Taking out the cbs_principal_arn since it was deleted

[sylviamclaughlin]

Summary | Résumé

Taking out the cbs_principal_arn since the user was deleted.

[github-actions]

Central account

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 0 to add, 3 to change, 0 to destroy

Show summary

CHANGE	NAME
update	aws_iam_policy.log_archive_read
	aws_iam_role.log_archive_read
	aws_kms_key.log_archive_encrypt

Show plan

Resource actions are indicated with the following symbols:
  ~ update in-place
 <= read (data resources)

Terraform will perform the following actions:

  # data.aws_iam_policy_document.log_archive_read will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "log_archive_read"  {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions   = [
              + "s3:GetObject",
              + "s3:ListBucket",
            ]
          + effect    = "Allow"
          + resources = [
              + "arn:aws:s3:::cbs-log-archive-871282759583",
              + "arn:aws:s3:::cbs-log-archive-871282759583/*",
            ]
        }
      + statement {
          + actions   = [
              + "kms:Decrypt",
            ]
          + effect    = "Allow"
          + resources = [
              + "arn:aws:kms:ca-central-1:871282759583:key/c4591f87-9445-4840-acb6-a5569e703c93",
            ]
        }
    }

  # aws_iam_policy.log_archive_read will be updated in-place
  ~ resource "aws_iam_policy" "log_archive_read" {
        id               = "arn:aws:iam::871282759583:policy/CbsASEAReaderRole"
        name             = "CbsASEAReaderRole"
      ~ policy           = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "s3:ListBucket",
                          - "s3:GetObject",
                        ]
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:s3:::cbs-log-archive-871282759583/*",
                          - "arn:aws:s3:::cbs-log-archive-871282759583",
                        ]
                      - Sid      = ""
                    },
                  - {
                      - Action   = "kms:Decrypt"
                      - Effect   = "Allow"
                      - Resource = "arn:aws:kms:ca-central-1:871282759583:key/c4591f87-9445-4840-acb6-a5569e703c93"
                      - Sid      = ""
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        tags             = {}
        # (5 unchanged attributes hidden)
    }

  # aws_iam_role.log_archive_read will be updated in-place
  ~ resource "aws_iam_role" "log_archive_read" {
      ~ assume_role_policy    = (sensitive)
        id                    = "CbsASEAReaderRole"
        name                  = "CbsASEAReaderRole"
        tags                  = {}
        # (11 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # aws_kms_key.log_archive_encrypt will be updated in-place
  ~ resource "aws_kms_key" "log_archive_encrypt" {
        id                                 = "c4591f87-9445-4840-acb6-a5569e703c93"
      ~ policy                             = (sensitive)
        tags                               = {}
        # (13 unchanged attributes hidden)
    }

Plan: 0 to add, 3 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.log_archive_access_bucket.aws_s3_bucket.this,
  on .terraform/modules/log_archive_access_bucket/S3_log_bucket/main.tf line 8, in resource "aws_s3_bucket" "this":
   8: resource "aws_s3_bucket" "this" {

server_side_encryption_configuration is deprecated. Use the
aws_s3_bucket_server_side_encryption_configuration resource instead.

(and 6 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_event_rule.cbs"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.event_bus_invoke_remote_event_bus"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.log_archive_read"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.event_bus_invoke_remote_event_bus"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.log_archive_read"]
WARN - plan.json - main - Missing Common Tags: ["aws_kms_key.log_archive_encrypt"]
WARN - plan.json - main - Missing Common Tags: ["aws_sns_topic.log_archive"]

27 tests, 20 passed, 7 warnings, 0 failures, 0 exceptions