DSOS-1759: combined reporting initial setup

Initial setup for combined reporting using baseline module:

added ec2-user ssh keys
added example security group per subnet
enabled resources for shared KMS CMKs and use of Image Builder AMIs
create s3-bucket inline with other accounts, and a single "software" bucket shared across accounts in development only
added example code for spinning up EC2s/ASGs in development locals

nomis-combined-reporting-preproduction terraform plan on pull_request event #29
Terraform will perform the following actions:

  # module.baseline.data.aws_iam_policy_document.this["EC2S3BucketWriteAndDeleteAccessPolicy"] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id   = (known after apply)
      + json = (known after apply)

      + statement {
          + actions   = [
              + "s3:DeleteObject",
              + "s3:GetObject",
              + "s3:ListBucket",
              + "s3:PutObject",
              + "s3:PutObjectAcl",
            ]
          + effect    = "Allow"
          + resources = [
              + (known after apply),
              + (known after apply),
            ]
        }
    }

  # module.baseline.aws_cloudwatch_log_group.this["cwagent-var-log-messages"] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + name              = "cwagent-var-log-messages"
      + name_prefix       = (known after apply)
      + retention_in_days = 30
      + skip_destroy      = false
      + tags              = {
          + "Name"                   = "cwagent-var-log-messages"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all          = {
          + "Name"                   = "cwagent-var-log-messages"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_cloudwatch_log_group.this["cwagent-var-log-secure"] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + name              = "cwagent-var-log-secure"
      + name_prefix       = (known after apply)
      + retention_in_days = 90
      + skip_destroy      = false
      + tags              = {
          + "Name"                   = "cwagent-var-log-secure"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all          = {
          + "Name"                   = "cwagent-var-log-secure"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_cloudwatch_log_group.this["cwagent-windows-system"] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + name              = "cwagent-windows-system"
      + name_prefix       = (known after apply)
      + retention_in_days = 30
      + skip_destroy      = false
      + tags              = {
          + "Name"                   = "cwagent-windows-system"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all          = {
          + "Name"                   = "cwagent-windows-system"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_cloudwatch_log_group.this["session-manager-logs"] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + name              = "session-manager-logs"
      + name_prefix       = (known after apply)
      + retention_in_days = 90
      + skip_destroy      = false
      + tags              = {
          + "Name"                   = "session-manager-logs"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all          = {
          + "Name"                   = "session-manager-logs"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_iam_policy.this["BusinessUnitKmsCmkPolicy"] will be created
  + resource "aws_iam_policy" "this" {
      + arn         = (known after apply)
      + description = "Policy allowing access to business unit wide customer managed keys"
      + id          = (known after apply)
      + name        = "BusinessUnitKmsCmkPolicy"
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "kms:RevokeGrant",
                          + "kms:ReEncrypt*",
                          + "kms:ListGrants",
                          + "kms:GenerateDataKey*",
                          + "kms:Encrypt",
                          + "kms:DescribeKey",
                          + "kms:Decrypt",
                          + "kms:CreateGrant",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:kms:eu-west-2:374269020027:key/90121e65-c5fa-43a9-8075-6f3410d2a025",
                          + "arn:aws:kms:eu-west-2:374269020027:key/12984197-3371-4c21-8e43-a88a1581e691",
                        ]
                      + Sid      = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags        = {
          + "Name"                   = "BusinessUnitKmsCmkPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all    = {
          + "Name"                   = "BusinessUnitKmsCmkPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_iam_policy.this["CloudWatchAgentServerReducedPolicy"] will be created
  + resource "aws_iam_policy" "this" {
      + arn         = (known after apply)
      + description = "Same as CloudWatchAgentServerReducedPolicy but with CreateLogGroup permission removed to ensure groups are created in code"
      + id          = (known after apply)
      + name        = "CloudWatchAgentServerReducedPolicy"
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "logs:PutLogEvents",
                          + "logs:DescribeLogStreams",
                          + "logs:DescribeLogGroups",
                          + "logs:CreateLogStream",
                          + "logs:CreateLogGroup",
                          + "ec2:DescribeVolumes",
                          + "ec2:DescribeTags",
                          + "cloudwatch:PutMetricData",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                      + Sid      = ""
                    },
                  + {
                      + Action   = "logs:CreateLogGroup"
                      + Effect   = "Deny"
                      + Resource = "*"
                      + Sid      = ""
                    },
                  + {
                      + Action   = [
                          + "ssm:GetParameters",
                          + "ssm:GetParameter",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"
                      + Sid      = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags        = {
          + "Name"                   = "CloudWatchAgentServerReducedPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all    = {
          + "Name"                   = "CloudWatchAgentServerReducedPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_iam_policy.this["EC2S3BucketWriteAndDeleteAccessPolicy"] will be created
  + resource "aws_iam_policy" "this" {
      + arn         = (known after apply)
      + description = "Allows access to S3 bucket"
      + id          = (known after apply)
      + name        = "EC2S3BucketWriteAndDeleteAccessPolicy"
      + path        = "/"
      + policy      = (known after apply)
      + policy_id   = (known after apply)
      + tags        = {
          + "Name"                   = "EC2S3BucketWriteAndDeleteAccessPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all    = {
          + "Name"                   = "EC2S3BucketWriteAndDeleteAccessPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_iam_policy.this["ImageBuilderLaunchTemplatePolicy"] will be created
  + resource "aws_iam_policy" "this" {
      + arn         = (known after apply)
      + description = "Policy allowing access to image builder launch templates"
      + id          = (known after apply)
      + name        = "ImageBuilderLaunchTemplatePolicy"
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "ec2:ModifyLaunchTemplate",
                          + "ec2:CreateLaunchTemplateVersion",
                        ]
                      + Condition = {
                          + StringEquals = {
                              + "aws:ResourceTag/CreatedBy" = "EC2 Image Builder"
                            }
                        }
                      + Effect    = "Allow"
                      + Resource  = "*"
                      + Sid       = ""
                    },
                  + {
                      + Action    = "ec2:DescribeLaunchTemplates"
                      + Condition = {
                          + StringEquals = {
                              + "aws:ResourceTag/CreatedBy" = "EC2 Image Builder"
                            }
                        }
                      + Effect    = "Allow"
                      + Resource  = "arn:aws:ec2:*:*:launch-template/*"
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags        = {
          + "Name"                   = "ImageBuilderLaunchTemplatePolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all    = {
          + "Name"                   = "ImageBuilderLaunchTemplatePolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_iam_role.this["EC2ImageBuilderDistributionCrossAccountRole"] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::374269020027:root"
                        }
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "EC2ImageBuilderDistributionCrossAccountRole"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags                  = {
          + "Name"                   = "each.key"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all              = {
          + "Name"                   = "each.key"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + unique_id             = (known after apply)

      + inline_policy {
          + name   = (known after apply)
          + policy = (known after apply)
        }
    }

  # module.baseline.aws_iam_role_policy_attachment.this["EC2ImageBuilderDistributionCrossAccountRole-BusinessUnitKmsCmkPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "EC2ImageBuilderDistributionCrossAccountRole"
    }

  # module.baseline.aws_iam_role_policy_attachment.this["EC2ImageBuilderDistributionCrossAccountRole-ImageBuilderLaunchTemplatePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "EC2ImageBuilderDistributionCrossAccountRole"
    }

  # module.baseline.aws_iam_role_policy_attachment.this["EC2ImageBuilderDistributionCrossAccountRole-arn:aws:iam::aws:policy/Ec2ImageBuilderCrossAccountDistributionAccess"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/Ec2ImageBuilderCrossAccountDistributionAccess"
      + role       = "EC2ImageBuilderDistributionCrossAccountRole"
    }

  # module.baseline.aws_iam_service_linked_role.this["autoscaling.amazonaws.com"] will be created
  + resource "aws_iam_service_linked_role" "this" {
      + arn              = (known after apply)
      + aws_service_name = "autoscaling.amazonaws.com"
      + create_date      = (known after apply)
      + id               = (known after apply)
      + name             = (known after apply)
      + path             = (known after apply)
      + tags             = {
          + "Name"                   = "each.key"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all         = {
          + "Name"                   = "each.key"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + unique_id        = (known after apply)
    }

  # module.baseline.aws_key_pair.this["ec2-user"] will be created
  + resource "aws_key_pair" "this" {
      + arn             = (known after apply)
      + fingerprint     = (known after apply)
      + id              = (known after apply)
      + key_name        = "ec2-user"
      + key_name_prefix = (known after apply)
      + key_pair_id     = (known after apply)
      + key_type        = (known after apply)
      + public_key      = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDRF/QTIcPQE/XdQxmYPGFJ7l7l+D0OhGXuC9uJcq2jAGR8gf7eKWfLUU20fNcyXo4PvI7Qq+pGBFYc6950oIYVce9FnNTZ5DWgOfQOeS5Zmr4O2xiR7Dpx2dVSOk1RUCKOoiHCzVWzvUWLHZbHEtRxwhFR2flnKUhheseurFjjHag7RP3iu0JxQDPqGmTX82/2ex/2/KeW6kTq9lVSHy1MkyltMIqMtLoaAzHLa7p/XmcJZVwhvufJDc35CgytEoJr6E/3elYhz7JJWpa10QIiXk9DYrjGygalm2726Pl2OGof+5YsC5oqed0yNHcxMToMwFJK+DnEoOahqRuyY9/gUSG5tHocOVaJp1kUFDDSqGig1xwXKHng3aIXqVQnSTGOcqkW5QVS8LJ2hUPvyazjZSDvdClG7otaIs6DvjE9u1cXqU0mIfga+RHHY1YZQwJJBsE3240bhCI2D31rQarzfo/CMEH7e6/PbLxbUYB9Jy+HqPUCIh0JlbcoQVrYVGLlUM4zrdJgQJX5+nYxmy2A7voo62EtbjJ+IDms+/qjmN4qqBbx0/+rCjan3PfVfvDaTeCw4Elir5cfcfS7Zlm/L1vgzNoUmb1Gn8dzLzN+1+ApAQrEBDfQbqzs5rHspr18NJipjcb1OJRSbxtn4ahuouSg466wrNwxl1cTL1WIyw=="
      + tags            = {
          + "Name"                   = "ec2-user"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all        = {
          + "Name"                   = "ec2-user"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_kms_grant.this["business-unit-ebs-cmk-grant-for-autoscaling"] will be created
  + resource "aws_kms_grant" "this" {
      + grant_id          = (known after apply)
      + grant_token       = (known after apply)
      + grantee_principal = (sensitive value)
      + id                = (known after apply)
      + key_id            = "arn:aws:kms:eu-west-2:374269020027:key/12984197-3371-4c21-8e43-a88a1581e691"
      + name              = "business-unit-ebs-cmk-grant-for-autoscaling"
      + operations        = [
          + "CreateGrant",
          + "Decrypt",
          + "DescribeKey",
          + "Encrypt",
          + "GenerateDataKey",
          + "GenerateDataKeyWithoutPlaintext",
          + "ReEncryptFrom",
          + "ReEncryptTo",
        ]
      + retire_on_delete  = false
    }

  # module.baseline.aws_security_group.this["data"] will be created
  + resource "aws_security_group" "this" {
      + arn                    = (known after apply)
      + description            = "Security group for data subnet"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "data"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                   = "data"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all               = {
          + "Name"                   = "data"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + vpc_id                 = "vpc-0d7bfee459b7bd221"
    }

  # module.baseline.aws_security_group.this["private"] will be created
  + resource "aws_security_group" "this" {
      + arn                    = (known after apply)
      + description            = "Security group for private subnet"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "private"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                   = "private"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all               = {
          + "Name"                   = "private"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + vpc_id                 = "vpc-0d7bfee459b7bd221"
    }

  # module.baseline.aws_security_group.this["public"] will be created
  + resource "aws_security_group" "this" {
      + arn                    = (known after apply)
      + description            = "Security group for public subnet"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "public"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                   = "public"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all               = {
          + "Name"                   = "public"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + vpc_id                 = "vpc-0d7bfee459b7bd221"
    }

  # module.baseline.aws_security_group_rule.this["data-egress-all-cidrs"] will be created
  + resource "aws_security_group_rule" "this" {
      + cidr_blocks              = [
          + "<IP_ADDRESS>/0",
        ]
      + description              = "Allow all egress"
      + from_port                = 0
      + id                       = (known after apply)
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "egress"
    }

  # module.baseline.aws_security_group_rule.this["data-ingress-all-within-subnet-self"] will be created
  + resource "aws_security_group_rule" "this" {
      + description              = "Allow all ingress to self"
      + from_port                = 0
      + id                       = (known after apply)
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "ingress"
    }

  # module.baseline.aws_security_group_rule.this["data-ingress-oracle1521-cidrs"] will be created
  + resource "aws_security_group_rule" "this" {
      + cidr_blocks              = [
          + "<IP_ADDRESS>/18",
          + "<IP_ADDRESS>/20",
          + "<IP_ADDRESS>/18",
          + "<IP_ADDRESS>/20",
          + "<IP_ADDRESS>/16",
        ]
      + description              = "Allow oracle database 1521 ingress"
      + from_port                = 1521
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 1521
      + type                     = "ingress"
    }

  # module.baseline.aws_security_group_rule.this["data-ingress-oracle1521-private"] will be created
  + resource "aws_security_group_rule" "this" {
      + description              = "Allow oracle database 1521 ingress"
      + from_port                = 1521
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 1521
      + type                     = "ingress"
    }

  # module.baseline.aws_security_group_rule.this["private-egress-all-cidrs"] will be created
  + resource "aws_security_group_rule" "this" {
      + cidr_blocks              = [
          + "<IP_ADDRESS>/0",
        ]
      + description              = "Allow all egress"
      + from_port                = 0
      + id                       = (known after apply)
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "egress"
    }

  # module.baseline.aws_security_group_rule.this["private-ingress-all-within-subnet-self"] will be created
  + resource "aws_security_group_rule" "this" {
      + description              = "Allow all ingress to self"
      + from_port                = 0
      + id                       = (known after apply)
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "ingress"
    }

  # module.baseline.aws_security_group_rule.this["private-ingress-http8080-public"] will be created
  + resource "aws_security_group_rule" "this" {
      + description              = "Allow http8080 ingress"
      + from_port                = 8080
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 8080
      + type                     = "ingress"
    }

  # module.baseline.aws_security_group_rule.this["public-egress-all-cidrs"] will be created
  + resource "aws_security_group_rule" "this" {
      + cidr_blocks              = [
          + "<IP_ADDRESS>/0",
        ]
      + description              = "Allow all egress"
      + from_port                = 0
      + id                       = (known after apply)
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "egress"
    }

  # module.baseline.aws_security_group_rule.this["public-ingress-all-within-subnet-self"] will be created
  + resource "aws_security_group_rule" "this" {
      + description              = "Allow all ingress to self"
      + from_port                = 0
      + id                       = (known after apply)
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "ingress"
    }

  # module.baseline.aws_security_group_rule.this["public-ingress-https-cidrs"] will be created
  + resource "aws_security_group_rule" "this" {
      + cidr_blocks              = [
          + "<IP_ADDRESS>/18",
          + "<IP_ADDRESS>/20",
          + "<IP_ADDRESS>/18",
          + "<IP_ADDRESS>/20",
          + "<IP_ADDRESS>/32",
          + "<IP_ADDRESS>/32",
          + "<IP_ADDRESS>/32",
          + "<IP_ADDRESS>/32",
          + "<IP_ADDRESS>/16",
          + "<IP_ADDRESS>/16",
          + "<IP_ADDRESS>/16",
          + "<IP_ADDRESS>/16",
          + "<IP_ADDRESS>/12",
        ]
      + description              = "Allow https ingress"
      + from_port                = 443
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.baseline.module.s3_bucket["s3-bucket"].data.aws_iam_policy_document.bucket_policy_v2 will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_iam_policy_document" "bucket_policy_v2" {
      + id   = (known after apply)
      + json = (known after apply)
    }

  # module.baseline.module.s3_bucket["s3-bucket"].data.aws_iam_policy_document.default will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "default" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + override_policy_documents = [
          + jsonencode({}),
          + (known after apply),
        ]

      + statement {
          + actions   = [
              + "s3:*",
            ]
          + effect    = "Deny"
          + resources = [
              + (known after apply),
              + (known after apply),
            ]

          + condition {
              + test     = "Bool"
              + values   = [
                  + "false",
                ]
              + variable = "aws:SecureTransport"
            }

          + principals {
              + identifiers = [
                  + "*",
                ]
              + type        = "AWS"
            }
        }
    }

  # module.baseline.module.s3_bucket["s3-bucket"].aws_s3_bucket.default will be created
  + resource "aws_s3_bucket" "default" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = (known after apply)
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = "s3-bucket"
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags                        = {
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all                    = {
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule {
          + allowed_headers = (known after apply)
          + allowed_methods = (known after apply)
          + allowed_origins = (known after apply)
          + expose_headers  = (known after apply)
          + max_age_seconds = (known after apply)
        }

      + grant {
          + id          = (known after apply)
          + permissions = (known after apply)
          + type        = (known after apply)
          + uri         = (known after apply)
        }

      + lifecycle_rule {
          + abort_incomplete_multipart_upload_days = (known after apply)
          + enabled                                = (known after apply)
          + id                                     = (known after apply)
          + prefix                                 = (known after apply)
          + tags                                   = (known after apply)

          + expiration {
              + date                         = (known after apply)
              + days                         = (known after apply)
              + expired_object_delete_marker = (known after apply)
            }

          + noncurrent_version_expiration {
              + days = (known after apply)
            }

          + noncurrent_version_transition {
              + days          = (known after apply)
              + storage_class = (known after apply)
            }

          + transition {
              + date          = (known after apply)
              + days          = (known after apply)
              + storage_class = (known after apply)
            }
        }

      + logging {
          + target_bucket = (known after apply)
          + target_prefix = (known after apply)
        }

      + object_lock_configuration {
          + object_lock_enabled = (known after apply)

          + rule {
              + default_retention {
                  + days  = (known after apply)
                  + mode  = (known after apply)
                  + years = (known after apply)
                }
            }
        }

      + replication_configuration {
          + role = (known after apply)

          + rules {
              + delete_marker_replication_status = (known after apply)
              + id                               = (known after apply)
              + prefix                           = (known after apply)
              + priority                         = (known after apply)
              + status                           = (known after apply)

              + destination {
                  + account_id         = (known after apply)
                  + bucket             = (known after apply)
                  + replica_kms_key_id = (known after apply)
                  + storage_class      = (known after apply)

                  + access_control_translation {
                      + owner = (known after apply)
                    }

                  + metrics {
                      + minutes = (known after apply)
                      + status  = (known after apply)
                    }

                  + replication_time {
                      + minutes = (known after apply)
                      + status  = (known after apply)
                    }
                }

              + filter {
                  + prefix = (known after apply)
                  + tags   = (known after apply)
                }

              + source_selection_criteria {
                  + sse_kms_encrypted_objects {
                      + enabled = (known after apply)
                    }
                }
            }
        }

      + server_side_encryption_configuration {
          + rule {
              + bucket_key_enabled = (known after apply)

              + apply_server_side_encryption_by_default {
                  + kms_master_key_id = (known after apply)
                  + sse_algorithm     = (known after apply)
                }
            }
        }

      + versioning {
          + enabled    = (known after apply)
          + mfa_delete = (known after apply)
        }

      + website {
          + error_document           = (known after apply)
          + index_document           = (known after apply)
          + redirect_all_requests_to = (known after apply)
          + routing_rules            = (known after apply)
        }
    }

  # module.baseline.module.s3_bucket["s3-bucket"].aws_s3_bucket_acl.default will be created
  + resource "aws_s3_bucket_acl" "default" {
      + acl    = "private"
      + bucket = (known after apply)
      + id     = (known after apply)

      + access_control_policy {
          + grant {
              + permission = (known after apply)

              + grantee {
                  + display_name  = (known after apply)
                  + email_address = (known after apply)
                  + id            = (known after apply)
                  + type          = (known after apply)
                  + uri           = (known after apply)
                }
            }

          + owner {
              + display_name = (known after apply)
              + id           = (known after apply)
            }
        }
    }

  # module.baseline.module.s3_bucket["s3-bucket"].aws_s3_bucket_lifecycle_configuration.default will be created
  + resource "aws_s3_bucket_lifecycle_configuration" "default" {
      + bucket = (known after apply)
      + id     = (known after apply)

      + rule {
          + id     = "main"
          + status = "Enabled"

          + abort_incomplete_multipart_upload {
              + days_after_initiation = 7
            }

          + expiration {
              + days                         = 730
              + expired_object_delete_marker = (known after apply)
            }

          + filter {
            }

          + noncurrent_version_expiration {
              + noncurrent_days = 730
            }

          + noncurrent_version_transition {
              + noncurrent_days = 365
              + storage_class   = "GLACIER"
            }
          + noncurrent_version_transition {
              + noncurrent_days = 90
              + storage_class   = "STANDARD_IA"
            }

          + transition {
              + days          = 365
              + storage_class = "GLACIER"
            }
          + transition {
              + days          = 90
              + storage_class = "STANDARD_IA"
            }
        }
    }

  # module.baseline.module.s3_bucket["s3-bucket"].aws_s3_bucket_policy.default will be created
  + resource "aws_s3_bucket_policy" "default" {
      + bucket = (known after apply)
      + id     = (known after apply)
      + policy = (known after apply)
    }

  # module.baseline.module.s3_bucket["s3-bucket"].aws_s3_bucket_public_access_block.default will be created
  + resource "aws_s3_bucket_public_access_block" "default" {
      + block_public_acls       = true
      + block_public_policy     = true
      + bucket                  = (known after apply)
      + id                      = (known after apply)
      + ignore_public_acls      = true
      + restrict_public_buckets = true
    }

  # module.baseline.module.s3_bucket["s3-bucket"].aws_s3_bucket_server_side_encryption_configuration.default will be created
  + resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
      + bucket = (known after apply)
      + id     = (known after apply)

      + rule {
          + apply_server_side_encryption_by_default {
              + kms_master_key_id = "arn:aws:kms:eu-west-2:374269020027:key/90121e65-c5fa-43a9-8075-6f3410d2a025"
              + sse_algorithm     = "aws:kms"
            }
        }
    }

  # module.baseline.module.s3_bucket["s3-bucket"].aws_s3_bucket_versioning.default will be created
  + resource "aws_s3_bucket_versioning" "default" {
      + bucket = (known after apply)
      + id     = (known after apply)

      + versioning_configuration {
          + mfa_delete = (known after apply)
          + status     = "Enabled"
        }
    }

Plan: 35 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

nomis-combined-reporting-production terraform plan on pull_request event #29
Terraform will perform the following actions:

  # module.baseline.data.aws_iam_policy_document.this["EC2S3BucketWriteAndDeleteAccessPolicy"] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id   = (known after apply)
      + json = (known after apply)

      + statement {
          + actions   = [
              + "s3:DeleteObject",
              + "s3:GetObject",
              + "s3:ListBucket",
              + "s3:PutObject",
              + "s3:PutObjectAcl",
            ]
          + effect    = "Allow"
          + resources = [
              + (known after apply),
              + (known after apply),
            ]
        }
    }

  # module.baseline.aws_cloudwatch_log_group.this["cwagent-var-log-messages"] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + name              = "cwagent-var-log-messages"
      + name_prefix       = (known after apply)
      + retention_in_days = 30
      + skip_destroy      = false
      + tags              = {
          + "Name"                   = "cwagent-var-log-messages"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all          = {
          + "Name"                   = "cwagent-var-log-messages"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_cloudwatch_log_group.this["cwagent-var-log-secure"] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + name              = "cwagent-var-log-secure"
      + name_prefix       = (known after apply)
      + retention_in_days = 90
      + skip_destroy      = false
      + tags              = {
          + "Name"                   = "cwagent-var-log-secure"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all          = {
          + "Name"                   = "cwagent-var-log-secure"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_cloudwatch_log_group.this["cwagent-windows-system"] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + name              = "cwagent-windows-system"
      + name_prefix       = (known after apply)
      + retention_in_days = 30
      + skip_destroy      = false
      + tags              = {
          + "Name"                   = "cwagent-windows-system"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all          = {
          + "Name"                   = "cwagent-windows-system"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_cloudwatch_log_group.this["session-manager-logs"] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + name              = "session-manager-logs"
      + name_prefix       = (known after apply)
      + retention_in_days = 90
      + skip_destroy      = false
      + tags              = {
          + "Name"                   = "session-manager-logs"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all          = {
          + "Name"                   = "session-manager-logs"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_iam_policy.this["BusinessUnitKmsCmkPolicy"] will be created
  + resource "aws_iam_policy" "this" {
      + arn         = (known after apply)
      + description = "Policy allowing access to business unit wide customer managed keys"
      + id          = (known after apply)
      + name        = "BusinessUnitKmsCmkPolicy"
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "kms:RevokeGrant",
                          + "kms:ReEncrypt*",
                          + "kms:ListGrants",
                          + "kms:GenerateDataKey*",
                          + "kms:Encrypt",
                          + "kms:DescribeKey",
                          + "kms:Decrypt",
                          + "kms:CreateGrant",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:kms:eu-west-2:374269020027:key/90121e65-c5fa-43a9-8075-6f3410d2a025",
                          + "arn:aws:kms:eu-west-2:374269020027:key/12984197-3371-4c21-8e43-a88a1581e691",
                        ]
                      + Sid      = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags        = {
          + "Name"                   = "BusinessUnitKmsCmkPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all    = {
          + "Name"                   = "BusinessUnitKmsCmkPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_iam_policy.this["CloudWatchAgentServerReducedPolicy"] will be created
  + resource "aws_iam_policy" "this" {
      + arn         = (known after apply)
      + description = "Same as CloudWatchAgentServerReducedPolicy but with CreateLogGroup permission removed to ensure groups are created in code"
      + id          = (known after apply)
      + name        = "CloudWatchAgentServerReducedPolicy"
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "logs:PutLogEvents",
                          + "logs:DescribeLogStreams",
                          + "logs:DescribeLogGroups",
                          + "logs:CreateLogStream",
                          + "logs:CreateLogGroup",
                          + "ec2:DescribeVolumes",
                          + "ec2:DescribeTags",
                          + "cloudwatch:PutMetricData",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                      + Sid      = ""
                    },
                  + {
                      + Action   = "logs:CreateLogGroup"
                      + Effect   = "Deny"
                      + Resource = "*"
                      + Sid      = ""
                    },
                  + {
                      + Action   = [
                          + "ssm:GetParameters",
                          + "ssm:GetParameter",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"
                      + Sid      = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags        = {
          + "Name"                   = "CloudWatchAgentServerReducedPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all    = {
          + "Name"                   = "CloudWatchAgentServerReducedPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_iam_policy.this["EC2S3BucketWriteAndDeleteAccessPolicy"] will be created
  + resource "aws_iam_policy" "this" {
      + arn         = (known after apply)
      + description = "Allows access to S3 bucket"
      + id          = (known after apply)
      + name        = "EC2S3BucketWriteAndDeleteAccessPolicy"
      + path        = "/"
      + policy      = (known after apply)
      + policy_id   = (known after apply)
      + tags        = {
          + "Name"                   = "EC2S3BucketWriteAndDeleteAccessPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all    = {
          + "Name"                   = "EC2S3BucketWriteAndDeleteAccessPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_iam_policy.this["ImageBuilderLaunchTemplatePolicy"] will be created
  + resource "aws_iam_policy" "this" {
      + arn         = (known after apply)
      + description = "Policy allowing access to image builder launch templates"
      + id          = (known after apply)
      + name        = "ImageBuilderLaunchTemplatePolicy"
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "ec2:ModifyLaunchTemplate",
                          + "ec2:CreateLaunchTemplateVersion",
                        ]
                      + Condition = {
                          + StringEquals = {
                              + "aws:ResourceTag/CreatedBy" = "EC2 Image Builder"
                            }
                        }
                      + Effect    = "Allow"
                      + Resource  = "*"
                      + Sid       = ""
                    },
                  + {
                      + Action    = "ec2:DescribeLaunchTemplates"
                      + Condition = {
                          + StringEquals = {
                              + "aws:ResourceTag/CreatedBy" = "EC2 Image Builder"
                            }
                        }
                      + Effect    = "Allow"
                      + Resource  = "arn:aws:ec2:*:*:launch-template/*"
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags        = {
          + "Name"                   = "ImageBuilderLaunchTemplatePolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all    = {
          + "Name"                   = "ImageBuilderLaunchTemplatePolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_iam_role.this["EC2ImageBuilderDistributionCrossAccountRole"] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::374269020027:root"
                        }
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "EC2ImageBuilderDistributionCrossAccountRole"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags                  = {
          + "Name"                   = "each.key"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all              = {
          + "Name"                   = "each.key"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + unique_id             = (known after apply)

      + inline_policy {
          + name   = (known after apply)
          + policy = (known after apply)
        }
    }

  # module.baseline.aws_iam_role_policy_attachment.this["EC2ImageBuilderDistributionCrossAccountRole-BusinessUnitKmsCmkPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "EC2ImageBuilderDistributionCrossAccountRole"
    }

  # module.baseline.aws_iam_role_policy_attachment.this["EC2ImageBuilderDistributionCrossAccountRole-ImageBuilderLaunchTemplatePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "EC2ImageBuilderDistributionCrossAccountRole"
    }

  # module.baseline.aws_iam_role_policy_attachment.this["EC2ImageBuilderDistributionCrossAccountRole-arn:aws:iam::aws:policy/Ec2ImageBuilderCrossAccountDistributionAccess"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/Ec2ImageBuilderCrossAccountDistributionAccess"
      + role       = "EC2ImageBuilderDistributionCrossAccountRole"
    }

  # module.baseline.aws_iam_service_linked_role.this["autoscaling.amazonaws.com"] will be created
  + resource "aws_iam_service_linked_role" "this" {
      + arn              = (known after apply)
      + aws_service_name = "autoscaling.amazonaws.com"
      + create_date      = (known after apply)
      + id               = (known after apply)
      + name             = (known after apply)
      + path             = (known after apply)
      + tags             = {
          + "Name"                   = "each.key"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all         = {
          + "Name"                   = "each.key"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + unique_id        = (known after apply)
    }

  # module.baseline.aws_key_pair.this["ec2-user"] will be created
  + resource "aws_key_pair" "this" {
      + arn             = (known after apply)
      + fingerprint     = (known after apply)
      + id              = (known after apply)
      + key_name        = "ec2-user"
      + key_name_prefix = (known after apply)
      + key_pair_id     = (known after apply)
      + key_type        = (known after apply)
      + public_key      = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/uAFq1KdA6fg3oLEQbFCF7B2lN7QaaGO7IGrNJGsArFLZ/1n6SsGte9Z6qrU4/OQSjcxQehjLSJhrK8BW0tZ8rlK28vCq1rsOwkw2vhjeVEmsGRCGz6B6/L5MsIIg4QhyfvNMCIvE737mgND/m4Uk0LRzc1gTXItcUgI1wVYg2d6ET8zRgAV1iNYCkC/FBFgZ5ZvbxeBnbl9/8OJjY3Ej5Lk+q6IExMLmG6iPJBf+xTsYmDJ3QePQR8O2a7ACEQLozvWakK7QWfYIhlo6wMVjS9240W6QcrUltDWpGI3NNTvrTtDX7NYba1NKzAFX6f8yBiQwY9kglMyKS2L2q6o3rtr4bkzku7vqZdmHzgMtrfRbzKg1WEjPpSEel3SaOrKo7w7+6LyBbwiOSKSbr5BClYSC0C/694NNzNuExyYO7iDgt2xUqYlaOLq0zaOpAN6YdUIcY2mnFeIvUFUIz8/E5T7m93r50bD/P1DdJGFMK1ICpZCdPwz6f0EFKdK/ENb/vLXl5f1UFp5nJ5JQ5UKRii5KA+FXTon7lCCO2PPSA204Dcx8uVzcJsUBb9JP0BpTxNaRo4oboNggoy8hqFitjUxmm9vReO/yqJciQ96ZB6PuXnjx++SKW0IdhzyzITw07MAxPAmo7aigXRc2I4c/CWG+xr/0jHwi2CfLgLAdvQ=="
      + tags            = {
          + "Name"                   = "ec2-user"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all        = {
          + "Name"                   = "ec2-user"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_kms_grant.this["business-unit-ebs-cmk-grant-for-autoscaling"] will be created
  + resource "aws_kms_grant" "this" {
      + grant_id          = (known after apply)
      + grant_token       = (known after apply)
      + grantee_principal = (sensitive value)
      + id                = (known after apply)
      + key_id            = "arn:aws:kms:eu-west-2:374269020027:key/12984197-3371-4c21-8e43-a88a1581e691"
      + name              = "business-unit-ebs-cmk-grant-for-autoscaling"
      + operations        = [
          + "CreateGrant",
          + "Decrypt",
          + "DescribeKey",
          + "Encrypt",
          + "GenerateDataKey",
          + "GenerateDataKeyWithoutPlaintext",
          + "ReEncryptFrom",
          + "ReEncryptTo",
        ]
      + retire_on_delete  = false
    }

  # module.baseline.aws_security_group.this["data"] will be created
  + resource "aws_security_group" "this" {
      + arn                    = (known after apply)
      + description            = "Security group for data subnet"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "data"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                   = "data"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all               = {
          + "Name"                   = "data"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + vpc_id                 = "vpc-0a16bb6858dd27aea"
    }

  # module.baseline.aws_security_group.this["private"] will be created
  + resource "aws_security_group" "this" {
      + arn                    = (known after apply)
      + description            = "Security group for private subnet"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "private"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                   = "private"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all               = {
          + "Name"                   = "private"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + vpc_id                 = "vpc-0a16bb6858dd27aea"
    }

  # module.baseline.aws_security_group.this["public"] will be created
  + resource "aws_security_group" "this" {
      + arn                    = (known after apply)
      + description            = "Security group for public subnet"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "public"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                   = "public"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all               = {
          + "Name"                   = "public"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + vpc_id                 = "vpc-0a16bb6858dd27aea"
    }

  # module.baseline.aws_security_group_rule.this["data-egress-all-cidrs"] will be created
  + resource "aws_security_group_rule" "this" {
      + cidr_blocks              = [
          + "<IP_ADDRESS>/0",
        ]
      + description              = "Allow all egress"
      + from_port                = 0
      + id                       = (known after apply)
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "egress"
    }

  # module.baseline.aws_security_group_rule.this["data-ingress-all-within-subnet-self"] will be created
  + resource "aws_security_group_rule" "this" {
      + description              = "Allow all ingress to self"
      + from_port                = 0
      + id                       = (known after apply)
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "ingress"
    }

  # module.baseline.aws_security_group_rule.this["data-ingress-oracle1521-cidrs"] will be created
  + resource "aws_security_group_rule" "this" {
      + cidr_blocks              = [
          + "<IP_ADDRESS>/18",
          + "<IP_ADDRESS>/20",
          + "<IP_ADDRESS>/18",
          + "<IP_ADDRESS>/20",
          + "<IP_ADDRESS>/16",
        ]
      + description              = "Allow oracle database 1521 ingress"
      + from_port                = 1521
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 1521
      + type                     = "ingress"
    }

  # module.baseline.aws_security_group_rule.this["data-ingress-oracle1521-private"] will be created
  + resource "aws_security_group_rule" "this" {
      + description              = "Allow oracle database 1521 ingress"
      + from_port                = 1521
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 1521
      + type                     = "ingress"
    }

  # module.baseline.aws_security_group_rule.this["private-egress-all-cidrs"] will be created
  + resource "aws_security_group_rule" "this" {
      + cidr_blocks              = [
          + "<IP_ADDRESS>/0",
        ]
      + description              = "Allow all egress"
      + from_port                = 0
      + id                       = (known after apply)
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "egress"
    }

  # module.baseline.aws_security_group_rule.this["private-ingress-all-within-subnet-self"] will be created
  + resource "aws_security_group_rule" "this" {
      + description              = "Allow all ingress to self"
      + from_port                = 0
      + id                       = (known after apply)
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "ingress"
    }

  # module.baseline.aws_security_group_rule.this["private-ingress-http8080-public"] will be created
  + resource "aws_security_group_rule" "this" {
      + description              = "Allow http8080 ingress"
      + from_port                = 8080
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 8080
      + type                     = "ingress"
    }

  # module.baseline.aws_security_group_rule.this["public-egress-all-cidrs"] will be created
  + resource "aws_security_group_rule" "this" {
      + cidr_blocks              = [
          + "<IP_ADDRESS>/0",
        ]
      + description              = "Allow all egress"
      + from_port                = 0
      + id                       = (known after apply)
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "egress"
    }

  # module.baseline.aws_security_group_rule.this["public-ingress-all-within-subnet-self"] will be created
  + resource "aws_security_group_rule" "this" {
      + description              = "Allow all ingress to self"
      + from_port                = 0
      + id                       = (known after apply)
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "ingress"
    }

  # module.baseline.aws_security_group_rule.this["public-ingress-https-cidrs"] will be created
  + resource "aws_security_group_rule" "this" {
      + cidr_blocks              = [
          + "<IP_ADDRESS>/18",
          + "<IP_ADDRESS>/20",
          + "<IP_ADDRESS>/18",
          + "<IP_ADDRESS>/20",
          + "<IP_ADDRESS>/32",
          + "<IP_ADDRESS>/32",
          + "<IP_ADDRESS>/32",
          + "<IP_ADDRESS>/32",
          + "<IP_ADDRESS>/16",
          + "<IP_ADDRESS>/16",
          + "<IP_ADDRESS>/16",
          + "<IP_ADDRESS>/16",
          + "<IP_ADDRESS>/12",
        ]
      + description              = "Allow https ingress"
      + from_port                = 443
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.baseline.module.s3_bucket["s3-bucket"].data.aws_iam_policy_document.bucket_policy_v2 will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_iam_policy_document" "bucket_policy_v2" {
      + id   = (known after apply)
      + json = (known after apply)
    }

  # module.baseline.module.s3_bucket["s3-bucket"].data.aws_iam_policy_document.default will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "default" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + override_policy_documents = [
          + jsonencode({}),
          + (known after apply),
        ]

      + statement {
          + actions   = [
              + "s3:*",
            ]
          + effect    = "Deny"
          + resources = [
              + (known after apply),
              + (known after apply),
            ]

          + condition {
              + test     = "Bool"
              + values   = [
                  + "false",
                ]
              + variable = "aws:SecureTransport"
            }

          + principals {
              + identifiers = [
                  + "*",
                ]
              + type        = "AWS"
            }
        }
    }

  # module.baseline.module.s3_bucket["s3-bucket"].aws_s3_bucket.default will be created
  + resource "aws_s3_bucket" "default" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = (known after apply)
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = "s3-bucket"
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags                        = {
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all                    = {
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-production"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "true"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule {
          + allowed_headers = (known after apply)
          + allowed_methods = (known after apply)
          + allowed_origins = (known after apply)
          + expose_headers  = (known after apply)
          + max_age_seconds = (known after apply)
        }

      + grant {
          + id          = (known after apply)
          + permissions = (known after apply)
          + type        = (known after apply)
          + uri         = (known after apply)
        }

      + lifecycle_rule {
          + abort_incomplete_multipart_upload_days = (known after apply)
          + enabled                                = (known after apply)
          + id                                     = (known after apply)
          + prefix                                 = (known after apply)
          + tags                                   = (known after apply)

          + expiration {
              + date                         = (known after apply)
              + days                         = (known after apply)
              + expired_object_delete_marker = (known after apply)
            }

          + noncurrent_version_expiration {
              + days = (known after apply)
            }

          + noncurrent_version_transition {
              + days          = (known after apply)
              + storage_class = (known after apply)
            }

          + transition {
              + date          = (known after apply)
              + days          = (known after apply)
              + storage_class = (known after apply)
            }
        }

      + logging {
          + target_bucket = (known after apply)
          + target_prefix = (known after apply)
        }

      + object_lock_configuration {
          + object_lock_enabled = (known after apply)

          + rule {
              + default_retention {
                  + days  = (known after apply)
                  + mode  = (known after apply)
                  + years = (known after apply)
                }
            }
        }

      + replication_configuration {
          + role = (known after apply)

          + rules {
              + delete_marker_replication_status = (known after apply)
              + id                               = (known after apply)
              + prefix                           = (known after apply)
              + priority                         = (known after apply)
              + status                           = (known after apply)

              + destination {
                  + account_id         = (known after apply)
                  + bucket             = (known after apply)
                  + replica_kms_key_id = (known after apply)
                  + storage_class      = (known after apply)

                  + access_control_translation {
                      + owner = (known after apply)
                    }

                  + metrics {
                      + minutes = (known after apply)
                      + status  = (known after apply)
                    }

                  + replication_time {
                      + minutes = (known after apply)
                      + status  = (known after apply)
                    }
                }

              + filter {
                  + prefix = (known after apply)
                  + tags   = (known after apply)
                }

              + source_selection_criteria {
                  + sse_kms_encrypted_objects {
                      + enabled = (known after apply)
                    }
                }
            }
        }

      + server_side_encryption_configuration {
          + rule {
              + bucket_key_enabled = (known after apply)

              + apply_server_side_encryption_by_default {
                  + kms_master_key_id = (known after apply)
                  + sse_algorithm     = (known after apply)
                }
            }
        }

      + versioning {
          + enabled    = (known after apply)
          + mfa_delete = (known after apply)
        }

      + website {
          + error_document           = (known after apply)
          + index_document           = (known after apply)
          + redirect_all_requests_to = (known after apply)
          + routing_rules            = (known after apply)
        }
    }

  # module.baseline.module.s3_bucket["s3-bucket"].aws_s3_bucket_acl.default will be created
  + resource "aws_s3_bucket_acl" "default" {
      + acl    = "private"
      + bucket = (known after apply)
      + id     = (known after apply)

      + access_control_policy {
          + grant {
              + permission = (known after apply)

              + grantee {
                  + display_name  = (known after apply)
                  + email_address = (known after apply)
                  + id            = (known after apply)
                  + type          = (known after apply)
                  + uri           = (known after apply)
                }
            }

          + owner {
              + display_name = (known after apply)
              + id           = (known after apply)
            }
        }
    }

  # module.baseline.module.s3_bucket["s3-bucket"].aws_s3_bucket_lifecycle_configuration.default will be created
  + resource "aws_s3_bucket_lifecycle_configuration" "default" {
      + bucket = (known after apply)
      + id     = (known after apply)

      + rule {
          + id     = "main"
          + status = "Enabled"

          + abort_incomplete_multipart_upload {
              + days_after_initiation = 7
            }

          + expiration {
              + days                         = 730
              + expired_object_delete_marker = (known after apply)
            }

          + filter {
            }

          + noncurrent_version_expiration {
              + noncurrent_days = 730
            }

          + noncurrent_version_transition {
              + noncurrent_days = 365
              + storage_class   = "GLACIER"
            }
          + noncurrent_version_transition {
              + noncurrent_days = 90
              + storage_class   = "STANDARD_IA"
            }

          + transition {
              + days          = 365
              + storage_class = "GLACIER"
            }
          + transition {
              + days          = 90
              + storage_class = "STANDARD_IA"
            }
        }
    }

  # module.baseline.module.s3_bucket["s3-bucket"].aws_s3_bucket_policy.default will be created
  + resource "aws_s3_bucket_policy" "default" {
      + bucket = (known after apply)
      + id     = (known after apply)
      + policy = (known after apply)
    }

  # module.baseline.module.s3_bucket["s3-bucket"].aws_s3_bucket_public_access_block.default will be created
  + resource "aws_s3_bucket_public_access_block" "default" {
      + block_public_acls       = true
      + block_public_policy     = true
      + bucket                  = (known after apply)
      + id                      = (known after apply)
      + ignore_public_acls      = true
      + restrict_public_buckets = true
    }

  # module.baseline.module.s3_bucket["s3-bucket"].aws_s3_bucket_server_side_encryption_configuration.default will be created
  + resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
      + bucket = (known after apply)
      + id     = (known after apply)

      + rule {
          + apply_server_side_encryption_by_default {
              + kms_master_key_id = "arn:aws:kms:eu-west-2:374269020027:key/90121e65-c5fa-43a9-8075-6f3410d2a025"
              + sse_algorithm     = "aws:kms"
            }
        }
    }

  # module.baseline.module.s3_bucket["s3-bucket"].aws_s3_bucket_versioning.default will be created
  + resource "aws_s3_bucket_versioning" "default" {
      + bucket = (known after apply)
      + id     = (known after apply)

      + versioning_configuration {
          + mfa_delete = (known after apply)
          + status     = "Enabled"
        }
    }

Plan: 35 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

nomis-combined-reporting-preproduction terraform plan on pull_request event #30
Terraform will perform the following actions:

  # module.baseline.data.aws_iam_policy_document.this["EC2S3BucketWriteAndDeleteAccessPolicy"] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id   = (known after apply)
      + json = (known after apply)

      + statement {
          + actions   = [
              + "s3:DeleteObject",
              + "s3:GetObject",
              + "s3:ListBucket",
              + "s3:PutObject",
              + "s3:PutObjectAcl",
            ]
          + effect    = "Allow"
          + resources = [
              + (known after apply),
              + (known after apply),
            ]
        }
    }

  # module.baseline.aws_cloudwatch_log_group.this["cwagent-var-log-messages"] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + name              = "cwagent-var-log-messages"
      + name_prefix       = (known after apply)
      + retention_in_days = 30
      + skip_destroy      = false
      + tags              = {
          + "Name"                   = "cwagent-var-log-messages"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all          = {
          + "Name"                   = "cwagent-var-log-messages"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_cloudwatch_log_group.this["cwagent-var-log-secure"] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + name              = "cwagent-var-log-secure"
      + name_prefix       = (known after apply)
      + retention_in_days = 90
      + skip_destroy      = false
      + tags              = {
          + "Name"                   = "cwagent-var-log-secure"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all          = {
          + "Name"                   = "cwagent-var-log-secure"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_cloudwatch_log_group.this["cwagent-windows-system"] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + name              = "cwagent-windows-system"
      + name_prefix       = (known after apply)
      + retention_in_days = 30
      + skip_destroy      = false
      + tags              = {
          + "Name"                   = "cwagent-windows-system"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all          = {
          + "Name"                   = "cwagent-windows-system"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_cloudwatch_log_group.this["session-manager-logs"] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + name              = "session-manager-logs"
      + name_prefix       = (known after apply)
      + retention_in_days = 90
      + skip_destroy      = false
      + tags              = {
          + "Name"                   = "session-manager-logs"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all          = {
          + "Name"                   = "session-manager-logs"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_iam_policy.this["BusinessUnitKmsCmkPolicy"] will be created
  + resource "aws_iam_policy" "this" {
      + arn         = (known after apply)
      + description = "Policy allowing access to business unit wide customer managed keys"
      + id          = (known after apply)
      + name        = "BusinessUnitKmsCmkPolicy"
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "kms:RevokeGrant",
                          + "kms:ReEncrypt*",
                          + "kms:ListGrants",
                          + "kms:GenerateDataKey*",
                          + "kms:Encrypt",
                          + "kms:DescribeKey",
                          + "kms:Decrypt",
                          + "kms:CreateGrant",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:kms:eu-west-2:374269020027:key/90121e65-c5fa-43a9-8075-6f3410d2a025",
                          + "arn:aws:kms:eu-west-2:374269020027:key/12984197-3371-4c21-8e43-a88a1581e691",
                        ]
                      + Sid      = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags        = {
          + "Name"                   = "BusinessUnitKmsCmkPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all    = {
          + "Name"                   = "BusinessUnitKmsCmkPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_iam_policy.this["CloudWatchAgentServerReducedPolicy"] will be created
  + resource "aws_iam_policy" "this" {
      + arn         = (known after apply)
      + description = "Same as CloudWatchAgentServerReducedPolicy but with CreateLogGroup permission removed to ensure groups are created in code"
      + id          = (known after apply)
      + name        = "CloudWatchAgentServerReducedPolicy"
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "logs:PutLogEvents",
                          + "logs:DescribeLogStreams",
                          + "logs:DescribeLogGroups",
                          + "logs:CreateLogStream",
                          + "logs:CreateLogGroup",
                          + "ec2:DescribeVolumes",
                          + "ec2:DescribeTags",
                          + "cloudwatch:PutMetricData",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                      + Sid      = ""
                    },
                  + {
                      + Action   = "logs:CreateLogGroup"
                      + Effect   = "Deny"
                      + Resource = "*"
                      + Sid      = ""
                    },
                  + {
                      + Action   = [
                          + "ssm:GetParameters",
                          + "ssm:GetParameter",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"
                      + Sid      = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags        = {
          + "Name"                   = "CloudWatchAgentServerReducedPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all    = {
          + "Name"                   = "CloudWatchAgentServerReducedPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_iam_policy.this["EC2S3BucketWriteAndDeleteAccessPolicy"] will be created
  + resource "aws_iam_policy" "this" {
      + arn         = (known after apply)
      + description = "Allows access to S3 bucket"
      + id          = (known after apply)
      + name        = "EC2S3BucketWriteAndDeleteAccessPolicy"
      + path        = "/"
      + policy      = (known after apply)
      + policy_id   = (known after apply)
      + tags        = {
          + "Name"                   = "EC2S3BucketWriteAndDeleteAccessPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all    = {
          + "Name"                   = "EC2S3BucketWriteAndDeleteAccessPolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_iam_policy.this["ImageBuilderLaunchTemplatePolicy"] will be created
  + resource "aws_iam_policy" "this" {
      + arn         = (known after apply)
      + description = "Policy allowing access to image builder launch templates"
      + id          = (known after apply)
      + name        = "ImageBuilderLaunchTemplatePolicy"
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "ec2:ModifyLaunchTemplate",
                          + "ec2:CreateLaunchTemplateVersion",
                        ]
                      + Condition = {
                          + StringEquals = {
                              + "aws:ResourceTag/CreatedBy" = "EC2 Image Builder"
                            }
                        }
                      + Effect    = "Allow"
                      + Resource  = "*"
                      + Sid       = ""
                    },
                  + {
                      + Action    = "ec2:DescribeLaunchTemplates"
                      + Condition = {
                          + StringEquals = {
                              + "aws:ResourceTag/CreatedBy" = "EC2 Image Builder"
                            }
                        }
                      + Effect    = "Allow"
                      + Resource  = "arn:aws:ec2:*:*:launch-template/*"
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags        = {
          + "Name"                   = "ImageBuilderLaunchTemplatePolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all    = {
          + "Name"                   = "ImageBuilderLaunchTemplatePolicy"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_iam_role.this["EC2ImageBuilderDistributionCrossAccountRole"] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::374269020027:root"
                        }
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "EC2ImageBuilderDistributionCrossAccountRole"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags                  = {
          + "Name"                   = "each.key"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all              = {
          + "Name"                   = "each.key"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + unique_id             = (known after apply)

      + inline_policy {
          + name   = (known after apply)
          + policy = (known after apply)
        }
    }

  # module.baseline.aws_iam_role_policy_attachment.this["EC2ImageBuilderDistributionCrossAccountRole-BusinessUnitKmsCmkPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "EC2ImageBuilderDistributionCrossAccountRole"
    }

  # module.baseline.aws_iam_role_policy_attachment.this["EC2ImageBuilderDistributionCrossAccountRole-ImageBuilderLaunchTemplatePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "EC2ImageBuilderDistributionCrossAccountRole"
    }

  # module.baseline.aws_iam_role_policy_attachment.this["EC2ImageBuilderDistributionCrossAccountRole-arn:aws:iam::aws:policy/Ec2ImageBuilderCrossAccountDistributionAccess"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/Ec2ImageBuilderCrossAccountDistributionAccess"
      + role       = "EC2ImageBuilderDistributionCrossAccountRole"
    }

  # module.baseline.aws_iam_service_linked_role.this["autoscaling.amazonaws.com"] will be created
  + resource "aws_iam_service_linked_role" "this" {
      + arn              = (known after apply)
      + aws_service_name = "autoscaling.amazonaws.com"
      + create_date      = (known after apply)
      + id               = (known after apply)
      + name             = (known after apply)
      + path             = (known after apply)
      + tags             = {
          + "Name"                   = "each.key"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all         = {
          + "Name"                   = "each.key"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + unique_id        = (known after apply)
    }

  # module.baseline.aws_key_pair.this["ec2-user"] will be created
  + resource "aws_key_pair" "this" {
      + arn             = (known after apply)
      + fingerprint     = (known after apply)
      + id              = (known after apply)
      + key_name        = "ec2-user"
      + key_name_prefix = (known after apply)
      + key_pair_id     = (known after apply)
      + key_type        = (known after apply)
      + public_key      = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDRF/QTIcPQE/XdQxmYPGFJ7l7l+D0OhGXuC9uJcq2jAGR8gf7eKWfLUU20fNcyXo4PvI7Qq+pGBFYc6950oIYVce9FnNTZ5DWgOfQOeS5Zmr4O2xiR7Dpx2dVSOk1RUCKOoiHCzVWzvUWLHZbHEtRxwhFR2flnKUhheseurFjjHag7RP3iu0JxQDPqGmTX82/2ex/2/KeW6kTq9lVSHy1MkyltMIqMtLoaAzHLa7p/XmcJZVwhvufJDc35CgytEoJr6E/3elYhz7JJWpa10QIiXk9DYrjGygalm2726Pl2OGof+5YsC5oqed0yNHcxMToMwFJK+DnEoOahqRuyY9/gUSG5tHocOVaJp1kUFDDSqGig1xwXKHng3aIXqVQnSTGOcqkW5QVS8LJ2hUPvyazjZSDvdClG7otaIs6DvjE9u1cXqU0mIfga+RHHY1YZQwJJBsE3240bhCI2D31rQarzfo/CMEH7e6/PbLxbUYB9Jy+HqPUCIh0JlbcoQVrYVGLlUM4zrdJgQJX5+nYxmy2A7voo62EtbjJ+IDms+/qjmN4qqBbx0/+rCjan3PfVfvDaTeCw4Elir5cfcfS7Zlm/L1vgzNoUmb1Gn8dzLzN+1+ApAQrEBDfQbqzs5rHspr18NJipjcb1OJRSbxtn4ahuouSg466wrNwxl1cTL1WIyw=="
      + tags            = {
          + "Name"                   = "ec2-user"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all        = {
          + "Name"                   = "ec2-user"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
    }

  # module.baseline.aws_kms_grant.this["business-unit-ebs-cmk-grant-for-autoscaling"] will be created
  + resource "aws_kms_grant" "this" {
      + grant_id          = (known after apply)
      + grant_token       = (known after apply)
      + grantee_principal = (sensitive value)
      + id                = (known after apply)
      + key_id            = "arn:aws:kms:eu-west-2:374269020027:key/12984197-3371-4c21-8e43-a88a1581e691"
      + name              = "business-unit-ebs-cmk-grant-for-autoscaling"
      + operations        = [
          + "CreateGrant",
          + "Decrypt",
          + "DescribeKey",
          + "Encrypt",
          + "GenerateDataKey",
          + "GenerateDataKeyWithoutPlaintext",
          + "ReEncryptFrom",
          + "ReEncryptTo",
        ]
      + retire_on_delete  = false
    }

  # module.baseline.aws_security_group.this["data"] will be created
  + resource "aws_security_group" "this" {
      + arn                    = (known after apply)
      + description            = "Security group for data subnet"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "data"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                   = "data"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all               = {
          + "Name"                   = "data"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + vpc_id                 = "vpc-0d7bfee459b7bd221"
    }

  # module.baseline.aws_security_group.this["private"] will be created
  + resource "aws_security_group" "this" {
      + arn                    = (known after apply)
      + description            = "Security group for private subnet"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "private"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                   = "private"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + tags_all               = {
          + "Name"                   = "private"
          + "application"            = "nomis-combined-reporting"
          + "business-unit"          = "HMPPS"
          + "environment-name"       = "nomis-combined-reporting-preproduction"
          + "infrastructure-support" =<EMAIL_ADDRESS>          + "is-production"          = "false"
          + "owner"                  =<EMAIL_ADDRESS>          + "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
        }
      + vpc_id                 = "vpc-0d7bfee459b7bd221"
    }

  # module.baseline.aws_security_group.this["public"] will be created
  + resource "aws_security_group" "this" {
      + arn                    = (known after apply)
      + description            = "Security group for public subnet"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "public"