feat(router): Stand up apollo router

Stand up an Apollo Router to front our graph. Will be deployed side-by-side with the gateway, eventually to replace.
Maintains expected subgraph header contracts.
Tasks

[x] Add secrets in dev and prod
[ ] Test in dev

[POCKET-9377]

Plan Result (shared-snowplow-consumer-cdk)
CI link
Plan: 1 to add, 0 to change, 0 to destroy.

Create

local_file.shared-snowplow-consumer-app_application_ecs_service_appspec_7674CFF9

Change Result (Click me)

  # local_file.shared-snowplow-consumer-app_application_ecs_service_appspec_7674CFF9 will be created
  + resource "local_file" "shared-snowplow-consumer-app_application_ecs_service_appspec_7674CFF9" {
      + content              = jsonencode(
            {
              + Resources = [
                  + {
                      + TargetService = {
                          + Properties = {
                              + LoadBalancerInfo = {
                                  + ContainerName = "app"
                                  + ContainerPort = 4015
                                }
                              + TaskDefinition   = "arn:aws:ecs:us-east-1:996905175585:task-definition/SharedSnowplowConsumer-Prod:68"
                            }
                          + Type       = "AWS::ECS::Service"
                        }
                    },
                ]
              + version   = 1
            }
        )
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "appspec.json"
      + id                   = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.
╷
│ Warning: Deprecated attribute
│
│   on cdk.tf.json line 1993, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
│ 1993:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",
│
│ The attribute "integration_key" is deprecated. Refer to the provider
│ documentation for details.
│
│ (and 3 more similar warnings elsewhere)
╵

:warning: Warnings
Warning: Deprecated attribute

   on cdk.tf.json line 1993, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
 1993:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",

 The attribute "integration_key" is deprecated. Refer to the provider
 documentation for details.

 (and 3 more similar warnings elsewhere)

Plan Result (transactional-emails-cdk)
CI link
Plan: 0 to add, 1 to change, 0 to destroy.

Update

aws_lambda_function.events_sqs-event-consumer_lambda_3BE960B8

Change Result (Click me)

  # aws_lambda_function.events_sqs-event-consumer_lambda_3BE960B8 will be updated in-place
  ~ resource "aws_lambda_function" "events_sqs-event-consumer_lambda_3BE960B8" {
        id                             = "TransactionalEmails-Prod-Sqs-Event-Consumer-Function"
      ~ qualified_arn                  = "arn:aws:lambda:us-east-1:996905175585:function:TransactionalEmails-Prod-Sqs-Event-Consumer-Function:171" -> (known after apply)
      ~ qualified_invoke_arn           = "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:996905175585:function:TransactionalEmails-Prod-Sqs-Event-Consumer-Function:171/invocations" -> (known after apply)
        tags                           = {
            "environment" = "Prod"
            "service"     = "TransactionalEmails"
        }
      ~ version                        = "171" -> (known after apply)
        # (19 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              ~ "GIT_SHA"                            = (sensitive value)
                # (6 unchanged elements hidden)
            }
        }

        # (3 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.
╷
│ Warning: Deprecated attribute
│
│   on cdk.tf.json line 1125, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
│ 1125:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",
│
│ The attribute "integration_key" is deprecated. Refer to the provider
│ documentation for details.
│
│ (and 3 more similar warnings elsewhere)
╵

:warning: Warnings
Warning: Deprecated attribute

   on cdk.tf.json line 1125, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
 1125:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",

 The attribute "integration_key" is deprecated. Refer to the provider
 documentation for details.

 (and 3 more similar warnings elsewhere)

Plan Result (parser-graphql-wrapper-cdk)
CI link
Plan: 1 to add, 0 to change, 0 to destroy.

Create

local_file.application_ecs_service_appspec_94386B9C

Change Result (Click me)

  # local_file.application_ecs_service_appspec_94386B9C will be created
  + resource "local_file" "application_ecs_service_appspec_94386B9C" {
      + content              = jsonencode(
            {
              + Resources = [
                  + {
                      + TargetService = {
                          + Properties = {
                              + LoadBalancerInfo = {
                                  + ContainerName = "app"
                                  + ContainerPort = 4001
                                }
                              + TaskDefinition   = "arn:aws:ecs:us-east-1:996905175585:task-definition/ParserGraphQLWrapper-Prod:629"
                            }
                          + Type       = "AWS::ECS::Service"
                        }
                    },
                ]
              + version   = 1
            }
        )
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "appspec.json"
      + id                   = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.
╷
│ Warning: Deprecated attribute
│
│   on cdk.tf.json line 2074, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
│ 2074:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",
│
│ The attribute "integration_key" is deprecated. Refer to the provider
│ documentation for details.
│
│ (and 3 more similar warnings elsewhere)
╵

:warning: Warnings
Warning: Deprecated attribute

   on cdk.tf.json line 2074, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
 2074:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",

 The attribute "integration_key" is deprecated. Refer to the provider
 documentation for details.

 (and 3 more similar warnings elsewhere)

:x: Plan Failed (image-api-cdk)
CI link
Error: Error acquiring the state lock

 Error message: workspace already locked (lock ID: "Pocket/ImageAPI-Prod")
 Lock Info:
   ID:        ad59723f-c6e0-14f7-4224-4880c30714f8
   Path:
   Operation: OperationTypePlan
   Who<EMAIL_ADDRESS>   Version:   1.6.6
   Created:   2024-01-05 00:41:44.816906238 +0000 UTC
   Info:

 Terraform acquires a state lock to protect the state from being written
 by multiple users at the same time. Please resolve the issue above and try
 again. For most commands, you can disable locking with the "-lock=false"
 flag, but this is not recommended.

:white_check_mark: Apply Succeeded (shared-snowplow-consumer-cdk-dev)
CI link
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
 Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # local_file.shared-snowplow-consumer-app_application_ecs_service_appspec_7674CFF9 will be created
  + resource "local_file" "shared-snowplow-consumer-app_application_ecs_service_appspec_7674CFF9" {
      + content              = jsonencode(
            {
              + Resources = [
                  + {
                      + TargetService = {
                          + Properties = {
                              + LoadBalancerInfo = {
                                  + ContainerName = "app"
                                  + ContainerPort = 4015
                                }
                              + TaskDefinition   = "arn:aws:ecs:us-east-1:410318598490:task-definition/SharedSnowplowConsumer-Dev:82"
                            }
                          + Type       = "AWS::ECS::Service"
                        }
                    },
                ]
              + version   = 1
            }
        )
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "appspec.json"
      + id                   = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.
local_file.shared-snowplow-consumer-app_application_ecs_service_appspec_7674CFF9: Creating...
local_file.shared-snowplow-consumer-app_application_ecs_service_appspec_7674CFF9: Creation complete after 0s [id=20a39d70abc4a57d82a6794926b51e014a7a9575]
╷
│ Warning: Deprecated attribute
│
│   on cdk.tf.json line 1991, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
│ 1991:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",
│
│ The attribute "integration_key" is deprecated. Refer to the provider
│ documentation for details.
│
│ (and 3 more similar warnings elsewhere)
╵

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Plan Result (user-api-cdk)
CI link
Plan: 1 to add, 0 to change, 0 to destroy.

Create

local_file.application_ecs_service_appspec_94386B9C

Change Result (Click me)

  # local_file.application_ecs_service_appspec_94386B9C will be created
  + resource "local_file" "application_ecs_service_appspec_94386B9C" {
      + content              = jsonencode(
            {
              + Resources = [
                  + {
                      + TargetService = {
                          + Properties = {
                              + LoadBalancerInfo = {
                                  + ContainerName = "app"
                                  + ContainerPort = 4006
                                }
                              + TaskDefinition   = "arn:aws:ecs:us-east-1:996905175585:task-definition/UserAPI-Prod:255"
                            }
                          + Type       = "AWS::ECS::Service"
                        }
                    },
                ]
              + version   = 1
            }
        )
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "appspec.json"
      + id                   = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.
╷
│ Warning: Deprecated attribute
│
│   on cdk.tf.json line 1976, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
│ 1976:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",
│
│ The attribute "integration_key" is deprecated. Refer to the provider
│ documentation for details.
│
│ (and 3 more similar warnings elsewhere)
╵

:warning: Warnings
Warning: Deprecated attribute

   on cdk.tf.json line 1976, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
 1976:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",

 The attribute "integration_key" is deprecated. Refer to the provider
 documentation for details.

 (and 3 more similar warnings elsewhere)

Plan Result (fxa-webhook-proxy-cdk)
CI link
:warning: Resource Deletion will happen
This plan contains resource delete operation. Please check the plan result very carefully!
Plan: 1 to add, 3 to change, 1 to destroy.

Update

aws_api_gateway_stage.apigateway-lambda_api-gateway-stage_E95B0DF9
aws_lambda_function.apigateway-lambda_fxa-events-apigateway-lambda_events-lambda_06645171
aws_lambda_function.proxy-lambda_fxa-events-sqs-lambda_39345609

Replace

aws_api_gateway_deployment.apigateway-lambda_api-gateway-deployment_3AF9B512

Change Result (Click me)

  # aws_api_gateway_deployment.apigateway-lambda_api-gateway-deployment_3AF9B512 must be replaced
+/- resource "aws_api_gateway_deployment" "apigateway-lambda_api-gateway-deployment_3AF9B512" {
      ~ created_date  = "2024-01-04T22:37:44Z" -> (known after apply)
      ~ execution_arn = "arn:aws:execute-api:us-east-1:996905175585:b1aoz7w8yj/" -> (known after apply)
      ~ id            = "v06wo2" -> (known after apply)
      ~ invoke_url    = "https://b1aoz7w8yj.execute-api.us-east-1.amazonaws.com/" -> (known after apply)
      ~ triggers      = { # forces replacement
          ~ "deployedAt"   = "1704407820975" -> "1704415431437"
            # (1 unchanged element hidden)
        }
        # (1 unchanged attribute hidden)
    }

  # aws_api_gateway_stage.apigateway-lambda_api-gateway-stage_E95B0DF9 will be updated in-place
  ~ resource "aws_api_gateway_stage" "apigateway-lambda_api-gateway-stage_E95B0DF9" {
      ~ deployment_id         = "v06wo2" -> (known after apply)
        id                    = "ags-b1aoz7w8yj-prod"
        tags                  = {}
        # (9 unchanged attributes hidden)
    }

  # aws_lambda_function.apigateway-lambda_fxa-events-apigateway-lambda_events-lambda_06645171 will be updated in-place
  ~ resource "aws_lambda_function" "apigateway-lambda_fxa-events-apigateway-lambda_events-lambda_06645171" {
        id                             = "FxAWebhookProxy-Prod-ApiGateway-FxA-Events-Function"
      ~ qualified_arn                  = "arn:aws:lambda:us-east-1:996905175585:function:FxAWebhookProxy-Prod-ApiGateway-FxA-Events-Function:715" -> (known after apply)
      ~ qualified_invoke_arn           = "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:996905175585:function:FxAWebhookProxy-Prod-ApiGateway-FxA-Events-Function:715/invocations" -> (known after apply)
        tags                           = {}
      ~ version                        = "715" -> (known after apply)
        # (19 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              ~ "GIT_SHA"            = (sensitive value)
                # (3 unchanged elements hidden)
            }
        }

        # (3 unchanged blocks hidden)
    }

  # aws_lambda_function.proxy-lambda_fxa-events-sqs-lambda_39345609 will be updated in-place
  ~ resource "aws_lambda_function" "proxy-lambda_fxa-events-sqs-lambda_39345609" {
        id                             = "FxAWebhookProxy-Prod-Sqs-FxA-Events-Function"
      ~ qualified_arn                  = "arn:aws:lambda:us-east-1:996905175585:function:FxAWebhookProxy-Prod-Sqs-FxA-Events-Function:748" -> (known after apply)
      ~ qualified_invoke_arn           = "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:996905175585:function:FxAWebhookProxy-Prod-Sqs-FxA-Events-Function:748/invocations" -> (known after apply)
        tags                           = {
            "environment" = "Prod"
            "service"     = "FxAWebhookProxy"
        }
      ~ version                        = "748" -> (known after apply)
        # (19 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              ~ "GIT_SHA"     = (sensitive value)
                # (4 unchanged elements hidden)
            }
        }

        # (3 unchanged blocks hidden)
    }

Plan: 1 to add, 3 to change, 1 to destroy.
╷
│ Warning: Deprecated attribute
│
│   on cdk.tf.json line 1672, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
│ 1672:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",
│
│ The attribute "integration_key" is deprecated. Refer to the provider
│ documentation for details.
│
│ (and 3 more similar warnings elsewhere)
╵

:warning: Warnings
Warning: Deprecated attribute

   on cdk.tf.json line 1672, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
 1672:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",

 The attribute "integration_key" is deprecated. Refer to the provider
 documentation for details.

 (and 3 more similar warnings elsewhere)

:white_check_mark: Apply Succeeded (parser-graphql-wrapper-cdk-dev)
CI link
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
 Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # local_file.application_ecs_service_appspec_94386B9C will be created
  + resource "local_file" "application_ecs_service_appspec_94386B9C" {
      + content              = jsonencode(
            {
              + Resources = [
                  + {
                      + TargetService = {
                          + Properties = {
                              + LoadBalancerInfo = {
                                  + ContainerName = "app"
                                  + ContainerPort = 4001
                                }
                              + TaskDefinition   = "arn:aws:ecs:us-east-1:410318598490:task-definition/ParserGraphQLWrapper-Dev:107"
                            }
                          + Type       = "AWS::ECS::Service"
                        }
                    },
                ]
              + version   = 1
            }
        )
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "appspec.json"
      + id                   = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.
local_file.application_ecs_service_appspec_94386B9C: Creating...
local_file.application_ecs_service_appspec_94386B9C: Creation complete after 0s [id=0ce4bcc4536ea7558626d33b50a09821dc589752]
╷
│ Warning: Deprecated attribute
│
│   on cdk.tf.json line 2258, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
│ 2258:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",
│
│ The attribute "integration_key" is deprecated. Refer to the provider
│ documentation for details.
│
│ (and 3 more similar warnings elsewhere)
╵
Releasing state lock. This may take a few moments...

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Plan Result (annotations-api-cdk)
CI link
Plan: 1 to add, 2 to change, 0 to destroy.

Create

local_file.application_ecs_service_appspec_94386B9C

Update

aws_dynamodb_table.dynamodb_highlight-notes_dynamodb_table_8BD520BF
aws_iam_policy.application_ecs_service_ecs-iam_ecs-task-role-policy_6FC89FB6

Change Result (Click me)

  # data.aws_iam_policy_document.application_ecs_service_ecs-iam_data-ecs-task-role-policy_090CC3AD will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_iam_policy_document" "application_ecs_service_ecs-iam_data-ecs-task-role-policy_090CC3AD" {
      + id      = (known after apply)
      + json    = (known after apply)
      + version = "2012-10-17"

      + statement {
          + actions   = [
              + "dynamodb:BatchGet*",
              + "dynamodb:BatchWrite*",
              + "dynamodb:Delete*",
              + "dynamodb:DescribeTable",
              + "dynamodb:Get*",
              + "dynamodb:PutItem",
              + "dynamodb:Query",
              + "dynamodb:Scan",
              + "dynamodb:UpdateItem",
            ]
          + effect    = "Allow"
          + resources = [
              + "arn:aws:dynamodb:us-east-1:996905175585:table/ANNOT-Prod-highlight-notes",
              + "arn:aws:dynamodb:us-east-1:996905175585:table/ANNOT-Prod-highlight-notes/*",
            ]
        }
      + statement {
          + actions   = [
              + "sqs:DeleteMessage",
              + "sqs:ReceiveMessage",
              + "sqs:SendMessage",
              + "sqs:SendMessageBatch",
            ]
          + effect    = "Allow"
          + resources = [
              + "arn:aws:sqs:us-east-1:996905175585:AnnotationsAPI-Prod-Batch-Delete-Consumer-Queue",
            ]
        }
    }

  # aws_dynamodb_table.dynamodb_highlight-notes_dynamodb_table_8BD520BF will be updated in-place
  ~ resource "aws_dynamodb_table" "dynamodb_highlight-notes_dynamodb_table_8BD520BF" {
        id                          = "ANNOT-Prod-highlight-notes"
        name                        = "ANNOT-Prod-highlight-notes"
        tags                        = {
            "environment" = "Prod"
            "service"     = "AnnotationsAPI"
        }
        # (9 unchanged attributes hidden)

      - global_secondary_index {
          - hash_key           = "userId" -> null
          - name               = "userId" -> null
          - non_key_attributes = [] -> null
          - projection_type    = "KEYS_ONLY" -> null
          - read_capacity      = 0 -> null
          - write_capacity     = 0 -> null
        }
      + global_secondary_index {
          + hash_key           = "userId"
          + name               = "userId"
          + non_key_attributes = []
          + projection_type    = "KEYS_ONLY"
          + read_capacity      = 5
          + write_capacity     = 5
        }

        # (4 unchanged blocks hidden)
    }

  # aws_iam_policy.application_ecs_service_ecs-iam_ecs-task-role-policy_6FC89FB6 will be updated in-place
  ~ resource "aws_iam_policy" "application_ecs_service_ecs-iam_ecs-task-role-policy_6FC89FB6" {
        id        = "arn:aws:iam::996905175585:policy/AnnotationsAPI-Prod-TaskRolePolicy"
        name      = "AnnotationsAPI-Prod-TaskRolePolicy"
      ~ policy    = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "dynamodb:UpdateItem",
                          - "dynamodb:Scan",
                          - "dynamodb:Query",
                          - "dynamodb:PutItem",
                          - "dynamodb:Get*",
                          - "dynamodb:DescribeTable",
                          - "dynamodb:Delete*",
                          - "dynamodb:BatchWrite*",
                          - "dynamodb:BatchGet*",
                        ]
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:dynamodb:us-east-1:996905175585:table/ANNOT-Prod-highlight-notes/*",
                          - "arn:aws:dynamodb:us-east-1:996905175585:table/ANNOT-Prod-highlight-notes",
                        ]
                      - Sid      = ""
                    },
                  - {
                      - Action   = [
                          - "sqs:SendMessageBatch",
                          - "sqs:SendMessage",
                          - "sqs:ReceiveMessage",
                          - "sqs:DeleteMessage",
                        ]
                      - Effect   = "Allow"
                      - Resource = "arn:aws:sqs:us-east-1:996905175585:AnnotationsAPI-Prod-Batch-Delete-Consumer-Queue"
                      - Sid      = ""
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        tags      = {
            "environment" = "Prod"
            "service"     = "AnnotationsAPI"
        }
        # (4 unchanged attributes hidden)
    }

  # local_file.application_ecs_service_appspec_94386B9C will be created
  + resource "local_file" "application_ecs_service_appspec_94386B9C" {
      + content              = jsonencode(
            {
              + Resources = [
                  + {
                      + TargetService = {
                          + Properties = {
                              + LoadBalancerInfo = {
                                  + ContainerName = "app"
                                  + ContainerPort = 4008
                                }
                              + TaskDefinition   = "arn:aws:ecs:us-east-1:996905175585:task-definition/AnnotationsAPI-Prod:614"
                            }
                          + Type       = "AWS::ECS::Service"
                        }
                    },
                ]
              + version   = 1
            }
        )
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "appspec.json"
      + id                   = (known after apply)
    }

Plan: 1 to add, 2 to change, 0 to destroy.
╷
│ Warning: Deprecated attribute
│
│   on cdk.tf.json line 3003, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
│ 3003:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",
│
│ The attribute "integration_key" is deprecated. Refer to the provider
│ documentation for details.
│
│ (and 3 more similar warnings elsewhere)
╵

:warning: Warnings
Warning: Deprecated attribute

   on cdk.tf.json line 3003, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
 3003:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",

 The attribute "integration_key" is deprecated. Refer to the provider
 documentation for details.

 (and 3 more similar warnings elsewhere)

:white_check_mark: Apply Succeeded (transactional-emails-cdk-dev)
CI link
Apply complete! Resources: 0 added, 1 changed, 0 destroyed.
 Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_lambda_function.events_sqs-event-consumer_lambda_3BE960B8 will be updated in-place
  ~ resource "aws_lambda_function" "events_sqs-event-consumer_lambda_3BE960B8" {
        id                             = "TransactionalEmails-Dev-Sqs-Event-Consumer-Function"
      ~ qualified_arn                  = "arn:aws:lambda:us-east-1:410318598490:function:TransactionalEmails-Dev-Sqs-Event-Consumer-Function:81" -> (known after apply)
      ~ qualified_invoke_arn           = "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:410318598490:function:TransactionalEmails-Dev-Sqs-Event-Consumer-Function:81/invocations" -> (known after apply)
        tags                           = {
            "environment" = "Dev"
            "service"     = "TransactionalEmails"
        }
      ~ version                        = "81" -> (known after apply)
        # (19 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              ~ "GIT_SHA"                            = (sensitive value)
                # (6 unchanged elements hidden)
            }
        }

        # (3 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.
aws_lambda_function.events_sqs-event-consumer_lambda_3BE960B8: Modifying... [id=TransactionalEmails-Dev-Sqs-Event-Consumer-Function]
aws_lambda_function.events_sqs-event-consumer_lambda_3BE960B8: Modifications complete after 6s [id=TransactionalEmails-Dev-Sqs-Event-Consumer-Function]
Releasing state lock. This may take a few moments...

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

:white_check_mark: Apply Succeeded (user-api-cdk-dev)
CI link
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
 Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # local_file.application_ecs_service_appspec_94386B9C will be created
  + resource "local_file" "application_ecs_service_appspec_94386B9C" {
      + content              = jsonencode(
            {
              + Resources = [
                  + {
                      + TargetService = {
                          + Properties = {
                              + LoadBalancerInfo = {
                                  + ContainerName = "app"
                                  + ContainerPort = 4006
                                }
                              + TaskDefinition   = "arn:aws:ecs:us-east-1:410318598490:task-definition/UserAPI-Dev:63"
                            }
                          + Type       = "AWS::ECS::Service"
                        }
                    },
                ]
              + version   = 1
            }
        )
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "appspec.json"
      + id                   = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.
local_file.application_ecs_service_appspec_94386B9C: Creating...
local_file.application_ecs_service_appspec_94386B9C: Creation complete after 0s [id=08186a6cffa18a9019524de9987fd7990e3c14a1]
╷
│ Warning: Deprecated attribute
│
│   on cdk.tf.json line 1972, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
│ 1972:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",
│
│ The attribute "integration_key" is deprecated. Refer to the provider
│ documentation for details.
│
│ (and 3 more similar warnings elsewhere)
╵

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

:white_check_mark: Apply Succeeded (image-api-cdk-dev)
CI link
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
 Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # local_file.application_ecs_service_appspec_94386B9C will be created
  + resource "local_file" "application_ecs_service_appspec_94386B9C" {
      + content              = jsonencode(
            {
              + Resources = [
                  + {
                      + TargetService = {
                          + Properties = {
                              + LoadBalancerInfo = {
                                  + ContainerName = "app"
                                  + ContainerPort = 4867
                                }
                              + TaskDefinition   = "arn:aws:ecs:us-east-1:410318598490:task-definition/ImageAPI-Dev:31"
                            }
                          + Type       = "AWS::ECS::Service"
                        }
                    },
                ]
              + version   = 1
            }
        )
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "appspec.json"
      + id                   = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.
local_file.application_ecs_service_appspec_94386B9C: Creating...
local_file.application_ecs_service_appspec_94386B9C: Creation complete after 0s [id=53cf36836bae4711b1fa483b89bca096fd1c647b]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

:white_check_mark: Apply Succeeded (fxa-webhook-proxy-cdk-dev)
CI link
Apply complete! Resources: 1 added, 3 changed, 1 destroyed.
 Resource actions are indicated with the following symbols:
  ~ update in-place
+/- create replacement and then destroy

Terraform will perform the following actions:

  # aws_api_gateway_deployment.apigateway-lambda_api-gateway-deployment_3AF9B512 must be replaced
+/- resource "aws_api_gateway_deployment" "apigateway-lambda_api-gateway-deployment_3AF9B512" {
      ~ created_date  = "2024-01-04T21:37:44Z" -> (known after apply)
      ~ execution_arn = "arn:aws:execute-api:us-east-1:410318598490:ctafu7cig4/" -> (known after apply)
      ~ id            = "zfjmbq" -> (known after apply)
      ~ invoke_url    = "https://ctafu7cig4.execute-api.us-east-1.amazonaws.com/" -> (known after apply)
      ~ triggers      = { # forces replacement
          ~ "deployedAt"   = "1704404220204" -> "1704415965572"
            # (1 unchanged element hidden)
        }
        # (1 unchanged attribute hidden)
    }

  # aws_api_gateway_stage.apigateway-lambda_api-gateway-stage_E95B0DF9 will be updated in-place
  ~ resource "aws_api_gateway_stage" "apigateway-lambda_api-gateway-stage_E95B0DF9" {
      ~ deployment_id         = "zfjmbq" -> (known after apply)
        id                    = "ags-ctafu7cig4-dev"
        tags                  = {}
        # (9 unchanged attributes hidden)
    }

  # aws_lambda_function.apigateway-lambda_fxa-events-apigateway-lambda_events-lambda_06645171 will be updated in-place
  ~ resource "aws_lambda_function" "apigateway-lambda_fxa-events-apigateway-lambda_events-lambda_06645171" {
        id                             = "FxAWebhookProxy-Dev-ApiGateway-FxA-Events-Function"
      ~ qualified_arn                  = "arn:aws:lambda:us-east-1:410318598490:function:FxAWebhookProxy-Dev-ApiGateway-FxA-Events-Function:56" -> (known after apply)
      ~ qualified_invoke_arn           = "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:410318598490:function:FxAWebhookProxy-Dev-ApiGateway-FxA-Events-Function:56/invocations" -> (known after apply)
        tags                           = {}
      ~ version                        = "56" -> (known after apply)
        # (19 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              ~ "GIT_SHA"            = (sensitive value)
                # (3 unchanged elements hidden)
            }
        }

        # (3 unchanged blocks hidden)
    }

  # aws_lambda_function.proxy-lambda_fxa-events-sqs-lambda_39345609 will be updated in-place
  ~ resource "aws_lambda_function" "proxy-lambda_fxa-events-sqs-lambda_39345609" {
        id                             = "FxAWebhookProxy-Dev-Sqs-FxA-Events-Function"
      ~ qualified_arn                  = "arn:aws:lambda:us-east-1:410318598490:function:FxAWebhookProxy-Dev-Sqs-FxA-Events-Function:67" -> (known after apply)
      ~ qualified_invoke_arn           = "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:410318598490:function:FxAWebhookProxy-Dev-Sqs-FxA-Events-Function:67/invocations" -> (known after apply)
        tags                           = {
            "environment" = "Dev"
            "service"     = "FxAWebhookProxy"
        }
      ~ version                        = "67" -> (known after apply)
        # (19 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              ~ "GIT_SHA"     = (sensitive value)
                # (4 unchanged elements hidden)
            }
        }

        # (3 unchanged blocks hidden)
    }

Plan: 1 to add, 3 to change, 1 to destroy.
aws_lambda_function.proxy-lambda_fxa-events-sqs-lambda_39345609: Modifying... [id=FxAWebhookProxy-Dev-Sqs-FxA-Events-Function]
aws_lambda_function.apigateway-lambda_fxa-events-apigateway-lambda_events-lambda_06645171: Modifying... [id=FxAWebhookProxy-Dev-ApiGateway-FxA-Events-Function]
aws_lambda_function.apigateway-lambda_fxa-events-apigateway-lambda_events-lambda_06645171: Modifications complete after 7s [id=FxAWebhookProxy-Dev-ApiGateway-FxA-Events-Function]
aws_api_gateway_deployment.apigateway-lambda_api-gateway-deployment_3AF9B512: Creating...
aws_api_gateway_deployment.apigateway-lambda_api-gateway-deployment_3AF9B512: Creation complete after 0s [id=r6dxlv]
aws_api_gateway_stage.apigateway-lambda_api-gateway-stage_E95B0DF9: Modifying... [id=ags-ctafu7cig4-dev]
aws_lambda_function.proxy-lambda_fxa-events-sqs-lambda_39345609: Modifications complete after 7s [id=FxAWebhookProxy-Dev-Sqs-FxA-Events-Function]
aws_api_gateway_stage.apigateway-lambda_api-gateway-stage_E95B0DF9: Modifications complete after 1s [id=ags-ctafu7cig4-dev]
aws_api_gateway_deployment.apigateway-lambda_api-gateway-deployment_3AF9B512 (deposed object 932b35c7): Destroying... [id=zfjmbq]
aws_api_gateway_deployment.apigateway-lambda_api-gateway-deployment_3AF9B512: Destruction complete after 0s

Apply complete! Resources: 1 added, 3 changed, 1 destroyed.

:white_check_mark: Apply Succeeded (annotations-api-cdk-dev)
CI link
Apply complete! Resources: 1 added, 3 changed, 0 destroyed.
 Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
 <= read (data resources)

Terraform will perform the following actions:

  # data.aws_iam_policy_document.application_ecs_service_ecs-iam_data-ecs-task-role-policy_090CC3AD will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_iam_policy_document" "application_ecs_service_ecs-iam_data-ecs-task-role-policy_090CC3AD" {
      + id      = (known after apply)
      + json    = (known after apply)
      + version = "2012-10-17"

      + statement {
          + actions   = [
              + "dynamodb:BatchGet*",
              + "dynamodb:BatchWrite*",
              + "dynamodb:Delete*",
              + "dynamodb:DescribeTable",
              + "dynamodb:Get*",
              + "dynamodb:PutItem",
              + "dynamodb:Query",
              + "dynamodb:Scan",
              + "dynamodb:UpdateItem",
            ]
          + effect    = "Allow"
          + resources = [
              + "arn:aws:dynamodb:us-east-1:410318598490:table/ANNOT-Dev-highlight-notes",
              + "arn:aws:dynamodb:us-east-1:410318598490:table/ANNOT-Dev-highlight-notes/*",
            ]
        }
      + statement {
          + actions   = [
              + "sqs:DeleteMessage",
              + "sqs:ReceiveMessage",
              + "sqs:SendMessage",
              + "sqs:SendMessageBatch",
            ]
          + effect    = "Allow"
          + resources = [
              + "arn:aws:sqs:us-east-1:410318598490:AnnotationsAPI-Dev-Batch-Delete-Consumer-Queue",
            ]
        }
    }

  # aws_cloudwatch_metric_alarm.synthetics_synthetics_synthetic_check_alarm_query_0_52F9FF21 will be updated in-place
  ~ resource "aws_cloudwatch_metric_alarm" "synthetics_synthetics_synthetic_check_alarm_query_0_52F9FF21" {
      ~ alarm_actions             = [
          + "",
        ]
        id                        = "annot-dev-query-0"
      ~ ok_actions                = [
          + "",
        ]
        tags                      = {}
        # (16 unchanged attributes hidden)
    }

  # aws_cloudwatch_metric_alarm.synthetics_synthetics_synthetic_check_alarm_uptime_0_3A56DFC7 will be updated in-place
  ~ resource "aws_cloudwatch_metric_alarm" "synthetics_synthetics_synthetic_check_alarm_uptime_0_3A56DFC7" {
      ~ alarm_actions             = [
          + "",
        ]
        id                        = "annot-dev-uptime-0"
      ~ ok_actions                = [
          + "",
        ]
        tags                      = {}
        # (16 unchanged attributes hidden)
    }

  # aws_dynamodb_table.dynamodb_highlight-notes_dynamodb_table_8BD520BF will be updated in-place
  ~ resource "aws_dynamodb_table" "dynamodb_highlight-notes_dynamodb_table_8BD520BF" {
        id                          = "ANNOT-Dev-highlight-notes"
        name                        = "ANNOT-Dev-highlight-notes"
        tags                        = {
            "environment" = "Dev"
            "service"     = "AnnotationsAPI"
        }
        # (9 unchanged attributes hidden)

      - global_secondary_index {
          - hash_key           = "userId" -> null
          - name               = "userId" -> null
          - non_key_attributes = [] -> null
          - projection_type    = "KEYS_ONLY" -> null
          - read_capacity      = 0 -> null
          - write_capacity     = 0 -> null
        }
      + global_secondary_index {
          + hash_key           = "userId"
          + name               = "userId"
          + non_key_attributes = []
          + projection_type    = "KEYS_ONLY"
          + read_capacity      = 5
          + write_capacity     = 5
        }

        # (4 unchanged blocks hidden)
    }

  # aws_iam_policy.application_ecs_service_ecs-iam_ecs-task-role-policy_6FC89FB6 will be updated in-place
  ~ resource "aws_iam_policy" "application_ecs_service_ecs-iam_ecs-task-role-policy_6FC89FB6" {
        id        = "arn:aws:iam::410318598490:policy/AnnotationsAPI-Dev-TaskRolePolicy"
        name      = "AnnotationsAPI-Dev-TaskRolePolicy"
      ~ policy    = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "dynamodb:UpdateItem",
                          - "dynamodb:Scan",
                          - "dynamodb:Query",
                          - "dynamodb:PutItem",
                          - "dynamodb:Get*",
                          - "dynamodb:DescribeTable",
                          - "dynamodb:Delete*",
                          - "dynamodb:BatchWrite*",
                          - "dynamodb:BatchGet*",
                        ]
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:dynamodb:us-east-1:410318598490:table/ANNOT-Dev-highlight-notes/*",
                          - "arn:aws:dynamodb:us-east-1:410318598490:table/ANNOT-Dev-highlight-notes",
                        ]
                    },
                  - {
                      - Action   = [
                          - "sqs:SendMessageBatch",
                          - "sqs:SendMessage",
                          - "sqs:ReceiveMessage",
                          - "sqs:DeleteMessage",
                        ]
                      - Effect   = "Allow"
                      - Resource = "arn:aws:sqs:us-east-1:410318598490:AnnotationsAPI-Dev-Batch-Delete-Consumer-Queue"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        tags      = {
            "environment" = "Dev"
            "service"     = "AnnotationsAPI"
        }
        # (4 unchanged attributes hidden)
    }

  # local_file.application_ecs_service_appspec_94386B9C will be created
  + resource "local_file" "application_ecs_service_appspec_94386B9C" {
      + content              = jsonencode(
            {
              + Resources = [
                  + {
                      + TargetService = {
                          + Properties = {
                              + LoadBalancerInfo = {
                                  + ContainerName = "app"
                                  + ContainerPort = 4008
                                }
                              + TaskDefinition   = "arn:aws:ecs:us-east-1:410318598490:task-definition/AnnotationsAPI-Dev:73"
                            }
                          + Type       = "AWS::ECS::Service"
                        }
                    },
                ]
              + version   = 1
            }
        )
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "appspec.json"
      + id                   = (known after apply)
    }

Plan: 1 to add, 4 to change, 0 to destroy.
aws_cloudwatch_metric_alarm.synthetics_synthetics_synthetic_check_alarm_uptime_0_3A56DFC7: Modifying... [id=annot-dev-uptime-0]
aws_cloudwatch_metric_alarm.synthetics_synthetics_synthetic_check_alarm_query_0_52F9FF21: Modifying... [id=annot-dev-query-0]
aws_dynamodb_table.dynamodb_highlight-notes_dynamodb_table_8BD520BF: Modifying... [id=ANNOT-Dev-highlight-notes]
aws_dynamodb_table.dynamodb_highlight-notes_dynamodb_table_8BD520BF: Modifications complete after 0s [id=ANNOT-Dev-highlight-notes]
data.aws_iam_policy_document.application_ecs_service_ecs-iam_data-ecs-task-role-policy_090CC3AD: Reading...
data.aws_iam_policy_document.application_ecs_service_ecs-iam_data-ecs-task-role-policy_090CC3AD: Read complete after 0s [id=126432256]
aws_cloudwatch_metric_alarm.synthetics_synthetics_synthetic_check_alarm_uptime_0_3A56DFC7: Modifications complete after 0s [id=annot-dev-uptime-0]
local_file.application_ecs_service_appspec_94386B9C: Creating...
local_file.application_ecs_service_appspec_94386B9C: Creation complete after 0s [id=6d984777d42d76913b195f66ac59a0b655a2adff]
aws_cloudwatch_metric_alarm.synthetics_synthetics_synthetic_check_alarm_query_0_52F9FF21: Modifications complete after 0s [id=annot-dev-query-0]
Releasing state lock. This may take a few moments...

Apply complete! Resources: 1 added, 3 changed, 0 destroyed.

:white_check_mark: Apply Succeeded (shared-snowplow-consumer-cdk-dev)
CI link
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
 Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # local_file.shared-snowplow-consumer-app_application_ecs_service_appspec_7674CFF9 will be created
  + resource "local_file" "shared-snowplow-consumer-app_application_ecs_service_appspec_7674CFF9" {
      + content              = jsonencode(
            {
              + Resources = [
                  + {
                      + TargetService = {
                          + Properties = {
                              + LoadBalancerInfo = {
                                  + ContainerName = "app"
                                  + ContainerPort = 4015
                                }
                              + TaskDefinition   = "arn:aws:ecs:us-east-1:410318598490:task-definition/SharedSnowplowConsumer-Dev:82"
                            }
                          + Type       = "AWS::ECS::Service"
                        }
                    },
                ]
              + version   = 1
            }
        )
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "appspec.json"
      + id                   = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.
local_file.shared-snowplow-consumer-app_application_ecs_service_appspec_7674CFF9: Creating...
local_file.shared-snowplow-consumer-app_application_ecs_service_appspec_7674CFF9: Creation complete after 0s [id=20a39d70abc4a57d82a6794926b51e014a7a9575]
╷
│ Warning: Deprecated attribute
│
│   on cdk.tf.json line 1991, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
│ 1991:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",
│
│ The attribute "integration_key" is deprecated. Refer to the provider
│ documentation for details.
│
│ (and 3 more similar warnings elsewhere)
╵

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

:white_check_mark: Apply Succeeded (parser-graphql-wrapper-cdk-dev)
CI link
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
 Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # local_file.application_ecs_service_appspec_94386B9C will be created
  + resource "local_file" "application_ecs_service_appspec_94386B9C" {
      + content              = jsonencode(
            {
              + Resources = [
                  + {
                      + TargetService = {
                          + Properties = {
                              + LoadBalancerInfo = {
                                  + ContainerName = "app"
                                  + ContainerPort = 4001
                                }
                              + TaskDefinition   = "arn:aws:ecs:us-east-1:410318598490:task-definition/ParserGraphQLWrapper-Dev:107"
                            }
                          + Type       = "AWS::ECS::Service"
                        }
                    },
                ]
              + version   = 1
            }
        )
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "appspec.json"
      + id                   = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.
local_file.application_ecs_service_appspec_94386B9C: Creating...
local_file.application_ecs_service_appspec_94386B9C: Creation complete after 0s [id=0ce4bcc4536ea7558626d33b50a09821dc589752]
╷
│ Warning: Deprecated attribute
│
│   on cdk.tf.json line 2258, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
│ 2258:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",
│
│ The attribute "integration_key" is deprecated. Refer to the provider
│ documentation for details.
│
│ (and 3 more similar warnings elsewhere)
╵

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

:white_check_mark: Apply Succeeded (transactional-emails-cdk-dev)
CI link
Apply complete! Resources: 0 added, 1 changed, 0 destroyed.
 Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_lambda_function.events_sqs-event-consumer_lambda_3BE960B8 will be updated in-place
  ~ resource "aws_lambda_function" "events_sqs-event-consumer_lambda_3BE960B8" {
        id                             = "TransactionalEmails-Dev-Sqs-Event-Consumer-Function"
      ~ qualified_arn                  = "arn:aws:lambda:us-east-1:410318598490:function:TransactionalEmails-Dev-Sqs-Event-Consumer-Function:83" -> (known after apply)
      ~ qualified_invoke_arn           = "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:410318598490:function:TransactionalEmails-Dev-Sqs-Event-Consumer-Function:83/invocations" -> (known after apply)
        tags                           = {
            "environment" = "Dev"
            "service"     = "TransactionalEmails"
        }
      ~ version                        = "83" -> (known after apply)
        # (19 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              ~ "GIT_SHA"                            = (sensitive value)
                # (6 unchanged elements hidden)
            }
        }

        # (3 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.
aws_lambda_function.events_sqs-event-consumer_lambda_3BE960B8: Modifying... [id=TransactionalEmails-Dev-Sqs-Event-Consumer-Function]
aws_lambda_function.events_sqs-event-consumer_lambda_3BE960B8: Modifications complete after 7s [id=TransactionalEmails-Dev-Sqs-Event-Consumer-Function]
Releasing state lock. This may take a few moments...

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

:white_check_mark: Apply Succeeded (image-api-cdk-dev)
CI link
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
 Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # local_file.application_ecs_service_appspec_94386B9C will be created
  + resource "local_file" "application_ecs_service_appspec_94386B9C" {
      + content              = jsonencode(
            {
              + Resources = [
                  + {
                      + TargetService = {
                          + Properties = {
                              + LoadBalancerInfo = {
                                  + ContainerName = "app"
                                  + ContainerPort = 4867
                                }
                              + TaskDefinition   = "arn:aws:ecs:us-east-1:410318598490:task-definition/ImageAPI-Dev:31"
                            }
                          + Type       = "AWS::ECS::Service"
                        }
                    },
                ]
              + version   = 1
            }
        )
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "appspec.json"
      + id                   = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.
local_file.application_ecs_service_appspec_94386B9C: Creating...
local_file.application_ecs_service_appspec_94386B9C: Creation complete after 0s [id=53cf36836bae4711b1fa483b89bca096fd1c647b]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Plan Result (pocket-router-cdk)
CI link
Plan: 63 to add, 0 to change, 0 to destroy.

Create

aws_acm_certificate.application_alb_certificate_93966247
aws_acm_certificate.application_cdn_certificate_E17B2815
aws_acm_certificate_validation.application_alb_certificate_certificate_validation_25DAB195
aws_acm_certificate_validation.application_cdn_certificate_certificate_validation_F216BBC7
aws_alb.application_application_load_balancer_alb_05EA9801
aws_alb_listener.application_listener_http_D74EC0ED
aws_alb_listener.application_listener_https_D31CB055
aws_alb_listener_rule.application_ecs_service_listener_rule_903F815F
aws_alb_target_group.application_ecs_service_blue_target_group_ecs_target_group_4A9BF49B
aws_alb_target_group.application_ecs_service_green_target_group_ecs_target_group_4E06DCA6
aws_appautoscaling_policy.application_autoscaling_scale_in_policy_BF273511
aws_appautoscaling_policy.application_autoscaling_scale_out_policy_D03900A2
aws_appautoscaling_target.application_autoscaling_autoscaling_target_42BF5C99
aws_cloudfront_distribution.application_cloudfront_distribution_B95C3E21
aws_cloudwatch_dashboard.application_cloudwatch-dashboard_1F3DC0ED
aws_cloudwatch_log_group.app-log-group
aws_cloudwatch_metric_alarm.application_alarm-httpresponsetime_9124C30A
aws_cloudwatch_metric_alarm.application_alarm-httptarget5xxerrorrate_F94D87C0
aws_cloudwatch_metric_alarm.application_autoscaling_scale_in_alarm_850BE3A1
aws_cloudwatch_metric_alarm.application_autoscaling_scale_out_alarm_E40FCBA0
aws_cloudwatch_metric_alarm.synthetics_synthetics_synthetic_check_alarm_uptime_0_3A56DFC7
aws_codedeploy_app.application_ecs_service_ecs_codedeploy_ecs_code_deploy_C2F7CBCF
aws_codedeploy_deployment_group.application_ecs_service_ecs_codedeploy_ecs_codedeploy_deployment_group_48384247
aws_codestarnotifications_notification_rule.application_ecs_service_ecs_codedeploy_ecs_codedeploy_notifications_CB44EADE
aws_ecr_lifecycle_policy.application_ecs_service_ecr-app_ecr-repo-lifecyclepolicy_CCDF75B7
aws_ecr_repository.application_ecs_service_ecr-app_ecr-repo_ABFE17F0
aws_ecs_cluster.application_ecs_cluster_4DC6EFB3
aws_ecs_service.application_ecs_service_ecs-service_A8BAB5F4
aws_ecs_task_definition.application_ecs_service_ecs-task_461CC9D4
aws_iam_policy.application_ecs_service_ecs-iam_ecs-task-execution-role-policy_2D469A77
aws_iam_policy.application_ecs_service_ecs-iam_ecs-task-role-policy_6FC89FB6
aws_iam_policy.synthetics_synthetics_synthetic_check_access_policy_9A7D8849
aws_iam_role.application_ecs_service_ecs-iam_ecs-execution-role_FB754BAA
aws_iam_role.application_ecs_service_ecs-iam_ecs-task-role_A72990ED
aws_iam_role.application_ecs_service_ecs_codedeploy_ecs_code_deploy_role_175DB7D3
aws_iam_role.synthetics_synthetic_check_role_A3A5C38B
aws_iam_role_policy_attachment.application_ecs_service_ecs-iam_ecs-task-custom-attachment_F8DDD355
aws_iam_role_policy_attachment.application_ecs_service_ecs-iam_ecs-task-execution-custom-attachment_046B7E2E
aws_iam_role_policy_attachment.application_ecs_service_ecs-iam_ecs-task-execution-default-attachment_99A621FF
aws_iam_role_policy_attachment.application_ecs_service_ecs_codedeploy_ecs_codedeploy_role_attachment_1A1D5725
aws_iam_role_policy_attachment.synthetics_synthetics_synthetic_check_access_attach_BC7F9559
aws_route53_record.application_alb_certificate_certificate_record_51B45CF2
aws_route53_record.application_alb_record_8EA9D3F9
aws_route53_record.application_base_dns_subhosted_zone_ns_DFB88A22
aws_route53_record.application_cdn_certificate_certificate_record_F3EF0357
aws_route53_record.application_cdn_record_B2BBECBB
aws_route53_zone.application_base_dns_subhosted_zone_77521D1C
aws_s3_bucket.synthetics_synthetics_synthetic_check_artifacts_53DD59E6
aws_s3_bucket_lifecycle_configuration.synthetics_synthetics_synthetic_check_artifacts_lifecycle_5A7B9150
aws_security_group.application_application_load_balancer_alb_security_group_7B45D070
aws_security_group.application_ecs_service_ecs_security_group_231C6B1E
aws_sns_topic.pagerduty_alarm-critical-topic_F1534579
aws_sns_topic.pagerduty_alarm-non-critical-topic_53C1A3B3
aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84
aws_sns_topic_subscription.pagerduty_alarm-non-critical-subscription_4702677B
aws_synthetics_canary.synthetics_synthetics_synthetic_check_uptime_0_4168D0DB
local_file.application_ecs_service_appspec_94386B9C
pagerduty_service.pagerduty_pagerduty-critical_464EE7CD
pagerduty_service.pagerduty_pagerduty-non-critical_B4CB3938
pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5
pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-non-critical_EFA67B2C
pagerduty_service_integration.pagerduty_pagerduty_sentry_FFB12B7C-critical_45BF6D23
pagerduty_service_integration.pagerduty_pagerduty_sentry_FFB12B7C-non-critical_B7B95197

Change Result (Click me)

  # data.aws_iam_policy_document.synthetics_synthetics_synthetic_check_access_4C83FECF will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "synthetics_synthetics_synthetic_check_access_4C83FECF" {
      + id      = (known after apply)
      + json    = (known after apply)
      + version = "2012-10-17"

      + statement {
          + actions   = [
              + "logs:CreateLogGroup",
              + "logs:CreateLogStream",
              + "logs:PutLogEvents",
            ]
          + effect    = "Allow"
          + resources = [
              + "*",
            ]
        }
      + statement {
          + actions   = [
              + "s3:GetObject",
              + "s3:PutObject",
            ]
          + resources = [
              + (known after apply),
            ]
        }
      + statement {
          + actions   = [
              + "s3:GetObject",
            ]
          + resources = [
              + "arn:aws:s3:::pocket-syntheticchecks-prod/*",
            ]
        }
      + statement {
          + actions   = [
              + "s3:GetBucketLocation",
            ]
          + resources = [
              + (known after apply),
            ]
        }
      + statement {
          + actions   = [
              + "s3:ListAllMyBuckets",
            ]
          + resources = [
              + "*",
            ]
        }
      + statement {
          + actions   = [
              + "cloudwatch:PutMetricData",
            ]
          + resources = [
              + "*",
            ]

          + condition {
              + test     = "StringEquals"
              + values   = [
                  + "CloudWatchSynthetics",
                ]
              + variable = "cloudwatch:namespace"
            }
        }
      + statement {
          + actions   = [
              + "ec2:AttachNetworkInterface",
              + "ec2:CreateNetworkInterface",
              + "ec2:DeleteNetworkInterface",
              + "ec2:DescribeNetworkInterfaces",
            ]
          + resources = [
              + "*",
            ]
        }
    }

  # aws_acm_certificate.application_alb_certificate_93966247 will be created
  + resource "aws_acm_certificate" "application_alb_certificate_93966247" {
      + arn                       = (known after apply)
      + domain_name               = "direct.pocket-router.getpocket.com"
      + domain_validation_options = [
          + {
              + domain_name           = "direct.pocket-router.getpocket.com"
              + resource_record_name  = (known after apply)
              + resource_record_type  = (known after apply)
              + resource_record_value = (known after apply)
            },
        ]
      + id                        = (known after apply)
      + key_algorithm             = (known after apply)
      + not_after                 = (known after apply)
      + not_before                = (known after apply)
      + pending_renewal           = (known after apply)
      + renewal_eligibility       = (known after apply)
      + renewal_summary           = (known after apply)
      + status                    = (known after apply)
      + subject_alternative_names = [
          + "direct.pocket-router.getpocket.com",
        ]
      + tags                      = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + tags_all                  = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + type                      = (known after apply)
      + validation_emails         = (known after apply)
      + validation_method         = "DNS"
    }

  # aws_acm_certificate.application_cdn_certificate_E17B2815 will be created
  + resource "aws_acm_certificate" "application_cdn_certificate_E17B2815" {
      + arn                       = (known after apply)
      + domain_name               = "pocket-router.getpocket.com"
      + domain_validation_options = [
          + {
              + domain_name           = "pocket-router.getpocket.com"
              + resource_record_name  = (known after apply)
              + resource_record_type  = (known after apply)
              + resource_record_value = (known after apply)
            },
        ]
      + id                        = (known after apply)
      + key_algorithm             = (known after apply)
      + not_after                 = (known after apply)
      + not_before                = (known after apply)
      + pending_renewal           = (known after apply)
      + renewal_eligibility       = (known after apply)
      + renewal_summary           = (known after apply)
      + status                    = (known after apply)
      + subject_alternative_names = [
          + "pocket-router.getpocket.com",
        ]
      + tags                      = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + tags_all                  = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + type                      = (known after apply)
      + validation_emails         = (known after apply)
      + validation_method         = "DNS"
    }

  # aws_acm_certificate_validation.application_alb_certificate_certificate_validation_25DAB195 will be created
  + resource "aws_acm_certificate_validation" "application_alb_certificate_certificate_validation_25DAB195" {
      + certificate_arn         = (known after apply)
      + id                      = (known after apply)
      + validation_record_fqdns = (known after apply)
    }

  # aws_acm_certificate_validation.application_cdn_certificate_certificate_validation_F216BBC7 will be created
  + resource "aws_acm_certificate_validation" "application_cdn_certificate_certificate_validation_F216BBC7" {
      + certificate_arn         = (known after apply)
      + id                      = (known after apply)
      + validation_record_fqdns = (known after apply)
    }

  # aws_alb.application_application_load_balancer_alb_05EA9801 will be created
  + resource "aws_alb" "application_application_load_balancer_alb_05EA9801" {
      + arn                                                          = (known after apply)
      + arn_suffix                                                   = (known after apply)
      + desync_mitigation_mode                                       = "defensive"
      + dns_name                                                     = (known after apply)
      + drop_invalid_header_fields                                   = false
      + enable_deletion_protection                                   = false
      + enable_http2                                                 = true
      + enable_tls_version_and_cipher_suite_headers                  = false
      + enable_waf_fail_open                                         = false
      + enable_xff_client_port                                       = false
      + enforce_security_group_inbound_rules_on_private_link_traffic = (known after apply)
      + id                                                           = (known after apply)
      + idle_timeout                                                 = 60
      + internal                                                     = false
      + ip_address_type                                              = (known after apply)
      + load_balancer_type                                           = "application"
      + name                                                         = (known after apply)
      + name_prefix                                                  = "ROUTER"
      + preserve_host_header                                         = false
      + security_groups                                              = (known after apply)
      + subnets                                                      = [
          + "subnet-36c2611d",
          + "subnet-420db61b",
          + "subnet-5a0f952d",
          + "subnet-6b400e51",
        ]
      + tags                                                         = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + tags_all                                                     = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + vpc_id                                                       = (known after apply)
      + xff_header_processing_mode                                   = "append"
      + zone_id                                                      = (known after apply)

      + access_logs {
          + bucket  = "pocket-data-items"
          + enabled = true
          + prefix  = "server-logs/pocketrouter-prod/alb"
        }
    }

  # aws_alb_listener.application_listener_http_D74EC0ED will be created
  + resource "aws_alb_listener" "application_listener_http_D74EC0ED" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + load_balancer_arn = (known after apply)
      + port              = 80
      + protocol          = "HTTP"
      + ssl_policy        = (known after apply)
      + tags              = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + tags_all          = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }

      + default_action {
          + order = (known after apply)
          + type  = "redirect"

          + redirect {
              + host        = "#{host}"
              + path        = "/#{path}"
              + port        = "443"
              + protocol    = "HTTPS"
              + query       = "#{query}"
              + status_code = "HTTP_301"
            }
        }
    }

  # aws_alb_listener.application_listener_https_D31CB055 will be created
  + resource "aws_alb_listener" "application_listener_https_D31CB055" {
      + arn               = (known after apply)
      + certificate_arn   = (known after apply)
      + id                = (known after apply)
      + load_balancer_arn = (known after apply)
      + port              = 443
      + protocol          = "HTTPS"
      + ssl_policy        = "ELBSecurityPolicy-TLS-1-1-2017-01"
      + tags              = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + tags_all          = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }

      + default_action {
          + order = (known after apply)
          + type  = "fixed-response"

          + fixed_response {
              + content_type = "text/plain"
              + status_code  = "503"
            }
        }
    }

  # aws_alb_listener_rule.application_ecs_service_listener_rule_903F815F will be created
  + resource "aws_alb_listener_rule" "application_ecs_service_listener_rule_903F815F" {
      + arn          = (known after apply)
      + id           = (known after apply)
      + listener_arn = (known after apply)
      + priority     = 1
      + tags         = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + tags_all     = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }

      + action {
          + order            = (known after apply)
          + target_group_arn = (known after apply)
          + type             = "forward"
        }

      + condition {
          + path_pattern {
              + values = [
                  + "*",
                ]
            }
        }
    }

  # aws_alb_target_group.application_ecs_service_blue_target_group_ecs_target_group_4A9BF49B will be created
  + resource "aws_alb_target_group" "application_ecs_service_blue_target_group_ecs_target_group_4A9BF49B" {
      + arn                                = (known after apply)
      + arn_suffix                         = (known after apply)
      + connection_termination             = (known after apply)
      + deregistration_delay               = "120"
      + id                                 = (known after apply)
      + ip_address_type                    = (known after apply)
      + lambda_multi_value_headers_enabled = false
      + load_balancing_algorithm_type      = (known after apply)
      + load_balancing_cross_zone_enabled  = (known after apply)
      + name                               = (known after apply)
      + name_prefix                        = "ROUTER"
      + port                               = 80
      + preserve_client_ip                 = (known after apply)
      + protocol                           = "HTTP"
      + protocol_version                   = (known after apply)
      + proxy_protocol_v2                  = false
      + slow_start                         = 0
      + tags                               = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
          + "type"        = "blue"
        }
      + tags_all                           = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
          + "type"        = "blue"
        }
      + target_type                        = "ip"
      + vpc_id                             = "vpc-867638e3"

      + health_check {
          + enabled             = true
          + healthy_threshold   = 5
          + interval            = 15
          + matcher             = (known after apply)
          + path                = "/.well-known/apollo/server-health"
          + port                = "traffic-port"
          + protocol            = "HTTP"
          + timeout             = (known after apply)
          + unhealthy_threshold = 3
        }
    }

  # aws_alb_target_group.application_ecs_service_green_target_group_ecs_target_group_4E06DCA6 will be created
  + resource "aws_alb_target_group" "application_ecs_service_green_target_group_ecs_target_group_4E06DCA6" {
      + arn                                = (known after apply)
      + arn_suffix                         = (known after apply)
      + connection_termination             = (known after apply)
      + deregistration_delay               = "120"
      + id                                 = (known after apply)
      + ip_address_type                    = (known after apply)
      + lambda_multi_value_headers_enabled = false
      + load_balancing_algorithm_type      = (known after apply)
      + load_balancing_cross_zone_enabled  = (known after apply)
      + name                               = (known after apply)
      + name_prefix                        = "ROUTER"
      + port                               = 80
      + preserve_client_ip                 = (known after apply)
      + protocol                           = "HTTP"
      + protocol_version                   = (known after apply)
      + proxy_protocol_v2                  = false
      + slow_start                         = 0
      + tags                               = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
          + "type"        = "green"
        }
      + tags_all                           = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
          + "type"        = "green"
        }
      + target_type                        = "ip"
      + vpc_id                             = "vpc-867638e3"

      + health_check {
          + enabled             = true
          + healthy_threshold   = 5
          + interval            = 15
          + matcher             = (known after apply)
          + path                = "/.well-known/apollo/server-health"
          + port                = "traffic-port"
          + protocol            = "HTTP"
          + timeout             = (known after apply)
          + unhealthy_threshold = 3
        }
    }

  # aws_appautoscaling_policy.application_autoscaling_scale_in_policy_BF273511 will be created
  + resource "aws_appautoscaling_policy" "application_autoscaling_scale_in_policy_BF273511" {
      + alarm_arns         = (known after apply)
      + arn                = (known after apply)
      + id                 = (known after apply)
      + name               = "PocketRouter-Prod-ScaleInPolicy"
      + policy_type        = "StepScaling"
      + resource_id        = "service/PocketRouter-Prod/PocketRouter-Prod"
      + scalable_dimension = "ecs:service:DesiredCount"
      + service_namespace  = "ecs"

      + step_scaling_policy_configuration {
          + adjustment_type         = "ChangeInCapacity"
          + cooldown                = 60
          + metric_aggregation_type = "Average"

          + step_adjustment {
              + metric_interval_upper_bound = "0"
              + scaling_adjustment          = -1
            }
        }
    }

  # aws_appautoscaling_policy.application_autoscaling_scale_out_policy_D03900A2 will be created
  + resource "aws_appautoscaling_policy" "application_autoscaling_scale_out_policy_D03900A2" {
      + alarm_arns         = (known after apply)
      + arn                = (known after apply)
      + id                 = (known after apply)
      + name               = "PocketRouter-Prod-ScaleOutPolicy"
      + policy_type        = "StepScaling"
      + resource_id        = "service/PocketRouter-Prod/PocketRouter-Prod"
      + scalable_dimension = "ecs:service:DesiredCount"
      + service_namespace  = "ecs"

      + step_scaling_policy_configuration {
          + adjustment_type         = "ChangeInCapacity"
          + cooldown                = 60
          + metric_aggregation_type = "Average"

          + step_adjustment {
              + metric_interval_lower_bound = "0"
              + scaling_adjustment          = 2
            }
        }
    }

  # aws_appautoscaling_target.application_autoscaling_autoscaling_target_42BF5C99 will be created
  + resource "aws_appautoscaling_target" "application_autoscaling_autoscaling_target_42BF5C99" {
      + arn                = (known after apply)
      + id                 = (known after apply)
      + max_capacity       = 20
      + min_capacity       = 4
      + resource_id        = "service/PocketRouter-Prod/PocketRouter-Prod"
      + role_arn           = (known after apply)
      + scalable_dimension = "ecs:service:DesiredCount"
      + service_namespace  = "ecs"
      + tags_all           = (known after apply)
    }

  # aws_cloudfront_distribution.application_cloudfront_distribution_B95C3E21 will be created
  + resource "aws_cloudfront_distribution" "application_cloudfront_distribution_B95C3E21" {
      + aliases                         = [
          + "pocket-router.getpocket.com",
        ]
      + arn                             = (known after apply)
      + caller_reference                = (known after apply)
      + comment                         = "CDN for direct.pocket-router.getpocket.com"
      + continuous_deployment_policy_id = (known after apply)
      + domain_name                     = (known after apply)
      + enabled                         = true
      + etag                            = (known after apply)
      + hosted_zone_id                  = (known after apply)
      + http_version                    = "http2"
      + id                              = (known after apply)
      + in_progress_validation_batches  = (known after apply)
      + is_ipv6_enabled                 = false
      + last_modified_time              = (known after apply)
      + price_class                     = "PriceClass_200"
      + retain_on_delete                = false
      + staging                         = false
      + status                          = (known after apply)
      + tags                            = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + tags_all                        = {
          + "environment" = "Prod"
          + "serv

# ...
# ... The maximum length of GitHub Comment is 65536, so the content is omitted by tfcmt.
# ...

  + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = "pocket-router.getpocket.com"
      + records         = (known after apply)
      + ttl             = 86400
      + type            = "NS"
      + zone_id         = "Z21HMDYFB951W4"
    }

  # aws_route53_record.application_cdn_certificate_certificate_record_F3EF0357 will be created
  + resource "aws_route53_record" "application_cdn_certificate_certificate_record_F3EF0357" {
      + allow_overwrite = (known after apply)
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = (known after apply)
      + records         = (known after apply)
      + ttl             = 60
      + type            = (known after apply)
      + zone_id         = (known after apply)
    }

  # aws_route53_record.application_cdn_record_B2BBECBB will be created
  + resource "aws_route53_record" "application_cdn_record_B2BBECBB" {
      + allow_overwrite = (known after apply)
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = "pocket-router.getpocket.com"
      + set_identifier  = "2"
      + type            = "A"
      + zone_id         = (known after apply)

      + alias {
          + evaluate_target_health = true
          + name                   = (known after apply)
          + zone_id                = (known after apply)
        }

      + weighted_routing_policy {
          + weight = 1
        }
    }

  # aws_route53_zone.application_base_dns_subhosted_zone_77521D1C will be created
  + resource "aws_route53_zone" "application_base_dns_subhosted_zone_77521D1C" {
      + arn                 = (known after apply)
      + comment             = "Managed by Terraform"
      + force_destroy       = false
      + id                  = (known after apply)
      + name                = "pocket-router.getpocket.com"
      + name_servers        = (known after apply)
      + primary_name_server = (known after apply)
      + tags                = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + tags_all            = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + zone_id             = (known after apply)
    }

  # aws_s3_bucket.synthetics_synthetics_synthetic_check_artifacts_53DD59E6 will be created
  + resource "aws_s3_bucket" "synthetics_synthetics_synthetic_check_artifacts_53DD59E6" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "pocket-pocketrouter-prod-synthetic-checks"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)
    }

  # aws_s3_bucket_lifecycle_configuration.synthetics_synthetics_synthetic_check_artifacts_lifecycle_5A7B9150 will be created
  + resource "aws_s3_bucket_lifecycle_configuration" "synthetics_synthetics_synthetic_check_artifacts_lifecycle_5A7B9150" {
      + bucket = (known after apply)
      + id     = (known after apply)

      + rule {
          + id     = "30-day-retention"
          + status = "Enabled"

          + expiration {
              + days                         = 30
              + expired_object_delete_marker = (known after apply)
            }
        }
    }

  # aws_security_group.application_application_load_balancer_alb_security_group_7B45D070 will be created
  + resource "aws_security_group" "application_application_load_balancer_alb_security_group_7B45D070" {
      + arn                    = (known after apply)
      + description            = "External security group  (Managed by Terraform)"
      + egress                 = [
          + {
              + cidr_blocks      = [
                  + "<IP_ADDRESS>/0",
                ]
              + description      = "required"
              + from_port        = 0
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "-1"
              + security_groups  = []
              + self             = false
              + to_port          = 0
            },
        ]
      + id                     = (known after apply)
      + ingress                = [
          + {
              + cidr_blocks      = [
                  + "<IP_ADDRESS>/0",
                ]
              + description      = ""
              + from_port        = 443
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 443
            },
          + {
              + cidr_blocks      = [
                  + "<IP_ADDRESS>/0",
                ]
              + description      = ""
              + from_port        = 80
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 80
            },
        ]
      + name                   = (known after apply)
      + name_prefix            = "PocketRouter-Prod-HTTP/S Security Group"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"        = "PocketRouter-Prod-HTTP/S Security Group"
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + tags_all               = {
          + "Name"        = "PocketRouter-Prod-HTTP/S Security Group"
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + vpc_id                 = "vpc-867638e3"
    }

  # aws_security_group.application_ecs_service_ecs_security_group_231C6B1E will be created
  + resource "aws_security_group" "application_ecs_service_ecs_security_group_231C6B1E" {
      + arn                    = (known after apply)
      + description            = "Internal ECS Security Group (Managed by Terraform)"
      + egress                 = [
          + {
              + cidr_blocks      = [
                  + "<IP_ADDRESS>/0",
                ]
              + description      = "required"
              + from_port        = 0
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "-1"
              + security_groups  = []
              + self             = false
              + to_port          = 0
            },
        ]
      + id                     = (known after apply)
      + ingress                = [
          + {
              + cidr_blocks      = []
              + description      = "required"
              + from_port        = 80
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = (known after apply)
              + self             = false
              + to_port          = 4000
            },
        ]
      + name                   = (known after apply)
      + name_prefix            = "PocketRouter-Prod-ECSSecurityGroup"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + tags_all               = {
          + "environment" = "Prod"
          + "service"     = "PocketRouter"
        }
      + vpc_id                 = "vpc-867638e3"
    }

  # aws_sns_topic.pagerduty_alarm-critical-topic_F1534579 will be created
  + resource "aws_sns_topic" "pagerduty_alarm-critical-topic_F1534579" {
      + arn                         = (known after apply)
      + beginning_archive_time      = (known after apply)
      + content_based_deduplication = false
      + fifo_topic                  = false
      + id                          = (known after apply)
      + name                        = "PocketRouter-Prod-Infrastructure-Alarm-Critical"
      + name_prefix                 = (known after apply)
      + owner                       = (known after apply)
      + policy                      = (known after apply)
      + signature_version           = (known after apply)
      + tags_all                    = (known after apply)
      + tracing_config              = (known after apply)
    }

  # aws_sns_topic.pagerduty_alarm-non-critical-topic_53C1A3B3 will be created
  + resource "aws_sns_topic" "pagerduty_alarm-non-critical-topic_53C1A3B3" {
      + arn                         = (known after apply)
      + beginning_archive_time      = (known after apply)
      + content_based_deduplication = false
      + fifo_topic                  = false
      + id                          = (known after apply)
      + name                        = "PocketRouter-Prod-Infrastructure-Alarm-Non-Critical"
      + name_prefix                 = (known after apply)
      + owner                       = (known after apply)
      + policy                      = (known after apply)
      + signature_version           = (known after apply)
      + tags_all                    = (known after apply)
      + tracing_config              = (known after apply)
    }

  # aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84 will be created
  + resource "aws_sns_topic_subscription" "pagerduty_alarm-critical-subscription_E2168B84" {
      + arn                             = (known after apply)
      + confirmation_timeout_in_minutes = 2
      + confirmation_was_authenticated  = (known after apply)
      + endpoint                        = (known after apply)
      + endpoint_auto_confirms          = true
      + filter_policy_scope             = (known after apply)
      + id                              = (known after apply)
      + owner_id                        = (known after apply)
      + pending_confirmation            = (known after apply)
      + protocol                        = "https"
      + raw_message_delivery            = false
      + topic_arn                       = (known after apply)
    }

  # aws_sns_topic_subscription.pagerduty_alarm-non-critical-subscription_4702677B will be created
  + resource "aws_sns_topic_subscription" "pagerduty_alarm-non-critical-subscription_4702677B" {
      + arn                             = (known after apply)
      + confirmation_timeout_in_minutes = 2
      + confirmation_was_authenticated  = (known after apply)
      + endpoint                        = (known after apply)
      + endpoint_auto_confirms          = true
      + filter_policy_scope             = (known after apply)
      + id                              = (known after apply)
      + owner_id                        = (known after apply)
      + pending_confirmation            = (known after apply)
      + protocol                        = "https"
      + raw_message_delivery            = false
      + topic_arn                       = (known after apply)
    }

  # aws_synthetics_canary.synthetics_synthetics_synthetic_check_uptime_0_4168D0DB will be created
  + resource "aws_synthetics_canary" "synthetics_synthetics_synthetic_check_uptime_0_4168D0DB" {
      + arn                      = (known after apply)
      + artifact_s3_location     = "s3://pocket-pocketrouter-prod-synthetic-checks/"
      + delete_lambda            = false
      + engine_arn               = (known after apply)
      + execution_role_arn       = (known after apply)
      + failure_retention_period = 31
      + handler                  = "synthetic.uptime"
      + id                       = (known after apply)
      + name                     = "router-prod-uptime-0"
      + runtime_version          = "syn-nodejs-puppeteer-4.0"
      + s3_bucket                = "pocket-syntheticchecks-prod"
      + s3_key                   = "aws-synthetic-prod.zip"
      + source_location_arn      = (known after apply)
      + start_canary             = true
      + status                   = (known after apply)
      + success_retention_period = 31
      + tags_all                 = (known after apply)
      + timeline                 = (known after apply)

      + run_config {
          + environment_variables = {
              + "UPTIME_BODY" = "ok"
              + "UPTIME_URL"  = "pocket-router.getpocket.com:4000/.well-known/apollo/server-health"
            }
          + memory_in_mb          = (known after apply)
          + timeout_in_seconds    = 180
        }

      + schedule {
          + expression = "rate(5 minutes)"
        }
    }

  # local_file.application_ecs_service_appspec_94386B9C will be created
  + resource "local_file" "application_ecs_service_appspec_94386B9C" {
      + content              = (known after apply)
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "appspec.json"
      + id                   = (known after apply)
    }

  # pagerduty_service.pagerduty_pagerduty-critical_464EE7CD will be created
  + resource "pagerduty_service" "pagerduty_pagerduty-critical_464EE7CD" {
      + acknowledgement_timeout = "1800"
      + alert_creation          = "create_incidents"
      + alert_grouping          = (known after apply)
      + alert_grouping_timeout  = (known after apply)
      + auto_resolve_timeout    = "14400"
      + created_at              = (known after apply)
      + description             = "PagerDuty Critical"
      + escalation_policy       = "PLPWYPC"
      + html_url                = (known after apply)
      + id                      = (known after apply)
      + last_incident_timestamp = (known after apply)
      + name                    = "PocketRouter-Prod-PagerDuty-Critical"
      + response_play           = (known after apply)
      + status                  = (known after apply)
      + type                    = (known after apply)

      + incident_urgency_rule {
          + type    = "constant"
          + urgency = "high"
        }
    }

  # pagerduty_service.pagerduty_pagerduty-non-critical_B4CB3938 will be created
  + resource "pagerduty_service" "pagerduty_pagerduty-non-critical_B4CB3938" {
      + acknowledgement_timeout = "1800"
      + alert_creation          = "create_incidents"
      + alert_grouping          = (known after apply)
      + alert_grouping_timeout  = (known after apply)
      + auto_resolve_timeout    = "14400"
      + created_at              = (known after apply)
      + description             = "PagerDuty Non-Critical"
      + escalation_policy       = "PLPWYPC"
      + html_url                = (known after apply)
      + id                      = (known after apply)
      + last_incident_timestamp = (known after apply)
      + name                    = "PocketRouter-Prod-PagerDuty-Non-Critical"
      + response_play           = (known after apply)
      + status                  = (known after apply)
      + type                    = (known after apply)

      + incident_urgency_rule {
          + type    = "constant"
          + urgency = "low"
        }
    }

  # pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5 will be created
  + resource "pagerduty_service_integration" "pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5" {
      + email_filter_mode       = (known after apply)
      + email_incident_creation = (known after apply)
      + email_parsing_fallback  = (known after apply)
      + html_url                = (known after apply)
      + id                      = (known after apply)
      + integration_email       = (known after apply)
      + integration_key         = (known after apply)
      + name                    = "Amazon CloudWatch"
      + service                 = (known after apply)
      + type                    = (known after apply)
      + vendor                  = "PZQ6AUS"
    }

  # pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-non-critical_EFA67B2C will be created
  + resource "pagerduty_service_integration" "pagerduty_pagerduty_cloudwatch_7956692A-non-critical_EFA67B2C" {
      + email_filter_mode       = (known after apply)
      + email_incident_creation = (known after apply)
      + email_parsing_fallback  = (known after apply)
      + html_url                = (known after apply)
      + id                      = (known after apply)
      + integration_email       = (known after apply)
      + integration_key         = (known after apply)
      + name                    = "Amazon CloudWatch"
      + service                 = (known after apply)
      + type                    = (known after apply)
      + vendor                  = "PZQ6AUS"
    }

  # pagerduty_service_integration.pagerduty_pagerduty_sentry_FFB12B7C-critical_45BF6D23 will be created
  + resource "pagerduty_service_integration" "pagerduty_pagerduty_sentry_FFB12B7C-critical_45BF6D23" {
      + email_filter_mode       = (known after apply)
      + email_incident_creation = (known after apply)
      + email_parsing_fallback  = (known after apply)
      + html_url                = (known after apply)
      + id                      = (known after apply)
      + integration_email       = (known after apply)
      + integration_key         = (known after apply)
      + name                    = "Sentry"
      + service                 = (known after apply)
      + type                    = (known after apply)
      + vendor                  = "PKAPG94"
    }

  # pagerduty_service_integration.pagerduty_pagerduty_sentry_FFB12B7C-non-critical_B7B95197 will be created
  + resource "pagerduty_service_integration" "pagerduty_pagerduty_sentry_FFB12B7C-non-critical_B7B95197" {
      + email_filter_mode       = (known after apply)
      + email_incident_creation = (known after apply)
      + email_parsing_fallback  = (known after apply)
      + html_url                = (known after apply)
      + id                      = (known after apply)
      + integration_email       = (known after apply)
      + integration_key         = (known after apply)
      + name                    = "Sentry"
      + service                 = (known after apply)
      + type                    = (known after apply)
      + vendor                  = "PKAPG94"
    }

Plan: 63 to add, 0 to change, 0 to destroy.
╷
│ Warning: Deprecated attribute
│
│   on cdk.tf.json line 1827, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
│ 1827:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",
│
│ The attribute "integration_key" is deprecated. Refer to the provider
│ documentation for details.
│
│ (and 3 more similar warnings elsewhere)
╵

:warning: Warnings
Warning: Deprecated attribute

   on cdk.tf.json line 1827, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
 1827:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",

 The attribute "integration_key" is deprecated. Refer to the provider
 documentation for details.

 (and 3 more similar warnings elsewhere)

:white_check_mark: Apply Succeeded (user-api-cdk-dev)
CI link
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
 Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # local_file.application_ecs_service_appspec_94386B9C will be created
  + resource "local_file" "application_ecs_service_appspec_94386B9C" {
      + content              = jsonencode(
            {
              + Resources = [
                  + {
                      + TargetService = {
                          + Properties = {
                              + LoadBalancerInfo = {
                                  + ContainerName = "app"
                                  + ContainerPort = 4006
                                }
                              + TaskDefinition   = "arn:aws:ecs:us-east-1:410318598490:task-definition/UserAPI-Dev:63"
                            }
                          + Type       = "AWS::ECS::Service"
                        }
                    },
                ]
              + version   = 1
            }
        )
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "appspec.json"
      + id                   = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.
local_file.application_ecs_service_appspec_94386B9C: Creating...
local_file.application_ecs_service_appspec_94386B9C: Creation complete after 0s [id=08186a6cffa18a9019524de9987fd7990e3c14a1]
╷
│ Warning: Deprecated attribute
│
│   on cdk.tf.json line 1972, in resource.aws_sns_topic_subscription.pagerduty_alarm-critical-subscription_E2168B84:
│ 1972:         "endpoint": "https://events.pagerduty.com/integration/${pagerduty_service_integration.pagerduty_pagerduty_cloudwatch_7956692A-critical_546FC7B5.integration_key}/enqueue",
│
│ The attribute "integration_key" is deprecated. Refer to the provider
│ documentation for details.
│
│ (and 3 more similar warnings elsewhere)
╵
Releasing state lock. This may take a few moments...

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

:white_check_mark: Apply Succeeded (fxa-webhook-proxy-cdk-dev)
CI link
Apply complete! Resources: 1 added, 3 changed, 1 destroyed.
 Resource actions are indicated with the following symbols:
  ~ update in-place
+/- create replacement and then destroy

Terraform will perform the following actions:

  # aws_api_gateway_deployment.apigateway-lambda_api-gateway-deployment_3AF9B512 must be replaced
+/- resource "aws_api_gateway_deployment" "apigateway-lambda_api-gateway-deployment_3AF9B512" {
      ~ created_date  = "2024-01-05T00:53:39Z" -> (known after apply)
      ~ execution_arn = "arn:aws:execute-api:us-east-1:410318598490:ctafu7cig4/" -> (known after apply)
      ~ id            = "r6dxlv" -> (known after apply)
      ~ invoke_url    = "https://ctafu7cig4.execute-api.us-east-1.amazonaws.com/" -> (known after apply)
      ~ triggers      = { # forces replacement
          ~ "deployedAt"   = "1704415965572" -> "1704419135287"
            # (1 unchanged element hidden)
        }
        # (1 unchanged attribute hidden)
    }

  # aws_api_gateway_stage.apigateway-lambda_api-gateway-stage_E95B0DF9 will be updated in-place
  ~ resource "aws_api_gateway_stage" "apigateway-lambda_api-gateway-stage_E95B0DF9" {
      ~ deployment_id         = "r6dxlv" -> (known after apply)
        id                    = "ags-ctafu7cig4-dev"
        tags                  = {}
        # (9 unchanged attributes hidden)
    }

  # aws_lambda_function.apigateway-lambda_fxa-events-apigateway-lambda_events-lambda_06645171 will be updated in-place
  ~ resource "aws_lambda_function" "apigateway-lambda_fxa-events-apigateway-lambda_events-lambda_06645171" {
        id                             = "FxAWebhookProxy-Dev-ApiGateway-FxA-Events-Function"
      ~ qualified_arn                  = "arn:aws:lambda:us-east-1:410318598490:function:FxAWebhookProxy-Dev-ApiGateway-FxA-Events-Function:58" -> (known after apply)
      ~ qualified_invoke_arn           = "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:410318598490:function:FxAWebhookProxy-Dev-ApiGateway-FxA-Events-Function:58/invocations" -> (known after apply)
        tags                           = {}
      ~ version                        = "58" -> (known after apply)
        # (19 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              ~ "GIT_SHA"            = (sensitive value)
                # (3 unchanged elements hidden)
            }
        }

        # (3 unchanged blocks hidden)
    }

  # aws_lambda_function.proxy-lambda_fxa-events-sqs-lambda_39345609 will be updated in-place
  ~ resource "aws_lambda_function" "proxy-lambda_fxa-events-sqs-lambda_39345609" {
        id                             = "FxAWebhookProxy-Dev-Sqs-FxA-Events-Function"
      ~ qualified_arn                  = "arn:aws:lambda:us-east-1:410318598490:function:FxAWebhookProxy-Dev-Sqs-FxA-Events-Function:69" -> (known after apply)
      ~ qualified_invoke_arn           = "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:410318598490:function:FxAWebhookProxy-Dev-Sqs-FxA-Events-Function:69/invocations" -> (known after apply)
        tags                           = {
            "environment" = "Dev"
            "service"     = "FxAWebhookProxy"
        }
      ~ version                        = "69" -> (known after apply)
        # (19 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              ~ "GIT_SHA"     = (sensitive value)
                # (4 unchanged elements hidden)
            }
        }

        # (3 unchanged blocks hidden)
    }

Plan: 1 to add, 3 to change, 1 to destroy.
aws_lambda_function.proxy-lambda_fxa-events-sqs-lambda_39345609: Modifying... [id=FxAWebhookProxy-Dev-Sqs-FxA-Events-Function]
aws_lambda_function.apigateway-lambda_fxa-events-apigateway-lambda_events-lambda_06645171: Modifying... [id=FxAWebhookProxy-Dev-ApiGateway-FxA-Events-Function]
aws_lambda_function.apigateway-lambda_fxa-events-apigateway-lambda_events-lambda_06645171: Modifications complete after 7s [id=FxAWebhookProxy-Dev-ApiGateway-FxA-Events-Function]
aws_api_gateway_deployment.apigateway-lambda_api-gateway-deployment_3AF9B512: Creating...
aws_api_gateway_deployment.apigateway-lambda_api-gateway-deployment_3AF9B512: Creation complete after 0s [id=renuy9]
aws_api_gateway_stage.apigateway-lambda_api-gateway-stage_E95B0DF9: Modifying... [id=ags-ctafu7cig4-dev]
aws_lambda_function.proxy-lambda_fxa-events-sqs-lambda_39345609: Modifications complete after 7s [id=FxAWebhookProxy-Dev-Sqs-FxA-Events-Function]
aws_api_gateway_stage.apigateway-lambda_api-gateway-stage_E95B0DF9: Modifications complete after 0s [id=ags-ctafu7cig4-dev]
aws_api_gateway_deployment.apigateway-lambda_api-gateway-deployment_3AF9B512 (deposed object 028e60b1): Destroying... [id=r6dxlv]
aws_api_gateway_deployment.apigateway-lambda_api-gateway-deployment_3AF9B512: Destruction complete after 0s
Releasing state lock. This may take a few moments...

Apply complete! Resources: 1 added, 3 changed, 1 destroyed.

:white_check_mark: Apply Succeeded (annotations-api-cdk-dev)
CI link
Apply complete! Resources: 1 added, 3 changed, 0 destroyed.
 Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
 <= read (data resources)

Terraform will perform the following actions:

  # data.aws_iam_policy_document.application_ecs_service_ecs-iam_data-ecs-task-role-policy_090CC3AD will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_iam_policy_document" "application_ecs_service_ecs-iam_data-ecs-task-role-policy_090CC3AD" {
      + id      = (known after apply)
      + json    = (known after apply)
      + version = "2012-10-17"

      + statement {
          + actions   = [
              + "dynamodb:BatchGet*",
              + "dynamodb:BatchWrite*",
              + "dynamodb:Delete*",
              + "dynamodb:DescribeTable",
              + "dynamodb:Get*",
              + "dynamodb:PutItem",
              + "dynamodb:Query",
              + "dynamodb:Scan",
              + "dynamodb:UpdateItem",
            ]
          + effect    = "Allow"
          + resources = [
              + "arn:aws:dynamodb:us-east-1:410318598490:table/ANNOT-Dev-highlight-notes",
              + "arn:aws:dynamodb:us-east-1:410318598490:table/ANNOT-Dev-highlight-notes/*",
            ]
        }
      + statement {
          + actions   = [
              + "sqs:DeleteMessage",
              + "sqs:ReceiveMessage",
              + "sqs:SendMessage",
              + "sqs:SendMessageBatch",
            ]
          + effect    = "Allow"
          + resources = [
              + "arn:aws:sqs:us-east-1:410318598490:AnnotationsAPI-Dev-Batch-Delete-Consumer-Queue",
            ]
        }
    }

  # aws_cloudwatch_metric_alarm.synthetics_synthetics_synthetic_check_alarm_query_0_52F9FF21 will be updated in-place
  ~ resource "aws_cloudwatch_metric_alarm" "synthetics_synthetics_synthetic_check_alarm_query_0_52F9FF21" {
      ~ alarm_actions             = [
          + "",
        ]
        id                        = "annot-dev-query-0"
      ~ ok_actions                = [
          + "",
        ]
        tags                      = {}
        # (16 unchanged attributes hidden)
    }

  # aws_cloudwatch_metric_alarm.synthetics_synthetics_synthetic_check_alarm_uptime_0_3A56DFC7 will be updated in-place
  ~ resource "aws_cloudwatch_metric_alarm" "synthetics_synthetics_synthetic_check_alarm_uptime_0_3A56DFC7" {
      ~ alarm_actions             = [
          + "",
        ]
        id                        = "annot-dev-uptime-0"
      ~ ok_actions                = [
          + "",
        ]
        tags                      = {}
        # (16 unchanged attributes hidden)
    }

  # aws_dynamodb_table.dynamodb_highlight-notes_dynamodb_table_8BD520BF will be updated in-place
  ~ resource "aws_dynamodb_table" "dynamodb_highlight-notes_dynamodb_table_8BD520BF" {
        id                          = "ANNOT-Dev-highlight-notes"
        name                        = "ANNOT-Dev-highlight-notes"
        tags                        = {
            "environment" = "Dev"
            "service"     = "AnnotationsAPI"
        }
        # (9 unchanged attributes hidden)

      - global_secondary_index {
          - hash_key           = "userId" -> null
          - name               = "userId" -> null
          - non_key_attributes = [] -> null
          - projection_type    = "KEYS_ONLY" -> null
          - read_capacity      = 0 -> null
          - write_capacity     = 0 -> null
        }
      + global_secondary_index {
          + hash_key           = "userId"
          + name               = "userId"
          + non_key_attributes = []
          + projection_type    = "KEYS_ONLY"
          + read_capacity      = 5
          + write_capacity     = 5
        }

        # (4 unchanged blocks hidden)
    }

  # aws_iam_policy.application_ecs_service_ecs-iam_ecs-task-role-policy_6FC89FB6 will be updated in-place
  ~ resource "aws_iam_policy" "application_ecs_service_ecs-iam_ecs-task-role-policy_6FC89FB6" {
        id        = "arn:aws:iam::410318598490:policy/AnnotationsAPI-Dev-TaskRolePolicy"
        name      = "AnnotationsAPI-Dev-TaskRolePolicy"
      ~ policy    = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "dynamodb:UpdateItem",
                          - "dynamodb:Scan",
                          - "dynamodb:Query",
                          - "dynamodb:PutItem",
                          - "dynamodb:Get*",
                          - "dynamodb:DescribeTable",
                          - "dynamodb:Delete*",
                          - "dynamodb:BatchWrite*",
                          - "dynamodb:BatchGet*",
                        ]
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:dynamodb:us-east-1:410318598490:table/ANNOT-Dev-highlight-notes/*",
                          - "arn:aws:dynamodb:us-east-1:410318598490:table/ANNOT-Dev-highlight-notes",
                        ]
                    },
                  - {
                      - Action   = [
                          - "sqs:SendMessageBatch",
                          - "sqs:SendMessage",
                          - "sqs:ReceiveMessage",
                          - "sqs:DeleteMessage",
                        ]
                      - Effect   = "Allow"
                      - Resource = "arn:aws:sqs:us-east-1:410318598490:AnnotationsAPI-Dev-Batch-Delete-Consumer-Queue"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        tags      = {
            "environment" = "Dev"
            "service"     = "AnnotationsAPI"
        }
        # (4 unchanged attributes hidden)
    }

  # local_file.application_ecs_service_appspec_94386B9C will be created
  + resource "local_file" "application_ecs_service_appspec_94386B9C" {
      + content              = jsonencode(
            {
              + Resources = [
                  + {
                      + TargetService = {
                          + Properties = {
                              + LoadBalancerInfo = {
                                  + ContainerName = "app"
                                  + ContainerPort = 4008
                                }
                              + TaskDefinition   = "arn:aws:ecs:us-east-1:410318598490:task-definition/AnnotationsAPI-Dev:73"
                            }
                          + Type       = "AWS::ECS::Service"
                        }
                    },
                ]
              + version   = 1
            }
        )
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "appspec.json"
      + id                   = (known after apply)
    }

Plan: 1 to add, 4 to change, 0 to destroy.
aws_cloudwatch_metric_alarm.synthetics_synthetics_synthetic_check_alarm_uptime_0_3A56DFC7: Modifying... [id=annot-dev-uptime-0]
aws_cloudwatch_metric_alarm.synthetics_synthetics_synthetic_check_alarm_query_0_52F9FF21: Modifying... [id=annot-dev-query-0]
aws_dynamodb_table.dynamodb_highlight-notes_dynamodb_table_8BD520BF: Modifying... [id=ANNOT-Dev-highlight-notes]
aws_dynamodb_table.dynamodb_highlight-notes_dynamodb_table_8BD520BF: Modifications complete after 0s [id=ANNOT-Dev-highlight-notes]
data.aws_iam_policy_document.application_ecs_service_ecs-iam_data-ecs-task-role-policy_090CC3AD: Reading...
data.aws_iam_policy_document.application_ecs_service_ecs-iam_data-ecs-task-role-policy_090CC3AD: Read complete after 0s [id=126432256]
local_file.application_ecs_service_appspec_94386B9C: Creating...
local_file.application_ecs_service_appspec_94386B9C: Creation complete after 0s [id=6d984777d42d76913b195f66ac59a0b655a2adff]
aws_cloudwatch_metric_alarm.synthetics_synthetics_synthetic_check_alarm_query_0_52F9FF21: Modifications complete after 0s [id=annot-dev-query-0]
aws_cloudwatch_metric_alarm.synthetics_synthetics_synthetic_check_alarm_uptime_0_3A56DFC7: Modifications complete after 0s [id=annot-dev-uptime-0]
Releasing state lock. This may take a few moments...

Apply complete! Resources: 1 added, 3 changed, 0 destroyed.

:white_check_mark: Apply Succeeded (pocket-router-cdk-dev)
CI link
Apply complete! Resources: 53 added, 0 changed, 0 destroyed.
 Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # data.aws_iam_policy_document.synthetics_synthetics_synthetic_check_access_4C83FECF will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "synthetics_synthetics_synthetic_check_access_4C83FECF" {
      + id      = (known after apply)
      + json    = (known after apply)
      + version = "2012-10-17"

      + statement {
          + actions   = [
              + "logs:CreateLogGroup",
              + "logs:CreateLogStream",
              + "logs:PutLogEvents",
            ]
          + effect    = "Allow"
          + resources = [
              + "*",
            ]
        }
      + statement {
          + actions   = [
              + "s3:GetObject",
              + "s3:PutObject",
            ]
          + resources = [
              + (known after apply),
            ]
        }
      + statement {
          + actions   = [
              + "s3:GetObject",
            ]
          + resources = [
              + "arn:aws:s3:::pocket-syntheticchecks-dev/*",
            ]
        }
      + statement {
          + actions   = [
              + "s3:GetBucketLocation",
            ]
          + resources = [
              + (known after apply),
            ]
        }
      + statement {
          + actions   = [
              + "s3:ListAllMyBuckets",
            ]
          + resources = [
              + "*",
            ]
        }
      + statement {
          + actions   = [
              + "cloudwatch:PutMetricData",
            ]
          + resources = [
              + "*",
            ]

          + condition {
              + test     = "StringEquals"
              + values   = [
                  + "CloudWatchSynthetics",
                ]
              + variable = "cloudwatch:namespace"
            }
        }
      + statement {
          + actions   = [
              + "ec2:AttachNetworkInterface",
              + "ec2:CreateNetworkInterface",
              + "ec2:DeleteNetworkInterface",
              + "ec2:DescribeNetworkInterfaces",
            ]
          + resources = [
              + "*",
            ]
        }
    }

  # aws_acm_certificate.application_alb_certificate_93966247 will be created
  + resource "aws_acm_certificate" "application_alb_certificate_93966247" {
      + arn                       = (known after apply)
      + domain_name               = "direct.pocket-router.getpocket.dev"
      + domain_validation_options = [
          + {
              + domain_name           = "direct.pocket-router.getpocket.dev"
              + resource_record_name  = (known after apply)
              + resource_record_type  = (known after apply)
              + resource_record_value = (known after apply)
            },
        ]
      + id                        = (known after apply)
      + key_algorithm             = (known after apply)
      + not_after                 = (known after apply)
      + not_before                = (known after apply)
      + pending_renewal           = (known after apply)
      + renewal_eligibility       = (known after apply)
      + renewal_summary           = (known after apply)
      + status                    = (known after apply)
      + subject_alternative_names = [
          + "direct.pocket-router.getpocket.dev",
        ]
      + tags                      = {
          + "environment" = "Dev"
          + "service"     = "PocketRouter"
        }
      + tags_all                  = {
          + "environment" = "Dev"
          + "service"     = "PocketRouter"
        }
      + type                      = (known after apply)
      + validation_emails         = (known after apply)
      + validation_method         = "DNS"
    }

  # aws_acm_certificate.application_cdn_certificate_E17B2815 will be created
  + resource "aws_acm_certificate" "application_cdn_certificate_E17B2815" {
      + arn                       = (known after apply)
      + domain_name               = "pocket-router.getpocket.dev"
      + domain_validation_options = [
          + {
              + domain_name           = "pocket-router.getpocket.dev"
              + resource_record_name  = (known after apply)
              + resource_record_type  = (known after apply)
              + resource_record_value = (known after apply)
            },
        ]
      + id                        = (known after apply)
      + key_algorithm             = (known after apply)
      + not_after                 = (known after apply)
      + not_before                = (known after apply)
      + pending_renewal           = (known after apply)
      + renewal_eligibility       = (known after apply)
      + renewal_summary           = (known after apply)
      + status                    = (known after apply)
      + subject_alternative_names = [
          + "pocket-router.getpocket.dev",
        ]
      + tags                      = {
          + "environment" = "Dev"
          + "service"     = "PocketRouter"
        }
      + tags_all                  = {
          + "environment" = "Dev"
          + "service"     = "PocketRouter"
        }
      + type                      = (known after apply)
      + validation_emails         = (known after apply)
      + validation_method         = "DNS"
    }

  # aws_acm_certificate_validation.application_alb_certificate_certificate_validation_25DAB195 will be created
  + resource "aws_acm_certificate_validation" "application_alb_certificate_certificate_validation_25DAB195" {
      + certificate_arn         = (known after apply)
      + id                      = (known after apply)
      + validation_record_fqdns = (known after apply)
    }

  # aws_acm_certificate_validation.application_cdn_certificate_certificate_validation_F216BBC7 will be created
  + resource "aws_acm_certificate_validation" "application_cdn_certificate_certificate_validation_F216BBC7" {
      + certificate_arn         = (known after apply)
      + id                      = (known after apply)
      + validation_record_fqdns = (known after apply)
    }

  # aws_alb.application_application_load_balancer_alb_05EA9801 will be created
  + resource "aws_alb" "application_application_load_balancer_alb_05EA9801" {
      + arn                                                          = (known after apply)
      + arn_suffix                                                   = (known after apply)
      + desync_mitigation_mode                                       = "defensive"
      + dns_name                                                     = (known after apply)
      + drop_invalid_header_fields                                   = false
      + enable_deletion_protection                                   = false
      + enable_http2                                                 = true
      + enable_tls_version_and_cipher_suite_headers                  = false
      + enable_waf_fail_open                                         = false
      + enable_xff_client_port                                       = false
      + enforce_security_group_inbound_rules_on_private_link_traffic = (known after apply)
      + id                                                           = (known after apply)
      + idle_timeout                                                 = 60
      + internal                                                     = false
      + ip_address_type                                              = (known after apply)
      + load_balancer_type                                           = "application"
      + name                                                         = (known after apply)
      + name_prefix                                                  = "ROUTER"
      + preserve_host_header                                         = false
      + security_groups                                              = (known after apply)
      + subnets                                                      = [
          + "subnet-0113cd98b0579a9ce",
          + "subnet-081629325ceaecb2f",
          + "subnet-0e72688834215913c",
          + "subnet-0eac4c4b2463a1653",
        ]
      + tags                                                         = {
          + "environment" = "Dev"
          + "service"     = "PocketRouter"
        }
      + tags_all                                                     = {
          + "environment" = "Dev"
          + "service"     = "PocketRouter"
        }
      + vpc_id                                                       = (known after apply)
      + xff_header_processing_mode                                   = "append"
      + zone_id                                                      = (known after apply)

      + access_logs {
          + bucket  = "pocket-data-items-dev"
          + enabled = true
          + prefix  = "server-logs/pocketrouter-dev/alb"
        }
    }