Skip to content

chore: GCForms release v3.43.3#1257

Open
cds-snc-release-bot[bot] wants to merge 1 commit intomainfrom
release-please--branches--main
Open

chore: GCForms release v3.43.3#1257
cds-snc-release-bot[bot] wants to merge 1 commit intomainfrom
release-please--branches--main

Conversation

@cds-snc-release-bot
Copy link
Copy Markdown
Contributor

@cds-snc-release-bot cds-snc-release-bot bot commented Mar 23, 2026

🤖 I have created a release beep boop

3.43.3 (2026-03-25)

Bug Fixes

  • notify-slack lambda logic should not be interrupted in case it fails to send Slack message (#1263) (6fc4e38)

Miscellaneous Chores

  • add option to increase computing resources for the AWS CodeBuild machine (#1262) (37d8d45)
  • creation of aws_codebuild_project.ecs_render should depend on creation of aws_iam_role_policy.codepipeline_policy resource (#1258) (bb804b5)
  • migrate GC Forms app deployment to new Code Pipeline solution (staging only) (#1227) (7b1b110)
  • modify app name in user_portal_code_pipeline to remove any '_' which would prevent the creation of an underlying S3 bucket (#1260) (ffc3499)
  • new deployment pipeline fixes (#1259) (f428adc)
  • revert changes to the creation of the codepipeline_policy resource (having an inline policy should work fine) (#1261) (f8bc04a)

This PR was generated with Release Please. See documentation.

@github-actions
Copy link
Copy Markdown

Production: ecr

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 0 to add, 0 to change, 0 to destroy
Show summary
CHANGE NAME
Show plan
Changes to Outputs:
  + ecr_form_viewer_repository_name                = "form_viewer_production"

You can apply this plan to save these new output values to the Terraform
state, without changing any real infrastructure.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Show Conftest results
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.api"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.forms_app_legacy_repository"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.idp"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.idp_user_portal"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.lambda[\"api-end-to-end-test-lambda\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.lambda[\"audit-logs-archiver-lambda\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.lambda[\"audit-logs-lambda\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.lambda[\"cognito-email-sender-lambda\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.lambda[\"cognito-pre-sign-up-lambda\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.lambda[\"file-upload-cleanup-lambda\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.lambda[\"file-upload-processor-lambda\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.lambda[\"form-archiver-lambda\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.lambda[\"nagware-lambda\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.lambda[\"notify-slack-lambda\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.lambda[\"prisma-migration-lambda\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.lambda[\"reliability-dlq-consumer-lambda\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.lambda[\"reliability-lambda\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.lambda[\"response-archiver-lambda\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecr_repository.lambda[\"submission-lambda\"]"]
WARN - plan.json - main - Missing Common Tags:...

@github-actions
Copy link
Copy Markdown

Production: oidc_roles

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

⚠️   Warning: resources will be destroyed by this change!

Plan: 0 to add, 0 to change, 3 to destroy
Show summary
CHANGE NAME
delete aws_iam_policy.forms_db_migration
aws_iam_role_policy_attachment.platform_forms_db_migration
module.github_workflow_roles.aws_iam_role.this["platform-forms-client-db-migration"]
Show plan
Resource actions are indicated with the following symbols:
  - destroy

Terraform will perform the following actions:

  # aws_iam_policy.forms_db_migration will be destroyed
  # (because aws_iam_policy.forms_db_migration is not in configuration)
  - resource "aws_iam_policy" "forms_db_migration" {
      - arn              = "arn:aws:iam::957818836222:policy/platform-forms-client-db-migration" -> null
      - attachment_count = 1 -> null
      - id               = "arn:aws:iam::957818836222:policy/platform-forms-client-db-migration" -> null
      - name             = "platform-forms-client-db-migration" -> null
      - path             = "/" -> null
      - policy           = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "s3:PutObjectTagging",
                          - "s3:PutObject",
                          - "s3:ListBucket",
                          - "s3:GetObjectTagging",
                          - "s3:GetObject",
                          - "s3:DeleteObject",
                        ]
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:s3:::forms-production-prisma-migration-storage/*",
                          - "arn:aws:s3:::forms-production-prisma-migration-storage",
                        ]
                    },
                  - {
                      - Action   = [
                          - "lambda:InvokeFunction",
                          - "lambda:GetFunction",
                        ]
                      - Effect   = "Allow"
                      - Resource = "arn:aws:lambda:ca-central-1:957818836222:function:prisma-migration"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - policy_id        = "ANPA56ATTST7F4LMLW7MW" -> null
      - tags             = {} -> null
      - tags_all         = {
          - "CostCentre" = "forms-platform-production"
          - "Terraform"  = "true"
        } -> null
        # (2 unchanged attributes hidden)
    }

  # aws_iam_role_policy_attachment.platform_forms_db_migration will be destroyed
  # (because aws_iam_role_policy_attachment.platform_forms_db_migration is not in configuration)
  - resource "aws_iam_role_policy_attachment" "platform_forms_db_migration" {
      - id         = "platform-forms-client-db-migration-20250408121647025900000001" -> null
      - policy_arn = "arn:aws:iam::957818836222:policy/platform-forms-client-db-migration" -> null
      - role       = "platform-forms-client-db-migration" -> null
    }

  # module.github_workflow_roles.aws_iam_role.this["platform-forms-client-db-migration"] will be destroyed
  # (because key ["platform-forms-client-db-migration"] is not in for_each map)
  - resource "aws_iam_role" "this" {
      - arn                   = "arn:aws:iam::957818836222:role/platform-forms-client-db-migration" -> null
      - assume_role_policy    = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "sts:AssumeRoleWithWebIdentity"
                      - Condition = {
                          - StringLike = {
                              - "token.actions.githubusercontent.com:sub" = "repo:cds-snc/platform-forms-client:ref:refs/tags/v*"
                            }
                        }
                      - Effect    = "Allow"
                      - Principal = {
                          - Federated = "arn:aws:iam::957818836222:oidc-provider/token.actions.githubusercontent.com"
                        }
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - create_date           = "2025-04-08T12:16:46Z" -> null
      - force_detach_policies = false -> null
      - id                    = "platform-forms-client-db-migration" -> null
      - managed_policy_arns   = [
          - "arn:aws:iam::957818836222:policy/platform-forms-client-db-migration",
        ] -> null
      - max_session_duration  = 3600 -> null
      - name                  = "platform-forms-client-db-migration" -> null
      - path                  = "/" -> null
      - tags                  = {
          - "CostCentre" = "forms-platform-production"
          - "Terraform"  = "true"
        } -> null
      - tags_all              = {
          - "CostCentre" = "forms-platform-production"
          - "Terraform"  = "true"
        } -> null
      - unique_id             = "AROA56ATTST7ORUOQRHPO" -> null
        # (3 unchanged attributes hidden)
    }

Plan: 0 to add, 0 to change, 3 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Show Conftest results
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.forms_api_release[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.platform_forms_client_release[0]"]

21 tests, 19 passed, 2 warnings, 0 failures, 0 exceptions

@github-actions
Copy link
Copy Markdown

Production: cognito

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 0 to add, 0 to change, 0 to destroy
Show summary
CHANGE NAME
Show plan
Changes to Outputs:
  + cognito_user_pool_id  = "ca-central-1_eSTGTCw33"

You can apply this plan to save these new output values to the Terraform
state, without changing any real infrastructure.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Show Conftest results
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.cognito_email_sender"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.cognito_pre_sign_up"]
WARN - plan.json - main - Missing Common Tags: ["aws_cognito_user_pool.forms"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.cognito_lambda_kms"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.cognito_lambda_logging"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.cognito_lambda_secrets"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.cognito_userpool_import_logging"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.cognito_lambda"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.cognito_userpool_import"]
WARN - plan.json - main - Missing Common Tags: ["aws_kms_key.cognito_encryption"]
WARN - plan.json - main - Missing Common Tags: ["aws_lambda_function.cognito_email_sender"]
WARN - plan.json - main - Missing Common Tags: ["aws_lambda_function.cognito_pre_sign_up"]

31 tests, 19 passed, 12 warnings, 0 failures, 0 exceptions

@github-actions
Copy link
Copy Markdown

Production: network

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 2 to add, 0 to change, 0 to destroy
Show summary
CHANGE NAME
add aws_vpc_security_group_egress_rule.code_build_to_database
aws_vpc_security_group_ingress_rule.database_to_code_build
Show plan
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_vpc_security_group_egress_rule.code_build_to_database will be created
  + resource "aws_vpc_security_group_egress_rule" "code_build_to_database" {
      + arn                          = (known after apply)
      + description                  = "Egress from Code Build to GC Forms database"
      + from_port                    = 5432
      + id                           = (known after apply)
      + ip_protocol                  = "tcp"
      + referenced_security_group_id = "sg-0603a6edcc9e34d98"
      + region                       = "ca-central-1"
      + security_group_id            = "sg-08700e3599aa098c1"
      + security_group_rule_id       = (known after apply)
      + tags_all                     = {
          + "CostCentre" = "forms-platform-production"
          + "Terraform"  = "true"
        }
      + to_port                      = 5432
    }

  # aws_vpc_security_group_ingress_rule.database_to_code_build will be created
  + resource "aws_vpc_security_group_ingress_rule" "database_to_code_build" {
      + arn                          = (known after apply)
      + description                  = "Ingress to GC Forms database from Code Build"
      + from_port                    = 5432
      + id                           = (known after apply)
      + ip_protocol                  = "tcp"
      + referenced_security_group_id = "sg-08700e3599aa098c1"
      + region                       = "ca-central-1"
      + security_group_id            = "sg-0603a6edcc9e34d98"
      + security_group_rule_id       = (known after apply)
      + tags_all                     = {
          + "CostCentre" = "forms-platform-production"
          + "Terraform"  = "true"
        }
      + to_port                      = 5432
    }

Plan: 2 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Show Conftest results
WARN - plan.json - main - Missing Common Tags: ["aws_default_network_acl.forms"]
WARN - plan.json - main - Missing Common Tags: ["aws_default_security_group.default"]
WARN - plan.json - main - Missing Common Tags: ["aws_eip.forms_natgw[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_eip.forms_natgw[1]"]
WARN - plan.json - main - Missing Common Tags: ["aws_eip.forms_natgw[2]"]
WARN - plan.json - main - Missing Common Tags: ["aws_flow_log.vpc_flow_logs[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_internet_gateway.forms"]
WARN - plan.json - main - Missing Common Tags: ["aws_nat_gateway.forms[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_nat_gateway.forms[1]"]
WARN - plan.json - main - Missing Common Tags: ["aws_nat_gateway.forms[2]"]
WARN - plan.json - main - Missing Common Tags: ["aws_route_table.forms_private_subnet[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_route_table.forms_private_subnet[1]"]
WARN - plan.json - main - Missing Common Tags: ["aws_route_table.forms_private_subnet[2]"]
WARN - plan.json - main - Missing Common Tags: ["aws_route_table.forms_public_subnet"]
WARN - plan.json - main - Missing Common Tags: ["aws_security_group.api_ecs"]
WARN - plan.json - main - Missing Common Tags: ["aws_security_group.api_end_to_end_test_lambda"]
WARN - plan.json - main - Missing Common Tags: ["aws_security_group.code_build"]
WARN - plan.json - main - Missing Common Tags: ["aws_security_group.connector_db"]
WARN - plan.json - main - Missing Common Tags: ["aws_security_group.forms"]
WARN - plan.json - main - Missing Common Tags: ["aws_security_group.forms_database"]
WARN - plan.json - main - Missing Common Tags: ["aws_security_group.forms_egress"]
WARN - plan.json - main - Missing Common Tags: ["aws_security_group.forms_load_balancer"]
WARN - plan.json - main - Missing Common Tags: ["aws_security_group.forms_redis"]
WARN - plan.json - main - Missing Common Tags: ["aws_security_group.glue_job"]
WARN - plan.json - main -...

@github-actions
Copy link
Copy Markdown

Production: idp

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

⚠️   Warning: resources will be destroyed by this change!

Plan: 1 to add, 1 to change, 1 to destroy
Show summary
CHANGE NAME
update module.idp_ecs.aws_ecs_service.this
recreate module.idp_ecs.aws_ecs_task_definition.this
Show plan
Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.idp_ecs.aws_ecs_service.this will be updated in-place
  ~ resource "aws_ecs_service" "this" {
        id                                 = "arn:aws:ecs:ca-central-1:957818836222:service/auth/zitadel"
        name                               = "zitadel"
        tags                               = {
            "CostCentre" = "forms-platform-production"
            "Terraform"  = "true"
        }
      ~ task_definition                    = "arn:aws:ecs:ca-central-1:957818836222:task-definition/zitadel:52" -> (known after apply)
        # (18 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # module.idp_ecs.aws_ecs_task_definition.this must be replaced
-/+ resource "aws_ecs_task_definition" "this" {
      ~ arn                      = "arn:aws:ecs:ca-central-1:957818836222:task-definition/zitadel:52" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:ca-central-1:957818836222:task-definition/zitadel" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                  ~ image                  = "957818836222.dkr.ecr.ca-central-1.amazonaws.com/idp/zitadel:v3.43.2" -> "957818836222.dkr.ecr.ca-central-1.amazonaws.com/idp/zitadel:latest"
                    name                   = "zitadel"
                    # (11 unchanged attributes hidden)
                },
            ] # forces replacement
        )
      ~ enable_fault_injection   = false -> (known after apply)
      ~ id                       = "zitadel" -> (known after apply)
      ~ revision                 = 52 -> (known after apply)
        tags                     = {
            "CostCentre" = "forms-platform-production"
            "Terraform"  = "true"
        }
      ~ tags_all                 = {
          + "CostCentre" = "forms-platform-production"
          + "Terraform"  = "true"
        }
        # (12 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 1 to add, 1 to change, 1 to destroy.

Warning: Deprecated attribute

  on .terraform/modules/idp_database/rds/locals.tf line 14, in locals:
  14:   region        = data.aws_region.current.name

The attribute "name" is deprecated. Refer to the provider documentation for
details.

(and 2 more similar warnings elsewhere)

Warning: Argument is deprecated

  with module.idp_ecs.aws_service_discovery_service.this,
  on .terraform/modules/idp_ecs/ecs/service_discovery.tf line 15, in resource "aws_service_discovery_service" "this":
  15:     failure_threshold = 1

failure_threshold is deprecated. The argument is no longer supported by AWS
and the value is always set to 1. The attribute will be removed in a future
major version.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Show Conftest results
WARN - plan.json - main - Missing Common Tags: ["aws_alb_listener_rule.idp_protocol_version"]
WARN - plan.json - main - Missing Common Tags: ["aws_alb_listener_rule.security_txt"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.user_portal"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecs_cluster.idp"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecs_task_definition.user_portal"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.ecs_xray"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.idp_send_email"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.user_portal_secrets_manager"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.user_portal_ssm"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.idp_user_portal"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_user.idp_send_email"]
WARN - plan.json - main - Missing Common Tags: ["aws_shield_protection.idp"]

31 tests, 19 passed, 12 warnings, 0 failures, 0 exceptions

@github-actions
Copy link
Copy Markdown

Production: app

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 2 to move, 0 to add, 1 to change, 0 to destroy
Show summary
CHANGE NAME
update aws_ecs_task_definition.form_viewer
Show plan
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_codedeploy_app.app has moved to aws_codedeploy_app.app[0]
    resource "aws_codedeploy_app" "app" {
        id                  = "38ffd54a-d5be-4ce4-8a02-127b6be4b444:AppECS-Forms-form-viewer"
        name                = "AppECS-Forms-form-viewer"
        tags                = {}
        # (7 unchanged attributes hidden)
    }

  # aws_codedeploy_deployment_group.app has moved to aws_codedeploy_deployment_group.app[0]
    resource "aws_codedeploy_deployment_group" "app" {
        id                          = "242791d0-af89-4e05-8e16-b250dac864b9"
        tags                        = {}
        # (12 unchanged attributes hidden)

        # (5 unchanged blocks hidden)
    }

  # aws_ecs_task_definition.form_viewer will be updated in-place
  ~ resource "aws_ecs_task_definition" "form_viewer" {
      # Warning: this attribute value will be marked as sensitive and will not
      # display in UI output after applying this change. The value is unchanged.
      ~ container_definitions    = (sensitive value)
        id                       = "form-viewer"
        tags                     = {}
        # (17 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Show Conftest results
WARN - plan.json - main - Missing Common Tags: ["aws_appautoscaling_target.forms[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.forms"]
WARN - plan.json - main - Missing Common Tags: ["aws_codedeploy_app.app[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_codedeploy_deployment_group.app[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecs_cluster.forms"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecs_service.form_viewer"]
WARN - plan.json - main - Missing Common Tags: ["aws_ecs_task_definition.form_viewer"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.cognito"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.ecs_xray"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.forms_audit_logs"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.forms_dynamodb"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.forms_kms"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.forms_s3"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.forms_secrets_manager"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.forms_sqs"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.codedeploy"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.forms"]

36 tests, 19 passed, 17 warnings, 0 failures, 0 exceptions

@github-actions
Copy link
Copy Markdown

Production: alarms

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 2 to add, 0 to change, 0 to destroy
Show summary
CHANGE NAME
add aws_cloudwatch_event_rule.code_pipeline_state_change
aws_cloudwatch_event_target.code_pipeline_state_change_to_sns
Show plan
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_cloudwatch_event_rule.code_pipeline_state_change will be created
  + resource "aws_cloudwatch_event_rule" "code_pipeline_state_change" {
      + arn            = (known after apply)
      + description    = "Catch Code Pipeline execution state change"
      + event_bus_name = "default"
      + event_pattern  = jsonencode(
            {
              + detail      = {
                  + state = [
                      + "STARTED",
                      + "SUCCEEDED",
                      + "FAILED",
                    ]
                }
              + detail-type = [
                  + "CodePipeline Pipeline Execution State Change",
                ]
              + source      = [
                  + "aws.codepipeline",
                ]
            }
        )
      + force_destroy  = false
      + id             = (known after apply)
      + name           = "alert-on-code-pipeline-state-change"
      + name_prefix    = (known after apply)
      + region         = "ca-central-1"
      + tags_all       = {
          + "CostCentre" = "forms-platform-production"
          + "Terraform"  = "true"
        }
    }

  # aws_cloudwatch_event_target.code_pipeline_state_change_to_sns will be created
  + resource "aws_cloudwatch_event_target" "code_pipeline_state_change_to_sns" {
      + arn            = "arn:aws:sns:ca-central-1:957818836222:alert-warning"
      + event_bus_name = "default"
      + force_destroy  = false
      + id             = (known after apply)
      + region         = "ca-central-1"
      + rule           = "alert-on-code-pipeline-state-change"
      + target_id      = "CodeDeploy_SNS"

      + input_transformer {
          + input_paths    = {
              + "executionId"  = "$.detail.execution-id"
              + "pipelineName" = "$.detail.pipeline"
              + "status"       = "$.detail.state"
            }
          + input_template = "\"CodePipeline <pipelineName> has <status> (execution identifier: <executionId>)\""
        }
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Warning: Invalid Attribute Combination

  with aws_s3_bucket_lifecycle_configuration.athena_spill_bucket,
  on athena.tf line 56, in resource "aws_s3_bucket_lifecycle_configuration" "athena_spill_bucket":
  56: resource "aws_s3_bucket_lifecycle_configuration" "athena_spill_bucket" {

No attribute specified when one (and only one) of
[rule[0].filter,rule[0].prefix] is required

This will be an error in a future version of the provider

Warning: Deprecated attribute

  on .terraform/modules/athena/athena_access_logs/locals.tf line 6, in locals:
   6:   region     = data.aws_region.current.name

The attribute "name" is deprecated. Refer to the provider documentation for
details.

Warning: Argument is deprecated

  with module.athena_bucket.aws_s3_bucket.this,
  on .terraform/modules/athena_bucket/S3/main.tf line 8, in resource "aws_s3_bucket" "this":
   8: resource "aws_s3_bucket" "this" {

lifecycle_rule is deprecated. Use the aws_s3_bucket_lifecycle_configuration
resource instead.

(and 2 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Show Conftest results
WARN - plan.json - main - Missing Common Tags: ["aws_athena_data_catalog.dynamodb"]
WARN - plan.json - main - Missing Common Tags: ["aws_athena_data_catalog.rds_data_catalog"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_event_rule.code_pipeline_state_change"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_event_rule.codedeploy_sns"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.notify_slack"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.ELB_5xx_error_warn"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.ELB_healthy_hosts"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.alb_ddos"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.api_cpu_utilization_high_warn"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.api_lb_healthy_host_count"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.api_lb_unhealthy_host_count"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.api_memory_utilization_high_warn"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.api_response_time_warn"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.cognito_signin_exceeded"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.ddos_detected_forms_warn"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.ddos_detected_route53_warn[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.dlq_message_detector[\"api_audit_log\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.dlq_message_detector[\"app_audit_log\"]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.dlq_message_detector[\"file_upload\"]"]
WARN - plan.json - main - Missing Common Tags:...

@cds-snc-release-bot cds-snc-release-bot bot force-pushed the release-please--branches--main branch from bcadf13 to c243d0f Compare March 25, 2026 12:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants