Upgrade gha-admin to 4.1.0 and add name_prefix to avoid role collisions#33
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
State
|
| Success | 🟢 Add | 🟡 Change | 🔴 Destroy |
|---|---|---|---|
| ✅ | 27 | 12 | 15 |
Affected resources by action
| Action | Resources |
|---|---|
| 🟢 | module.aws_service_infrahouse_app.github_repository_environment.cd["production"] |
| 🟢 | module.aws_service_infrahouse_app.github_repository_environment.ci["production"] |
| 🟢 | module.aws_service_infrahouse_app.github_repository_file.makefile_env["production"] |
| 🟢 | module.aws_service_infrahouse_app.github_repository_file.releases_auto_tfvars["production"] |
| 🟢 | module.aws_service_infrahouse_app.github_repository_file.requirements_txt["production"] |
| 🟢 | module.aws_service_infrahouse_app.github_repository_file.terraform_tf["production"] |
| 🟢 | module.aws_service_infrahouse_app.github_repository_file.terraform_tfvars["production"] |
| 🟢 | module.aws_service_infrahouse_app_gha_production.aws_iam_policy.github |
| 🟢 | module.aws_service_infrahouse_app_gha_production.aws_iam_role_policy_attachment.github |
| 🟢 | module.aws_service_infrahouse_app_gha_production.module.state-manager.aws_iam_role.state-manager |
| 🟢 | module.aws_service_infrahouse_app_gha_production.module.state-manager.aws_iam_role_policy_attachment.state-manager-ro |
| 🟢 | module.aws_service_infrahouse_app_gha_production.module.state-manager.aws_iam_role_policy_attachment.state-manager-rw[0] |
| 🟡 | github_team_members.admins |
| 🟡 | github_team_members.dev |
| 🟡 | module.aws_service_infrahouse_app.github_actions_variable.aws_default_region |
| 🟡 | module.aws_service_infrahouse_app.github_actions_variable.role_admin |
| 🟡 | module.aws_service_infrahouse_app.github_actions_variable.role_github |
| 🟡 | module.aws_service_infrahouse_app.github_actions_variable.role_state_manager |
| 🟡 | module.aws_service_infrahouse_app.github_repository_file.makefile_fragment[0] |
| 🟡 | module.aws_service_infrahouse_app.github_repository_file.terraform_cd[0] |
| 🟡 | module.aws_service_infrahouse_app.github_repository_file.terraform_ci[0] |
| 🟡 | module.aws_service_infrahouse_app.github_repository_file.terraform_drift_wrapper[0] |
| 🟡 | module.aws_service_infrahouse_app.github_repository_file.terraform_tf["sandbox"] |
| 🟡 | module.aws_service_infrahouse_app.github_repository_ruleset.main |
STDOUT
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
~ update in-place
-/+ destroy and then create replacement
<= read (data resources)
Terraform will perform the following actions:
# github_team_members.admins will be updated in-place
~ resource "github_team_members" "admins" {
id = "14268696"
# (1 unchanged attribute hidden)
- members {
- role = "maintainer" -> null
- username = "infrahouse8" -> null
}
+ members {
+ role = "member"
+ username = "infrahouse8"
}
# (1 unchanged block hidden)
}
# github_team_members.dev will be updated in-place
~ resource "github_team_members" "dev" {
id = "7332815"
# (1 unchanged attribute hidden)
- members {
- role = "maintainer" -> null
- username = "infrahouse8" -> null
}
+ members {
+ role = "member"
+ username = "infrahouse8"
}
# (2 unchanged blocks hidden)
}
# module.aws_service_infrahouse_app.github_actions_variable.aws_default_region will be updated in-place
~ resource "github_actions_variable" "aws_default_region" {
id = "aws-service-infrahouse-app:AWS_DEFAULT_REGION"
~ value = jsonencode(
~ {
+ production = "us-west-1"
# (1 unchanged attribute hidden)
}
)
# (5 unchanged attributes hidden)
}
# module.aws_service_infrahouse_app.github_actions_variable.role_admin will be updated in-place
~ resource "github_actions_variable" "role_admin" {
id = "aws-service-infrahouse-app:ROLE_ADMIN"
~ value = jsonencode(
{
- sandbox = "arn:aws:iam::303467602807:role/ih-tf-aws-service-infrahouse-app-admin"
}
) -> (known after apply)
# (5 unchanged attributes hidden)
}
# module.aws_service_infrahouse_app.github_actions_variable.role_github will be updated in-place
~ resource "github_actions_variable" "role_github" {
id = "aws-service-infrahouse-app:ROLE_GITHUB"
~ value = jsonencode(
{
- sandbox = "arn:aws:iam::303467602807:role/ih-tf-aws-service-infrahouse-app-github"
}
) -> (known after apply)
# (5 unchanged attributes hidden)
}
# module.aws_service_infrahouse_app.github_actions_variable.role_state_manager will be updated in-place
~ resource "github_actions_variable" "role_state_manager" {
id = "aws-service-infrahouse-app:ROLE_STATE_MANAGER"
~ value = jsonencode(
{
- sandbox = "arn:aws:iam::289256138624:role/ih-tf-aws-service-infrahouse-app-state-manager"
}
) -> (known after apply)
# (5 unchanged attributes hidden)
}
# module.aws_service_infrahouse_app.github_repository_environment.cd["production"] will be created
+ resource "github_repository_environment" "cd" {
+ can_admins_bypass = true
+ environment = "live-production"
+ id = (known after apply)
+ prevent_self_review = false
+ repository = "aws-service-infrahouse-app"
+ repository_id = (known after apply)
+ reviewers {
+ teams = [
+ 14268696,
]
}
}
# module.aws_service_infrahouse_app.github_repository_environment.ci["production"] will be created
+ resource "github_repository_environment" "ci" {
+ can_admins_bypass = true
+ environment = "continuous-integration-production"
+ id = (known after apply)
+ prevent_self_review = false
+ repository = "aws-service-infrahouse-app"
+ repository_id = (known after apply)
}
# module.aws_service_infrahouse_app.github_repository_file.makefile_env["production"] will be created
+ resource "github_repository_file" "makefile_env" {
+ autocreate_branch_source_sha = (known after apply)
+ branch = (known after apply)
+ commit_message = "Add Makefile for production environment"
+ commit_sha = (known after apply)
+ content = <<-EOT
# This file is managed by Terraform in infrahouse/github-control repository.
# Do not edit this file, all changes will be overwritten.
# If you need to add custom targets, create a new file in the makefiles/ directory.
include $(wildcard ../../makefiles/*)
EOT
+ file = "environments/production/Makefile"
+ id = (known after apply)
+ overwrite_on_create = true
+ ref = (known after apply)
+ repository = "aws-service-infrahouse-app"
+ repository_id = (known after apply)
+ sha = (known after apply)
}
# module.aws_service_infrahouse_app.github_repository_file.makefile_fragment[0] will be updated in-place
~ resource "github_repository_file" "makefile_fragment" {
~ commit_message = "Update makefiles/Makefile" -> "Add makefiles/Makefile"
id = "aws-service-infrahouse-app:makefiles/Makefile:main"
# (9 unchanged attributes hidden)
}
# module.aws_service_infrahouse_app.github_repository_file.releases_auto_tfvars["production"] will be created
+ resource "github_repository_file" "releases_auto_tfvars" {
+ autocreate_branch_source_sha = (known after apply)
+ branch = "main"
+ commit_message = "Add releases.auto.tfvars for production environment"
+ commit_sha = (known after apply)
+ content = <<-EOT
# Release-managed values — bumped by CI pipelines or release managers.
# This file is owned by the service repo, not github-control.
docker_image_tag = "latest"
EOT
+ file = "environments/production/releases.auto.tfvars"
+ id = (known after apply)
+ overwrite_on_create = true
+ ref = (known after apply)
+ repository = "aws-service-infrahouse-app"
+ repository_id = (known after apply)
+ sha = (known after apply)
}
# module.aws_service_infrahouse_app.github_repository_file.requirements_txt["production"] will be created
+ resource "github_repository_file" "requirements_txt" {
+ autocreate_branch_source_sha = (known after apply)
+ branch = (known after apply)
+ commit_message = "Add requirements.txt for production environment"
+ commit_sha = (known after apply)
+ content = <<-EOT
infrahouse-toolkit ~= 2.59
semgrep ~= 1.163
yamllint ~= 1.29
EOT
+ file = "environments/production/requirements.txt"
+ id = (known after apply)
+ overwrite_on_create = false
+ ref = (known after apply)
+ repository = "aws-service-infrahouse-app"
+ repository_id = (known after apply)
+ sha = (known after apply)
}
# module.aws_service_infrahouse_app.github_repository_file.terraform_cd[0] will be updated in-place
~ resource "github_repository_file" "terraform_cd" {
~ content = <<-EOT
---
name: "Terraform CD"
on: # yamllint disable-line rule:truthy
pull_request:
types:
- "closed"
permissions:
id-token: "write"
contents: "read"
concurrency:
group: "terraform"
cancel-in-progress: false
jobs:
deploy-order-0:
if: "github.event.pull_request.merged"
strategy:
fail-fast: false
matrix:
env: ["sandbox"]
name: "Terraform Apply ${{ matrix.env }}"
runs-on: ubuntu-24.04
environment: "live-${{ matrix.env }}"
timeout-minutes: 60
env:
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
REGION_JSON: "${{ vars.AWS_DEFAULT_REGION }}"
ROLE_GITHUB_JSON: "${{ vars.ROLE_GITHUB }}"
ROLE_SM_JSON: "${{ vars.ROLE_STATE_MANAGER }}"
TF_VAR_environment: "${{ matrix.env }}"
defaults:
run:
shell: "bash"
steps:
- name: "Checkout"
uses: "actions/checkout@v6"
- name: "Extract Variables"
id: "extract_vars"
run: |
REGION=$(echo '${{ env.REGION_JSON }}' | jq -r '.${{ matrix.env }}')
echo "REGION=$REGION" >> "$GITHUB_OUTPUT"
ROLE_GITHUB=$(echo '${{ env.ROLE_GITHUB_JSON }}' | jq -r '.${{ matrix.env }}')
echo "ROLE_GITHUB=$ROLE_GITHUB" >> "$GITHUB_OUTPUT"
ROLE_SM=$(echo '${{ env.ROLE_SM_JSON }}' | jq -r '.${{ matrix.env }}')
echo "ROLE_STATE_MANAGER=$ROLE_SM" >> "$GITHUB_OUTPUT"
- name: "Configure AWS Credentials"
uses: "aws-actions/configure-aws-credentials@v6"
with:
role-to-assume: "${{ steps.extract_vars.outputs.ROLE_GITHUB }}"
role-session-name: "github-actions-${{ matrix.env }}"
aws-region: "${{ steps.extract_vars.outputs.REGION }}"
- name: "Set Terraform version"
id: "terraform_version"
run: |
echo "IH_TF_VERSION=$(cat .terraform-version)" >> "$GITHUB_OUTPUT"
- name: "Setup Terraform"
uses: "hashicorp/setup-terraform@v4"
with:
terraform_version: "${{ steps.terraform_version.outputs.IH_TF_VERSION }}"
- name: "Set up Python"
uses: "actions/setup-python@v6"
with:
python-version: "3.14"
- name: "Setup Python Environment"
working-directory: "environments/${{ matrix.env }}"
run: |
make bootstrap
- name: "Download Terraform Plan"
working-directory: "environments/${{ matrix.env }}"
run: |
ih-plan \
--aws-assume-role-arn \
${{ steps.extract_vars.outputs.ROLE_STATE_MANAGER }} \
download \
plans/${{ matrix.env }}/${{ github.event.pull_request.number }}.plan \
tf.plan
- name: "Terraform Init"
working-directory: "environments/${{ matrix.env }}"
run: |
terraform init -input=false
- name: "Terraform Validate"
working-directory: "environments/${{ matrix.env }}"
run: |
terraform validate -no-color
- name: "Terraform Apply"
working-directory: "environments/${{ matrix.env }}"
run: |
make apply
- name: "Remove Plan"
working-directory: "environments/${{ matrix.env }}"
run: |
ih-plan \
--aws-assume-role-arn \
${{ steps.extract_vars.outputs.ROLE_STATE_MANAGER }} \
remove \
plans/${{ matrix.env }}/${{ github.event.pull_request.number }}.plan
+ deploy-order-1:
+ if: "github.event.pull_request.merged"
+ needs: ["deploy-order-0"]
+ strategy:
+ fail-fast: false
+ matrix:
+ env: ["production"]
+ name: "Terraform Apply ${{ matrix.env }}"
+ runs-on: ubuntu-24.04
+ environment: "live-${{ matrix.env }}"
+ timeout-minutes: 60
+ env:
+ GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+ REGION_JSON: "${{ vars.AWS_DEFAULT_REGION }}"
+ ROLE_GITHUB_JSON: "${{ vars.ROLE_GITHUB }}"
+ ROLE_SM_JSON: "${{ vars.ROLE_STATE_MANAGER }}"
+ TF_VAR_environment: "${{ matrix.env }}"
+
+ defaults:
+ run:
+ shell: "bash"
+
+ steps:
+ - name: "Checkout"
+ uses: "actions/checkout@v6"
+
+ - name: "Extract Variables"
+ id: "extract_vars"
+ run: |
+ REGION=$(echo '${{ env.REGION_JSON }}' | jq -r '.${{ matrix.env }}')
+ echo "REGION=$REGION" >> "$GITHUB_OUTPUT"
+ ROLE_GITHUB=$(echo '${{ env.ROLE_GITHUB_JSON }}' | jq -r '.${{ matrix.env }}')
+ echo "ROLE_GITHUB=$ROLE_GITHUB" >> "$GITHUB_OUTPUT"
+ ROLE_SM=$(echo '${{ env.ROLE_SM_JSON }}' | jq -r '.${{ matrix.env }}')
+ echo "ROLE_STATE_MANAGER=$ROLE_SM" >> "$GITHUB_OUTPUT"
+
+ - name: "Configure AWS Credentials"
+ uses: "aws-actions/configure-aws-credentials@v6"
+ with:
+ role-to-assume: "${{ steps.extract_vars.outputs.ROLE_GITHUB }}"
+ role-session-name: "github-actions-${{ matrix.env }}"
+ aws-region: "${{ steps.extract_vars.outputs.REGION }}"
+
+ - name: "Set Terraform version"
+ id: "terraform_version"
+ run: |
+ echo "IH_TF_VERSION=$(cat .terraform-version)" >> "$GITHUB_OUTPUT"
+
+ - name: "Setup Terraform"
+ uses: "hashicorp/setup-terraform@v4"
+ with:
+ terraform_version: "${{ steps.terraform_version.outputs.IH_TF_VERSION }}"
+
+ - name: "Set up Python"
+ uses: "actions/setup-python@v6"
+ with:
+ python-version: "3.14"
+
+ - name: "Setup Python Environment"
+ working-directory: "environments/${{ matrix.env }}"
+ run: |
+ make bootstrap
+
+ - name: "Download Terraform Plan"
+ working-directory: "environments/${{ matrix.env }}"
+ run: |
+ ih-plan \
+ --aws-assume-role-arn \
+ ${{ steps.extract_vars.outputs.ROLE_STATE_MANAGER }} \
+ download \
+ plans/${{ matrix.env }}/${{ github.event.pull_request.number }}.plan \
+ tf.plan
+
+ - name: "Terraform Init"
+ working-directory: "environments/${{ matrix.env }}"
+ run: |
+ terraform init -input=false
+
+ - name: "Terraform Validate"
+ working-directory: "environments/${{ matrix.env }}"
+ run: |
+ terraform validate -no-color
+
+ - name: "Terraform Apply"
+ working-directory: "environments/${{ matrix.env }}"
+ run: |
+ make apply
+
+ - name: "Remove Plan"
+ working-directory: "environments/${{ matrix.env }}"
+ run: |
+ ih-plan \
+ --aws-assume-role-arn \
+ ${{ steps.extract_vars.outputs.ROLE_STATE_MANAGER }} \
+ remove \
+ plans/${{ matrix.env }}/${{ github.event.pull_request.number }}.plan
EOT
id = "aws-service-infrahouse-app:.github/workflows/terraform-CD.yml:main"
# (9 unchanged attributes hidden)
}
# module.aws_service_infrahouse_app.github_repository_file.terraform_ci[0] will be updated in-place
~ resource "github_repository_file" "terraform_ci" {
~ content = <<-EOT
---
name: "Terraform CI"
on: # yamllint disable-line rule:truthy
pull_request:
permissions:
id-token: "write"
contents: "read"
pull-requests: "write"
concurrency:
group: "terraform"
cancel-in-progress: false
jobs:
plan:
strategy:
fail-fast: false
matrix:
- env: ["sandbox"]
+ env: ["production","sandbox"]
name: "Terraform Plan ${{ matrix.env }}"
runs-on: ubuntu-24.04
environment: "continuous-integration-${{ matrix.env }}"
timeout-minutes: 15
env:
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
REGION_JSON: "${{ vars.AWS_DEFAULT_REGION }}"
ROLE_GITHUB_JSON: "${{ vars.ROLE_GITHUB }}"
ROLE_SM_JSON: "${{ vars.ROLE_STATE_MANAGER }}"
TF_VAR_environment: "${{ matrix.env }}"
defaults:
run:
shell: "bash"
steps:
- name: "Checkout"
uses: "actions/checkout@v6"
- name: "Extract Variables"
id: "extract_vars"
run: |
REGION=$(echo '${{ env.REGION_JSON }}' | jq -r '.${{ matrix.env }}')
echo "REGION=$REGION" >> "$GITHUB_OUTPUT"
ROLE_GITHUB=$(echo '${{ env.ROLE_GITHUB_JSON }}' | jq -r '.${{ matrix.env }}')
echo "ROLE_GITHUB=$ROLE_GITHUB" >> "$GITHUB_OUTPUT"
ROLE_SM=$(echo '${{ env.ROLE_SM_JSON }}' | jq -r '.${{ matrix.env }}')
echo "ROLE_STATE_MANAGER=$ROLE_SM" >> "$GITHUB_OUTPUT"
- name: "Configure AWS Credentials"
uses: "aws-actions/configure-aws-credentials@v6"
with:
role-to-assume: "${{ steps.extract_vars.outputs.ROLE_GITHUB }}"
role-session-name: "github-actions-${{ matrix.env }}"
aws-region: "${{ steps.extract_vars.outputs.REGION }}"
- name: "Set Terraform version"
id: "terraform_version"
run: |
echo "IH_TF_VERSION=$(cat .terraform-version)" >> "$GITHUB_OUTPUT"
- name: "Setup Terraform"
uses: "hashicorp/setup-terraform@v4"
with:
terraform_version: "${{ steps.terraform_version.outputs.IH_TF_VERSION }}"
- name: "Set up Python"
uses: "actions/setup-python@v6"
with:
python-version: "3.14"
- name: "Setup Python Environment"
working-directory: "environments/${{ matrix.env }}"
run: |
make bootstrap
- name: "Code Style Check"
working-directory: "environments/${{ matrix.env }}"
run: |
make lint
- name: "Terraform Init"
working-directory: "environments/${{ matrix.env }}"
run: |
terraform init -input=false
- name: "Terraform Validate"
working-directory: "environments/${{ matrix.env }}"
run: |
terraform validate -no-color
- name: "Terraform Plan"
working-directory: "environments/${{ matrix.env }}"
run: |
make plan
ih-plan publish \
${{ github.repository }} \
${{ github.event.pull_request.number }} \
plan.stdout plan.stderr
- name: "Upload Terraform Plan"
working-directory: "environments/${{ matrix.env }}"
run: |
ih-plan \
--aws-assume-role-arn \
${{ steps.extract_vars.outputs.ROLE_STATE_MANAGER }} \
upload \
--key-name=plans/${{ matrix.env }}/${{ github.event.pull_request.number }}.plan \
tf.plan
EOT
id = "aws-service-infrahouse-app:.github/workflows/terraform-CI.yml:main"
# (9 unchanged attributes hidden)
}
# module.aws_service_infrahouse_app.github_repository_file.terraform_drift_wrapper[0] will be updated in-place
~ resource "github_repository_file" "terraform_drift_wrapper" {
~ content = <<-EOT
---
name: "[Meta] Terraform Drift Detection"
on:
workflow_dispatch:
schedule:
# Runs daily at 10:XX AM UTC
- cron: "57 10 * * *"
jobs:
config-drift-check:
strategy:
matrix:
- env: ["sandbox"]
+ env: ["production","sandbox"]
uses: "./.github/workflows/terraform-drift.yml"
with:
env: "${{ matrix.env }}"
secrets: "inherit"
notify_on_failure:
name: "Notify #infra slack on failure"
needs: ["config-drift-check"]
if: ${{ failure() }}
runs-on: ubuntu-latest
steps:
- name: Post to Slack
uses: "slackapi/slack-github-action@v2.1.1"
with:
method: "chat.postMessage"
token: ${{ secrets.SLACK_BOT_TOKEN }}
payload: |
channel: "${{ vars.INFRA_NOTIFICATION_CHANNEL }}"
text: "❌ Terraform Drift Detection failed for ${{ github.repository }}. Check the workflow run for more details: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}."
EOT
id = "aws-service-infrahouse-app:.github/workflows/terraform-drift-wrapper.yml:main"
# (9 unchanged attributes hidden)
}
# module.aws_service_infrahouse_app.github_repository_file.terraform_tf["production"] will be created
+ resource "github_repository_file" "terraform_tf" {
+ autocreate_branch_source_sha = (known after apply)
+ branch = "main"
+ commit_message = "Add terraform.tf for production environment"
+ commit_sha = (known after apply)
+ content = (known after apply)
+ file = "environments/production/terraform.tf"
+ id = (known after apply)
+ overwrite_on_create = true
+ ref = (known after apply)
+ repository = "aws-service-infrahouse-app"
+ repository_id = (known after apply)
+ sha = (known after apply)
}
# module.aws_service_infrahouse_app.github_repository_file.terraform_tf["sandbox"] will be updated in-place
~ resource "github_repository_file" "terraform_tf" {
~ content = <<-EOT
terraform {
required_version = ">= 1.10"
backend "s3" {
bucket = "infrahouse-github-control-aws-service-infrahouse-app"
key = "sandbox/terraform.tfstate"
region = "us-west-1"
encrypt = true
use_lockfile = true
assume_role = {
role_arn = "arn:aws:iam::289256138624:role/ih-tf-aws-service-infrahouse-app-state-manager"
}
}
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 6.0"
}
}
}
EOT -> (known after apply)
id = "aws-service-infrahouse-app:environments/sandbox/terraform.tf:main"
# (9 unchanged attributes hidden)
}
# module.aws_service_infrahouse_app.github_repository_file.terraform_tfvars["production"] will be created
+ resource "github_repository_file" "terraform_tfvars" {
+ autocreate_branch_source_sha = (known after apply)
+ branch = "main"
+ commit_message = "Add terraform.tfvars for production environment"
+ commit_sha = (known after apply)
+ content = (known after apply)
+ file = "environments/production/terraform.tfvars"
+ id = (known after apply)
+ overwrite_on_create = true
+ ref = (known after apply)
+ repository = "aws-service-infrahouse-app"
+ repository_id = (known after apply)
+ sha = (known after apply)
}
# module.aws_service_infrahouse_app.github_repository_ruleset.main will be updated in-place
~ resource "github_repository_ruleset" "main" {
id = "16000443"
name = "Main Branch Protection"
# (6 unchanged attributes hidden)
~ rules {
# (7 unchanged attributes hidden)
~ required_status_checks {
# (2 unchanged attributes hidden)
+ required_check {
+ context = "Terraform Plan production"
+ integration_id = 0
}
# (3 unchanged blocks hidden)
}
# (1 unchanged block hidden)
}
# (2 unchanged blocks hidden)
}
# module.aws_service_infrahouse_app_gha_production.data.aws_iam_policy_document.admin-trust will be read during apply
# (config refers to values not yet known)
<= data "aws_iam_policy_document" "admin-trust" {
+ id = (known after apply)
+ json = (known after apply)
+ minified_json = (known after apply)
+ statement {
+ actions = [
+ "sts:AssumeRole",
]
+ principals {
+ identifiers = [
+ "arn:aws:iam::990466748045:role/aws-reserved/sso.amazonaws.com/us-west-1/AWSReservedSSO_AWSAdministratorAccess_16bdbe5eb442e7ef",
+ (known after apply),
]
+ type = "AWS"
}
}
}
# module.aws_service_infrahouse_app_gha_production.data.aws_iam_policy_document.github-permissions will be read during apply
# (config refers to values not yet known)
<= data "aws_iam_policy_document" "github-permissions" {
+ id = (known after apply)
+ json = (known after apply)
+ minified_json = (known after apply)
+ statement {
+ actions = [
+ "sts:AssumeRole",
]
+ resources = [
+ (known after apply),
+ (known after apply),
]
}
}
# module.aws_service_infrahouse_app_gha_production.aws_iam_policy.github will be created
+ resource "aws_iam_policy" "github" {
+ arn = (known after apply)
+ attachment_count = (known after apply)
+ id = (known after apply)
+ name = (known after apply)
+ name_prefix = "ih-tf-production-aws-service-infrahouse-app-github"
+ path = "/"
+ policy = (known after apply)
+ policy_id = (known after apply)
+ tags = {
+ "created_by_module" = "infrahouse/gha-admin/aws"
+ "environment" = "production"
}
+ tags_all = {
+ "created_by" = "infrahouse/github-control"
+ "created_by_module" = "infrahouse/gha-admin/aws"
+ "environment" = "production"
}
}
# module.aws_service_infrahouse_app_gha_production.aws_iam_role.admin must be replaced
-/+ resource "aws_iam_role" "admin" {
~ arn = "arn:aws:iam::493370826424:role/ih-tf-aws-service-infrahouse-app-admin" -> (known after apply)
~ assume_role_policy = jsonencode(
{
- Statement = [
- {
- Action = "sts:AssumeRole"
- Effect = "Allow"
- Principal = {
- AWS = [
- "arn:aws:iam::990466748045:role/aws-reserved/sso.amazonaws.com/us-west-1/AWSReservedSSO_AWSAdministratorAccess_16bdbe5eb442e7ef",
- "arn:aws:iam::493370826424:role/ih-tf-aws-service-infrahouse-app-github",
]
}
},
]
- Version = "2012-10-17"
}
) -> (known after apply)
~ create_date = "2026-05-26T15:17:44Z" -> (known after apply)
~ id = "ih-tf-aws-service-infrahouse-app-admin" -> (known after apply)
~ managed_policy_arns = [
- "arn:aws:iam::aws:policy/AdministratorAccess",
] -> (known after apply)
~ name = "ih-tf-aws-service-infrahouse-app-admin" -> "ih-tf-production-aws-service-infrahouse-app-admin" # forces replacement
+ name_prefix = (known after apply)
~ tags = {
"created_by_module" = "infrahouse/gha-admin/aws"
"environment" = "production"
~ "module_version" = "4.0.0" -> "4.1.0"
}
~ tags_all = {
~ "module_version" = "4.0.0" -> "4.1.0"
# (3 unchanged elements hidden)
}
~ unique_id = "AROAXFXZRL24LXZISEZA3" -> (known after apply)
# (5 unchanged attributes hidden)
~ inline_policy (known after apply)
}
# module.aws_service_infrahouse_app_gha_production.aws_iam_role.github must be replaced
-/+ resource "aws_iam_role" "github" {
~ arn = "arn:aws:iam::493370826424:role/ih-tf-aws-service-infrahouse-app-github" -> (known after apply)
~ create_date = "2026-05-26T15:17:35Z" -> (known after apply)
~ id = "ih-tf-aws-service-infrahouse-app-github" -> (known after apply)
~ managed_policy_arns = [] -> (known after apply)
~ name = "ih-tf-aws-service-infrahouse-app-github" -> "ih-tf-production-aws-service-infrahouse-app-github" # forces replacement
+ name_prefix = (known after apply)
tags = {
"created_by_module" = "infrahouse/gha-admin/aws"
"environment" = "production"
}
~ unique_id = "AROAXFXZRL24MHTFXGWMZ" -> (known after apply)
# (7 unchanged attributes hidden)
~ inline_policy (known after apply)
}
# module.aws_service_infrahouse_app_gha_production.aws_iam_role_policy_attachment.admin must be replaced
-/+ resource "aws_iam_role_policy_attachment" "admin" {
~ id = "ih-tf-aws-service-infrahouse-app-admin/arn:aws:iam::aws:policy/AdministratorAccess" -> (known after apply)
~ role = "ih-tf-aws-service-infrahouse-app-admin" -> "ih-tf-production-aws-service-infrahouse-app-admin" # forces replacement
# (1 unchanged attribute hidden)
}
# module.aws_service_infrahouse_app_gha_production.aws_iam_role_policy_attachment.github will be created
+ resource "aws_iam_role_policy_attachment" "github" {
+ id = (known after apply)
+ policy_arn = (known after apply)
+ role = "ih-tf-production-aws-service-infrahouse-app-github"
}
# module.aws_service_infrahouse_app_gha_sandbox.data.aws_iam_policy_document.admin-trust will be read during apply
# (config refers to values not yet known)
<= data "aws_iam_policy_document" "admin-trust" {
+ id = (known after apply)
+ json = (known after apply)
+ minified_json = (known after apply)
+ statement {
+ actions = [
+ "sts:AssumeRole",
]
+ principals {
+ identifiers = [
+ "arn:aws:iam::990466748045:role/aws-reserved/sso.amazonaws.com/us-west-1/AWSReservedSSO_AWSAdministratorAccess_16bdbe5eb442e7ef",
+ (known after apply),
]
+ type = "AWS"
}
}
}
# module.aws_service_infrahouse_app_gha_sandbox.data.aws_iam_policy_document.github-permissions will be read during apply
# (config refers to values not yet known)
<= data "aws_iam_policy_document" "github-permissions" {
+ id = (known after apply)
+ json = (known after apply)
+ minified_json = (known after apply)
+ statement {
+ actions = [
+ "sts:AssumeRole",
]
+ resources = [
+ (known after apply),
+ (known after apply),
]
}
}
# module.aws_service_infrahouse_app_gha_sandbox.aws_iam_policy.github must be replaced
-/+ resource "aws_iam_policy" "github" {
~ arn = "arn:aws:iam::303467602807:policy/ih-tf-aws-service-infrahouse-app-github20260505170644603400000001" -> (known after apply)
~ attachment_count = 1 -> (known after apply)
~ id = "arn:aws:iam::303467602807:policy/ih-tf-aws-service-infrahouse-app-github20260505170644603400000001" -> (known after apply)
~ name = "ih-tf-aws-service-infrahouse-app-github20260505170644603400000001" -> (known after apply)
~ name_prefix = "ih-tf-aws-service-infrahouse-app-github" -> "ih-tf-sandbox-aws-service-infrahouse-app-github" # forces replacement
~ policy = jsonencode(
{
- Statement = [
- {
- Action = "sts:AssumeRole"
- Effect = "Allow"
- Resource = [
- "arn:aws:iam::303467602807:role/ih-tf-aws-service-infrahouse-app-admin",
- "arn:aws:iam::289256138624:role/ih-tf-aws-service-infrahouse-app-state-manager",
]
},
]
- Version = "2012-10-17"
}
) -> (known after apply)
~ policy_id = "ANPAUNKAUEN337QETIJMU" -> (known after apply)
tags = {
"created_by_module" = "infrahouse/gha-admin/aws"
"environment" = "sandbox"
}
# (3 unchanged attributes hidden)
}
# module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role.admin must be replaced
-/+ resource "aws_iam_role" "admin" {
~ arn = "arn:aws:iam::303467602807:role/ih-tf-aws-service-infrahouse-app-admin" -> (known after apply)
~ assume_role_policy = jsonencode(
{
- Statement = [
- {
- Action = "sts:AssumeRole"
- Effect = "Allow"
- Principal = {
- AWS = [
- "arn:aws:iam::990466748045:role/aws-reserved/sso.amazonaws.com/us-west-1/AWSReservedSSO_AWSAdministratorAccess_16bdbe5eb442e7ef",
- "arn:aws:iam::303467602807:role/ih-tf-aws-service-infrahouse-app-github",
]
}
},
]
- Version = "2012-10-17"
}
) -> (known after apply)
~ create_date = "2026-05-05T17:04:25Z" -> (known after apply)
~ id = "ih-tf-aws-service-infrahouse-app-admin" -> (known after apply)
~ managed_policy_arns = [
- "arn:aws:iam::aws:policy/AdministratorAccess",
] -> (known after apply)
~ name = "ih-tf-aws-service-infrahouse-app-admin" -> "ih-tf-sandbox-aws-service-infrahouse-app-admin" # forces replacement
+ name_prefix = (known after apply)
~ tags = {
"created_by_module" = "infrahouse/gha-admin/aws"
"environment" = "sandbox"
~ "module_version" = "4.0.0" -> "4.1.0"
}
~ tags_all = {
~ "module_version" = "4.0.0" -> "4.1.0"
# (3 unchanged elements hidden)
}
~ unique_id = "AROAUNKAUEN33OPIOLPR3" -> (known after apply)
# (5 unchanged attributes hidden)
~ inline_policy (known after apply)
}
# module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role.github must be replaced
-/+ resource "aws_iam_role" "github" {
~ arn = "arn:aws:iam::303467602807:role/ih-tf-aws-service-infrahouse-app-github" -> (known after apply)
~ create_date = "2026-05-05T17:04:16Z" -> (known after apply)
~ id = "ih-tf-aws-service-infrahouse-app-github" -> (known after apply)
~ managed_policy_arns = [
- "arn:aws:iam::303467602807:policy/ih-tf-aws-service-infrahouse-app-github20260505170644603400000001",
] -> (known after apply)
~ name = "ih-tf-aws-service-infrahouse-app-github" -> "ih-tf-sandbox-aws-service-infrahouse-app-github" # forces replacement
+ name_prefix = (known after apply)
tags = {
"created_by_module" = "infrahouse/gha-admin/aws"
"environment" = "sandbox"
}
~ unique_id = "AROAUNKAUEN3R34WBWWA5" -> (known after apply)
# (7 unchanged attributes hidden)
~ inline_policy (known after apply)
}
# module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role_policy_attachment.admin must be replaced
-/+ resource "aws_iam_role_policy_attachment" "admin" {
~ id = "ih-tf-aws-service-infrahouse-app-admin/arn:aws:iam::aws:policy/AdministratorAccess" -> (known after apply)
~ role = "ih-tf-aws-service-infrahouse-app-admin" -> "ih-tf-sandbox-aws-service-infrahouse-app-admin" # forces replacement
# (1 unchanged attribute hidden)
}
# module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role_policy_attachment.github must be replaced
-/+ resource "aws_iam_role_policy_attachment" "github" {
~ id = "ih-tf-aws-service-infrahouse-app-github/arn:aws:iam::303467602807:policy/ih-tf-aws-service-infrahouse-app-github20260505170644603400000001" -> (known after apply)
~ policy_arn = "arn:aws:iam::303467602807:policy/ih-tf-aws-service-infrahouse-app-github20260505170644603400000001" -> (known after apply) # forces replacement
~ role = "ih-tf-aws-service-infrahouse-app-github" -> "ih-tf-sandbox-aws-service-infrahouse-app-github" # forces replacement
}
# module.aws_service_infrahouse_app_gha_production.module.state-manager.data.aws_iam_policy_document.assume will be read during apply
# (config refers to values not yet known)
<= data "aws_iam_policy_document" "assume" {
+ id = (known after apply)
+ json = (known after apply)
+ minified_json = (known after apply)
+ statement {
+ actions = [
+ "sts:AssumeRole",
]
+ sid = "000"
+ principals {
+ identifiers = [
+ "arn:aws:iam::990466748045:role/aws-reserved/sso.amazonaws.com/us-west-1/AWSReservedSSO_AWSAdministratorAccess_16bdbe5eb442e7ef",
+ (known after apply),
]
+ type = "AWS"
}
}
}
# module.aws_service_infrahouse_app_gha_production.module.state-manager.aws_iam_policy.permissions_ro must be replaced
-/+ resource "aws_iam_policy" "permissions_ro" {
~ arn = "arn:aws:iam::289256138624:policy/ih-tf-aws-service-infrahouse-app-state-manager-ro20260526151735259200000001" -> (known after apply)
~ attachment_count = 0 -> (known after apply)
~ id = "arn:aws:iam::289256138624:policy/ih-tf-aws-service-infrahouse-app-state-manager-ro20260526151735259200000001" -> (known after apply)
~ name = "ih-tf-aws-service-infrahouse-app-state-manager-ro20260526151735259200000001" -> (known after apply)
~ name_prefix = "ih-tf-aws-service-infrahouse-app-state-manager-ro" -> "ih-tf-production-aws-service-infrahouse-app-state-manager-ro" # forces replacement
~ policy_id = "ANPAUGWICM6ABWMGHLOTV" -> (known after apply)
tags = {
"created_by_module" = "infrahouse/state-manager/aws"
"environment" = "production"
}
# (4 unchanged attributes hidden)
}
# module.aws_service_infrahouse_app_gha_production.module.state-manager.aws_iam_policy.permissions_rw must be replaced
-/+ resource "aws_iam_policy" "permissions_rw" {
~ arn = "arn:aws:iam::289256138624:policy/ih-tf-aws-service-infrahouse-app-state-manager-rw20260526151735259500000002" -> (known after apply)
~ attachment_count = 0 -> (known after apply)
~ id = "arn:aws:iam::289256138624:policy/ih-tf-aws-service-infrahouse-app-state-manager-rw20260526151735259500000002" -> (known after apply)
~ name = "ih-tf-aws-service-infrahouse-app-state-manager-rw20260526151735259500000002" -> (known after apply)
~ name_prefix = "ih-tf-aws-service-infrahouse-app-state-manager-rw" -> "ih-tf-production-aws-service-infrahouse-app-state-manager-rw" # forces replacement
~ policy_id = "ANPAUGWICM6ALVWVIPCTQ" -> (known after apply)
tags = {
"created_by_module" = "infrahouse/state-manager/aws"
"environment" = "production"
}
# (4 unchanged attributes hidden)
}
# module.aws_service_infrahouse_app_gha_production.module.state-manager.aws_iam_role.state-manager will be created
+ resource "aws_iam_role" "state-manager" {
+ arn = (known after apply)
+ assume_role_policy = (known after apply)
+ create_date = (known after apply)
+ description = "Role to manage a terraform state of a repo"
+ force_detach_policies = false
+ id = (known after apply)
+ managed_policy_arns = (known after apply)
+ max_session_duration = 43200
+ name = "ih-tf-production-aws-service-infrahouse-app-state-manager"
+ name_prefix = (known after apply)
+ path = "/"
+ tags = {
+ "created_by_module" = "infrahouse/state-manager/aws"
+ "environment" = "production"
+ "module_version" = "1.5.0"
}
+ tags_all = {
+ "created_by" = "infrahouse/github-control"
+ "created_by_module" = "infrahouse/state-manager/aws"
+ "environment" = "production"
+ "module_version" = "1.5.0"
}
+ unique_id = (known after apply)
+ inline_policy (known after apply)
}
# module.aws_service_infrahouse_app_gha_production.module.state-manager.aws_iam_role_policy_attachment.state-manager-ro will be created
+ resource "aws_iam_role_policy_attachment" "state-manager-ro" {
+ id = (known after apply)
+ policy_arn = (known after apply)
+ role = "ih-tf-production-aws-service-infrahouse-app-state-manager"
}
# module.aws_service_infrahouse_app_gha_production.module.state-manager.aws_iam_role_policy_attachment.state-manager-rw[0] will be created
+ resource "aws_iam_role_policy_attachment" "state-manager-rw" {
+ id = (known after apply)
+ policy_arn = (known after apply)
+ role = "ih-tf-production-aws-service-infrahouse-app-state-manager"
}
# module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.data.aws_iam_policy_document.assume will be read during apply
# (config refers to values not yet known)
<= data "aws_iam_policy_document" "assume" {
+ id = (known after apply)
+ json = (known after apply)
+ minified_json = (known after apply)
+ statement {
+ actions = [
+ "sts:AssumeRole",
]
+ sid = "000"
+ principals {
+ identifiers = [
+ "arn:aws:iam::990466748045:role/aws-reserved/sso.amazonaws.com/us-west-1/AWSReservedSSO_AWSAdministratorAccess_16bdbe5eb442e7ef",
+ (known after apply),
]
+ type = "AWS"
}
}
}
# module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_policy.permissions_ro must be replaced
-/+ resource "aws_iam_policy" "permissions_ro" {
~ arn = "arn:aws:iam::289256138624:policy/ih-tf-aws-service-infrahouse-app-state-manager-ro20260505170659715500000001" -> (known after apply)
~ attachment_count = 1 -> (known after apply)
~ id = "arn:aws:iam::289256138624:policy/ih-tf-aws-service-infrahouse-app-state-manager-ro20260505170659715500000001" -> (known after apply)
~ name = "ih-tf-aws-service-infrahouse-app-state-manager-ro20260505170659715500000001" -> (known after apply)
~ name_prefix = "ih-tf-aws-service-infrahouse-app-state-manager-ro" -> "ih-tf-sandbox-aws-service-infrahouse-app-state-manager-ro" # forces replacement
~ policy_id = "ANPAUGWICM6AJLG5NOHHE" -> (known after apply)
tags = {
"created_by_module" = "infrahouse/state-manager/aws"
"environment" = "sandbox"
}
# (4 unchanged attributes hidden)
}
# module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_policy.permissions_rw must be replaced
-/+ resource "aws_iam_policy" "permissions_rw" {
~ arn = "arn:aws:iam::289256138624:policy/ih-tf-aws-service-infrahouse-app-state-manager-rw20260505170704150400000002" -> (known after apply)
~ attachment_count = 1 -> (known after apply)
~ id = "arn:aws:iam::289256138624:policy/ih-tf-aws-service-infrahouse-app-state-manager-rw20260505170704150400000002" -> (known after apply)
~ name = "ih-tf-aws-service-infrahouse-app-state-manager-rw20260505170704150400000002" -> (known after apply)
~ name_prefix = "ih-tf-aws-service-infrahouse-app-state-manager-rw" -> "ih-tf-sandbox-aws-service-infrahouse-app-state-manager-rw" # forces replacement
~ policy_id = "ANPAUGWICM6AIEDLOY7AG" -> (known after apply)
tags = {
"created_by_module" = "infrahouse/state-manager/aws"
"environment" = "sandbox"
}
# (4 unchanged attributes hidden)
}
# module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_role.state-manager must be replaced
-/+ resource "aws_iam_role" "state-manager" {
~ arn = "arn:aws:iam::289256138624:role/ih-tf-aws-service-infrahouse-app-state-manager" -> (known after apply)
~ assume_role_policy = jsonencode(
{
- Statement = [
- {
- Action = "sts:AssumeRole"
- Effect = "Allow"
- Principal = {
- AWS = [
- "arn:aws:iam::990466748045:role/aws-reserved/sso.amazonaws.com/us-west-1/AWSReservedSSO_AWSAdministratorAccess_16bdbe5eb442e7ef",
- "arn:aws:iam::303467602807:role/ih-tf-aws-service-infrahouse-app-github",
]
}
- Sid = "000"
},
]
- Version = "2012-10-17"
}
) -> (known after apply)
~ create_date = "2026-05-05T17:04:33Z" -> (known after apply)
~ id = "ih-tf-aws-service-infrahouse-app-state-manager" -> (known after apply)
~ managed_policy_arns = [
- "arn:aws:iam::289256138624:policy/ih-tf-aws-service-infrahouse-app-state-manager-ro20260505170659715500000001",
- "arn:aws:iam::289256138624:policy/ih-tf-aws-service-infrahouse-app-state-manager-rw20260505170704150400000002",
] -> (known after apply)
~ name = "ih-tf-aws-service-infrahouse-app-state-manager" -> "ih-tf-sandbox-aws-service-infrahouse-app-state-manager" # forces replacement
+ name_prefix = (known after apply)
tags = {
"created_by_module" = "infrahouse/state-manager/aws"
"environment" = "sandbox"
"module_version" = "1.5.0"
}
~ unique_id = "AROAUGWICM6AMR4P5WQ6A" -> (known after apply)
# (6 unchanged attributes hidden)
~ inline_policy (known after apply)
}
# module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_role_policy_attachment.state-manager-ro must be replaced
-/+ resource "aws_iam_role_policy_attachment" "state-manager-ro" {
~ id = "ih-tf-aws-service-infrahouse-app-state-manager/arn:aws:iam::289256138624:policy/ih-tf-aws-service-infrahouse-app-state-manager-ro20260505170659715500000001" -> (known after apply)
~ policy_arn = "arn:aws:iam::289256138624:policy/ih-tf-aws-service-infrahouse-app-state-manager-ro20260505170659715500000001" -> (known after apply) # forces replacement
~ role = "ih-tf-aws-service-infrahouse-app-state-manager" -> "ih-tf-sandbox-aws-service-infrahouse-app-state-manager" # forces replacement
}
# module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_role_policy_attachment.state-manager-rw[0] must be replaced
-/+ resource "aws_iam_role_policy_attachment" "state-manager-rw" {
~ id = "ih-tf-aws-service-infrahouse-app-state-manager/arn:aws:iam::289256138624:policy/ih-tf-aws-service-infrahouse-app-state-manager-rw20260505170704150400000002" -> (known after apply)
~ policy_arn = "arn:aws:iam::289256138624:policy/ih-tf-aws-service-infrahouse-app-state-manager-rw20260505170704150400000002" -> (known after apply) # forces replacement
~ role = "ih-tf-aws-service-infrahouse-app-state-manager" -> "ih-tf-sandbox-aws-service-infrahouse-app-state-manager" # forces replacement
}
Plan: 27 to add, 12 to change, 15 to destroy.
Warning: Argument is deprecated
with module.ih_8_repos.github_repository.repo,
on modules/local-repo/repos.tf line 4, in resource "github_repository" "repo":
4: has_downloads = false
This attribute is no longer in use, but it hasn't been removed yet. It will
be removed in a future version. See
https://github.com/orgs/community/discussions/102145#discussioncomment-8351756
(and 6 more similar warnings elsewhere)
Warning: Deprecated attribute
on .terraform/modules/actions-runner-pem-493370826424-uw1/data_sources.tf line 11, in data "external" "secret_value":
11: "python", "${path.module}/assets/get_secret.py", data.aws_region.current.name, aws_secretsmanager_secret.secret.id, data.aws_iam_role.caller_role.arn
The attribute "name" is deprecated. Refer to the provider documentation for
details.
(and 5 more similar warnings elsewhere)
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: tf.plan
To perform exactly these actions, run the following command to apply:
terraform apply "tf.plan"
metadata
eyJzMzovL2luZnJhaG91c2UtZ2l0aHViLWNvbnRyb2wtc3RhdGUvdGVycmFmb3JtLnRmc3RhdGUiOiB7InN1Y2Nlc3MiOiB0cnVlLCAiYWRkIjogMjcsICJjaGFuZ2UiOiAxMiwgImRlc3Ryb3kiOiAxNX19
infrahouse8
approved these changes
May 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
aws-service-infrahouse-appname_prefix = "sandbox"andname_prefix = "production"to disambiguate IAM role namesEntityAlreadyExistserror from Add production environment for aws-service-infrahouse-app #32 where both environments tried to createih-tf-aws-service-infrahouse-app-state-managerin the shared tfstates accountContext
PR #32 failed during apply because the state-manager role name didn't include the environment.
gha-admin 4.1.0 adds an optional
name_prefixvariable that's inserted into all role names.Roles will be named:
ih-tf-sandbox-aws-service-infrahouse-app-{admin,github,state-manager}ih-tf-production-aws-service-infrahouse-app-{admin,github,state-manager}Note
The failed #32 apply created orphaned IAM resources with unprefixed names in accounts 493370826424 and 289256138624 that need manual cleanup.
Test plan
terraform planshows sandbox roles being recreated with new names🤖 Generated with Claude Code