHUB }}"
                      role-session-name: "github-actions-${{ inputs.env }}"
                      aws-region: "${{ steps.extract_vars.outputs.REGION }}"
            
                  - name: "Set Terraform version"
                    id: "terraform_version"
                    run: |
                      echo "IH_TF_VERSION=$(cat .terraform-version)" >> "$GITHUB_OUTPUT"
            
                  - name: "Setup Terraform"
                    uses: "hashicorp/setup-terraform@v4"
                    with:
                      terraform_version: "${{ steps.terraform_version.outputs.IH_TF_VERSION }}"
            
                  - name: "Set up Python"
                    uses: "actions/setup-python@v6"
                    with:
                      python-version: "3.14"
            
                  - name: "Setup Python Environment"
                    run: |
                      make bootstrap-ci
            
                  - name: "Terraform Init"
                    run: |
                      terraform init -input=false
            
                  - name: "Check if any changes are planned"
                    id: "check_drift"
                    run: |
                      terraform plan -no-color -input=false -detailed-exitcode
            
                  - name: Cleanup working dir
                    run: git clean -df
            
                  - name: "Record Config Drift Log Entry"
                    if: "steps.check_drift.outputs.exitcode == 2"
                    run: |
                      git \
                      -c user.name="${{ github.actor }}" \
                      -c user.email="${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com" \
                      commit -m "Reconcile configuration drift" --allow-empty
            
                  - name: "Check for open PR with label"
                    id: "check_label"
                    if: "steps.check_drift.outputs.exitcode == 2"
                    run: |
                      LABEL="config-drift"
                      REPO="${{ github.repository }}"
                      COUNT=$(gh pr list --repo "$REPO" --label "$LABEL" --state open --json number --jq 'length')
                      echo "Found $COUNT open PR(s) with label '$LABEL'"
                      if [[ $COUNT -gt 0 ]]; then
                        echo "label_exists=true" >> $GITHUB_OUTPUT
                      else
                        echo "label_exists=false" >> $GITHUB_OUTPUT
                      fi
            
                  - name: "Create Pull Request"
                    if: "steps.check_label.outputs.label_exists == 'false'"
                    uses: "peter-evans/create-pull-request@v8"
                    with:
                      token: "${{ steps.app-token.outputs.token }}"
                      base: "main"
                      branch: "create-pull-request/config-drift"
                      title: "[config-drift] Reconcile Terraform configuration drift in ${{ inputs.env }}"
                      commit-message: "[config-drift] Configuration drift record for ${{ inputs.env }}"
                      team-reviewers: "devops-members"
                      labels: |
                        config-drift
        EOT
      + file                         = ".github/workflows/terraform-drift.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_file.terraform_drift_wrapper[0] will be created
  + resource "github_repository_file" "terraform_drift_wrapper" {
      + autocreate_branch_source_sha = (known after apply)
      + commit_message               = "Add terraform-drift-wrapper.yml workflow"
      + commit_sha                   = (known after apply)
      + content                      = (known after apply)
      + file                         = ".github/workflows/terraform-drift-wrapper.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_file.terraform_tf["sandbox"] will be created
  + resource "github_repository_file" "terraform_tf" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = "main"
      + commit_message               = "Add terraform.tf for sandbox environment"
      + commit_sha                   = (known after apply)
      + content                      = (known after apply)
      + file                         = "environments/sandbox/terraform.tf"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_file.terraform_tfvars["sandbox"] will be created
  + resource "github_repository_file" "terraform_tfvars" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = "main"
      + commit_message               = "Add terraform.tfvars for sandbox environment"
      + commit_sha                   = (known after apply)
      + content                      = (known after apply)
      + file                         = "environments/sandbox/terraform.tfvars"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_file.vuln_scanner[0] will be created
  + resource "github_repository_file" "vuln_scanner" {
      + autocreate_branch_source_sha = (known after apply)
      + commit_message               = "Add vuln-scanner-pr.yml workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            # This file is managed by Terraform in github-control repository
            # Do not edit this file, all changes will be overwritten
            ---
            name: OSV-Scanner PR Scan
            
            on:  # yamllint disable-line rule:truthy
              pull_request:
                branches: [main]
              merge_group:
                branches: [main]
            
            permissions:
              contents: read
              pull-requests: write
            
            env:
              GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
            
            jobs:
              vulnerability-check:
                runs-on: ubuntu-24.04
                steps:
                  - uses: actions/checkout@v6
                  - name: Detect vulnerabilities
                    run: |
                      if [ -n "${{ github.event.pull_request.number }}" ]; then
                        ih-github scan \
                        --repo ${{ github.repository }} \
                        --pull-request ${{ github.event.pull_request.number }}
                      else
                        ih-github scan
                      fi
            
              sast-check:
                runs-on: ubuntu-24.04
                steps:
                  - uses: actions/checkout@v6
                  - name: Set up Python
                    uses: actions/setup-python@v6
                    with:
                      python-version: "3.14"
            
                  - name: SAST
                    run: |
                      pip install --upgrade semgrep
                      if [ -n "${{ github.event.pull_request.number }}" ]; then
                        ih-github run \
                        ${{ github.repository }} \
                        ${{ github.event.pull_request.number }} \
                        semgrep scan --error
                      else
                        semgrep scan --error
                      fi
        EOT
      + file                         = ".github/workflows/vuln-scanner-pr.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_ruleset.main will be created
  + resource "github_repository_ruleset" "main" {
      + enforcement = "active"
      + etag        = (known after apply)
      + id          = (known after apply)
      + name        = "Main Branch Protection"
      + node_id     = (known after apply)
      + repository  = "aws-service-infrahouse-app"
      + ruleset_id  = (known after apply)
      + target      = "branch"

      + bypass_actors {
          + actor_id    = 1016363
          + actor_type  = "Integration"
          + bypass_mode = "always"
        }

      + conditions {
          + ref_name {
              + exclude = []
              + include = [
                  + "~DEFAULT_BRANCH",
                ]
            }
        }

      + rules {
          + update_allows_fetch_and_merge = false

          + pull_request {
              + dismiss_stale_reviews_on_push     = true
              + require_code_owner_review         = true
              + require_last_push_approval        = false
              + required_approving_review_count   = 1
              + required_review_thread_resolution = false
            }

          + required_status_checks {
              + do_not_enforce_on_create             = false
              + strict_required_status_checks_policy = true

              + required_check {
                  + context        = "Terraform Plan sandbox"
                  + integration_id = 0
                }
              + required_check {
                  + context        = "TruffleHog"
                  + integration_id = 0
                }
              + required_check {
                  + context        = "vulnerability-check"
                  + integration_id = 0
                }
            }
        }
    }

  # module.aws_service_infrahouse_app.github_team_repository.admins["admins"] will be created
  + resource "github_team_repository" "admins" {
      + etag       = (known after apply)
      + id         = (known after apply)
      + permission = "admin"
      + repository = "aws-service-infrahouse-app"
      + team_id    = "14268696"
    }

  # module.aws_service_infrahouse_app.github_team_repository.committers["developers"] will be created
  + resource "github_team_repository" "committers" {
      + etag       = (known after apply)
      + id         = (known after apply)
      + permission = "push"
      + repository = "aws-service-infrahouse-app"
      + team_id    = "7332815"
    }

  # module.aws_service_infrahouse_app.random_integer.minute will be created
  + resource "random_integer" "minute" {
      + id     = (known after apply)
      + max    = 59
      + min    = 0
      + result = (known after apply)
    }

  # module.aws_service_infrahouse_app_gha_sandbox.data.aws_iam_policy_document.admin-trust will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "admin-trust" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions = [
              + "sts:AssumeRole",
            ]

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.aws_service_infrahouse_app_gha_sandbox.data.aws_iam_policy_document.github-permissions will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "github-permissions" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions   = [
              + "sts:AssumeRole",
            ]
          + resources = [
              + (known after apply),
              + (known after apply),
            ]
        }
    }

  # module.aws_service_infrahouse_app_gha_sandbox.aws_iam_policy.github will be created
  + resource "aws_iam_policy" "github" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + id               = (known after apply)
      + name             = (known after apply)
      + name_prefix      = "ih-tf-aws-service-infrahouse-app-github"
      + path             = "/"
      + policy           = (known after apply)
      + policy_id        = (known after apply)
      + tags             = {
          + "created_by_module" = "infrahouse/gha-admin/aws"
        }
      + tags_all         = {
          + "created_by"        = "infrahouse8/github-control"
          + "created_by_module" = "infrahouse/gha-admin/aws"
        }
    }

  # module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role.admin will be created
  + resource "aws_iam_role" "admin" {
      + arn                   = (known after apply)
      + assume_role_policy    = (known after apply)
      + create_date           = (known after apply)
      + description           = "Role to manage AWS account"
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 43200
      + name                  = "ih-tf-aws-service-infrahouse-app-admin"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags                  = {
          + "created_by_module" = "infrahouse/gha-admin/aws"
          + "module_version"    = "3.6.1"
        }
      + tags_all              = {
          + "created_by"        = "infrahouse8/github-control"
          + "created_by_module" = "infrahouse/gha-admin/aws"
          + "module_version"    = "3.6.1"
        }
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role.github will be created
  + resource "aws_iam_role" "github" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRoleWithWebIdentity"
                      + Condition = {
                          + StringEquals = {
                              + "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
                            }
                          + StringLike   = {
                              + "token.actions.githubusercontent.com:sub" = "repo:infrahouse/aws-service-infrahouse-app:*"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Federated = "arn:aws:iam::303467602807:oidc-provider/token.actions.githubusercontent.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "Role for a GitHub Actions runner in repo aws-service-infrahouse-app"
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 43200
      + name                  = "ih-tf-aws-service-infrahouse-app-github"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags                  = {
          + "created_by_module" = "infrahouse/gha-admin/aws"
        }
      + tags_all              = {
          + "created_by"        = "infrahouse8/github-control"
          + "created_by_module" = "infrahouse/gha-admin/aws"
        }
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role_policy_attachment.admin will be created
  + resource "aws_iam_role_policy_attachment" "admin" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
      + role       = "ih-tf-aws-service-infrahouse-app-admin"
    }

  # module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role_policy_attachment.github will be created
  + resource "aws_iam_role_policy_attachment" "github" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "ih-tf-aws-service-infrahouse-app-github"
    }

  # module.aws_service_infrahouse_app_state.data.aws_iam_policy_document.enforce_ssl_policy will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "enforce_ssl_policy" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions   = [
              + "s3:*",
            ]
          + effect    = "Deny"
          + resources = [
              + (known after apply),
              + (known after apply),
            ]
          + sid       = "AllowSSLRequestsOnly"

          + condition {
              + test     = "Bool"
              + values   = [
                  + "false",
                ]
              + variable = "aws:SecureTransport"
            }

          + principals {
              + identifiers = [
                  + "*",
                ]
              + type        = "*"
            }
        }
    }

  # module.aws_service_infrahouse_app_state.aws_dynamodb_table.terraform_locks will be created
  + resource "aws_dynamodb_table" "terraform_locks" {
      + arn              = (known after apply)
      + billing_mode     = "PAY_PER_REQUEST"
      + hash_key         = "LockID"
      + id               = (known after apply)
      + name             = (known after apply)
      + read_capacity    = (known after apply)
      + region           = "us-west-1"
      + stream_arn       = (known after apply)
      + stream_label     = (known after apply)
      + stream_view_type = (known after apply)
      + tags             = {
          + "VantaNoAlert"      = "Table used for Terraform state lock and does not contain user data"
          + "created_by_module" = "infrahouse/state-bucket/aws"
          + "state_bucket"      = "infrahouse-github-control-aws-service-infrahouse-app"
        }
      + tags_all         = {
          + "VantaNoAlert"      = "Table used for Terraform state lock and does not contain user data"
          + "created_by"        = "infrahouse8/github-control"
          + "created_by_module" = "infrahouse/state-bucket/aws"
          + "state_bucket"      = "infrahouse-github-control-aws-service-infrahouse-app"
        }
      + write_capacity   = (known after apply)

      + attribute {
          + name = "LockID"
          + type = "S"
        }

      + global_secondary_index (known after apply)

      + global_table_witness (known after apply)

      + point_in_time_recovery (known after apply)

      + server_side_encryption (known after apply)

      + ttl (known after apply)

      + warm_throughput (known after apply)
    }

  # module.aws_service_infrahouse_app_state.aws_s3_bucket.state-bucket will be created
  + resource "aws_s3_bucket" "state-bucket" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "infrahouse-github-control-aws-service-infrahouse-app"
      + bucket_domain_name          = (known after apply)
      + bucket_namespace            = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_region               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = "us-west-1"
      + request_payer               = (known after apply)
      + tags                        = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # module.aws_service_infrahouse_app_state.aws_s3_bucket_policy.state-bucke will be created
  + resource "aws_s3_bucket_policy" "state-bucke" {
      + bucket = (known after apply)
      + id     = (known after apply)
      + policy = (known after apply)
      + region = "us-west-1"
    }

  # module.aws_service_infrahouse_app_state.aws_s3_bucket_public_access_block.public_access will be created
  + resource "aws_s3_bucket_public_access_block" "public_access" {
      + block_public_acls       = true
      + block_public_policy     = true
      + bucket                  = (known after apply)
      + id                      = (known after apply)
      + ignore_public_acls      = true
      + region                  = "us-west-1"
      + restrict_public_buckets = true
    }

  # module.aws_service_infrahouse_app_state.aws_s3_bucket_server_side_encryption_configuration.default will be created
  + resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
      + bucket = (known after apply)
      + id     = (known after apply)
      + region = "us-west-1"

      + rule {
          + blocked_encryption_types = (known after apply)
          + bucket_key_enabled       = (known after apply)

          + apply_server_side_encryption_by_default {
              + kms_master_key_id = (known after apply)
              + sse_algorithm     = "AES256"
            }
        }
    }

  # module.aws_service_infrahouse_app_state.aws_s3_bucket_versioning.enabled will be created
  + resource "aws_s3_bucket_versioning" "enabled" {
      + bucket = (known after apply)
      + id     = (known after apply)
      + region = "us-west-1"

      + versioning_configuration {
          + mfa_delete = (known after apply)
          + status     = "Enabled"
        }
    }

  # module.aws_service_infrahouse_app_state.random_pet.suffix will be created
  + resource "random_pet" "suffix" {
      + id        = (known after apply)
      + length    = 2
      + prefix    = "infrahouse-github-control-aws-service-infrahouse-app"
      + separator = "-"
    }

  # module.ih_8_repos["github-control"].github_actions_secret.secret["IH_GH_TF_APP_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "github-control:IH_GH_TF_APP_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-289256138624"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-289256138624:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-289256138624"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-289256138624:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-303467602807"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-303467602807:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-303467602807"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-303467602807:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-338531211565"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-338531211565:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-338531211565"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-338531211565:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-493370826424"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-493370826424:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-493370826424"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-493370826424:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["cookiecutter-github-control"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "cookiecutter-github-control:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["hiera-aws-sm"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "hiera-aws-sm:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["homebrew-infrahouse-toolkit"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "homebrew-infrahouse-toolkit:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["homebrew-infrahouse-toolkit"].github_actions_secret.secret["PAT_TOKEN"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "homebrew-infrahouse-toolkit:PAT_TOKEN"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-com"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-com:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-com"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-com:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-core"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-core:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-core"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-core:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-core"].github_actions_secret.secret["PYPI_API_TOKEN"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-core:PYPI_API_TOKEN"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-puppet-data"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-puppet-data:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-puppet-data"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-puppet-data:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-toolkit"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-toolkit:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-toolkit"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-toolkit:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-toolkit"].github_actions_secret.secret["CODACY_PROJECT_TOKEN"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-toolkit:CODACY_PROJECT_TOKEN"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-toolkit"].github_actions_secret.secret["HOMEBREW_TAP_TOKEN"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-toolkit:HOMEBREW_TAP_TOKEN"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-toolkit"].github_actions_secret.secret["PYPI_API_TOKEN"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-toolkit:PYPI_API_TOKEN"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-ubuntu-pro"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-ubuntu-pro:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-website-infra"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-website-infra:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-website-infra"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-website-infra:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["osv-scanner"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "osv-scanner:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["osv-scanner"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "osv-scanner:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["prometheus-elasticsearch-exporter"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "prometheus-elasticsearch-exporter:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["proxysql-sandbox"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "proxysql-sandbox:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["puppet-code"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "puppet-code:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["puppet-code"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "puppet-code:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["pytest-infrahouse"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "pytest-infrahouse:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["pytest-infrahouse"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "pytest-infrahouse:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["pytest-infrahouse"].github_actions_secret.secret["PYPI_API_TOKEN"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "pytest-infrahouse:PYPI_API_TOKEN"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-actions-runner"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-actions-runner:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-actions-runner"].github_actions_secret.secret["CI_TEST_TOKEN"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-actions-runner:CI_TEST_TOKEN"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-bookstack"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-bookstack:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-ci-cd"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-ci-cd:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-cloud-init"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-cloud-init:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-cloudcraft-role"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-cloudcraft-role:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-cost-alert"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-cost-alert:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-debian-repo"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-debian-repo:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-dms"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-dms:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-ecr"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-ecr:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-ecs"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-ecs:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-elasticsearch"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-elasticsearch:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-emrserverless"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-emrserverless:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-gh-identity-provider"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-gh-identity-provider:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-gha-admin"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-gha-admin:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-github-backup"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-github-backup:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-github-backup-configuration"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-github-backup-configuration:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-github-role"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-github-role:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-guardduty-configuration"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-guardduty-configuration:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-http-redirect"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-http-redirect:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-instance-profile"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-instance-profile:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-iso27001"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-iso27001:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-jumphost"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-jumphost:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-key"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-key:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-kibana"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-kibana:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-lambda-monitored"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-lambda-monitored:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-openclaw"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-openclaw:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-openvpn"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-openvpn:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-openvpn"].github_actions_secret.secret["OPENVPN_CLIENT_SECRET"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-openvpn:OPENVPN_CLIENT_SECRET"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-org-governance"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-org-governance:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-percona-server"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-percona-server:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-pmm-ecs"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-pmm-ecs:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-postfix"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-postfix:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-pypiserver"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-pypiserver:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-registry"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-registry:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-s3-bucket"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-s3-bucket:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-secret"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-secret:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-secret-policy"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-secret-policy:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-service-network"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-service-network:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-sqs-ecs"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-sqs-ecs:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-sqs-pod"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-sqs-pod:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-state-bucket"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-state-bucket:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-state-manager"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-state-manager:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-tags-override"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-tags-override:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-tcp-pod"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-tcp-pod:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-teleport"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-teleport:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-teleport-agent"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-teleport-agent:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-terraformer"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-terraformer:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-truststore"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-truststore:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-update-dns"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-update-dns:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-website-pod"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-website-pod:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.data.aws_iam_policy_document.assume will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "assume" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions = [
              + "sts:AssumeRole",
            ]
          + sid     = "000"

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.data.aws_iam_policy_document.permissions_rw will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "permissions_rw" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions   = [
              + "s3:DeleteObject",
              + "s3:PutObject",
            ]
          + resources = [
              + "arn:aws:s3:::infrahouse-github-control-aws-service-infrahouse-app/*.zip",
              + "arn:aws:s3:::infrahouse-github-control-aws-service-infrahouse-app/plans/*",
              + "arn:aws:s3:::infrahouse-github-control-aws-service-infrahouse-app/terraform.tfstate",
            ]
        }
      + statement {
          + actions   = [
              + "dynamodb:DeleteItem",
              + "dynamodb:DescribeTable",
              + "dynamodb:GetItem",
              + "dynamodb:PutItem",
            ]
          + resources = [
              + (known after apply),
            ]
        }
    }

  # module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_policy.permissions_ro will be created
  + resource "aws_iam_policy" "permissions_ro" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + id               = (known after apply)
      + name             = (known after apply)
      + name_prefix      = "ih-tf-aws-service-infrahouse-app-state-manager-ro"
      + path             = "/"
      + policy           = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = "s3:ListBucket"
                      + Effect   = "Allow"
                      + Resource = "arn:aws:s3:::infrahouse-github-control-aws-service-infrahouse-app"
                    },
                  + {
                      + Action   = "s3:GetObject"
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:s3:::infrahouse-github-control-aws-service-infrahouse-app/terraform.tfstate",
                          + "arn:aws:s3:::infrahouse-github-control-aws-service-infrahouse-app/plans/*",
                          + "arn:aws:s3:::infrahouse-github-control-aws-service-infrahouse-app/*.zip",
                        ]
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id        = (known after apply)
      + tags             = {
          + "created_by_module" = "infrahouse/state-manager/aws"
        }
      + tags_all         = {
          + "created_by"        = "infrahouse8/github-control"
          + "created_by_module" = "infrahouse/state-manager/aws"
        }
    }

  # module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_policy.permissions_rw will be created
  + resource "aws_iam_policy" "permissions_rw" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + id               = (known after apply)
      + name             = (known after apply)
      + name_prefix      = "ih-tf-aws-service-infrahouse-app-state-manager-rw"
      + path             = "/"
      + policy           = (known after apply)
      + policy_id        = (known after apply)
      + tags             = {
          + "created_by_module" = "infrahouse/state-manager/aws"
        }
      + tags_all         = {
          + "created_by"        = "infrahouse8/github-control"
          + "created_by_module" = "infrahouse/state-manager/aws"
        }
    }

  # module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_role.state-manager will be created
  + resource "aws_iam_role" "state-manager" {
      + arn                   = (known after apply)
      + assume_role_policy    = (known after apply)
      + create_date           = (known after apply)
      + description           = "Role to manage a terraform state of a repo"
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 43200
      + name                  = "ih-tf-aws-service-infrahouse-app-state-manager"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags                  = {
          + "created_by_module" = "infrahouse/state-manager/aws"
          + "module_version"    = "1.4.2"
        }
      + tags_all              = {
          + "created_by"        = "infrahouse8/github-control"
          + "created_by_module" = "infrahouse/state-manager/aws"
          + "module_version"    = "1.4.2"
        }
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_role_policy_attachment.state-manager-ro will be created
  + resource "aws_iam_role_policy_attachment" "state-manager-ro" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "ih-tf-aws-service-infrahouse-app-state-manager"
    }

  # module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_role_policy_attachment.state-manager-rw[0] will be created
  + resource "aws_iam_role_policy_attachment" "state-manager-rw" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "ih-tf-aws-service-infrahouse-app-state-manager"
    }

Plan: 38 to add, 90 to change, 0 to destroy.

Warning: Deprecated attribute

  on .terraform/modules/actions-runner-pem-493370826424-uw1/data_sources.tf line 11, in data "external" "secret_value":
  11:     "python", "${path.module}/assets/get_secret.py", data.aws_region.current.name, aws_secretsmanager_secret.secret.id, data.aws_iam_role.caller_role.arn

The attribute "name" is deprecated. Refer to the provider documentation for
details.

(and 5 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tf.plan

To perform exactly these actions, run the following command to apply:
    terraform apply "tf.plan"

eyJzMzovL2luZnJhaG91c2UtZ2l0aHViLWNvbnRyb2wtc3RhdGUvdGVycmFmb3JtLnRmc3RhdGUiOiB7InN1Y2Nlc3MiOiB0cnVlLCAiYWRkIjogMzgsICJjaGFuZ2UiOiA5MCwgImRlc3Ryb3kiOiAwfX0=