[PRMP-120] Downgraded terraform aws provider to latest version 4

[AndyFlintNHS]

No description provided.

[github-actions]

Report for environment: pre-prod

Terraform Format and Style 🖌success

Format Output

Terraform Initialization ⚙️success

Initialization Output

Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 4.0"...
- Installing hashicorp/aws v4.67.0...
- Installed hashicorp/aws v4.67.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Terraform Validation 🤖success

Validation Output

Success! The configuration is valid.

Terraform Plan 📖success

Show Plan (2 to add, 2 to change, 16 to destroy)

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
  - destroy
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_db_subnet_group.db-cluster-subnet-group will be destroyed
  # (because aws_db_subnet_group.db-cluster-subnet-group is not in configuration)
  - resource "aws_db_subnet_group" "db-cluster-subnet-group" {
      - arn         = "arn:aws:rds:eu-west-2:108148468272:subgrp:pre-prod-ehr-db-subnet-group" -> null
      - description = "Managed by Terraform" -> null
      - id          = "pre-prod-ehr-db-subnet-group" -> null
      - name        = "pre-prod-ehr-db-subnet-group" -> null
      - subnet_ids  = (sensitive value) -> null
      - tags        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
          - "Name"        = "pre-prod-ehr-db-subnet-group"
        } -> null
      - tags_all    = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
          - "Name"        = "pre-prod-ehr-db-subnet-group"
        } -> null
    }

  # aws_ecs_service.ecs-service will be updated in-place
  ~ resource "aws_ecs_service" "ecs-service" {
        id                                 = "arn:aws:ecs:eu-west-2:108148468272:service/pre-prod-ehr-repo-ecs-cluster/pre-prod-ehr-repo-service"
        name                               = "pre-prod-ehr-repo-service"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:eu-west-2:108148468272:task-definition/ehr-repo:179" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # aws_ecs_task_definition.task must be replaced
-/+ resource "aws_ecs_task_definition" "task" {
      ~ arn                      = "arn:aws:ecs:eu-west-2:108148468272:task-definition/ehr-repo:179" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:eu-west-2:108148468272:task-definition/ehr-repo" -> (known after apply)
      ~ container_definitions    = (sensitive value) # forces replacement
      ~ id                       = "ehr-repo" -> (known after apply)
      ~ revision                 = 179 -> (known after apply)
        tags                     = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "pre-prod"
        }
        # (11 unchanged attributes hidden)
    }

  # aws_kms_alias.ehr_repo_encryption will be destroyed
  # (because aws_kms_alias.ehr_repo_encryption is not in configuration)
  - resource "aws_kms_alias" "ehr_repo_encryption" {
      - arn            = "arn:aws:kms:eu-west-2:108148468272:alias/ehr-repo-encryption-kms-key" -> null
      - id             = "alias/ehr-repo-encryption-kms-key" -> null
      - name           = "alias/ehr-repo-encryption-kms-key" -> null
      - target_key_arn = "arn:aws:kms:eu-west-2:108148468272:key/487f6ebb-86d7-42fe-8295-2388792d848e" -> null
      - target_key_id  = "487f6ebb-86d7-42fe-8295-2388792d848e" -> null
        # (1 unchanged attribute hidden)
    }

  # aws_kms_key.ehr-repo-key will be destroyed
  # (because aws_kms_key.ehr-repo-key is not in configuration)
  - resource "aws_kms_key" "ehr-repo-key" {
      - arn                      = "arn:aws:kms:eu-west-2:108148468272:key/487f6ebb-86d7-42fe-8295-2388792d848e" -> null
      - customer_master_key_spec = "SYMMETRIC_DEFAULT" -> null
      - description              = "EHR repository KMS key in pre-prod environment" -> null
      - enable_key_rotation      = true -> null
      - id                       = "487f6ebb-86d7-42fe-8295-2388792d848e" -> null
      - is_enabled               = true -> null
      - key_id                   = "487f6ebb-86d7-42fe-8295-2388792d848e" -> null
      - key_usage                = "ENCRYPT_DECRYPT" -> null
      - multi_region             = false -> null
      - policy                   = jsonencode(
            {
              - Id        = "key-default-1"
              - Statement = [
                  - {
                      - Action    = "kms:*"
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::108148468272:root"
                        }
                      - Resource  = "*"
                      - Sid       = "Enable IAM User Permissions"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - tags                     = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
          - "Name"        = "pre-prod-ehr-repo-db"
        } -> null
      - tags_all                 = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
          - "Name"        = "pre-prod-ehr-repo-db"
        } -> null
    }

  # aws_rds_cluster.db-cluster will be destroyed
  # (because aws_rds_cluster.db-cluster is not in configuration)
  - resource "aws_rds_cluster" "db-cluster" {
      - allow_major_version_upgrade         = true -> null
      - apply_immediately                   = true -> null
      - arn                                 = "arn:aws:rds:eu-west-2:108148468272:cluster:pre-prod-ehr-db-cluster" -> null
      - availability_zones                  = [
          - "eu-west-2a",
          - "eu-west-2b",
          - "eu-west-2c",
        ] -> null
      - backtrack_window                    = 0 -> null
      - backup_retention_period             = 35 -> null
      - cluster_identifier                  = "pre-prod-ehr-db-cluster" -> null
      - cluster_members                     = [
          - "pre-prod-ehr-db-instance-0",
          - "pre-prod-ehr-db-instance-1",
          - "pre-prod-ehr-db-instance-2",
        ] -> null
      - cluster_resource_id                 = "cluster-JSHOKGBIHZ5WIAZ5VZU2VCM5SI" -> null
      - copy_tags_to_snapshot               = false -> null
      - database_name                       = "ehrdb" -> null
      - db_cluster_parameter_group_name     = (sensitive value) -> null
      - db_subnet_group_name                = "pre-prod-ehr-db-subnet-group" -> null
      - deletion_protection                 = true -> null
      - enable_global_write_forwarding      = false -> null
      - enable_http_endpoint                = false -> null
      - enabled_cloudwatch_logs_exports     = [] -> null
      - endpoint                            = "pre-prod-ehr-db-cluster.cluster-clctfuke1ykl.eu-west-2.rds.amazonaws.com" -> null
      - engine                              = "aurora-postgresql" -> null
      - engine_mode                         = "provisioned" -> null
      - engine_version                      = "13.12" -> null
      - engine_version_actual               = "13.12" -> null
      - hosted_zone_id                      = "Z1TTGA775OQIYO" -> null
      - iam_database_authentication_enabled = true -> null
      - iam_roles                           = [] -> null
      - id                                  = "pre-prod-ehr-db-cluster" -> null
      - kms_key_id                          = "arn:aws:kms:eu-west-2:108148468272:key/487f6ebb-86d7-42fe-8295-2388792d848e" -> null
      - master_password                     = (sensitive value) -> null
      - master_username                     = (sensitive value) -> null
      - port                                = 5432 -> null
      - preferred_backup_window             = "06:30-08:00" -> null
      - preferred_maintenance_window        = "thu:03:38-thu:04:08" -> null
      - reader_endpoint                     = "pre-prod-ehr-db-cluster.cluster-ro-clctfuke1ykl.eu-west-2.rds.amazonaws.com" -> null
      - skip_final_snapshot                 = true -> null
      - storage_encrypted                   = true -> null
      - tags                                = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
        } -> null
      - tags_all                            = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
        } -> null
      - vpc_security_group_ids              = [
          - "sg-0090301c2004582db",
          - "sg-0155911d730632c30",
          - "sg-0e7799c42da3e5404",
        ] -> null
        # (2 unchanged attributes hidden)
    }

  # aws_rds_cluster_instance.ehr-db-instances[0] will be destroyed
  # (because aws_rds_cluster_instance.ehr-db-instances is not in configuration)
  - resource "aws_rds_cluster_instance" "ehr-db-instances" {
      - arn                                   = "arn:aws:rds:eu-west-2:108148468272:db:pre-prod-ehr-db-instance-0" -> null
      - auto_minor_version_upgrade            = true -> null
      - availability_zone                     = "eu-west-2b" -> null
      - ca_cert_identifier                    = "rds-ca-ecc384-g1" -> null
      - cluster_identifier                    = "pre-prod-ehr-db-cluster" -> null
      - copy_tags_to_snapshot                 = false -> null
      - db_parameter_group_name               = "default.aurora-postgresql13" -> null
      - db_subnet_group_name                  = "pre-prod-ehr-db-subnet-group" -> null
      - dbi_resource_id                       = "db-CDECFICNSY5V7MZKKZUWNDS34I" -> null
      - endpoint                              = "pre-prod-ehr-db-instance-0.clctfuke1ykl.eu-west-2.rds.amazonaws.com" -> null
      - engine                                = "aurora-postgresql" -> null
      - engine_version                        = "13.12" -> null
      - engine_version_actual                 = "13.12" -> null
      - id                                    = "pre-prod-ehr-db-instance-0" -> null
      - identifier                            = "pre-prod-ehr-db-instance-0" -> null
      - instance_class                        = "db.t3.medium" -> null
      - kms_key_id                            = "arn:aws:kms:eu-west-2:108148468272:key/487f6ebb-86d7-42fe-8295-2388792d848e" -> null
      - monitoring_interval                   = 0 -> null
      - performance_insights_enabled          = false -> null
      - performance_insights_retention_period = 0 -> null
      - port                                  = 5432 -> null
      - preferred_backup_window               = "06:30-08:00" -> null
      - preferred_maintenance_window          = "wed:02:05-wed:02:35" -> null
      - promotion_tier                        = 0 -> null
      - publicly_accessible                   = false -> null
      - storage_encrypted                     = true -> null
      - tags                                  = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
        } -> null
      - tags_all                              = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
        } -> null
      - writer                                = true -> null
        # (2 unchanged attributes hidden)
    }

  # aws_rds_cluster_instance.ehr-db-instances[1] will be destroyed
  # (because aws_rds_cluster_instance.ehr-db-instances is not in configuration)
  - resource "aws_rds_cluster_instance" "ehr-db-instances" {
      - arn                                   = "arn:aws:rds:eu-west-2:108148468272:db:pre-prod-ehr-db-instance-1" -> null
      - auto_minor_version_upgrade            = true -> null
      - availability_zone                     = "eu-west-2a" -> null
      - ca_cert_identifier                    = "rds-ca-ecc384-g1" -> null
      - cluster_identifier                    = "pre-prod-ehr-db-cluster" -> null
      - copy_tags_to_snapshot                 = false -> null
      - db_parameter_group_name               = "default.aurora-postgresql13" -> null
      - db_subnet_group_name                  = "pre-prod-ehr-db-subnet-group" -> null
      - dbi_resource_id                       = "db-IH7LOSQMAAYNT4YFZGDL2UYD4E" -> null
      - endpoint                              = "pre-prod-ehr-db-instance-1.clctfuke1ykl.eu-west-2.rds.amazonaws.com" -> null
      - engine                                = "aurora-postgresql" -> null
      - engine_version                        = "13.12" -> null
      - engine_version_actual                 = "13.12" -> null
      - id                                    = "pre-prod-ehr-db-instance-1" -> null
      - identifier                            = "pre-prod-ehr-db-instance-1" -> null
      - instance_class                        = "db.t3.medium" -> null
      - kms_key_id                            = "arn:aws:kms:eu-west-2:108148468272:key/487f6ebb-86d7-42fe-8295-2388792d848e" -> null
      - monitoring_interval                   = 0 -> null
      - performance_insights_enabled          = false -> null
      - performance_insights_retention_period = 0 -> null
      - port                                  = 5432 -> null
      - preferred_backup_window               = "06:30-08:00" -> null
      - preferred_maintenance_window          = "sat:22:00-sat:22:30" -> null
      - promotion_tier                        = 0 -> null
      - publicly_accessible                   = false -> null
      - storage_encrypted                     = true -> null
      - tags                                  = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
        } -> null
      - tags_all                              = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
        } -> null
      - writer                                = false -> null
        # (2 unchanged attributes hidden)
    }

  # aws_rds_cluster_instance.ehr-db-instances[2] will be destroyed
  # (because aws_rds_cluster_instance.ehr-db-instances is not in configuration)
  - resource "aws_rds_cluster_instance" "ehr-db-instances" {
      - arn                                   = "arn:aws:rds:eu-west-2:108148468272:db:pre-prod-ehr-db-instance-2" -> null
      - auto_minor_version_upgrade            = true -> null
      - availability_zone                     = "eu-west-2c" -> null
      - ca_cert_identifier                    = "rds-ca-ecc384-g1" -> null
      - cluster_identifier                    = "pre-prod-ehr-db-cluster" -> null
      - copy_tags_to_snapshot                 = false -> null
      - db_parameter_group_name               = "default.aurora-postgresql13" -> null
      - db_subnet_group_name                  = "pre-prod-ehr-db-subnet-group" -> null
      - dbi_resource_id                       = "db-EQRZ4NG2MLXEOUDCOYCTKBKI5A" -> null
      - endpoint                              = "pre-prod-ehr-db-instance-2.clctfuke1ykl.eu-west-2.rds.amazonaws.com" -> null
      - engine                                = "aurora-postgresql" -> null
      - engine_version                        = "13.12" -> null
      - engine_version_actual                 = "13.12" -> null
      - id                                    = "pre-prod-ehr-db-instance-2" -> null
      - identifier                            = "pre-prod-ehr-db-instance-2" -> null
      - instance_class                        = "db.t3.medium" -> null
      - kms_key_id                            = "arn:aws:kms:eu-west-2:108148468272:key/487f6ebb-86d7-42fe-8295-2388792d848e" -> null
      - monitoring_interval                   = 0 -> null
      - performance_insights_enabled          = false -> null
      - performance_insights_retention_period = 0 -> null
      - port                                  = 5432 -> null
      - preferred_backup_window               = "06:30-08:00" -> null
      - preferred_maintenance_window          = "mon:02:38-mon:03:08" -> null
      - promotion_tier                        = 0 -> null
      - publicly_accessible                   = false -> null
      - storage_encrypted                     = true -> null
      - tags                                  = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
        } -> null
      - tags_all                              = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
        } -> null
      - writer                                = false -> null
        # (2 unchanged attributes hidden)
    }

  # aws_s3_bucket_logging.ehr-repo-bucket will be created
  + resource "aws_s3_bucket_logging" "ehr-repo-bucket" {
      + bucket        = "pre-prod-ehr-repo-bucket"
      + id            = (known after apply)
      + target_bucket = "pre-prod-ehr-repo-access-logs"
      + target_prefix = "s3-access-log/"
    }

  # aws_s3_bucket_policy.ehr_repo_permit_developer_to_see_access_logs_policy[0] will be updated in-place
  ~ resource "aws_s3_bucket_policy" "ehr_repo_permit_developer_to_see_access_logs_policy" {
        id     = "pre-prod-ehr-repo-access-logs"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Action    = [
                          - "s3:Get*",
                          - "s3:ListBucket",
                        ] -> "s3:PutObject"
                      ~ Principal = {
                          - AWS     = "arn:aws:iam::108148468272:role/RepoDeveloper"
                          + Service = "logging.s3.amazonaws.com"
                        }
                      ~ Resource  = [
                          - "arn:aws:s3:::pre-prod-ehr-repo-access-logs",
                          - "arn:aws:s3:::pre-prod-ehr-repo-access-logs/*",
                        ] -> "arn:aws:s3:::pre-prod-ehr-repo-access-logs/s3-access-log/*"
                      + Sid       = "S3ServerAccessLogsPolicy"
                        # (2 unchanged attributes hidden)
                    },
                  + {
                      + Action    = [
                          + "s3:Get*",
                          + "s3:ListBucket",
                        ]
                      + Condition = {
                          + Bool = {
                              + "aws:SecureTransport" = "false"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::108148468272:role/RepoDeveloper"
                        }
                      + Resource  = [
                          + "arn:aws:s3:::pre-prod-ehr-repo-access-logs",
                          + "arn:aws:s3:::pre-prod-ehr-repo-access-logs/*",
                        ]
                      + Sid       = "S3PermitDeveloperAccessLogsPolicy"
                    },
                ]
              ~ Version   = "2008-10-17" -> "2012-10-17"
            }
        )
        # (1 unchanged attribute hidden)
    }

  # aws_s3_bucket_policy.ehr_repo_permit_s3_to_write_access_logs_policy will be destroyed
  # (because aws_s3_bucket_policy.ehr_repo_permit_s3_to_write_access_logs_policy is not in configuration)
  - resource "aws_s3_bucket_policy" "ehr_repo_permit_s3_to_write_access_logs_policy" {
      - bucket = "pre-prod-ehr-repo-access-logs" -> null
      - id     = "pre-prod-ehr-repo-access-logs" -> null
      - policy = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "s3:PutObject"
                      - Condition = {
                          - Bool = {
                              - "aws:SecureTransport" = "false"
                            }
                        }
                      - Effect    = "Allow"
                      - Principal = {
                          - Service = "logging.s3.amazonaws.com"
                        }
                      - Resource  = "arn:aws:s3:::pre-prod-ehr-repo-access-logs/s3-access-log/*"
                      - Sid       = "S3ServerAccessLogsPolicy"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
    }

  # aws_security_group.ehr_repo_to_db_sg will be destroyed
  # (because aws_security_group.ehr_repo_to_db_sg is not in configuration)
  - resource "aws_security_group" "ehr_repo_to_db_sg" {
      - arn                    = "arn:aws:ec2:eu-west-2:108148468272:security-group/sg-0e7799c42da3e5404" -> null
      - description            = "Managed by Terraform" -> null
      - egress                 = [] -> null
      - id                     = "sg-0e7799c42da3e5404" -> null
      - ingress                = [
          - {
              - cidr_blocks      = []
              - description      = "Allow traffic from ehr-repo to the db"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0dff35434cccfa342",
                ]
              - self             = false
              - to_port          = 5432
            },
        ] -> null
      - name                   = "pre-prod-ehr-repo-ecs-to-ehr-repo-db-sg" -> null
      - owner_id               = "108148468272" -> null
      - revoke_rules_on_delete = false -> null
      - tags                   = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
          - "Name"        = "pre-prod-ehr-repo-ecs-to-ehr-repo-db-sg"
        } -> null
      - tags_all               = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
          - "Name"        = "pre-prod-ehr-repo-ecs-to-ehr-repo-db-sg"
        } -> null
      - vpc_id                 = (sensitive value) -> null
        # (1 unchanged attribute hidden)
    }

  # aws_security_group.gocd_to_db_sg will be destroyed
  # (because aws_security_group.gocd_to_db_sg is not in configuration)
  - resource "aws_security_group" "gocd_to_db_sg" {
      - arn                    = "arn:aws:ec2:eu-west-2:108148468272:security-group/sg-0155911d730632c30" -> null
      - description            = "Managed by Terraform" -> null
      - egress                 = [] -> null
      - id                     = "sg-0155911d730632c30" -> null
      - ingress                = (sensitive value) -> null
      - name                   = "pre-prod-gocd-to-ehr-repo-db-sg" -> null
      - owner_id               = "108148468272" -> null
      - revoke_rules_on_delete = false -> null
      - tags                   = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
          - "Name"        = "pre-prod-gocd-to-ehr-repo-db-sg"
        } -> null
      - tags_all               = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
          - "Name"        = "pre-prod-gocd-to-ehr-repo-db-sg"
        } -> null
      - vpc_id                 = (sensitive value) -> null
        # (1 unchanged attribute hidden)
    }

  # aws_security_group.vpn_to_db_sg will be destroyed
  # (because aws_security_group.vpn_to_db_sg is not in configuration)
  - resource "aws_security_group" "vpn_to_db_sg" {
      - arn                    = "arn:aws:ec2:eu-west-2:108148468272:security-group/sg-0090301c2004582db" -> null
      - description            = "Managed by Terraform" -> null
      - egress                 = [] -> null
      - id                     = "sg-0090301c2004582db" -> null
      - ingress                = [
          - {
              - cidr_blocks      = []
              - description      = "Allow traffic from VPN to the db"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0fb81c4397e9bc16e",
                ]
              - self             = false
              - to_port          = 5432
            },
        ] -> null
      - name                   = "pre-prod-vpn-to-ehr-repo-db-sg" -> null
      - owner_id               = "108148468272" -> null
      - revoke_rules_on_delete = false -> null
      - tags                   = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
          - "Name"        = "pre-prod-vpn-to-ehr-repo-db-sg"
        } -> null
      - tags_all               = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
          - "Name"        = "pre-prod-vpn-to-ehr-repo-db-sg"
        } -> null
      - vpc_id                 = (sensitive value) -> null
        # (1 unchanged attribute hidden)
    }

  # aws_security_group_rule.vpn_to_db_sg[0] will be destroyed
  # (because aws_security_group_rule.vpn_to_db_sg is not in configuration)
  - resource "aws_security_group_rule" "vpn_to_db_sg" {
      - cidr_blocks              = [] -> null
      - description              = "Allow traffic from VPN to the db" -> null
      - from_port                = 5432 -> null
      - id                       = "sgrule-3903434226" -> null
      - ipv6_cidr_blocks         = [] -> null
      - prefix_list_ids          = [] -> null
      - protocol                 = "tcp" -> null
      - security_group_id        = "sg-0090301c2004582db" -> null
      - self                     = false -> null
      - source_security_group_id = (sensitive value) -> null
      - to_port                  = 5432 -> null
      - type                     = "ingress" -> null
    }

  # aws_ssm_parameter.db_host will be destroyed
  # (because aws_ssm_parameter.db_host is not in configuration)
  - resource "aws_ssm_parameter" "db_host" {
      - arn             = "arn:aws:ssm:eu-west-2:108148468272:parameter/repo/pre-prod/output/prm-deductions-ehr-repository/db-host" -> null
      - data_type       = "text" -> null
      - id              = "/repo/pre-prod/output/prm-deductions-ehr-repository/db-host" -> null
      - name            = "/repo/pre-prod/output/prm-deductions-ehr-repository/db-host" -> null
      - tags            = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
        } -> null
      - tags_all        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
        } -> null
      - tier            = "Standard" -> null
      - type            = "String" -> null
      - value           = (sensitive value) -> null
      - version         = 1 -> null
        # (3 unchanged attributes hidden)
    }

  # aws_ssm_parameter.db_name will be destroyed
  # (because aws_ssm_parameter.db_name is not in configuration)
  - resource "aws_ssm_parameter" "db_name" {
      - arn             = "arn:aws:ssm:eu-west-2:108148468272:parameter/repo/pre-prod/output/prm-deductions-ehr-repository/db-name" -> null
      - data_type       = "text" -> null
      - id              = "/repo/pre-prod/output/prm-deductions-ehr-repository/db-name" -> null
      - name            = "/repo/pre-prod/output/prm-deductions-ehr-repository/db-name" -> null
      - tags            = {} -> null
      - tags_all        = {} -> null
      - tier            = "Standard" -> null
      - type            = "String" -> null
      - value           = (sensitive value) -> null
      - version         = 1 -> null
        # (3 unchanged attributes hidden)
    }

  # aws_ssm_parameter.db_resource_cluster_id will be destroyed
  # (because aws_ssm_parameter.db_resource_cluster_id is not in configuration)
  - resource "aws_ssm_parameter" "db_resource_cluster_id" {
      - arn             = "arn:aws:ssm:eu-west-2:108148468272:parameter/repo/pre-prod/output/prm-deductions-ehr-repository/db-resource-cluster-id" -> null
      - data_type       = "text" -> null
      - id              = "/repo/pre-prod/output/prm-deductions-ehr-repository/db-resource-cluster-id" -> null
      - name            = "/repo/pre-prod/output/prm-deductions-ehr-repository/db-resource-cluster-id" -> null
      - tags            = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
        } -> null
      - tags_all        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "pre-prod"
        } -> null
      - tier            = "Standard" -> null
      - type            = "String" -> null
      - value           = (sensitive value) -> null
      - version         = 2 -> null
        # (3 unchanged attributes hidden)
    }

Plan: 2 to add, 2 to change, 16 to destroy.

[github-actions]

Report for environment: dev

Terraform Format and Style 🖌success

Format Output

Terraform Initialization ⚙️success

Initialization Output

Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 4.0"...
- Installing hashicorp/aws v4.67.0...
- Installed hashicorp/aws v4.67.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Terraform Validation 🤖success

Validation Output

Success! The configuration is valid.

Terraform Plan 📖success

Show Plan (1 to add, 1 to change, 14 to destroy)

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
  - destroy
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_db_subnet_group.db-cluster-subnet-group will be destroyed
  # (because aws_db_subnet_group.db-cluster-subnet-group is not in configuration)
  - resource "aws_db_subnet_group" "db-cluster-subnet-group" {
      - arn         = "arn:aws:rds:eu-west-2:416874859154:subgrp:dev-ehr-db-subnet-group" -> null
      - description = "Managed by Terraform" -> null
      - id          = "dev-ehr-db-subnet-group" -> null
      - name        = "dev-ehr-db-subnet-group" -> null
      - subnet_ids  = (sensitive value) -> null
      - tags        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
          - "Name"        = "dev-ehr-db-subnet-group"
        } -> null
      - tags_all    = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
          - "Name"        = "dev-ehr-db-subnet-group"
        } -> null
    }

  # aws_ecs_service.ecs-service will be updated in-place
  ~ resource "aws_ecs_service" "ecs-service" {
        id                                 = "arn:aws:ecs:eu-west-2:416874859154:service/dev-ehr-repo-ecs-cluster/dev-ehr-repo-service"
        name                               = "dev-ehr-repo-service"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:eu-west-2:416874859154:task-definition/ehr-repo:297" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # aws_ecs_task_definition.task must be replaced
-/+ resource "aws_ecs_task_definition" "task" {
      ~ arn                      = "arn:aws:ecs:eu-west-2:416874859154:task-definition/ehr-repo:297" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:eu-west-2:416874859154:task-definition/ehr-repo" -> (known after apply)
      ~ container_definitions    = (sensitive value) # forces replacement
      ~ id                       = "ehr-repo" -> (known after apply)
      ~ revision                 = 297 -> (known after apply)
        tags                     = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "dev"
        }
        # (11 unchanged attributes hidden)
    }

  # aws_kms_alias.ehr_repo_encryption will be destroyed
  # (because aws_kms_alias.ehr_repo_encryption is not in configuration)
  - resource "aws_kms_alias" "ehr_repo_encryption" {
      - arn            = "arn:aws:kms:eu-west-2:416874859154:alias/ehr-repo-encryption-kms-key" -> null
      - id             = "alias/ehr-repo-encryption-kms-key" -> null
      - name           = "alias/ehr-repo-encryption-kms-key" -> null
      - target_key_arn = "arn:aws:kms:eu-west-2:416874859154:key/7c9a3d1b-895e-4387-889f-f68b736e8d3d" -> null
      - target_key_id  = "7c9a3d1b-895e-4387-889f-f68b736e8d3d" -> null
        # (1 unchanged attribute hidden)
    }

  # aws_kms_key.ehr-repo-key will be destroyed
  # (because aws_kms_key.ehr-repo-key is not in configuration)
  - resource "aws_kms_key" "ehr-repo-key" {
      - arn                      = "arn:aws:kms:eu-west-2:416874859154:key/7c9a3d1b-895e-4387-889f-f68b736e8d3d" -> null
      - customer_master_key_spec = "SYMMETRIC_DEFAULT" -> null
      - description              = "EHR repository KMS key in dev environment" -> null
      - enable_key_rotation      = true -> null
      - id                       = "7c9a3d1b-895e-4387-889f-f68b736e8d3d" -> null
      - is_enabled               = true -> null
      - key_id                   = "7c9a3d1b-895e-4387-889f-f68b736e8d3d" -> null
      - key_usage                = "ENCRYPT_DECRYPT" -> null
      - multi_region             = false -> null
      - policy                   = jsonencode(
            {
              - Id        = "key-default-1"
              - Statement = [
                  - {
                      - Action    = "kms:*"
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::416874859154:root"
                        }
                      - Resource  = "*"
                      - Sid       = "Enable IAM User Permissions"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - tags                     = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
          - "Name"        = "dev-ehr-repo-db"
        } -> null
      - tags_all                 = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
          - "Name"        = "dev-ehr-repo-db"
        } -> null
    }

  # aws_rds_cluster.db-cluster will be destroyed
  # (because aws_rds_cluster.db-cluster is not in configuration)
  - resource "aws_rds_cluster" "db-cluster" {
      - allow_major_version_upgrade         = true -> null
      - apply_immediately                   = true -> null
      - arn                                 = "arn:aws:rds:eu-west-2:416874859154:cluster:dev-ehr-db-cluster" -> null
      - availability_zones                  = [
          - "eu-west-2a",
          - "eu-west-2b",
          - "eu-west-2c",
        ] -> null
      - backtrack_window                    = 0 -> null
      - backup_retention_period             = 35 -> null
      - cluster_identifier                  = "dev-ehr-db-cluster" -> null
      - cluster_members                     = [
          - "dev-ehr-db-instance-0",
        ] -> null
      - cluster_resource_id                 = "cluster-Q5OLJKOXAB3GVLRPUXCWVCX4EY" -> null
      - copy_tags_to_snapshot               = false -> null
      - database_name                       = "ehrdb" -> null
      - db_cluster_parameter_group_name     = (sensitive value) -> null
      - db_subnet_group_name                = "dev-ehr-db-subnet-group" -> null
      - deletion_protection                 = false -> null
      - enable_global_write_forwarding      = false -> null
      - enable_http_endpoint                = false -> null
      - enabled_cloudwatch_logs_exports     = [] -> null
      - endpoint                            = "dev-ehr-db-cluster.cluster-cbgfvxtvhnhv.eu-west-2.rds.amazonaws.com" -> null
      - engine                              = "aurora-postgresql" -> null
      - engine_mode                         = "provisioned" -> null
      - engine_version                      = "13.12" -> null
      - engine_version_actual               = "13.12" -> null
      - hosted_zone_id                      = "Z1TTGA775OQIYO" -> null
      - iam_database_authentication_enabled = true -> null
      - iam_roles                           = [] -> null
      - id                                  = "dev-ehr-db-cluster" -> null
      - kms_key_id                          = "arn:aws:kms:eu-west-2:416874859154:key/7c9a3d1b-895e-4387-889f-f68b736e8d3d" -> null
      - master_password                     = (sensitive value) -> null
      - master_username                     = (sensitive value) -> null
      - port                                = 5432 -> null
      - preferred_backup_window             = "06:30-08:00" -> null
      - preferred_maintenance_window        = "mon:01:27-mon:01:57" -> null
      - reader_endpoint                     = "dev-ehr-db-cluster.cluster-ro-cbgfvxtvhnhv.eu-west-2.rds.amazonaws.com" -> null
      - skip_final_snapshot                 = true -> null
      - storage_encrypted                   = true -> null
      - tags                                = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
        } -> null
      - tags_all                            = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
        } -> null
      - vpc_security_group_ids              = [
          - "sg-04bed35f86fdf1a92",
          - "sg-09fd68538ca488c93",
          - "sg-0a62bb4aa08851524",
        ] -> null
        # (2 unchanged attributes hidden)
    }

  # aws_rds_cluster_instance.ehr-db-instances[0] will be destroyed
  # (because aws_rds_cluster_instance.ehr-db-instances is not in configuration)
  - resource "aws_rds_cluster_instance" "ehr-db-instances" {
      - arn                                   = "arn:aws:rds:eu-west-2:416874859154:db:dev-ehr-db-instance-0" -> null
      - auto_minor_version_upgrade            = true -> null
      - availability_zone                     = "eu-west-2b" -> null
      - ca_cert_identifier                    = "rds-ca-ecc384-g1" -> null
      - cluster_identifier                    = "dev-ehr-db-cluster" -> null
      - copy_tags_to_snapshot                 = false -> null
      - db_parameter_group_name               = "default.aurora-postgresql13" -> null
      - db_subnet_group_name                  = "dev-ehr-db-subnet-group" -> null
      - dbi_resource_id                       = "db-UQQ52BV3KTGFPTBIXBXOFXZXGY" -> null
      - endpoint                              = "dev-ehr-db-instance-0.cbgfvxtvhnhv.eu-west-2.rds.amazonaws.com" -> null
      - engine                                = "aurora-postgresql" -> null
      - engine_version                        = "13.12" -> null
      - engine_version_actual                 = "13.12" -> null
      - id                                    = "dev-ehr-db-instance-0" -> null
      - identifier                            = "dev-ehr-db-instance-0" -> null
      - instance_class                        = "db.t3.medium" -> null
      - kms_key_id                            = "arn:aws:kms:eu-west-2:416874859154:key/7c9a3d1b-895e-4387-889f-f68b736e8d3d" -> null
      - monitoring_interval                   = 0 -> null
      - performance_insights_enabled          = false -> null
      - performance_insights_retention_period = 0 -> null
      - port                                  = 5432 -> null
      - preferred_backup_window               = "06:30-08:00" -> null
      - preferred_maintenance_window          = "fri:00:24-fri:00:54" -> null
      - promotion_tier                        = 0 -> null
      - publicly_accessible                   = false -> null
      - storage_encrypted                     = true -> null
      - tags                                  = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
        } -> null
      - tags_all                              = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
        } -> null
      - writer                                = true -> null
        # (2 unchanged attributes hidden)
    }

  # aws_s3_bucket_policy.ehr_repo_permit_s3_to_write_access_logs_policy will be destroyed
  # (because aws_s3_bucket_policy.ehr_repo_permit_s3_to_write_access_logs_policy is not in configuration)
  - resource "aws_s3_bucket_policy" "ehr_repo_permit_s3_to_write_access_logs_policy" {
      - bucket = "dev-ehr-repo-access-logs" -> null
      - id     = "dev-ehr-repo-access-logs" -> null
      - policy = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "s3:PutObject"
                      - Condition = {
                          - Bool = {
                              - "aws:SecureTransport" = "false"
                            }
                        }
                      - Effect    = "Allow"
                      - Principal = {
                          - Service = "logging.s3.amazonaws.com"
                        }
                      - Resource  = "arn:aws:s3:::dev-ehr-repo-access-logs/s3-access-log/*"
                      - Sid       = "S3ServerAccessLogsPolicy"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
    }

  # aws_security_group.ehr_repo_to_db_sg will be destroyed
  # (because aws_security_group.ehr_repo_to_db_sg is not in configuration)
  - resource "aws_security_group" "ehr_repo_to_db_sg" {
      - arn                    = "arn:aws:ec2:eu-west-2:416874859154:security-group/sg-04bed35f86fdf1a92" -> null
      - description            = "Managed by Terraform" -> null
      - egress                 = [] -> null
      - id                     = "sg-04bed35f86fdf1a92" -> null
      - ingress                = [
          - {
              - cidr_blocks      = []
              - description      = "Allow traffic from ehr-repo to the db"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0840ae61e2d8dcd76",
                ]
              - self             = false
              - to_port          = 5432
            },
        ] -> null
      - name                   = "dev-ehr-repo-ecs-to-ehr-repo-db-sg" -> null
      - owner_id               = "416874859154" -> null
      - revoke_rules_on_delete = false -> null
      - tags                   = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
          - "Name"        = "dev-ehr-repo-ecs-to-ehr-repo-db-sg"
        } -> null
      - tags_all               = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
          - "Name"        = "dev-ehr-repo-ecs-to-ehr-repo-db-sg"
        } -> null
      - vpc_id                 = (sensitive value) -> null
        # (1 unchanged attribute hidden)
    }

  # aws_security_group.gocd_to_db_sg will be destroyed
  # (because aws_security_group.gocd_to_db_sg is not in configuration)
  - resource "aws_security_group" "gocd_to_db_sg" {
      - arn                    = "arn:aws:ec2:eu-west-2:416874859154:security-group/sg-0a62bb4aa08851524" -> null
      - description            = "Managed by Terraform" -> null
      - egress                 = [] -> null
      - id                     = "sg-0a62bb4aa08851524" -> null
      - ingress                = (sensitive value) -> null
      - name                   = "dev-gocd-to-ehr-repo-db-sg" -> null
      - owner_id               = "416874859154" -> null
      - revoke_rules_on_delete = false -> null
      - tags                   = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
          - "Name"        = "dev-gocd-to-ehr-repo-db-sg"
        } -> null
      - tags_all               = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
          - "Name"        = "dev-gocd-to-ehr-repo-db-sg"
        } -> null
      - vpc_id                 = (sensitive value) -> null
        # (1 unchanged attribute hidden)
    }

  # aws_security_group.vpn_to_db_sg will be destroyed
  # (because aws_security_group.vpn_to_db_sg is not in configuration)
  - resource "aws_security_group" "vpn_to_db_sg" {
      - arn                    = "arn:aws:ec2:eu-west-2:416874859154:security-group/sg-09fd68538ca488c93" -> null
      - description            = "Managed by Terraform" -> null
      - egress                 = [] -> null
      - id                     = "sg-09fd68538ca488c93" -> null
      - ingress                = [
          - {
              - cidr_blocks      = []
              - description      = "Allow traffic from VPN to the db"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-06df174eb101a7289",
                ]
              - self             = false
              - to_port          = 5432
            },
        ] -> null
      - name                   = "dev-vpn-to-ehr-repo-db-sg" -> null
      - owner_id               = "416874859154" -> null
      - revoke_rules_on_delete = false -> null
      - tags                   = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
          - "Name"        = "dev-vpn-to-ehr-repo-db-sg"
        } -> null
      - tags_all               = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
          - "Name"        = "dev-vpn-to-ehr-repo-db-sg"
        } -> null
      - vpc_id                 = (sensitive value) -> null
        # (1 unchanged attribute hidden)
    }

  # aws_security_group_rule.vpn_to_db_sg[0] will be destroyed
  # (because aws_security_group_rule.vpn_to_db_sg is not in configuration)
  - resource "aws_security_group_rule" "vpn_to_db_sg" {
      - cidr_blocks              = [] -> null
      - description              = "Allow traffic from VPN to the db" -> null
      - from_port                = 5432 -> null
      - id                       = "sgrule-3991842426" -> null
      - ipv6_cidr_blocks         = [] -> null
      - prefix_list_ids          = [] -> null
      - protocol                 = "tcp" -> null
      - security_group_id        = "sg-09fd68538ca488c93" -> null
      - self                     = false -> null
      - source_security_group_id = (sensitive value) -> null
      - to_port                  = 5432 -> null
      - type                     = "ingress" -> null
    }

  # aws_ssm_parameter.db_host will be destroyed
  # (because aws_ssm_parameter.db_host is not in configuration)
  - resource "aws_ssm_parameter" "db_host" {
      - arn             = "arn:aws:ssm:eu-west-2:416874859154:parameter/repo/dev/output/prm-deductions-ehr-repository/db-host" -> null
      - data_type       = "text" -> null
      - id              = "/repo/dev/output/prm-deductions-ehr-repository/db-host" -> null
      - name            = "/repo/dev/output/prm-deductions-ehr-repository/db-host" -> null
      - tags            = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
        } -> null
      - tags_all        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
        } -> null
      - tier            = "Standard" -> null
      - type            = "String" -> null
      - value           = (sensitive value) -> null
      - version         = 1 -> null
        # (3 unchanged attributes hidden)
    }

  # aws_ssm_parameter.db_name will be destroyed
  # (because aws_ssm_parameter.db_name is not in configuration)
  - resource "aws_ssm_parameter" "db_name" {
      - arn             = "arn:aws:ssm:eu-west-2:416874859154:parameter/repo/dev/output/prm-deductions-ehr-repository/db-name" -> null
      - data_type       = "text" -> null
      - id              = "/repo/dev/output/prm-deductions-ehr-repository/db-name" -> null
      - name            = "/repo/dev/output/prm-deductions-ehr-repository/db-name" -> null
      - tags            = {} -> null
      - tags_all        = {} -> null
      - tier            = "Standard" -> null
      - type            = "String" -> null
      - value           = (sensitive value) -> null
      - version         = 1 -> null
        # (3 unchanged attributes hidden)
    }

  # aws_ssm_parameter.db_resource_cluster_id will be destroyed
  # (because aws_ssm_parameter.db_resource_cluster_id is not in configuration)
  - resource "aws_ssm_parameter" "db_resource_cluster_id" {
      - arn             = "arn:aws:ssm:eu-west-2:416874859154:parameter/repo/dev/output/prm-deductions-ehr-repository/db-resource-cluster-id" -> null
      - data_type       = "text" -> null
      - id              = "/repo/dev/output/prm-deductions-ehr-repository/db-resource-cluster-id" -> null
      - name            = "/repo/dev/output/prm-deductions-ehr-repository/db-resource-cluster-id" -> null
      - tags            = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
        } -> null
      - tags_all        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "dev"
        } -> null
      - tier            = "Standard" -> null
      - type            = "String" -> null
      - value           = (sensitive value) -> null
      - version         = 1 -> null
        # (3 unchanged attributes hidden)
    }

Plan: 1 to add, 1 to change, 14 to destroy.

[github-actions]

Report for environment: prod

Terraform Format and Style 🖌success

Format Output

Terraform Initialization ⚙️success

Initialization Output

Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 4.0"...
- Installing hashicorp/aws v4.67.0...
- Installed hashicorp/aws v4.67.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Terraform Validation 🤖success

Validation Output

Success! The configuration is valid.

Terraform Plan 📖success

Show Plan (1 to add, 7 to change, 16 to destroy)

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
  - destroy
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_db_subnet_group.db-cluster-subnet-group will be destroyed
  # (because aws_db_subnet_group.db-cluster-subnet-group is not in configuration)
  - resource "aws_db_subnet_group" "db-cluster-subnet-group" {
      - arn         = "arn:aws:rds:eu-west-2:535760944720:subgrp:prod-ehr-db-subnet-group" -> null
      - description = "Managed by Terraform" -> null
      - id          = "prod-ehr-db-subnet-group" -> null
      - name        = "prod-ehr-db-subnet-group" -> null
      - subnet_ids  = (sensitive value) -> null
      - tags        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-ehr-db-subnet-group"
        } -> null
      - tags_all    = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-ehr-db-subnet-group"
        } -> null
    }

  # aws_ecs_service.ecs-service will be updated in-place
  ~ resource "aws_ecs_service" "ecs-service" {
        id                                 = "arn:aws:ecs:eu-west-2:535760944720:service/prod-ehr-repo-ecs-cluster/prod-ehr-repo-service"
        name                               = "prod-ehr-repo-service"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:eu-west-2:535760944720:task-definition/ehr-repo:20" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # aws_ecs_task_definition.task must be replaced
-/+ resource "aws_ecs_task_definition" "task" {
      ~ arn                      = "arn:aws:ecs:eu-west-2:535760944720:task-definition/ehr-repo:20" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:eu-west-2:535760944720:task-definition/ehr-repo" -> (known after apply)
      ~ container_definitions    = (sensitive value) # forces replacement
      ~ id                       = "ehr-repo" -> (known after apply)
      ~ revision                 = 20 -> (known after apply)
        tags                     = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
        }
        # (11 unchanged attributes hidden)
    }

  # aws_kms_alias.ehr_repo_encryption will be destroyed
  # (because aws_kms_alias.ehr_repo_encryption is not in configuration)
  - resource "aws_kms_alias" "ehr_repo_encryption" {
      - arn            = "arn:aws:kms:eu-west-2:535760944720:alias/ehr-repo-encryption-kms-key" -> null
      - id             = "alias/ehr-repo-encryption-kms-key" -> null
      - name           = "alias/ehr-repo-encryption-kms-key" -> null
      - target_key_arn = "arn:aws:kms:eu-west-2:535760944720:key/a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - target_key_id  = "a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
        # (1 unchanged attribute hidden)
    }

  # aws_kms_key.ehr-repo-key will be destroyed
  # (because aws_kms_key.ehr-repo-key is not in configuration)
  - resource "aws_kms_key" "ehr-repo-key" {
      - arn                                = "arn:aws:kms:eu-west-2:535760944720:key/a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - bypass_policy_lockout_safety_check = false -> null
      - customer_master_key_spec           = "SYMMETRIC_DEFAULT" -> null
      - description                        = "EHR repository KMS key in prod environment" -> null
      - enable_key_rotation                = true -> null
      - id                                 = "a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - is_enabled                         = true -> null
      - key_id                             = "a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - key_usage                          = "ENCRYPT_DECRYPT" -> null
      - multi_region                       = false -> null
      - policy                             = jsonencode(
            {
              - Id        = "key-default-1"
              - Statement = [
                  - {
                      - Action    = "kms:*"
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::535760944720:root"
                        }
                      - Resource  = "*"
                      - Sid       = "Enable IAM User Permissions"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - tags                               = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-ehr-repo-db"
        } -> null
      - tags_all                           = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-ehr-repo-db"
        } -> null
    }

  # aws_rds_cluster.db-cluster will be destroyed
  # (because aws_rds_cluster.db-cluster is not in configuration)
  - resource "aws_rds_cluster" "db-cluster" {
      - allow_major_version_upgrade         = true -> null
      - apply_immediately                   = true -> null
      - arn                                 = "arn:aws:rds:eu-west-2:535760944720:cluster:prod-ehr-db-cluster" -> null
      - availability_zones                  = [
          - "eu-west-2a",
          - "eu-west-2b",
          - "eu-west-2c",
        ] -> null
      - backtrack_window                    = 0 -> null
      - backup_retention_period             = 35 -> null
      - cluster_identifier                  = "prod-ehr-db-cluster" -> null
      - cluster_members                     = [
          - "prod-ehr-db-instance-0",
          - "prod-ehr-db-instance-1",
          - "prod-ehr-db-instance-2",
        ] -> null
      - cluster_resource_id                 = "cluster-ZTTUOUYKB2M5FLE6CBYCUU6PMI" -> null
      - copy_tags_to_snapshot               = false -> null
      - database_name                       = "ehrdb" -> null
      - db_cluster_parameter_group_name     = (sensitive value) -> null
      - db_subnet_group_name                = "prod-ehr-db-subnet-group" -> null
      - deletion_protection                 = true -> null
      - enable_global_write_forwarding      = false -> null
      - enable_http_endpoint                = false -> null
      - enabled_cloudwatch_logs_exports     = [] -> null
      - endpoint                            = "prod-ehr-db-cluster.cluster-cyniu6lsek4i.eu-west-2.rds.amazonaws.com" -> null
      - engine                              = "aurora-postgresql" -> null
      - engine_mode                         = "provisioned" -> null
      - engine_version                      = "13.12" -> null
      - engine_version_actual               = "13.12" -> null
      - hosted_zone_id                      = "Z1TTGA775OQIYO" -> null
      - iam_database_authentication_enabled = true -> null
      - iam_roles                           = [] -> null
      - id                                  = "prod-ehr-db-cluster" -> null
      - kms_key_id                          = "arn:aws:kms:eu-west-2:535760944720:key/a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - master_password                     = (sensitive value) -> null
      - master_username                     = (sensitive value) -> null
      - port                                = 5432 -> null
      - preferred_backup_window             = "06:30-08:00" -> null
      - preferred_maintenance_window        = "sat:04:35-sat:05:05" -> null
      - reader_endpoint                     = "prod-ehr-db-cluster.cluster-ro-cyniu6lsek4i.eu-west-2.rds.amazonaws.com" -> null
      - skip_final_snapshot                 = true -> null
      - storage_encrypted                   = true -> null
      - tags                                = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tags_all                            = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - vpc_security_group_ids              = [
          - "sg-0202aa7080b14a4fe",
          - "sg-04a1bdc4b2d04025f",
          - "sg-0d10d724060aac975",
        ] -> null
        # (2 unchanged attributes hidden)
    }

  # aws_rds_cluster_instance.ehr-db-instances[0] will be destroyed
  # (because aws_rds_cluster_instance.ehr-db-instances is not in configuration)
  - resource "aws_rds_cluster_instance" "ehr-db-instances" {
      - arn                                   = "arn:aws:rds:eu-west-2:535760944720:db:prod-ehr-db-instance-0" -> null
      - auto_minor_version_upgrade            = true -> null
      - availability_zone                     = "eu-west-2a" -> null
      - ca_cert_identifier                    = "rds-ca-ecc384-g1" -> null
      - cluster_identifier                    = "prod-ehr-db-cluster" -> null
      - copy_tags_to_snapshot                 = false -> null
      - db_parameter_group_name               = "default.aurora-postgresql13" -> null
      - db_subnet_group_name                  = "prod-ehr-db-subnet-group" -> null
      - dbi_resource_id                       = "db-GMPCED57L6P4JNJ6A5OC54WHCU" -> null
      - endpoint                              = "prod-ehr-db-instance-0.cyniu6lsek4i.eu-west-2.rds.amazonaws.com" -> null
      - engine                                = "aurora-postgresql" -> null
      - engine_version                        = "13.12" -> null
      - engine_version_actual                 = "13.12" -> null
      - id                                    = "prod-ehr-db-instance-0" -> null
      - identifier                            = "prod-ehr-db-instance-0" -> null
      - instance_class                        = "db.t3.medium" -> null
      - kms_key_id                            = "arn:aws:kms:eu-west-2:535760944720:key/a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - monitoring_interval                   = 0 -> null
      - performance_insights_enabled          = false -> null
      - performance_insights_retention_period = 0 -> null
      - port                                  = 5432 -> null
      - preferred_backup_window               = "06:30-08:00" -> null
      - preferred_maintenance_window          = "mon:22:23-mon:22:53" -> null
      - promotion_tier                        = 0 -> null
      - publicly_accessible                   = false -> null
      - storage_encrypted                     = true -> null
      - tags                                  = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tags_all                              = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - writer                                = true -> null
        # (2 unchanged attributes hidden)
    }

  # aws_rds_cluster_instance.ehr-db-instances[1] will be destroyed
  # (because aws_rds_cluster_instance.ehr-db-instances is not in configuration)
  - resource "aws_rds_cluster_instance" "ehr-db-instances" {
      - arn                                   = "arn:aws:rds:eu-west-2:535760944720:db:prod-ehr-db-instance-1" -> null
      - auto_minor_version_upgrade            = true -> null
      - availability_zone                     = "eu-west-2b" -> null
      - ca_cert_identifier                    = "rds-ca-ecc384-g1" -> null
      - cluster_identifier                    = "prod-ehr-db-cluster" -> null
      - copy_tags_to_snapshot                 = false -> null
      - db_parameter_group_name               = "default.aurora-postgresql13" -> null
      - db_subnet_group_name                  = "prod-ehr-db-subnet-group" -> null
      - dbi_resource_id                       = "db-XYC4IK37KX2NKSJ5K7LUSYJPWQ" -> null
      - endpoint                              = "prod-ehr-db-instance-1.cyniu6lsek4i.eu-west-2.rds.amazonaws.com" -> null
      - engine                                = "aurora-postgresql" -> null
      - engine_version                        = "13.12" -> null
      - engine_version_actual                 = "13.12" -> null
      - id                                    = "prod-ehr-db-instance-1" -> null
      - identifier                            = "prod-ehr-db-instance-1" -> null
      - instance_class                        = "db.t3.medium" -> null
      - kms_key_id                            = "arn:aws:kms:eu-west-2:535760944720:key/a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - monitoring_interval                   = 0 -> null
      - performance_insights_enabled          = false -> null
      - performance_insights_retention_period = 0 -> null
      - port                                  = 5432 -> null
      - preferred_backup_window               = "06:30-08:00" -> null
      - preferred_maintenance_window          = "fri:02:45-fri:03:15" -> null
      - promotion_tier                        = 0 -> null
      - publicly_accessible                   = false -> null
      - storage_encrypted                     = true -> null
      - tags                                  = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tags_all                              = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - writer                                = false -> null
        # (2 unchanged attributes hidden)
    }

  # aws_rds_cluster_instance.ehr-db-instances[2] will be destroyed
  # (because aws_rds_cluster_instance.ehr-db-instances is not in configuration)
  - resource "aws_rds_cluster_instance" "ehr-db-instances" {
      - arn                                   = "arn:aws:rds:eu-west-2:535760944720:db:prod-ehr-db-instance-2" -> null
      - auto_minor_version_upgrade            = true -> null
      - availability_zone                     = "eu-west-2b" -> null
      - ca_cert_identifier                    = "rds-ca-ecc384-g1" -> null
      - cluster_identifier                    = "prod-ehr-db-cluster" -> null
      - copy_tags_to_snapshot                 = false -> null
      - db_parameter_group_name               = "default.aurora-postgresql13" -> null
      - db_subnet_group_name                  = "prod-ehr-db-subnet-group" -> null
      - dbi_resource_id                       = "db-O5LXTPCNCTJFQSYDKYXE3ZWPWM" -> null
      - endpoint                              = "prod-ehr-db-instance-2.cyniu6lsek4i.eu-west-2.rds.amazonaws.com" -> null
      - engine                                = "aurora-postgresql" -> null
      - engine_version                        = "13.12" -> null
      - engine_version_actual                 = "13.12" -> null
      - id                                    = "prod-ehr-db-instance-2" -> null
      - identifier                            = "prod-ehr-db-instance-2" -> null
      - instance_class                        = "db.t3.medium" -> null
      - kms_key_id                            = "arn:aws:kms:eu-west-2:535760944720:key/a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - monitoring_interval                   = 0 -> null
      - performance_insights_enabled          = false -> null
      - performance_insights_retention_period = 0 -> null
      - port                                  = 5432 -> null
      - preferred_backup_window               = "06:30-08:00" -> null
      - preferred_maintenance_window          = "thu:02:16-thu:02:46" -> null
      - promotion_tier                        = 0 -> null
      - publicly_accessible                   = false -> null
      - storage_encrypted                     = true -> null
      - tags                                  = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tags_all                              = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - writer                                = false -> null
        # (2 unchanged attributes hidden)
    }

  # aws_s3_bucket_policy.ehr_repo_permit_developer_to_see_access_logs_policy[0] will be updated in-place
  ~ resource "aws_s3_bucket_policy" "ehr_repo_permit_developer_to_see_access_logs_policy" {
        id     = "prod-ehr-repo-access-logs"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    {
                        Action    = "s3:PutObject"
                        Condition = {
                            Bool = {
                                "aws:SecureTransport" = "false"
                            }
                        }
                        Effect    = "Allow"
                        Principal = {
                            Service = "logging.s3.amazonaws.com"
                        }
                        Resource  = "arn:aws:s3:::prod-ehr-repo-access-logs/s3-access-log/*"
                        Sid       = "S3ServerAccessLogsPolicy"
                    },
                  + {
                      + Action    = [
                          + "s3:Get*",
                          + "s3:ListBucket",
                        ]
                      + Condition = {
                          + Bool = {
                              + "aws:SecureTransport" = "false"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::535760944720:role/RepoDeveloper"
                        }
                      + Resource  = [
                          + "arn:aws:s3:::prod-ehr-repo-access-logs",
                          + "arn:aws:s3:::prod-ehr-repo-access-logs/*",
                        ]
                      + Sid       = "S3PermitDeveloperAccessLogsPolicy"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

  # aws_s3_bucket_policy.ehr_repo_permit_s3_to_write_access_logs_policy will be destroyed
  # (because aws_s3_bucket_policy.ehr_repo_permit_s3_to_write_access_logs_policy is not in configuration)
  - resource "aws_s3_bucket_policy" "ehr_repo_permit_s3_to_write_access_logs_policy" {
      - bucket = "prod-ehr-repo-access-logs" -> null
      - id     = "prod-ehr-repo-access-logs" -> null
      - policy = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "s3:PutObject"
                      - Condition = {
                          - Bool = {
                              - "aws:SecureTransport" = "false"
                            }
                        }
                      - Effect    = "Allow"
                      - Principal = {
                          - Service = "logging.s3.amazonaws.com"
                        }
                      - Resource  = "arn:aws:s3:::prod-ehr-repo-access-logs/s3-access-log/*"
                      - Sid       = "S3ServerAccessLogsPolicy"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
    }

  # aws_security_group.alb_to_ehr_repo_ecs will be updated in-place
  ~ resource "aws_security_group" "alb_to_ehr_repo_ecs" {
        id                     = "sg-091d2c37cedc98276"
        name                   = "prod-alb-to-ehr-repo-ecr"
      + revoke_rules_on_delete = false
        tags                   = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
            "Name"        = "prod-alb-to-ehr-repo-ecs"
        }
        # (8 unchanged attributes hidden)

      - timeouts {}
    }

  # aws_security_group.ehr_repo_alb will be updated in-place
  ~ resource "aws_security_group" "ehr_repo_alb" {
        id                     = "sg-07e5606b3bcd4649d"
        name                   = "prod-alb-ehr-repo"
      + revoke_rules_on_delete = false
        tags                   = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
            "Name"        = "prod-alb-ehr-repo"
        }
        # (8 unchanged attributes hidden)

      - timeouts {}
    }

  # aws_security_group.ehr_repo_to_db_sg will be destroyed
  # (because aws_security_group.ehr_repo_to_db_sg is not in configuration)
  - resource "aws_security_group" "ehr_repo_to_db_sg" {
      - arn         = "arn:aws:ec2:eu-west-2:535760944720:security-group/sg-0d10d724060aac975" -> null
      - description = "Managed by Terraform" -> null
      - egress      = [] -> null
      - id          = "sg-0d10d724060aac975" -> null
      - ingress     = [
          - {
              - cidr_blocks      = []
              - description      = "Allow traffic from ehr-repo to the db"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0c51ae31e24afddf9",
                ]
              - self             = false
              - to_port          = 5432
            },
        ] -> null
      - name        = "prod-ehr-repo-ecs-to-ehr-repo-db-sg" -> null
      - owner_id    = "535760944720" -> null
      - tags        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-ehr-repo-ecs-to-ehr-repo-db-sg"
        } -> null
      - tags_all    = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-ehr-repo-ecs-to-ehr-repo-db-sg"
        } -> null
      - vpc_id      = (sensitive value) -> null
        # (1 unchanged attribute hidden)

      - timeouts {}
    }

  # aws_security_group.gocd_to_db_sg will be destroyed
  # (because aws_security_group.gocd_to_db_sg is not in configuration)
  - resource "aws_security_group" "gocd_to_db_sg" {
      - arn                    = "arn:aws:ec2:eu-west-2:535760944720:security-group/sg-04a1bdc4b2d04025f" -> null
      - description            = "Managed by Terraform" -> null
      - egress                 = [] -> null
      - id                     = "sg-04a1bdc4b2d04025f" -> null
      - ingress                = (sensitive value) -> null
      - name                   = "prod-gocd-to-ehr-repo-db-sg" -> null
      - owner_id               = "535760944720" -> null
      - revoke_rules_on_delete = false -> null
      - tags                   = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-gocd-to-ehr-repo-db-sg"
        } -> null
      - tags_all               = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-gocd-to-ehr-repo-db-sg"
        } -> null
      - vpc_id                 = (sensitive value) -> null
        # (1 unchanged attribute hidden)

      - timeouts {}
    }

  # aws_security_group.gocd_to_ehr_repo will be updated in-place
  ~ resource "aws_security_group" "gocd_to_ehr_repo" {
        id                     = "sg-03ac6aa886cc858a1"
      ~ ingress                = (sensitive value)
        name                   = "prod-gocd-to-ehr-repo"
        tags                   = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
            "Name"        = "prod-gocd-to-ehr-repo-sg"
        }
        # (8 unchanged attributes hidden)

      - timeouts {}
    }

  # aws_security_group.service_to_ehr_repo will be updated in-place
  ~ resource "aws_security_group" "service_to_ehr_repo" {
        id                     = "sg-0843b1d0b553c2023"
        name                   = "prod-service-to-ehr-repo"
      + revoke_rules_on_delete = false
        tags                   = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
            "Name"        = "prod-service-to-ehr-repo-sg"
        }
        # (8 unchanged attributes hidden)

      - timeouts {}
    }

  # aws_security_group.vpn_to_db_sg will be destroyed
  # (because aws_security_group.vpn_to_db_sg is not in configuration)
  - resource "aws_security_group" "vpn_to_db_sg" {
      - arn         = "arn:aws:ec2:eu-west-2:535760944720:security-group/sg-0202aa7080b14a4fe" -> null
      - description = "Managed by Terraform" -> null
      - egress      = [] -> null
      - id          = "sg-0202aa7080b14a4fe" -> null
      - ingress     = [
          - {
              - cidr_blocks      = []
              - description      = "Allow traffic from VPN to the db"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0db679480c00ed82c",
                ]
              - self             = false
              - to_port          = 5432
            },
        ] -> null
      - name        = "prod-vpn-to-ehr-repo-db-sg" -> null
      - owner_id    = "535760944720" -> null
      - tags        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-vpn-to-ehr-repo-db-sg"
        } -> null
      - tags_all    = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-vpn-to-ehr-repo-db-sg"
        } -> null
      - vpc_id      = (sensitive value) -> null
        # (1 unchanged attribute hidden)

      - timeouts {}
    }

  # aws_security_group.vpn_to_ehr_repo will be updated in-place
  ~ resource "aws_security_group" "vpn_to_ehr_repo" {
        id                     = "sg-0b1fbb458ed13a742"
        name                   = "prod-vpn-to-ehr-repo"
      + revoke_rules_on_delete = false
        tags                   = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
            "Name"        = "prod-vpn-to-ehr-repo-sg"
        }
        # (8 unchanged attributes hidden)

      - timeouts {}
    }

  # aws_security_group_rule.vpn_to_db_sg[0] will be destroyed
  # (because aws_security_group_rule.vpn_to_db_sg is not in configuration)
  - resource "aws_security_group_rule" "vpn_to_db_sg" {
      - cidr_blocks              = [] -> null
      - description              = "Allow traffic from VPN to the db" -> null
      - from_port                = 5432 -> null
      - id                       = "sgrule-2902444858" -> null
      - ipv6_cidr_blocks         = [] -> null
      - prefix_list_ids          = [] -> null
      - protocol                 = "tcp" -> null
      - security_group_id        = "sg-0202aa7080b14a4fe" -> null
      - self                     = false -> null
      - source_security_group_id = (sensitive value) -> null
      - to_port                  = 5432 -> null
      - type                     = "ingress" -> null
    }

  # aws_ssm_parameter.db_host will be destroyed
  # (because aws_ssm_parameter.db_host is not in configuration)
  - resource "aws_ssm_parameter" "db_host" {
      - arn             = "arn:aws:ssm:eu-west-2:535760944720:parameter/repo/prod/output/prm-deductions-ehr-repository/db-host" -> null
      - data_type       = "text" -> null
      - id              = "/repo/prod/output/prm-deductions-ehr-repository/db-host" -> null
      - name            = "/repo/prod/output/prm-deductions-ehr-repository/db-host" -> null
      - tags            = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tags_all        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tier            = "Standard" -> null
      - type            = "String" -> null
      - value           = (sensitive value) -> null
      - version         = 1 -> null
        # (3 unchanged attributes hidden)
    }

  # aws_ssm_parameter.db_name will be destroyed
  # (because aws_ssm_parameter.db_name is not in configuration)
  - resource "aws_ssm_parameter" "db_name" {
      - arn             = "arn:aws:ssm:eu-west-2:535760944720:parameter/repo/prod/output/prm-deductions-ehr-repository/db-name" -> null
      - data_type       = "text" -> null
      - id              = "/repo/prod/output/prm-deductions-ehr-repository/db-name" -> null
      - name            = "/repo/prod/output/prm-deductions-ehr-repository/db-name" -> null
      - tags            = {} -> null
      - tags_all        = {} -> null
      - tier            = "Standard" -> null
      - type            = "String" -> null
      - value           = (sensitive value) -> null
      - version         = 1 -> null
        # (3 unchanged attributes hidden)
    }

  # aws_ssm_parameter.db_resource_cluster_id will be destroyed
  # (because aws_ssm_parameter.db_resource_cluster_id is not in configuration)
  - resource "aws_ssm_parameter" "db_resource_cluster_id" {
      - arn             = "arn:aws:ssm:eu-west-2:535760944720:parameter/repo/prod/output/prm-deductions-ehr-repository/db-resource-cluster-id" -> null
      - data_type       = "text" -> null
      - id              = "/repo/prod/output/prm-deductions-ehr-repository/db-resource-cluster-id" -> null
      - name            = "/repo/prod/output/prm-deductions-ehr-repository/db-resource-cluster-id" -> null
      - tags            = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tags_all        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tier            = "Standard" -> null
      - type            = "String" -> null
      - value           = (sensitive value) -> null
      - version         = 1 -> null
        # (3 unchanged attributes hidden)
    }

Plan: 1 to add, 7 to change, 16 to destroy.

[github-actions]

Report for environment: test

Terraform Format and Style 🖌success

Format Output

Terraform Initialization ⚙️success

Initialization Output

Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 4.0"...
- Installing hashicorp/aws v4.67.0...
- Installed hashicorp/aws v4.67.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Terraform Validation 🤖success

Validation Output

Success! The configuration is valid.

Terraform Plan 📖success

Show Plan (2 to add, 1 to change, 14 to destroy)

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
  - destroy
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_db_subnet_group.db-cluster-subnet-group will be destroyed
  # (because aws_db_subnet_group.db-cluster-subnet-group is not in configuration)
  - resource "aws_db_subnet_group" "db-cluster-subnet-group" {
      - arn         = "arn:aws:rds:eu-west-2:005235525306:subgrp:test-ehr-db-subnet-group" -> null
      - description = "Managed by Terraform" -> null
      - id          = "test-ehr-db-subnet-group" -> null
      - name        = "test-ehr-db-subnet-group" -> null
      - subnet_ids  = (sensitive value) -> null
      - tags        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
          - "Name"        = "test-ehr-db-subnet-group"
        } -> null
      - tags_all    = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
          - "Name"        = "test-ehr-db-subnet-group"
        } -> null
    }

  # aws_ecs_service.ecs-service will be updated in-place
  ~ resource "aws_ecs_service" "ecs-service" {
        id                                 = "arn:aws:ecs:eu-west-2:005235525306:service/test-ehr-repo-ecs-cluster/test-ehr-repo-service"
        name                               = "test-ehr-repo-service"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:eu-west-2:005235525306:task-definition/ehr-repo:174" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # aws_ecs_task_definition.task must be replaced
-/+ resource "aws_ecs_task_definition" "task" {
      ~ arn                      = "arn:aws:ecs:eu-west-2:005235525306:task-definition/ehr-repo:174" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:eu-west-2:005235525306:task-definition/ehr-repo" -> (known after apply)
      ~ container_definitions    = (sensitive value) # forces replacement
      ~ id                       = "ehr-repo" -> (known after apply)
      ~ revision                 = 174 -> (known after apply)
        tags                     = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "test"
        }
        # (11 unchanged attributes hidden)
    }

  # aws_kms_alias.ehr_repo_encryption will be destroyed
  # (because aws_kms_alias.ehr_repo_encryption is not in configuration)
  - resource "aws_kms_alias" "ehr_repo_encryption" {
      - arn            = "arn:aws:kms:eu-west-2:005235525306:alias/ehr-repo-encryption-kms-key" -> null
      - id             = "alias/ehr-repo-encryption-kms-key" -> null
      - name           = "alias/ehr-repo-encryption-kms-key" -> null
      - target_key_arn = "arn:aws:kms:eu-west-2:005235525306:key/b65145e7-e1e4-4031-886d-16c74d60d91c" -> null
      - target_key_id  = "b65145e7-e1e4-4031-886d-16c74d60d91c" -> null
        # (1 unchanged attribute hidden)
    }

  # aws_kms_key.ehr-repo-key will be destroyed
  # (because aws_kms_key.ehr-repo-key is not in configuration)
  - resource "aws_kms_key" "ehr-repo-key" {
      - arn                      = "arn:aws:kms:eu-west-2:005235525306:key/b65145e7-e1e4-4031-886d-16c74d60d91c" -> null
      - customer_master_key_spec = "SYMMETRIC_DEFAULT" -> null
      - description              = "EHR repository KMS key in test environment" -> null
      - enable_key_rotation      = true -> null
      - id                       = "b65145e7-e1e4-4031-886d-16c74d60d91c" -> null
      - is_enabled               = true -> null
      - key_id                   = "b65145e7-e1e4-4031-886d-16c74d60d91c" -> null
      - key_usage                = "ENCRYPT_DECRYPT" -> null
      - multi_region             = false -> null
      - policy                   = jsonencode(
            {
              - Id        = "key-default-1"
              - Statement = [
                  - {
                      - Action    = "kms:*"
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::005235525306:root"
                        }
                      - Resource  = "*"
                      - Sid       = "Enable IAM User Permissions"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - tags                     = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
          - "Name"        = "test-ehr-repo-db"
        } -> null
      - tags_all                 = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
          - "Name"        = "test-ehr-repo-db"
        } -> null
    }

  # aws_rds_cluster.db-cluster will be destroyed
  # (because aws_rds_cluster.db-cluster is not in configuration)
  - resource "aws_rds_cluster" "db-cluster" {
      - allow_major_version_upgrade         = true -> null
      - apply_immediately                   = true -> null
      - arn                                 = "arn:aws:rds:eu-west-2:005235525306:cluster:test-ehr-db-cluster" -> null
      - availability_zones                  = [
          - "eu-west-2a",
          - "eu-west-2b",
          - "eu-west-2c",
        ] -> null
      - backtrack_window                    = 0 -> null
      - backup_retention_period             = 35 -> null
      - cluster_identifier                  = "test-ehr-db-cluster" -> null
      - cluster_members                     = [
          - "test-ehr-db-instance-0",
        ] -> null
      - cluster_resource_id                 = "cluster-RRI57NUSYM2N4BJ4UYIIFWZ6HI" -> null
      - copy_tags_to_snapshot               = false -> null
      - database_name                       = "ehrdb" -> null
      - db_cluster_parameter_group_name     = (sensitive value) -> null
      - db_subnet_group_name                = "test-ehr-db-subnet-group" -> null
      - deletion_protection                 = false -> null
      - enable_global_write_forwarding      = false -> null
      - enable_http_endpoint                = false -> null
      - enabled_cloudwatch_logs_exports     = [] -> null
      - endpoint                            = "test-ehr-db-cluster.cluster-c9ukxaeahmlz.eu-west-2.rds.amazonaws.com" -> null
      - engine                              = "aurora-postgresql" -> null
      - engine_mode                         = "provisioned" -> null
      - engine_version                      = "13.12" -> null
      - engine_version_actual               = "13.12" -> null
      - hosted_zone_id                      = "Z1TTGA775OQIYO" -> null
      - iam_database_authentication_enabled = true -> null
      - iam_roles                           = [] -> null
      - id                                  = "test-ehr-db-cluster" -> null
      - kms_key_id                          = "arn:aws:kms:eu-west-2:005235525306:key/b65145e7-e1e4-4031-886d-16c74d60d91c" -> null
      - master_password                     = (sensitive value) -> null
      - master_username                     = (sensitive value) -> null
      - port                                = 5432 -> null
      - preferred_backup_window             = "06:30-08:00" -> null
      - preferred_maintenance_window        = "tue:02:21-tue:02:51" -> null
      - reader_endpoint                     = "test-ehr-db-cluster.cluster-ro-c9ukxaeahmlz.eu-west-2.rds.amazonaws.com" -> null
      - skip_final_snapshot                 = true -> null
      - storage_encrypted                   = true -> null
      - tags                                = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
        } -> null
      - tags_all                            = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
        } -> null
      - vpc_security_group_ids              = [
          - "sg-04cba74a243619e61",
          - "sg-0840e7f602f61a749",
          - "sg-0e2ca97a28f1af9be",
        ] -> null
        # (2 unchanged attributes hidden)
    }

  # aws_rds_cluster_instance.ehr-db-instances[0] will be destroyed
  # (because aws_rds_cluster_instance.ehr-db-instances is not in configuration)
  - resource "aws_rds_cluster_instance" "ehr-db-instances" {
      - arn                                   = "arn:aws:rds:eu-west-2:005235525306:db:test-ehr-db-instance-0" -> null
      - auto_minor_version_upgrade            = true -> null
      - availability_zone                     = "eu-west-2b" -> null
      - ca_cert_identifier                    = "rds-ca-ecc384-g1" -> null
      - cluster_identifier                    = "test-ehr-db-cluster" -> null
      - copy_tags_to_snapshot                 = false -> null
      - db_parameter_group_name               = "default.aurora-postgresql13" -> null
      - db_subnet_group_name                  = "test-ehr-db-subnet-group" -> null
      - dbi_resource_id                       = "db-4Z7PPKZQXQAZZFKW2L5TXCCTMQ" -> null
      - endpoint                              = "test-ehr-db-instance-0.c9ukxaeahmlz.eu-west-2.rds.amazonaws.com" -> null
      - engine                                = "aurora-postgresql" -> null
      - engine_version                        = "13.12" -> null
      - engine_version_actual                 = "13.12" -> null
      - id                                    = "test-ehr-db-instance-0" -> null
      - identifier                            = "test-ehr-db-instance-0" -> null
      - instance_class                        = "db.t3.medium" -> null
      - kms_key_id                            = "arn:aws:kms:eu-west-2:005235525306:key/b65145e7-e1e4-4031-886d-16c74d60d91c" -> null
      - monitoring_interval                   = 0 -> null
      - performance_insights_enabled          = false -> null
      - performance_insights_retention_period = 0 -> null
      - port                                  = 5432 -> null
      - preferred_backup_window               = "06:30-08:00" -> null
      - preferred_maintenance_window          = "sat:02:47-sat:03:17" -> null
      - promotion_tier                        = 0 -> null
      - publicly_accessible                   = false -> null
      - storage_encrypted                     = true -> null
      - tags                                  = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
        } -> null
      - tags_all                              = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
        } -> null
      - writer                                = true -> null
        # (2 unchanged attributes hidden)
    }

  # aws_s3_bucket_logging.ehr-repo-bucket will be created
  + resource "aws_s3_bucket_logging" "ehr-repo-bucket" {
      + bucket        = "test-ehr-repo-bucket"
      + id            = (known after apply)
      + target_bucket = "test-ehr-repo-access-logs"
      + target_prefix = "s3-access-log/"
    }

  # aws_s3_bucket_policy.ehr_repo_permit_s3_to_write_access_logs_policy will be destroyed
  # (because aws_s3_bucket_policy.ehr_repo_permit_s3_to_write_access_logs_policy is not in configuration)
  - resource "aws_s3_bucket_policy" "ehr_repo_permit_s3_to_write_access_logs_policy" {
      - bucket = "test-ehr-repo-access-logs" -> null
      - id     = "test-ehr-repo-access-logs" -> null
      - policy = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "s3:PutObject"
                      - Condition = {
                          - Bool = {
                              - "aws:SecureTransport" = "false"
                            }
                        }
                      - Effect    = "Allow"
                      - Principal = {
                          - Service = "logging.s3.amazonaws.com"
                        }
                      - Resource  = "arn:aws:s3:::test-ehr-repo-access-logs/s3-access-log/*"
                      - Sid       = "S3ServerAccessLogsPolicy"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
    }

  # aws_security_group.ehr_repo_to_db_sg will be destroyed
  # (because aws_security_group.ehr_repo_to_db_sg is not in configuration)
  - resource "aws_security_group" "ehr_repo_to_db_sg" {
      - arn                    = "arn:aws:ec2:eu-west-2:005235525306:security-group/sg-0840e7f602f61a749" -> null
      - description            = "Managed by Terraform" -> null
      - egress                 = [] -> null
      - id                     = "sg-0840e7f602f61a749" -> null
      - ingress                = [
          - {
              - cidr_blocks      = []
              - description      = "Allow traffic from ehr-repo to the db"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-056426ee8408c9681",
                ]
              - self             = false
              - to_port          = 5432
            },
        ] -> null
      - name                   = "test-ehr-repo-ecs-to-ehr-repo-db-sg" -> null
      - owner_id               = "005235525306" -> null
      - revoke_rules_on_delete = false -> null
      - tags                   = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
          - "Name"        = "test-ehr-repo-ecs-to-ehr-repo-db-sg"
        } -> null
      - tags_all               = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
          - "Name"        = "test-ehr-repo-ecs-to-ehr-repo-db-sg"
        } -> null
      - vpc_id                 = (sensitive value) -> null
        # (1 unchanged attribute hidden)
    }

  # aws_security_group.gocd_to_db_sg will be destroyed
  # (because aws_security_group.gocd_to_db_sg is not in configuration)
  - resource "aws_security_group" "gocd_to_db_sg" {
      - arn                    = "arn:aws:ec2:eu-west-2:005235525306:security-group/sg-04cba74a243619e61" -> null
      - description            = "Managed by Terraform" -> null
      - egress                 = [] -> null
      - id                     = "sg-04cba74a243619e61" -> null
      - ingress                = (sensitive value) -> null
      - name                   = "test-gocd-to-ehr-repo-db-sg" -> null
      - owner_id               = "005235525306" -> null
      - revoke_rules_on_delete = false -> null
      - tags                   = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
          - "Name"        = "test-gocd-to-ehr-repo-db-sg"
        } -> null
      - tags_all               = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
          - "Name"        = "test-gocd-to-ehr-repo-db-sg"
        } -> null
      - vpc_id                 = (sensitive value) -> null
        # (1 unchanged attribute hidden)
    }

  # aws_security_group.vpn_to_db_sg will be destroyed
  # (because aws_security_group.vpn_to_db_sg is not in configuration)
  - resource "aws_security_group" "vpn_to_db_sg" {
      - arn                    = "arn:aws:ec2:eu-west-2:005235525306:security-group/sg-0e2ca97a28f1af9be" -> null
      - description            = "Managed by Terraform" -> null
      - egress                 = [] -> null
      - id                     = "sg-0e2ca97a28f1af9be" -> null
      - ingress                = [
          - {
              - cidr_blocks      = []
              - description      = "Allow traffic from VPN to the db"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd411b5a8a92a193",
                ]
              - self             = false
              - to_port          = 5432
            },
        ] -> null
      - name                   = "test-vpn-to-ehr-repo-db-sg" -> null
      - owner_id               = "005235525306" -> null
      - revoke_rules_on_delete = false -> null
      - tags                   = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
          - "Name"        = "test-vpn-to-ehr-repo-db-sg"
        } -> null
      - tags_all               = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
          - "Name"        = "test-vpn-to-ehr-repo-db-sg"
        } -> null
      - vpc_id                 = (sensitive value) -> null
        # (1 unchanged attribute hidden)
    }

  # aws_security_group_rule.vpn_to_db_sg[0] will be destroyed
  # (because aws_security_group_rule.vpn_to_db_sg is not in configuration)
  - resource "aws_security_group_rule" "vpn_to_db_sg" {
      - cidr_blocks              = [] -> null
      - description              = "Allow traffic from VPN to the db" -> null
      - from_port                = 5432 -> null
      - id                       = "sgrule-1448133580" -> null
      - ipv6_cidr_blocks         = [] -> null
      - prefix_list_ids          = [] -> null
      - protocol                 = "tcp" -> null
      - security_group_id        = "sg-0e2ca97a28f1af9be" -> null
      - self                     = false -> null
      - source_security_group_id = (sensitive value) -> null
      - to_port                  = 5432 -> null
      - type                     = "ingress" -> null
    }

  # aws_ssm_parameter.db_host will be destroyed
  # (because aws_ssm_parameter.db_host is not in configuration)
  - resource "aws_ssm_parameter" "db_host" {
      - arn             = "arn:aws:ssm:eu-west-2:005235525306:parameter/repo/test/output/prm-deductions-ehr-repository/db-host" -> null
      - data_type       = "text" -> null
      - id              = "/repo/test/output/prm-deductions-ehr-repository/db-host" -> null
      - name            = "/repo/test/output/prm-deductions-ehr-repository/db-host" -> null
      - tags            = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
        } -> null
      - tags_all        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
        } -> null
      - tier            = "Standard" -> null
      - type            = "String" -> null
      - value           = (sensitive value) -> null
      - version         = 1 -> null
        # (3 unchanged attributes hidden)
    }

  # aws_ssm_parameter.db_name will be destroyed
  # (because aws_ssm_parameter.db_name is not in configuration)
  - resource "aws_ssm_parameter" "db_name" {
      - arn             = "arn:aws:ssm:eu-west-2:005235525306:parameter/repo/test/output/prm-deductions-ehr-repository/db-name" -> null
      - data_type       = "text" -> null
      - id              = "/repo/test/output/prm-deductions-ehr-repository/db-name" -> null
      - name            = "/repo/test/output/prm-deductions-ehr-repository/db-name" -> null
      - tags            = {} -> null
      - tags_all        = {} -> null
      - tier            = "Standard" -> null
      - type            = "String" -> null
      - value           = (sensitive value) -> null
      - version         = 1 -> null
        # (3 unchanged attributes hidden)
    }

  # aws_ssm_parameter.db_resource_cluster_id will be destroyed
  # (because aws_ssm_parameter.db_resource_cluster_id is not in configuration)
  - resource "aws_ssm_parameter" "db_resource_cluster_id" {
      - arn             = "arn:aws:ssm:eu-west-2:005235525306:parameter/repo/test/output/prm-deductions-ehr-repository/db-resource-cluster-id" -> null
      - data_type       = "text" -> null
      - id              = "/repo/test/output/prm-deductions-ehr-repository/db-resource-cluster-id" -> null
      - name            = "/repo/test/output/prm-deductions-ehr-repository/db-resource-cluster-id" -> null
      - tags            = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
        } -> null
      - tags_all        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "test"
        } -> null
      - tier            = "Standard" -> null
      - type            = "String" -> null
      - value           = (sensitive value) -> null
      - version         = 1 -> null
        # (3 unchanged attributes hidden)
    }

Plan: 2 to add, 1 to change, 14 to destroy.

[chrisbloe-nhse]

Yup, let's go to version 4.