feat: rename files and remove some unused iam

[CalvinRodo]

Summary | Résumé

Debugging stuff

[github-actions]

cloud_asset_inventory

✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

⚠️   Warning: resources will be destroyed by this change!

Plan: 0 to add, 3 to change, 9 to destroy

Show plan

Resource actions are indicated with the following symbols:
  ~ update in-place
  - destroy

Terraform will perform the following actions:

  # aws_iam_policy.cloudquery_policies will be updated in-place
  ~ resource "aws_iam_policy" "cloudquery_policies" {
        id        = "arn:aws:iam::794722365809:policy/CloudqueryContainerExecutionPolicies"
        name      = "CloudqueryContainerExecutionPolicies"
      ~ policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Resource = [
                          - "arn:aws:iam::*:role/secopsAssetInventorySecurityAuditRole",
                          - "arn:aws:iam::794722365809:role/secopsAssetInventoryCloudqueryRole",
                        ] -> "arn:aws:iam::*:role/secopsAssetInventorySecurityAuditRole"
                        # (3 unchanged elements hidden)
                    },
                    {
                        Action   = "ec2:Describe*"
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = ""
                    },
                    # (1 unchanged element hidden)
                ]
                # (1 unchanged element hidden)
            }
        )
        tags      = {
            "CostCentre" = "security-tools-794722365809"
            "Product"    = "security-tools-cloud-asset-inventory"
            "Terraform"  = "true"
        }
        # (4 unchanged attributes hidden)
    }

  # aws_iam_policy.write_waf_logs will be destroyed
  # (because aws_iam_policy.write_waf_logs is not in configuration)
  - resource "aws_iam_policy" "write_waf_logs" {
      - arn         = "arn:aws:iam::794722365809:policy/security-tools-cloud-asset-inventory_WriteLogs" -> null
      - description = "Allow writing WAF logs to S3 + CloudWatch" -> null
      - id          = "arn:aws:iam::794722365809:policy/security-tools-cloud-asset-inventory_WriteLogs" -> null
      - name        = "security-tools-cloud-asset-inventory_WriteLogs" -> null
      - path        = "/" -> null
      - policy      = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "s3:PutObject",
                          - "s3:ListBucketMultipartUploads",
                          - "s3:ListBucket",
                          - "s3:GetObject",
                          - "s3:GetBucketLocation",
                          - "s3:AbortMultipartUpload",
                        ]
                      - Effect   = "Allow"
                      - Resource = "arn:aws:s3:::cbs-satellite-794722365809/*"
                      - Sid      = "S3PutObjects"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - policy_id   = "ANPA3SCJE6FYYMQJOQULF" -> null
      - tags        = {
          - "CostCentre" = "security-tools-794722365809"
          - "Product"    = "security-tools-cloud-asset-inventory"
          - "Terraform"  = "true"
        } -> null
      - tags_all    = {
          - "CostCentre" = "security-tools-794722365809"
          - "Product"    = "security-tools-cloud-asset-inventory"
          - "Terraform"  = "true"
        } -> null
    }

  # aws_iam_role.cloudquery_container_execution_role will be updated in-place
  ~ resource "aws_iam_role" "cloudquery_container_execution_role" {
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Principal = {
                          ~ Service = [
                              - "ecs-tasks.amazonaws.com",
                                "ecs.amazonaws.com",
                                "ec2.amazonaws.com",
                              + "ecs-tasks.amazonaws.com",
                            ]
                        }
                        # (3 unchanged elements hidden)
                    },
                  - {
                      - Action    = "sts:AssumeRole"
                      - Condition = {
                          - ArnLike      = {
                              - "aws:SourceArn" = "arn:aws:ecs:ca-central-1:794722365809:*"
                            }
                          - StringEquals = {
                              - "aws:SourceAccount" = "794722365809"
                            }
                        }
                      - Effect    = "Allow"
                      - Principal = {
                          - Service = "ecs-tasks.amazonaws.com"
                        }
                    },
                ]
                # (1 unchanged element hidden)
            }
        )
        id                    = "cloudquery_container_execution_role"
        name                  = "cloudquery_container_execution_role"
        tags                  = {
            "CostCentre" = "security-tools-794722365809"
            "Product"    = "security-tools-cloud-asset-inventory"
            "Terraform"  = "true"
        }
        # (8 unchanged attributes hidden)
    }

  # aws_iam_role.cloudquery_task_execution_role will be updated in-place
  ~ resource "aws_iam_role" "cloudquery_task_execution_role" {
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Principal = {
                          - AWS     = [
                              - "arn:aws:iam::794722365809:role/cloudquery_container_execution_role",
                              - "arn:aws:sts::794722365809:assumed-role/AWSReservedSSO_AWSAdministratorAccess_b6d6eefb49121fb1/guillaume.charest@cds-snc.ca",
                            ] -> null
                            # (1 unchanged element hidden)
                        }
                        # (3 unchanged elements hidden)
                    },
                  - {
                      - Action    = "sts:AssumeRole"
                      - Condition = {
                          - ArnLike = {
                              - "aws:SourceArn" = "arn:aws:sts::794722365809:assumed-role/secopsAssetInventoryCloudqueryRole/*"
                            }
                        }
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS     = "arn:aws:iam::794722365809:role/secopsAssetInventoryCloudqueryRole"
                          - Service = "ecs-tasks.amazonaws.com"
                        }
                    },
                ]
                # (1 unchanged element hidden)
            }
        )
        id                    = "secopsAssetInventoryCloudqueryRole"
        name                  = "secopsAssetInventoryCloudqueryRole"
        tags                  = {
            "CostCentre" = "security-tools-794722365809"
            "Product"    = "security-tools-cloud-asset-inventory"
            "Terraform"  = "true"
        }
        # (8 unchanged attributes hidden)
    }

  # aws_iam_role.list_accounts_in_org will be destroyed
  # (because aws_iam_role.list_accounts_in_org is not in configuration)
  - resource "aws_iam_role" "list_accounts_in_org" {
      - arn                   = "arn:aws:iam::794722365809:role/ListAccountsInOrg" -> null
      - assume_role_policy    = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "sts:AssumeRole"
                      - Effect    = "Allow"
                      - Principal = {
                          - Service = "states.amazonaws.com"
                        }
                      - Sid       = ""
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - create_date           = "2023-03-13T13:20:00Z" -> null
      - force_detach_policies = false -> null
      - id                    = "ListAccountsInOrg" -> null
      - managed_policy_arns   = [
          - "arn:aws:iam::aws:policy/AWSAccountManagementReadOnlyAccess",
          - "arn:aws:iam::aws:policy/service-role/AWSLambdaRole",
        ] -> null
      - max_session_duration  = 3600 -> null
      - name                  = "ListAccountsInOrg" -> null
      - path                  = "/" -> null
      - tags                  = {} -> null
      - tags_all              = {} -> null
      - unique_id             = "AROA3SCJE6FYQNRHCL7DX" -> null
    }

  # aws_iam_role.waf_log_role will be destroyed
  # (because aws_iam_role.waf_log_role is not in configuration)
  - resource "aws_iam_role" "waf_log_role" {
      - arn                   = "arn:aws:iam::794722365809:role/security-tools-cloud-asset-inventory-logs" -> null
      - assume_role_policy    = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "sts:AssumeRole"
                      - Effect    = "Allow"
                      - Principal = {
                          - Service = "firehose.amazonaws.com"
                        }
                      - Sid       = ""
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - create_date           = "2022-05-13T15:02:07Z" -> null
      - force_detach_policies = false -> null
      - id                    = "security-tools-cloud-asset-inventory-logs" -> null
      - managed_policy_arns   = [
          - "arn:aws:iam::794722365809:policy/security-tools-cloud-asset-inventory_WriteLogs",
        ] -> null
      - max_session_duration  = 3600 -> null
      - name                  = "security-tools-cloud-asset-inventory-logs" -> null
      - path                  = "/" -> null
      - tags                  = {
          - "CostCentre" = "security-tools-794722365809"
          - "Product"    = "security-tools-cloud-asset-inventory"
          - "Terraform"  = "true"
        } -> null
      - tags_all              = {
          - "CostCentre" = "security-tools-794722365809"
          - "Product"    = "security-tools-cloud-asset-inventory"
          - "Terraform"  = "true"
        } -> null
      - unique_id             = "AROA3SCJE6FYTE2LPOOKD" -> null

      - inline_policy {}
    }

  # aws_iam_role_policy_attachment.cloudwatch_policies will be destroyed
  # (because aws_iam_role_policy_attachment.cloudwatch_policies is not in configuration)
  - resource "aws_iam_role_policy_attachment" "cloudwatch_policies" {
      - id         = "secopsAssetInventoryCloudqueryRole-20230330162011986600000004" -> null
      - policy_arn = "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy" -> null
      - role       = "secopsAssetInventoryCloudqueryRole" -> null
    }

  # aws_iam_role_policy_attachment.ec2_container_registery_policies will be destroyed
  # (because aws_iam_role_policy_attachment.ec2_container_registery_policies is not in configuration)
  - resource "aws_iam_role_policy_attachment" "ec2_container_registery_policies" {
      - id         = "secopsAssetInventoryCloudqueryRole-20230330162012065100000005" -> null
      - policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly" -> null
      - role       = "secopsAssetInventoryCloudqueryRole" -> null
    }

  # aws_iam_role_policy_attachment.ecs_container_registery_policies will be destroyed
  # (because aws_iam_role_policy_attachment.ecs_container_registery_policies is not in configuration)
  - resource "aws_iam_role_policy_attachment" "ecs_container_registery_policies" {
      - id         = "secopsAssetInventoryCloudqueryRole-20230330162012076700000006" -> null
      - policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy" -> null
      - role       = "secopsAssetInventoryCloudqueryRole" -> null
    }

  # aws_iam_role_policy_attachment.ecs_task_execution_policy will be destroyed
  # (because aws_iam_role_policy_attachment.ecs_task_execution_policy is not in configuration)
  - resource "aws_iam_role_policy_attachment" "ecs_task_execution_policy" {
      - id         = "secopsAssetInventoryCloudqueryRole-20230330162011945700000003" -> null
      - policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy" -> null
      - role       = "secopsAssetInventoryCloudqueryRole" -> null
    }

  # aws_iam_role_policy_attachment.list_accounts_in_org will be destroyed
  # (because aws_iam_role_policy_attachment.list_accounts_in_org is not in configuration)
  - resource "aws_iam_role_policy_attachment" "list_accounts_in_org" {
      - id         = "ListAccountsInOrg-20230313132001669700000001" -> null
      - policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaRole" -> null
      - role       = "ListAccountsInOrg" -> null
    }

  # aws_iam_role_policy_attachment.write_waf_logs will be destroyed
  # (because aws_iam_role_policy_attachment.write_waf_logs is not in configuration)
  - resource "aws_iam_role_policy_attachment" "write_waf_logs" {
      - id         = "security-tools-cloud-asset-inventory-logs-20220513150208665200000003" -> null
      - policy_arn = "arn:aws:iam::794722365809:policy/security-tools-cloud-asset-inventory_WriteLogs" -> null
      - role       = "security-tools-cloud-asset-inventory-logs" -> null
    }

Plan: 0 to add, 3 to change, 9 to destroy.

Warning: Argument is deprecated

  with module.cloudquery_s3_bucket.aws_s3_bucket.this,
  on .terraform/modules/cloudquery_s3_bucket/S3/main.tf line 8, in resource "aws_s3_bucket" "this":
   8: resource "aws_s3_bucket" "this" {

Use the aws_s3_bucket_server_side_encryption_configuration resource instead

(and 2 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Releasing state lock. This may take a few moments...

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_event_rule.cloudquery"]

18 tests, 17 passed, 1 warning, 0 failures, 0 exceptions