Skip to content

add fastpath instance for reuploading reports#443

Open
aagbsn wants to merge 5 commits into
mainfrom
add_reuploader_fastpath
Open

add fastpath instance for reuploading reports#443
aagbsn wants to merge 5 commits into
mainfrom
add_reuploader_fastpath

Conversation

@aagbsn

@aagbsn aagbsn commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Adds another fastpath+s3 uploader instance for failed reports to be resubmitted to.
#398

@github-actions

github-actions Bot commented Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Terraform Run Output 🤖

Format and Style 🖌success

Initialization ⚙️success

Validation 🤖success

Validation Output 

$ terraform validate

Warning: Argument is deprecated

  with aws_s3_bucket.anoncred_manifests,
  on main.tf line 260, in resource "aws_s3_bucket" "anoncred_manifests":
 260: resource "aws_s3_bucket" "anoncred_manifests" {

Use the aws_s3_bucket_versioning resource instead

Warning: Deprecated value used

  on ../../modules/ecs_cluster/outputs.tf line 22, in output "container_host_role":
  22:   value = aws_iam_role.container_host

  The deprecation originates from module.oonitier1plus_cluster.aws_iam_role.container_host.inline_policy

Deprecated resource block "inline_policy" used. Refer to the provider
documentation for details.

(and 3 more similar warnings elsewhere)

Warning: Available Write-only Attribute Alternative

  with module.ooni_monitoring.aws_ssm_parameter.ooni_monitoring_access_key,
  on ../../modules/ooni_monitoring/main.tf line 47, in resource "aws_ssm_parameter" "ooni_monitoring_access_key":
  47:   value = aws_iam_access_key.ooni_monitoring.id

The attribute value has a write-only alternative value_wo available. Use the
write-only alternative of the attribute when possible.

(and one more similar warning elsewhere)
Success! The configuration is valid, but there were some validation warnings
as shown above.

Plan 📖success

  • Plan: 0 to add, 4 to change, 13 to destroy.
Show Plan 

$ terraform plan

Warning: Deprecated Parameter

The parameter "dynamodb_table" is deprecated. Use parameter "use_lockfile"
instead.
Acquiring state lock. This may take a few moments...
module.adm_iam_roles.tls_private_key.oonidevops: Refreshing state... [id=b49a9fdb9f720320340226016efe24808dd68203]
module.ooni_jumphost.data.cloudinit_config.ooni_ec2: Reading...
data.dns_a_record_set.monitoring_host: Reading...
module.ansible_inventory.local_file.ansible_inventory: Refreshing state... [id=b6de844ed8d384f890fa6f467502390de843f758]
module.ooni_monitoring_proxy.data.cloudinit_config.ooni_ec2: Reading...
random_id.artifact_id: Refreshing state... [id=8Ujqew]
module.ooniapi_frontend.random_id.artifact_id: Refreshing state... [id=_3cQlA]
module.ooni_anonc.data.cloudinit_config.ooni_ec2: Reading...
module.ooni_anonc.data.cloudinit_config.ooni_ec2: Read complete after 0s [id=2022394177]
module.ooni_monitoring_proxy.data.cloudinit_config.ooni_ec2: Read complete after 0s [id=2022394177]
module.ooniapi_testlists.data.cloudinit_config.ooni_ec2: Reading...
module.ooni_jumphost.data.cloudinit_config.ooni_ec2: Read complete after 0s [id=2022394177]
module.ooniapi_testlists.data.cloudinit_config.ooni_ec2: Read complete after 0s [id=2022394177]
module.ooni_clickhouse_proxy.data.cloudinit_config.ooni_ec2: Reading...
module.ooni_fastpath.module.ec2.data.cloudinit_config.ooni_ec2: Reading...
module.ooni_fastpath.module.ec2.data.cloudinit_config.ooni_ec2: Read complete after 0s [id=2022394177]
module.ooni_clickhouse_proxy.data.cloudinit_config.ooni_ec2: Read complete after 0s [id=2022394177]
module.ansible_inventory.null_resource.ansible_update_known_hosts: Refreshing state... [id=236461505953331670]
data.dns_a_record_set.monitoring_host: Read complete after 0s [id=monitoring.ooni.org]
aws_iam_role_policy.reuploader_role: Refreshing state... [id=scheduled-service-reuploader-task-role:oonidevops-dev-task-role]
module.reuploader_builder.aws_iam_policy.codepipeline: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codepipeline-oonidkr-reuploader]
module.reuploader_builder.aws_iam_role.codepipeline: Refreshing state... [id=codepipeline-oonidkr-reuploader]
module.reuploader.aws_cloudwatch_event_rule.scheduled_run: Refreshing state... [id=scheduled-service-reuploader-schedule]
module.reuploader.aws_iam_role.events_run_task: Refreshing state... [id=scheduled-service-reuploader-events-run-task-role]
module.reuploader.aws_iam_role_policy.scheduled_service_task: Refreshing state... [id=scheduled-service-reuploader-task-role:scheduled-service-reuploader-task-role]
module.ooni_fastpath.module.ec2.data.aws_ssm_parameter.ubuntu_22_ami: Reading...
module.reuploader.aws_cloudwatch_log_group.scheduled_service: Refreshing state... [id=ooni-ecs-group/scheduled-service-reuploader]
module.reuploader.aws_iam_role.scheduled_service_task: Refreshing state... [id=scheduled-service-reuploader-task-role]
module.reuploader_builder.aws_codebuild_project.oonidkr: Refreshing state... [id=arn:aws:codebuild:eu-central-1:905418398257:project/oonidkr-reuploader]
module.reuploader.aws_iam_role_policy.events_run_task_policy: Refreshing state... [id=scheduled-service-reuploader-events-run-task-role:scheduled-service-reuploader-events-run-task-policy]
module.reuploader_builder.aws_iam_policy.codebuild: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codebuild-reuploader-eu-central-1]
module.reuploader_builder.aws_codepipeline.oonidkr: Refreshing state... [id=oonidkr-reuploader]
module.reuploader.aws_ecs_task_definition.scheduled_service: Refreshing state... [id=scheduled-service-reuploader-td]
module.reuploader.aws_cloudwatch_event_target.run_ecs_task: Refreshing state... [id=scheduled-service-reuploader-schedule-terraform-20260611131707161700000001]
module.reuploader_builder.aws_iam_role.codebuild: Refreshing state... [id=codebuild-oonidkr-reuploader]
module.ooniapi_frontend.aws_s3_bucket.load_balancer_logs: Refreshing state... [id=lb-logs-eu-central-1-ff771094]
module.ooni_fastpath.module.ec2.data.aws_ssm_parameter.ubuntu_22_ami: Read complete after 1s [id=/aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id]
module.oonidevops_github_user.aws_iam_user.oonidevops_github: Refreshing state... [id=oonidevops-github]
data.aws_ssm_parameter.anonc_secret_key: Reading...
data.aws_ssm_parameter.clickhouse_write_url: Reading...
module.ooniapi_oonimeasurements.aws_iam_role.ooniapi_service_task: Refreshing state... [id=ooniapi-service-oonimeasurements-task-role]
module.ooniapi_oonifindings_deployer.aws_iam_policy.codepipeline: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codepipeline-ooniapi-oonifindings]
aws_s3_bucket.anoncred_manifests: Refreshing state... [id=ooni-anoncreds-manifests-dev-eu-central-1]
data.aws_availability_zones.available: Reading...
data.aws_ssm_parameter.anonc_secret_key: Read complete after 0s [id=/oonidevops/secrets/zkp/secret_key]
module.ooniapi_oonifindings.aws_cloudwatch_log_group.ooniapi_service: Refreshing state... [id=ooni-ecs-group/ooniapi-service-oonifindings]
module.adm_iam_roles.aws_iam_policy.oonidevops: Refreshing state... [id=arn:aws:iam::905418398257:policy/OONIDevopsPolicy]
data.aws_ssm_parameter.clickhouse_write_url: Read complete after 0s [id=/oonidevops/secrets/clickhouse_write_url]
module.adm_iam_roles.aws_key_pair.oonidevops: Refreshing state... [id=oonidevops]
module.ooniapi_oonimeasurements_deployer.data.aws_caller_identity.current: Reading...
module.oonidevops_github_user.aws_secretsmanager_secret.oonidevops_github: Refreshing state... [id=arn:aws:secretsmanager:eu-central-1:905418398257:secret:oonidevops/github_user/access_key_json-9JTJgd]
module.ooniapi_reverseproxy.aws_cloudwatch_log_group.ooniapi_service: Refreshing state... [id=ooni-ecs-group/ooniapi-service-reverseproxy]
module.ooniapi_ooniauth.aws_cloudwatch_log_group.ooniapi_service: Refreshing state... [id=ooni-ecs-group/ooniapi-service-ooniauth]
aws_acm_certificate.ooniapi_frontend: Refreshing state... [id=arn:aws:acm:eu-central-1:905418398257:certificate/c6d8f7a1-5b6d-4302-9aa6-92850ded970e]
module.ooniapi_oonimeasurements_deployer.data.aws_caller_identity.current: Read complete after 0s [id=905418398257]
module.ooniapi_oonirun_deployer.data.aws_caller_identity.current: Reading...
module.ooniapi_user.aws_secretsmanager_secret.aws_access_key_id: Refreshing state... [id=arn:aws:secretsmanager:eu-central-1:905418398257:secret:oonidevops/ooniapi_user/aws_access_key_id-EcXOBx]
module.ooniapi_oonirun_deployer.data.aws_caller_identity.current: Read complete after 0s [id=905418398257]
module.fastpath_builder.aws_iam_policy.codepipeline: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codepipeline-oonidkr-fastpath]
data.aws_availability_zones.available: Read complete after 1s [id=eu-central-1]
aws_s3_bucket.oonith_codepipeline_bucket: Refreshing state... [id=codepipeline-oonith-eu-central-1-f148ea7b]
module.ooniapi_cluster.aws_cloudwatch_log_group.ooniapi_services: Refreshing state... [id=ooni-ecs-group/ooniapi-ecs-cluster]
module.ooniapi_ooniprobe_deployer.aws_iam_policy.codepipeline: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codepipeline-ooniapi-ooniprobe]
module.ooniapi_user.aws_ses_email_identity.ooniapi: Refreshing state... [id=admin+dev@ooni.org]
module.ooniapi_oonirun.data.aws_ecs_container_definition.ooniapi_service_current[0]: Reading...
module.ooniapi_reverseproxy.data.aws_ecs_container_definition.ooniapi_service_current[0]: Reading...
module.ooniapi_ooniauth.data.aws_ecs_container_definition.ooniapi_service_current[0]: Reading...
module.ooni_monitoring_proxy.data.aws_ssm_parameter.ubuntu_22_ami: Reading...
data.aws_ssm_parameter.clickhouse_readonly_url: Reading...
module.ooniapi_oonirun.data.aws_ecs_container_definition.ooniapi_service_current[0]: Read complete after 0s [id=ooniapi-service-oonirun-td/ooniapi-service-oonirun]
module.ooniapi_oonimeasurements.aws_cloudwatch_log_group.ooniapi_service: Refreshing state... [id=ooni-ecs-group/ooniapi-service-oonimeasurements]
module.ooniapi_oonifindings.data.aws_ecs_container_definition.ooniapi_service_current[0]: Reading...
module.ooni_monitoring_proxy.data.aws_ssm_parameter.ubuntu_22_ami: Read complete after 0s [id=/aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id]
module.ooniapi_oonifindings.aws_iam_role.ooniapi_service_task: Refreshing state... [id=ooniapi-service-oonifindings-task-role]
module.ooniapi_reverseproxy.data.aws_ecs_container_definition.ooniapi_service_current[0]: Read complete after 0s [id=ooniapi-service-reverseproxy-td/ooniapi-service-reverseproxy]
module.ooniapi_ooniprobe.data.aws_ecs_container_definition.ooniapi_service_current[0]: Reading...
data.aws_ssm_parameter.clickhouse_readonly_url: Read complete after 0s [id=/oonidevops/secrets/clickhouse_readonly_url]
module.ooniapi_oonimeasurements_deployer.aws_iam_policy.codepipeline: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codepipeline-ooniapi-oonimeasurements]
module.ooniapi_user.aws_secretsmanager_secret.aws_secret_access_key: Refreshing state... [id=arn:aws:secretsmanager:eu-central-1:905418398257:secret:oonidevops/ooniapi_user/aws_secret_access_key-L0DQDr]
module.ooni_clickhouse_proxy.data.aws_ssm_parameter.ubuntu_22_ami: Reading...
module.ooniapi_ooniauth.data.aws_ecs_container_definition.ooniapi_service_current[0]: Read complete after 0s [id=ooniapi-service-ooniauth-td/ooniapi-service-ooniauth]
module.ooniapi_ooniprobe.aws_iam_role.ooniapi_service_task: Refreshing state... [id=ooniapi-service-ooniprobe-task-role]
module.adm_iam_roles.data.aws_iam_policy_document.assume_role: Reading...
module.adm_iam_roles.data.aws_iam_policy_document.assume_role: Read complete after 0s [id=3569030007]
module.ooniapi_ooniauth.aws_iam_role.ooniapi_service_task: Refreshing state... [id=ooniapi-service-ooniauth-task-role]
module.ooniapi_ooniprobe.aws_cloudwatch_log_group.ooniapi_service: Refreshing state... [id=ooni-ecs-group/ooniapi-service-ooniprobe]
module.ooniapi_oonifindings.data.aws_ecs_container_definition.ooniapi_service_current[0]: Read complete after 0s [id=ooniapi-service-oonifindings-td/ooniapi-service-oonifindings]
aws_s3_bucket.ooni_private_config_bucket: Refreshing state... [id=ooni-config-eu-central-1-f148ea7b]
module.ooni_clickhouse_proxy.data.aws_ssm_parameter.ubuntu_22_ami: Read complete after 1s [id=/aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id]
aws_s3_bucket.ooniapi_codepipeline_bucket: Refreshing state... [id=codepipeline-ooniapi-eu-central-1-f148ea7b]
module.ooniapi_ooniprobe.data.aws_ecs_container_definition.ooniapi_service_current[0]: Read complete after 1s [id=ooniapi-service-ooniprobe-td/ooniapi-service-ooniprobe]
module.adm_iam_roles.aws_secretsmanager_secret.oonidevops_deploy_key: Refreshing state... [id=arn:aws:secretsmanager:eu-central-1:905418398257:secret:oonidevops/deploy_key-2ebqSe]
data.aws_ssm_parameter.jwt_secret_legacy: Reading...
data.aws_ssm_parameter.jwt_secret: Reading...
data.aws_ssm_parameter.account_id_hashing_key: Reading...
data.aws_ssm_parameter.prometheus_metrics_password: Reading...
data.aws_ssm_parameter.jwt_secret_legacy: Read complete after 0s [id=/oonidevops/secrets/ooni_services/jwt_secret_legacy]
data.aws_ssm_parameter.do_token: Reading...
module.ooniapi_ooniprobe_deployer.data.aws_caller_identity.current: Reading...
data.aws_ssm_parameter.jwt_secret: Read complete after 0s [id=/oonidevops/secrets/ooni_services/jwt_secret]
module.ooniapi_reverseproxy.aws_iam_role.ooniapi_service_task: Refreshing state... [id=ooniapi-service-reverseproxy-task-role]
data.aws_ssm_parameter.account_id_hashing_key: Read complete after 0s [id=/oonidevops/secrets/ooni_services/account_id_hashing_key]
aws_iam_role.monitoring_proxy_yace: Refreshing state... [id=monitoring-proxy-yace]
module.ooniapi_ooniprobe_deployer.data.aws_caller_identity.current: Read complete after 0s [id=905418398257]
module.ooni_monitoring.aws_iam_user.ooni_monitoring: Refreshing state... [id=oonidevops-monitoring]
module.fastpath_builder.data.aws_caller_identity.current: Reading...
data.aws_ssm_parameter.prometheus_metrics_password: Read complete after 0s [id=/oonidevops/ooni_services/prometheus_metrics_password]
module.ooni_anonc.data.aws_ssm_parameter.ubuntu_22_ami: Reading...
data.aws_ssm_parameter.do_token: Read complete after 0s [id=/oonidevops/secrets/digitalocean_access_token]
module.testlists_builder.aws_iam_policy.codepipeline: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codepipeline-oonidkr-testlists]
module.fastpath_builder.data.aws_caller_identity.current: Read complete after 0s [id=905418398257]
module.ooniapi_cluster.aws_iam_role.container_host: Refreshing state... [id=ooniapi-ecs-cluster-container-host-role]
module.ooni_anonc.data.aws_ssm_parameter.ubuntu_22_ami: Read complete after 0s [id=/aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id]
module.ooniapi_ooniauth_deployer.aws_iam_policy.codepipeline: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codepipeline-ooniapi-ooniauth]
module.oonitier1plus_cluster.data.aws_ssm_parameter.ecs_optimized_ami: Reading...
module.ooniapi_frontend.aws_s3_bucket.athena_results: Refreshing state... [id=ooni-athena-results-ff771094]
aws_s3_bucket.ooniprobe_failed_reports: Refreshing state... [id=ooniprobe-failed-reports-eu-central-1]
module.oonitier1plus_cluster.data.aws_ssm_parameter.ecs_optimized_ami: Read complete after 0s [id=/aws/service/ecs/optimized-ami/amazon-linux-2023/recommended]
module.oonitier1plus_cluster.aws_cloudwatch_log_group.ooniapi_services: Refreshing state... [id=ooni-ecs-group/oonitier1plus-ecs-cluster]
module.ooniapi_ooniauth_deployer.data.aws_caller_identity.current: Reading...
module.ooniapi_testlists.data.aws_ssm_parameter.ubuntu_22_ami: Reading...
module.ooniapi_cluster.data.aws_ssm_parameter.ecs_optimized_ami: Reading...
module.ooniapi_ooniauth_deployer.data.aws_caller_identity.current: Read complete after 0s [id=905418398257]
module.ooniapi_reverseproxy_deployer.aws_iam_policy.codepipeline: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codepipeline-ooniapi-reverseproxy]
module.ooni_jumphost.data.aws_ssm_parameter.ubuntu_22_ami: Reading...
module.ooniapi_testlists.data.aws_ssm_parameter.ubuntu_22_ami: Read complete after 0s [id=/aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id]
module.testlists_builder.data.aws_caller_identity.current: Reading...
module.ooniapi_cluster.data.aws_ssm_parameter.ecs_optimized_ami: Read complete after 0s [id=/aws/service/ecs/optimized-ami/amazon-linux-2023/recommended]
module.ooniapi_oonirun_deployer.aws_iam_policy.codepipeline: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codepipeline-ooniapi-oonirun]
data.aws_ssm_parameter.clickhouse_readonly_test_url: Reading...
module.testlists_builder.data.aws_caller_identity.current: Read complete after 0s [id=905418398257]
module.ooniapi_oonirun.aws_cloudwatch_log_group.ooniapi_service: Refreshing state... [id=ooni-ecs-group/ooniapi-service-oonirun]
module.ooni_jumphost.data.aws_ssm_parameter.ubuntu_22_ami: Read complete after 0s [id=/aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id]
module.ooniapi_oonirun.aws_iam_role.ooniapi_service_task: Refreshing state... [id=ooniapi-service-oonirun-task-role]
module.oonitier1plus_cluster.aws_iam_role.container_host: Refreshing state... [id=oonitier1plus-ecs-cluster-container-host-role]
module.ooniapi_reverseproxy_deployer.data.aws_caller_identity.current: Reading...
data.aws_ssm_parameter.clickhouse_readonly_test_url: Read complete after 0s [id=/oonidevops/secrets/clickhouse_readonly_test_url]
module.oonidevops_github_user.aws_iam_policy.oonidevops_github: Refreshing state... [id=arn:aws:iam::905418398257:policy/oonidevops-github-policy]
module.ooniapi_reverseproxy_deployer.data.aws_caller_identity.current: Read complete after 0s [id=905418398257]
aws_secretsmanager_secret.oonipg_url: Refreshing state... [id=arn:aws:secretsmanager:eu-central-1:905418398257:secret:oonidevops/ooni-tier0-postgres/postgresql_url-w62CTZ]
data.aws_ssm_parameter.oonipg_url: Reading...
module.ooniapi_user.aws_iam_user.ooniapi: Refreshing state... [id=oonidevops-ooniapi]
module.ooniapi_oonifindings_deployer.data.aws_caller_identity.current: Reading...
module.oonidevops_github_user.aws_iam_access_key.oonidevops_github: Refreshing state... [id=AKIA5FTZELIYXDN55SMS]
module.ooniapi_oonifindings_deployer.aws_iam_role.codepipeline: Refreshing state... [id=codepipeline-ooniapi-oonifindings]
module.ooniapi_oonimeasurements.aws_iam_role_policy.ooniapi_service_task: Refreshing state... [id=ooniapi-service-oonimeasurements-task-role:ooniapi-service-oonimeasurements-task-role]
data.aws_ssm_parameter.oonipg_url: Read complete after 0s [id=/oonidevops/secrets/ooni-tier0-postgres/postgresql_write_url]
module.fastpath_builder.aws_iam_role.codepipeline: Refreshing state... [id=codepipeline-oonidkr-fastpath]
module.ooniapi_oonifindings_deployer.data.aws_caller_identity.current: Read complete after 0s [id=905418398257]
module.ooniapi_ooniprobe_deployer.aws_iam_role.codepipeline: Refreshing state... [id=codepipeline-ooniapi-ooniprobe]
aws_route53_record.ooniapi_frontend_cert_validation["ooniprobe.dev.ooni.io"]: Refreshing state... [id=Z055356431RGCLK3JXZDL__a064be8aa084a037ff9fa5e3e541c87d.ooniprobe.dev.ooni.io._CNAME]
aws_route53_record.ooniapi_frontend_cert_validation["ooniauth.dev.ooni.io"]: Refreshing state... [id=Z055356431RGCLK3JXZDL__48cd4e71cee9930614228176b7deefb9.ooniauth.dev.ooni.io._CNAME]
aws_route53_record.ooniapi_frontend_cert_validation["oonirun.dev.ooni.io"]: Refreshing state... [id=Z055356431RGCLK3JXZDL__05c891caeb4509d4cd7f9c24d8b6dbd0.oonirun.dev.ooni.io._CNAME]
aws_route53_record.ooniapi_frontend_cert_validation["8.th.dev.ooni.io"]: Refreshing state... [id=Z055356431RGCLK3JXZDL__ef17825e5fd9713f596344bdd9626f5e.8.th.dev.ooni.io._CNAME]
aws_route53_record.ooniapi_frontend_cert_validation["api.dev.ooni.io"]: Refreshing state... [id=Z055356431RGCLK3JXZDL__cd4729fc0c282e771d056e719a7bdf4f.api.dev.ooni.io._CNAME]
aws_route53_record.ooniapi_frontend_cert_validation["oonimeasurements.dev.ooni.io"]: Refreshing state... [id=Z055356431RGCLK3JXZDL__8fb10887c4ca7af87e33703c03c4c82e.oonimeasurements.dev.ooni.io._CNAME]
aws_route53_record.ooniapi_frontend_cert_validation["testlists.dev.ooni.io"]: Refreshing state... [id=Z055356431RGCLK3JXZDL__2b445be660c03a7eecbd5429f176ec99.testlists.dev.ooni.io._CNAME]
module.ooniapi_cluster.aws_ecs_cluster.main: Refreshing state... [id=arn:aws:ecs:eu-central-1:905418398257:cluster/ooniapi-ecs-cluster]
module.ooniapi_oonimeasurements_deployer.aws_iam_role.codepipeline: Refreshing state... [id=codepipeline-ooniapi-oonimeasurements]
module.adm_iam_roles.aws_iam_role.oonidevops: Refreshing state... [id=oonidevops]
module.ooniapi_oonifindings.aws_iam_role_policy.ooniapi_service_task: Refreshing state... [id=ooniapi-service-oonifindings-task-role:ooniapi-service-oonifindings-task-role]
module.ooniapi_ooniprobe.aws_iam_role_policy.ooniapi_service_task: Refreshing state... [id=ooniapi-service-ooniprobe-task-role:ooniapi-service-ooniprobe-task-role]
module.ooniapi_ooniauth.aws_iam_role_policy.ooniapi_service_task: Refreshing state... [id=ooniapi-service-ooniauth-task-role:ooniapi-service-ooniauth-task-role]
module.adm_iam_roles.aws_secretsmanager_secret_version.oonidevops_deploy_key: Refreshing state... [id=arn:aws:secretsmanager:eu-central-1:905418398257:secret:oonidevops/deploy_key-2ebqSe|terraform-20240925140131946100000002]
module.ooni_monitoring.aws_iam_access_key.ooni_monitoring: Refreshing state... [id=AKIA5FTZELIYWULOT65S]
module.ooni_monitoring.aws_iam_user_policy.ooni_monitoring: Refreshing state... [id=oonidevops-monitoring:oonidevops-monitoring-policy]
module.ooniapi_reverseproxy.aws_iam_role_policy.ooniapi_service_task: Refreshing state... [id=ooniapi-service-reverseproxy-task-role:ooniapi-service-reverseproxy-task-role]
module.testlists_builder.aws_iam_role.codepipeline: Refreshing state... [id=codepipeline-oonidkr-testlists]
aws_iam_instance_profile.monitoring_proxy_yace: Refreshing state... [id=oonidevops-dev-monitoring-proxy-yace]
aws_iam_role_policy.monitoring_proxy_yace: Refreshing state... [id=monitoring-proxy-yace:yace-cloudwatch-read]
module.ooniapi_ooniauth_deployer.aws_iam_role.codepipeline: Refreshing state... [id=codepipeline-ooniapi-ooniauth]
module.ooniapi_frontend.aws_s3_bucket_ownership_controls.load_balancer_logs: Refreshing state... [id=lb-logs-eu-central-1-ff771094]
module.ooniapi_frontend.aws_s3_bucket_policy.alb_logs_policy: Refreshing state... [id=lb-logs-eu-central-1-ff771094]
module.ooniapi_frontend.aws_s3_bucket_lifecycle_configuration.load_balancer_logs: Refreshing state... [id=lb-logs-eu-central-1-ff771094]
aws_s3_bucket_public_access_block.anonc_manifests: Refreshing state... [id=ooni-anoncreds-manifests-dev-eu-central-1]
aws_s3_bucket_versioning.anoncred_manifests_version: Refreshing state... [id=ooni-anoncreds-manifests-dev-eu-central-1]
aws_s3_bucket_ownership_controls.anonc_manifests: Refreshing state... [id=ooni-anoncreds-manifests-dev-eu-central-1]
aws_s3_object.test_manifest: Refreshing state... [id=test_manifest.json]
aws_s3_object.manifest: Refreshing state... [id=manifest.json]
aws_s3_bucket_policy.anonc_manifests_policy: Refreshing state... [id=ooni-anoncreds-manifests-dev-eu-central-1]
module.ooniapi_cluster.aws_iam_role_policy.container_host: Refreshing state... [id=ooniapi-ecs-cluster-container-host-role:ooniapi-ecs-cluster-instance-role-policy]
module.ooniapi_cluster.aws_iam_instance_profile.container_host: Refreshing state... [id=ooniapi-ecs-cluster]
module.oonitier1plus_cluster.aws_ecs_cluster.main: Refreshing state... [id=arn:aws:ecs:eu-central-1:905418398257:cluster/oonitier1plus-ecs-cluster]
module.ooniapi_reverseproxy_deployer.aws_iam_role.codepipeline: Refreshing state... [id=codepipeline-ooniapi-reverseproxy]
module.ooniapi_oonirun_deployer.aws_iam_role.codepipeline: Refreshing state... [id=codepipeline-ooniapi-oonirun]
module.oonidevops_github_user.aws_iam_user_policy_attachment.oonidevops_github: Refreshing state... [id=oonidevops-github-20240313195612421500000001]
module.ooniapi_oonirun.aws_iam_role_policy.ooniapi_service_task: Refreshing state... [id=ooniapi-service-oonirun-task-role:ooniapi-service-oonirun-task-role]
module.ooniapi_user.aws_iam_access_key.ooniapi: Refreshing state... [id=AKIA5FTZELIYSK2XEVOT]
module.ooniapi_user.aws_iam_user_policy.ooniapi: Refreshing state... [id=oonidevops-ooniapi:oonidevops-ooniapi-policy]
module.oonitier1plus_cluster.aws_iam_role_policy.container_host: Refreshing state... [id=oonitier1plus-ecs-cluster-container-host-role:oonitier1plus-ecs-cluster-instance-role-policy]
module.oonitier1plus_cluster.aws_iam_instance_profile.container_host: Refreshing state... [id=oonitier1plus-ecs-cluster]
module.oonidevops_github_user.aws_secretsmanager_secret_version.oonidevops_github: Refreshing state... [id=arn:aws:secretsmanager:eu-central-1:905418398257:secret:oonidevops/github_user/access_key_json-9JTJgd|terraform-20240519071250187000000004]
aws_acm_certificate_validation.ooniapi_frontend: Refreshing state... [id=2026-03-02 13:38:05.483 +0000 UTC]
module.ooniapi_reverseproxy.aws_ecs_task_definition.ooniapi_service: Refreshing state... [id=ooniapi-service-reverseproxy-td]
module.ooni_monitoring.aws_ssm_parameter.ooni_monitoring_secret_key: Refreshing state... [id=/oonidevops/secrets/ooni_monitoring/secret_key]
module.ooni_monitoring.aws_ssm_parameter.ooni_monitoring_access_key: Refreshing state... [id=/oonidevops/secrets/ooni_monitoring/access_key]
aws_s3_bucket_acl.anonc_manifests: Refreshing state... [id=ooni-anoncreds-manifests-dev-eu-central-1,public-read]
module.ooniapi_user.aws_secretsmanager_secret_version.aws_access_key_id: Refreshing state... [id=arn:aws:secretsmanager:eu-central-1:905418398257:secret:oonidevops/ooniapi_user/aws_access_key_id-EcXOBx|terraform-20240314200140918400000007]
module.ooniapi_user.aws_secretsmanager_secret_version.aws_secret_access_key: Refreshing state... [id=arn:aws:secretsmanager:eu-central-1:905418398257:secret:oonidevops/ooniapi_user/aws_secret_access_key-L0DQDr|terraform-20240314200140914600000006]
module.ooniapi_oonirun.aws_ecs_task_definition.ooniapi_service: Refreshing state... [id=ooniapi-service-oonirun-td]
module.ooniapi_oonifindings.aws_ecs_task_definition.ooniapi_service: Refreshing state... [id=ooniapi-service-oonifindings-td]
module.ooniapi_ooniauth.aws_ecs_task_definition.ooniapi_service: Refreshing state... [id=ooniapi-service-ooniauth-td]
aws_iam_role_policy.ooniprobe_role: Refreshing state... [id=ooniapi-ecs-cluster-container-host-role:oonidevops-dev-task-role]
module.ooniapi_frontend.aws_athena_database.load_balancer_logs: Refreshing state... [id=load_balancer_logs]
module.ooniapi_frontend.aws_s3_bucket_lifecycle_configuration.athena_results: Refreshing state... [id=ooni-athena-results-ff771094]
module.ooniapi_frontend.aws_athena_workgroup.ooni_workgroup: Refreshing state... [id=ooni-workgroup]
aws_codestarconnections_connection.oonidevops: Refreshing state... [id=arn:aws:codestar-connections:eu-central-1:905418398257:connection/6bd492f6-c11d-43ec-92b0-24c47700d528]
module.network.aws_vpc.main: Refreshing state... [id=vpc-0e382f3ad89286de9]
module.ooni_th_droplet.digitalocean_droplet.ooni_th_docker[0]: Refreshing state... [id=459912318]
module.terraform_state_backend.aws_s3_bucket.default[0]: Refreshing state... [id=oonidevops-dev-terraform-state]
module.terraform_state_backend.aws_dynamodb_table.with_server_side_encryption[0]: Refreshing state... [id=oonidevops-dev-terraform-state-lock]
module.ooni_th_droplet.aws_route53_record.ooni_th["0"]: Refreshing state... [id=Z055356431RGCLK3JXZDL_0.do.th.dev.ooni.io_A]
module.ooniapi_ooniprobe_deployer.aws_iam_policy.codebuild: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codebuild-ooniprobe-eu-central-1]
module.ooniapi_reverseproxy_deployer.aws_iam_policy.codebuild: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codebuild-reverseproxy-eu-central-1]
module.ooniapi_oonimeasurements_deployer.aws_iam_policy.codebuild: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codebuild-oonimeasurements-eu-central-1]
module.ooniapi_oonifindings_deployer.aws_iam_policy.codebuild: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codebuild-oonifindings-eu-central-1]
module.fastpath_builder.aws_iam_policy.codebuild: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codebuild-fastpath-eu-central-1]
module.ooniapi_oonirun_deployer.aws_iam_policy.codebuild: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codebuild-oonirun-eu-central-1]
module.testlists_builder.aws_iam_policy.codebuild: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codebuild-testlists-eu-central-1]
module.ooniapi_ooniauth_deployer.aws_iam_policy.codebuild: Refreshing state... [id=arn:aws:iam::905418398257:policy/service-role/codebuild-ooniauth-eu-central-1]
module.ooniapi_oonimeasurements_deployer.aws_iam_role.codebuild: Refreshing state... [id=codebuild-ooniapi-oonimeasurements]
module.ooniapi_oonifindings_deployer.aws_iam_role.codebuild: Refreshing state... [id=codebuild-ooniapi-oonifindings]
module.ooniapi_ooniprobe_deployer.aws_iam_role.codebuild: Refreshing state... [id=codebuild-ooniapi-ooniprobe]
module.ooniapi_reverseproxy_deployer.aws_iam_role.codebuild: Refreshing state... [id=codebuild-ooniapi-reverseproxy]
module.fastpath_builder.aws_iam_role.codebuild: Refreshing state... [id=codebuild-oonidkr-fastpath]
module.ooniapi_oonirun_deployer.aws_iam_role.codebuild: Refreshing state... [id=codebuild-ooniapi-oonirun]
module.ooniapi_ooniauth_deployer.aws_iam_role.codebuild: Refreshing state... [id=codebuild-ooniapi-ooniauth]
module.testlists_builder.aws_iam_role.codebuild: Refreshing state... [id=codebuild-oonidkr-testlists]
module.ooniapi_ooniprobe_deployer.aws_codebuild_project.ooniapi: Refreshing state... [id=arn:aws:codebuild:eu-central-1:905418398257:project/ooniapi-ooniprobe]
module.ooniapi_oonimeasurements_deployer.aws_codebuild_project.ooniapi: Refreshing state... [id=arn:aws:codebuild:eu-central-1:905418398257:project/ooniapi-oonimeasurements]
module.ooniapi_oonifindings_deployer.aws_codebuild_project.ooniapi: Refreshing state... [id=arn:aws:codebuild:eu-central-1:905418398257:project/ooniapi-oonifindings]
module.fastpath_builder.aws_codebuild_project.oonidkr: Refreshing state... [id=arn:aws:codebuild:eu-central-1:905418398257:project/oonidkr-fastpath]
module.ooniapi_reverseproxy_deployer.aws_codebuild_project.ooniapi: Refreshing state... [id=arn:aws:codebuild:eu-central-1:905418398257:project/ooniapi-reverseproxy]
module.ooniapi_oonirun_deployer.aws_codebuild_project.ooniapi: Refreshing state... [id=arn:aws:codebuild:eu-central-1:905418398257:project/ooniapi-oonirun]
module.ooniapi_ooniauth_deployer.aws_codebuild_project.ooniapi: Refreshing state... [id=arn:aws:codebuild:eu-central-1:905418398257:project/ooniapi-ooniauth]
module.testlists_builder.aws_codebuild_project.oonidkr: Refreshing state... [id=arn:aws:codebuild:eu-central-1:905418398257:project/oonidkr-testlists]
module.network.aws_internet_gateway.gw: Refreshing state... [id=igw-0c080e9b235ed29d1]
aws_security_group.elasticache_sg: Refreshing state... [id=sg-071f88ba24fb3d6ed]
module.ooni_clickhouse_proxy.aws_alb_target_group.ooni_ec2: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/oockpr20250116192249626700000002/2e9dada4dd22c268]
module.ooni_clickhouse_proxy.aws_security_group.ec2_sg: Refreshing state... [id=sg-0903c108a44c922a5]
module.ooniapi_cluster.aws_security_group.web: Refreshing state... [id=sg-0187eedfe39538357]
module.ooni_monitoring_proxy.aws_security_group.ec2_sg: Refreshing state... [id=sg-00c4199ae6a658579]
module.ooni_monitoring_proxy.aws_alb_target_group.ooni_ec2: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/oomnpr20250423083217708600000002/90babad6f0c8b903]
module.ooniapi_ooniauth.aws_alb_target_group.ooniapi_service: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/OautM-20250115122624347200000004/6e746a968782a49f]
module.ooni_anonc.aws_alb_target_group.ooni_ec2: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/ooanon20251003085918842900000002/3d14866336282a65]
module.ooni_anonc.aws_security_group.ec2_sg: Refreshing state... [id=sg-063668ca077d07d17]
module.ooniapi_oonirun.aws_alb_target_group.ooniapi_service: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/OrunM-20250115122624347100000003/17e1664b99b708a5]
module.oonitier1plus_cluster.aws_security_group.web: Refreshing state... [id=sg-07090c14e80a5def2]
module.ooniapi_ooniprobe.aws_alb_target_group.ooniapi_service: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/OproM-20250115122624346700000001/9f9264a4e53931d3]
module.ooniapi_reverseproxy.aws_alb_target_group.ooniapi_service: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/OrevM-20250115122624347000000002/32c2f9b4e4d3b8c4]
module.ooni_jumphost.aws_security_group.ec2_sg: Refreshing state... [id=sg-0ee46dd91ace739e1]
module.ooni_jumphost.aws_alb_target_group.ooni_ec2: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/oojump20251216144624441200000002/52a32be88e2fcac5]
module.ooniapi_oonifindings.aws_alb_target_group.ooniapi_service: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/OfinM-20250115122624350600000005/ad715c6e26dd616c]
module.ooniapi_oonimeasurements.aws_alb_target_group.ooniapi_service: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/OmeaM-20250116160254864500000001/4d88cb32eb2f381c]
module.ooniapi_testlists.aws_security_group.ec2_sg: Refreshing state... [id=sg-031fd5ff750f4c94b]
module.ooniapi_testlists.aws_alb_target_group.ooni_ec2: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/ootstl20260302133704045300000001/4892b94962057fea]
module.network.aws_route_table.public: Refreshing state... [id=rtb-0ccb0852e6a365a95]
module.fastpath_builder.aws_codepipeline.oonidkr: Refreshing state... [id=oonidkr-fastpath]
module.network.aws_route_table.private: Refreshing state... [id=rtb-011463437da96c77b]
module.network.aws_subnet.private[0]: Refreshing state... [id=subnet-09314a43ec89d6331]
module.network.aws_subnet.public[1]: Refreshing state... [id=subnet-0b18966cccfc9d5ef]
module.network.aws_subnet.private[1]: Refreshing state... [id=subnet-0b899a7ad10406d06]
module.network.aws_subnet.public[0]: Refreshing state... [id=subnet-0e7a4478be988463f]
module.testlists_builder.aws_codepipeline.oonidkr: Refreshing state... [id=oonidkr-testlists]
module.ooni_clickhouse_proxy.aws_security_group_rule.ec2_sg_egress[1]: Refreshing state... [id=sgrule-1281654482]
module.ooni_clickhouse_proxy.aws_security_group_rule.ec2_sg_egress[0]: Refreshing state... [id=sgrule-1099643652]
module.ooni_monitoring_proxy.aws_security_group_rule.ec2_sg_egress[0]: Refreshing state... [id=sgrule-4288788045]
module.ooni_monitoring_proxy.aws_security_group_rule.ec2_sg_egress[1]: Refreshing state... [id=sgrule-3806784481]
module.ooni_fastpath.module.ec2.aws_security_group.ec2_sg: Refreshing state... [id=sg-03507eea1e0e5bb0c]
module.ooni_monitoring_proxy.aws_security_group_rule.ec2_sg_ingress[3]: Refreshing state... [id=sgrule-1109732603]
module.ooni_monitoring_proxy.aws_security_group_rule.ec2_sg_ingress[0]: Refreshing state... [id=sgrule-2756751855]
module.ooni_monitoring_proxy.aws_security_group_rule.ec2_sg_ingress[1]: Refreshing state... [id=sgrule-316337242]
module.ooni_monitoring_proxy.aws_security_group_rule.ec2_sg_ingress[2]: Refreshing state... [id=sgrule-2383513485]
module.ooni_fastpath.module.ec2.aws_alb_target_group.ooni_ec2: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/oofstp20260423110252291900000001/63d84df4b8ea92a9]
module.ooni_anonc.aws_security_group_rule.ec2_sg_egress[0]: Refreshing state... [id=sgrule-3803885271]
module.ooni_anonc.aws_security_group_rule.ec2_sg_egress[1]: Refreshing state... [id=sgrule-2372809180]
module.ooni_jumphost.aws_security_group_rule.ec2_sg_egress[0]: Refreshing state... [id=sgrule-844844036]
module.ooni_jumphost.aws_security_group_rule.ec2_sg_egress[1]: Refreshing state... [id=sgrule-780291060]
module.terraform_state_backend.aws_s3_bucket_public_access_block.default[0]: Refreshing state... [id=oonidevops-dev-terraform-state]
module.terraform_state_backend.aws_s3_bucket_server_side_encryption_configuration.default[0]: Refreshing state... [id=oonidevops-dev-terraform-state]
module.terraform_state_backend.aws_s3_bucket_versioning.default[0]: Refreshing state... [id=oonidevops-dev-terraform-state]
module.ooniapi_ooniauth.aws_ecs_service.ooniapi_service: Refreshing state... [id=arn:aws:ecs:eu-central-1:905418398257:service/ooniapi-ecs-cluster/ooniapi-service-ooniauth]
module.ooniapi_oonirun.aws_ecs_service.ooniapi_service: Refreshing state... [id=arn:aws:ecs:eu-central-1:905418398257:service/ooniapi-ecs-cluster/ooniapi-service-oonirun]
module.ooniapi_reverseproxy.aws_ecs_service.ooniapi_service: Refreshing state... [id=arn:aws:ecs:eu-central-1:905418398257:service/ooniapi-ecs-cluster/ooniapi-service-reverseproxy]
module.ooniapi_testlists.aws_security_group_rule.ec2_sg_egress[0]: Refreshing state... [id=sgrule-3440521332]
module.ooniapi_testlists.aws_security_group_rule.ec2_sg_egress[1]: Refreshing state... [id=sgrule-1726180651]
module.ooniapi_oonifindings.aws_ecs_service.ooniapi_service: Refreshing state... [id=arn:aws:ecs:eu-central-1:905418398257:service/ooniapi-ecs-cluster/ooniapi-service-oonifindings]
module.network.aws_route_table_association.private[0]: Refreshing state... [id=rtbassoc-0e7933e6b804ff2c1]
module.network.aws_route_table_association.private[1]: Refreshing state... [id=rtbassoc-0c9cc0f117ef15fe7]
module.network.aws_route_table_association.public[0]: Refreshing state... [id=rtbassoc-0dbd7fb16801ee049]
module.network.aws_route_table_association.public[1]: Refreshing state... [id=rtbassoc-08ab18165bf481054]
module.ooni_fastpath.module.ec2.aws_security_group_rule.ec2_sg_egress[0]: Refreshing state... [id=sgrule-3915082054]
module.ooni_fastpath.module.ec2.aws_security_group_rule.ec2_sg_egress[1]: Refreshing state... [id=sgrule-2098199074]
module.terraform_state_backend.aws_s3_bucket_policy.default[0]: Refreshing state... [id=oonidevops-dev-terraform-state]
module.ooniapi_cluster.aws_security_group.container_host: Refreshing state... [id=sg-0aa6a97400b619de3]
module.oonitier1plus_cluster.aws_security_group.container_host: Refreshing state... [id=sg-0e74a206196727883]
aws_elasticache_serverless_cache.ooniapi: Refreshing state... [id=ooniapi-dev-cache]
aws_security_group_rule.elasticache_sg_rule: Refreshing state... [id=sgrule-1589925589]
module.oonipg.aws_security_group.pg: Refreshing state... [id=sg-005ca579eb9c08cda]
module.ooni_monitoring_proxy.aws_launch_template.ooni_ec2: Refreshing state... [id=lt-0c9dddb576a4f71a3]
module.ooniapi_testlists.aws_launch_template.ooni_ec2: Refreshing state... [id=lt-01d0fc9e7bff14cac]
module.oonipg.aws_db_subnet_group.pg: Refreshing state... [id=ooni-tier0-postgres-dbsng]
module.ooniapi_frontend.aws_alb.ooniapi: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:loadbalancer/app/ooni-api-frontend/4a50f3dd46584390]
module.ooni_jumphost.aws_launch_template.ooni_ec2: Refreshing state... [id=lt-093e415469bef9855]
module.ooni_clickhouse_proxy.aws_launch_template.ooni_ec2: Refreshing state... [id=lt-0855bc6373ff4c75b]
module.ooni_anonc.aws_launch_template.ooni_ec2: Refreshing state... [id=lt-097d2fb5eb0bf4559]
module.terraform_state_backend.time_sleep.wait_for_aws_s3_bucket_settings[0]: Refreshing state... [id=2024-03-10T15:06:17Z]
module.ooniapi_cluster.aws_launch_template.container_host: Refreshing state... [id=lt-0e328a8671f870c64]
module.oonitier1plus_cluster.aws_launch_template.container_host: Refreshing state... [id=lt-0eb432177b5a9f2aa]
module.ooni_fastpath.module.ec2.aws_launch_template.ooni_ec2: Refreshing state... [id=lt-04f17f1d49bea5597]
module.ooniapi_ooniauth_deployer.aws_codepipeline.ooniapi: Refreshing state... [id=ooniapi-ooniauth]
module.ooniapi_oonirun_deployer.aws_codepipeline.ooniapi: Refreshing state... [id=ooniapi-oonirun]
module.terraform_state_backend.aws_s3_bucket_ownership_controls.default[0]: Refreshing state... [id=oonidevops-dev-terraform-state]
module.ooniapi_reverseproxy_deployer.aws_codepipeline.ooniapi: Refreshing state... [id=ooniapi-reverseproxy]
module.ooni_monitoring_proxy.aws_instance.ooni_ec2: Refreshing state... [id=i-067b337ada2d9cc00]
module.ooniapi_testlists.aws_instance.ooni_ec2: Refreshing state... [id=i-07217491c5a2f9d77]
module.ooni_jumphost.aws_instance.ooni_ec2: Refreshing state... [id=i-0ab8df111ab0fa5a3]
module.ooni_clickhouse_proxy.aws_instance.ooni_ec2: Refreshing state... [id=i-0757310827bc642fa]
module.ooni_anonc.aws_instance.ooni_ec2: Refreshing state... [id=i-058b0fd97a772f7e1]
module.ooniapi_frontend.aws_alb_listener.ooniapi_listener_http: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener/app/ooni-api-frontend/4a50f3dd46584390/664a34cfb30f72e8]
module.ooniapi_frontend.aws_alb_listener.ooniapi_listener_https: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45]
module.ooniapi_oonifindings_deployer.aws_codepipeline.ooniapi: Refreshing state... [id=ooniapi-oonifindings]
module.ooniapi_cluster.aws_autoscaling_group.container_host: Refreshing state... [id=ooniapi-ecs-cluster20240310192644083800000003]
module.oonitier1plus_cluster.aws_autoscaling_group.container_host: Refreshing state... [id=oonitier1plus-ecs-cluster20251022145227179100000007]
module.ooni_fastpath.module.ec2.aws_instance.ooni_ec2: Refreshing state... [id=i-0eeb4d9320fc9dd3a]
aws_route53_record.ooniapi_frontend_main: Refreshing state... [id=Z055356431RGCLK3JXZDL_api.dev.ooni.io_A]
aws_route53_record.ooniapi_frontend_alt["ooniauth.dev.ooni.io"]: Refreshing state... [id=Z055356431RGCLK3JXZDL_ooniauth.dev.ooni.io_A]
aws_route53_record.ooniapi_frontend_alt["oonirun.dev.ooni.io"]: Refreshing state... [id=Z055356431RGCLK3JXZDL_oonirun.dev.ooni.io_A]
aws_route53_record.ooniapi_frontend_alt["testlists.dev.ooni.io"]: Refreshing state... [id=Z055356431RGCLK3JXZDL_testlists.dev.ooni.io_A]
aws_route53_record.ooniapi_frontend_alt["oonimeasurements.dev.ooni.io"]: Refreshing state... [id=Z055356431RGCLK3JXZDL_oonimeasurements.dev.ooni.io_A]
aws_route53_record.ooniapi_frontend_alt["8.th.dev.ooni.io"]: Refreshing state... [id=Z055356431RGCLK3JXZDL_8.th.dev.ooni.io_A]
aws_route53_record.ooniapi_frontend_alt["ooniprobe.dev.ooni.io"]: Refreshing state... [id=Z055356431RGCLK3JXZDL_ooniprobe.dev.ooni.io_A]
module.oonipg.aws_db_instance.pg: Refreshing state... [id=db-27N7Q6XIBNASFCOXN4N7C762L4]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_ooniprobe_rule_2: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/5f2394ffa8b71f98]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_oonifindings_rule: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/36d49e835c0b81c5]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_oonimeasurements_rule_1[0]: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/1cf3d6a7a694eec9]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_oonirun_rule_host: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/9af03e886f8803f2]
module.ooniapi_frontend.aws_alb_listener_rule.ooniapi_th: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/775cd6d0dc062fd3]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_testlists_rule[0]: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/2864c2a72dfd4018]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_oonirun_rule: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/cc29701b6ed6aa2e]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_ooniprobe_rule: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/82069bb29bca6af1]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_oonimeasurements_rule_2[0]: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/e6dbe09be108b001]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_oonimeasurements_rule_host[0]: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/f3d75d5d93fd6903]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_ooniprobe_rule_4: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/6026e8ac5ba962ec]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_ooniauth_rule_host: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/f4bf91203c7ca76e]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_oonimeasurements_rule_3: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/48b97ed405c9c6cc]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_ooniprobe_rule_3: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/e57ed4ddc7991afe]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_oonifindings_rule_host: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/54cda6e694a0103f]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_ooniprobe_rule_host: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/583471b0bdc1c388]
module.ooniapi_frontend.aws_lb_listener_rule.ooniapi_ooniauth_rule: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:listener-rule/app/ooni-api-frontend/4a50f3dd46584390/9ef650e256f41d45/178511e1b6ae89c5]
module.oonitier1plus_cluster.aws_ecs_capacity_provider.capacity_provider: Refreshing state... [id=arn:aws:ecs:eu-central-1:905418398257:capacity-provider/oonitier1plus-ecs-cluster-capacity-provider]
module.ooniapi_cluster.aws_ecs_capacity_provider.capacity_provider: Refreshing state... [id=arn:aws:ecs:eu-central-1:905418398257:capacity-provider/ooniapi-ecs-cluster-capacity-provider]
module.ooni_anonc.aws_lb_target_group_attachment.oonibackend_proxy: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/ooanon20251003085918842900000002/3d14866336282a65-20251003085941554000000006]
aws_route53_record.postgres_dns: Refreshing state... [id=Z091407123AEJO90Z3H6D_postgres.dev.ooni.nu_CNAME]
data.aws_secretsmanager_secret_version.pg_login: Reading...
aws_route53_record.anonc_alias: Refreshing state... [id=Z055356431RGCLK3JXZDL_anonc.dev.ooni.io_CNAME]
module.oonitier1plus_cluster.aws_ecs_cluster_capacity_providers.cluster_capacity_providers: Refreshing state... [id=oonitier1plus-ecs-cluster]
module.ooniapi_cluster.aws_ecs_cluster_capacity_providers.cluster_capacity_providers: Refreshing state... [id=ooniapi-ecs-cluster]
module.ooni_monitoring_proxy.aws_lb_target_group_attachment.oonibackend_proxy: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/oomnpr20250423083217708600000002/90babad6f0c8b903-20250423083239704200000006]
aws_route53_record.monitoring_proxy_alias: Refreshing state... [id=Z055356431RGCLK3JXZDL_monitoringproxy.dev.ooni.io_CNAME]
data.aws_secretsmanager_secret_version.pg_login: Read complete after 0s [id=arn:aws:secretsmanager:eu-central-1:905418398257:secret:rds!db-5fe27151-3a37-44e0-a5bd-3517363fa2e8-BDI0KI|AWSCURRENT]
aws_secretsmanager_secret_version.oonipg_url: Refreshing state... [id=arn:aws:secretsmanager:eu-central-1:905418398257:secret:oonidevops/ooni-tier0-postgres/postgresql_url-w62CTZ|terraform-20260617094811149900000001]
module.ooniapi_testlists.aws_security_group_rule.ec2_sg_ingress[0]: Refreshing state... [id=sgrule-2460724300]
module.ooniapi_testlists.aws_security_group_rule.ec2_sg_ingress[2]: Refreshing state... [id=sgrule-14456781]
module.ooniapi_testlists.aws_security_group_rule.ec2_sg_ingress[1]: Refreshing state... [id=sgrule-606204409]
module.ooniapi_testlists.aws_security_group_rule.ec2_sg_ingress[3]: Refreshing state... [id=sgrule-2701186690]
module.ooni_anonc.aws_security_group_rule.ec2_sg_ingress[0]: Refreshing state... [id=sgrule-3208669716]
module.ooni_anonc.aws_security_group_rule.ec2_sg_ingress[2]: Refreshing state... [id=sgrule-2843886495]
module.ooni_anonc.aws_security_group_rule.ec2_sg_ingress[3]: Refreshing state... [id=sgrule-3453785268]
module.ooni_anonc.aws_security_group_rule.ec2_sg_ingress[1]: Refreshing state... [id=sgrule-164247457]
module.ooni_jumphost.aws_security_group_rule.ec2_sg_ingress[0]: Refreshing state... [id=sgrule-4143979435]
module.ooni_jumphost.aws_security_group_rule.ec2_sg_ingress[1]: Refreshing state... [id=sgrule-1099580958]
module.ooni_jumphost.aws_security_group_rule.ec2_sg_ingress[2]: Refreshing state... [id=sgrule-1528835277]
module.ooniapi_testlists.aws_lb_target_group_attachment.oonibackend_proxy: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/ootstl20260302133704045300000001/4892b94962057fea-20260302133730682200000008]
module.ooni_jumphost.aws_lb_target_group_attachment.oonibackend_proxy: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/oojump20251216144624441200000002/52a32be88e2fcac5-20251216144651363600000006]
module.ooni_clickhouse_proxy.aws_lb_target_group_attachment.oonibackend_proxy: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/oockpr20250116192249626700000002/2e9dada4dd22c268-20260227131827648300000002]
aws_route53_record.testlists_alias: Refreshing state... [id=Z055356431RGCLK3JXZDL_testlist-ec2.dev.ooni.io_CNAME]
aws_route53_record.jumphost_alias: Refreshing state... [id=Z055356431RGCLK3JXZDL_jumphost.dev.ooni.io_CNAME]
aws_route53_record.clickhouse_proxy_alias: Refreshing state... [id=Z055356431RGCLK3JXZDL_clickhouseproxy.dev.ooni.io_CNAME]
module.ooni_fastpath.module.ec2.aws_security_group_rule.ec2_sg_ingress[1]: Refreshing state... [id=sgrule-2656646093]
module.ooni_fastpath.module.ec2.aws_security_group_rule.ec2_sg_ingress[3]: Refreshing state... [id=sgrule-3011210381]
module.ooni_fastpath.module.ec2.aws_security_group_rule.ec2_sg_ingress[4]: Refreshing state... [id=sgrule-858198288]
module.ooni_fastpath.module.ec2.aws_security_group_rule.ec2_sg_ingress[2]: Refreshing state... [id=sgrule-3549062282]
module.ooni_fastpath.module.ec2.aws_security_group_rule.ec2_sg_ingress[0]: Refreshing state... [id=sgrule-4279797320]
module.ooni_fastpath.module.ec2.aws_lb_target_group_attachment.oonibackend_proxy: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:905418398257:targetgroup/oofstp20260423110252291900000001/63d84df4b8ea92a9-20260423110318998700000007]
module.ooni_fastpath.aws_route53_record.fastpath_alias: Refreshing state... [id=Z055356431RGCLK3JXZDL_fastpath.dev.ooni.io_CNAME]
module.ooni_clickhouse_proxy.aws_security_group_rule.ec2_sg_ingress[1]: Refreshing state... [id=sgrule-3288936075]
module.ooni_clickhouse_proxy.aws_security_group_rule.ec2_sg_ingress[0]: Refreshing state... [id=sgrule-1921217342]
module.ooni_clickhouse_proxy.aws_security_group_rule.ec2_sg_ingress[3]: Refreshing state... [id=sgrule-3953292375]
module.ooni_clickhouse_proxy.aws_security_group_rule.ec2_sg_ingress[2]: Refreshing state... [id=sgrule-3265385170]
module.ooni_clickhouse_proxy.aws_security_group_rule.ec2_sg_ingress[4]: Refreshing state... [id=sgrule-3520426823]
module.ooniapi_ooniprobe.aws_ecs_task_definition.ooniapi_service: Refreshing state... [id=ooniapi-service-ooniprobe-td]
module.ooniapi_ooniprobe.aws_ecs_service.ooniapi_service: Refreshing state... [id=arn:aws:ecs:eu-central-1:905418398257:service/ooniapi-ecs-cluster/ooniapi-service-ooniprobe]
module.ooniapi_ooniprobe_deployer.aws_codepipeline.ooniapi: Refreshing state... [id=ooniapi-ooniprobe]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
  - destroy
 <= read (data resources)

Terraform planned the following actions, but then encountered a problem:

  # data.aws_secretsmanager_secret_version.deploy_key will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_secretsmanager_secret_version" "deploy_key" {
      + arn            = (known after apply)
      + created_date   = (known after apply)
      + id             = (known after apply)
      + secret_binary  = (sensitive value)
      + secret_id      = "arn:aws:secretsmanager:eu-central-1:905418398257:secret:oonidevops/deploy_key-2ebqSe"
      + secret_string  = (sensitive value)
      + version_id     = (known after apply)
      + version_stages = (known after apply)
    }

  # aws_iam_role_policy.reuploader_role will be destroyed
  # (because aws_iam_role_policy.reuploader_role is not in configuration)
  - resource "aws_iam_role_policy" "reuploader_role" {
      - id          = "scheduled-service-reuploader-task-role:oonidevops-dev-task-role" -> null
      - name        = "oonidevops-dev-task-role" -> null
      - policy      = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "s3:GetObject",
                        ]
                      - Effect   = "Allow"
                      - Resource = "arn:aws:s3:::ooniprobe-failed-reports-eu-central-1/*"
                      - Sid      = ""
                    },
                  - {
                      - Action   = [
                          - "s3:ListBucket",
                        ]
                      - Effect   = "Allow"
                      - Resource = "arn:aws:s3:::ooniprobe-failed-reports-eu-central-1"
                      - Sid      = ""
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - role        = "scheduled-service-reuploader-task-role" -> null
        # (1 unchanged attribute hidden)
    }

  # module.adm_iam_roles.aws_iam_policy.oonidevops will be updated in-place
  ~ resource "aws_iam_policy" "oonidevops" {
        id               = "arn:aws:iam::905418398257:policy/OONIDevopsPolicy"
        name             = "OONIDevopsPolicy"
      ~ policy           = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Action   = [
                            # (33 unchanged elements hidden)
                            "glue:*",
                          - "events:*",
                        ]
                        # (2 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        tags             = {}
        # (7 unchanged attributes hidden)
    }

  # module.ooni_th_droplet.data.cloudinit_config.ooni_th_docker will be read during apply
  # (config refers to values not yet known)
 <= data "cloudinit_config" "ooni_th_docker" {
      + base64_encode = false
      + boundary      = (known after apply)
      + gzip          = false
      + id            = (known after apply)
      + rendered      = (known after apply)

      + part {
          + content      = (sensitive value)
          + content_type = "text/cloud-config"
          + filename     = "init.cfg"
        }
    }

  # module.ooniapi_cluster.aws_launch_template.container_host will be updated in-place
  ~ resource "aws_launch_template" "container_host" {
      ~ default_version                      = 89 -> (known after apply)
        id                                   = "lt-0e328a8671f870c64"
      ~ image_id                             = (sensitive value)
      ~ latest_version                       = 89 -> (known after apply)
        name                                 = "ooniapi-ecs-cluster20240310192643664900000001"
        tags                                 = {}
        # (16 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # module.oonitier1plus_cluster.aws_launch_template.container_host will be updated in-place
  ~ resource "aws_launch_template" "container_host" {
      ~ default_version                      = 24 -> (known after apply)
        id                                   = "lt-0eb432177b5a9f2aa"
      ~ image_id                             = (sensitive value)
      ~ latest_version                       = 24 -> (known after apply)
        name                                 = "oonitier1plus-ecs-cluster20251022145221257700000004"
        tags                                 = {}
        # (16 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # module.reuploader.aws_cloudwatch_log_group.scheduled_service will be destroyed
  # (because aws_cloudwatch_log_group.scheduled_service is not in configuration)
  - resource "aws_cloudwatch_log_group" "scheduled_service" {
      - arn               = "arn:aws:logs:eu-central-1:905418398257:log-group:ooni-ecs-group/scheduled-service-reuploader" -> null
      - id                = "ooni-ecs-group/scheduled-service-reuploader" -> null
      - log_group_class   = "STANDARD" -> null
      - name              = "ooni-ecs-group/scheduled-service-reuploader" -> null
      - retention_in_days = 0 -> null
      - skip_destroy      = false -> null
      - tags              = {} -> null
      - tags_all          = {} -> null
        # (2 unchanged attributes hidden)
    }

  # module.reuploader.aws_ecs_task_definition.scheduled_service will be destroyed
  # (because aws_ecs_task_definition.scheduled_service is not in configuration)
  - resource "aws_ecs_task_definition" "scheduled_service" {
      - arn                      = "arn:aws:ecs:eu-central-1:905418398257:task-definition/scheduled-service-reuploader-td:12" -> null
      - arn_without_revision     = "arn:aws:ecs:eu-central-1:905418398257:task-definition/scheduled-service-reuploader-td" -> null
      - container_definitions    = jsonencode(
            [
              - {
                  - environment       = [
                      - {
                          - name  = "AWS_REGION"
                          - value = "eu-central-1"
                        },
                      - {
                          - name  = "BATCH_SIZE"
                          - value = "10"
                        },
                      - {
                          - name  = "DRY_RUN"
                          - value = "true"
                        },
                      - {
                          - name  = "FASTPATH_API"
                          - value = "http://10.0.0.78:8472"
                        },
                      - {
                          - name  = "S3_BUCKET_NAME"
                          - value = "ooniprobe-failed-reports-eu-central-1"
                        },
                    ]
                  - essential         = true
                  - image             = "ooni/reuploader:20260617-8b35a38f"
                  - logConfiguration  = {
                      - logDriver = "awslogs"
                      - options   = {
                          - awslogs-group  = "ooni-ecs-group/scheduled-service-reuploader"
                          - awslogs-region = "eu-central-1"
                        }
                    }
                  - memory            = 1024
                  - memoryReservation = 256
                  - mountPoints       = []
                  - name              = "scheduled-service-reuploader"
                  - portMappings      = []
                  - secrets           = []
                  - systemControls    = []
                  - volumesFrom       = []
                },
            ]
        ) -> null
      - enable_fault_injection   = false -> null
      - execution_role_arn       = "arn:aws:iam::905418398257:role/scheduled-service-reuploader-task-role" -> null
      - family                   = "scheduled-service-reuploader-td" -> null
      - id                       = "scheduled-service-reuploader-td" -> null
      - network_mode             = "bridge" -> null
      - requires_compatibilities = [] -> null
      - revision                 = 12 -> null
      - skip_destroy             = false -> null
      - tags                     = {
          - "Environment" = "dev"
          - "Name"        = "ooni-tier0-reuploader"
          - "Repository"  = "https://github.com/ooni/devops"
        } -> null
      - tags_all                 = {
          - "Environment" = "dev"
          - "Name"        = "ooni-tier0-reuploader"
          - "Repository"  = "https://github.com/ooni/devops"
        } -> null
      - task_role_arn            = "arn:aws:iam::905418398257:role/scheduled-service-reuploader-task-role" -> null
      - track_latest             = true -> null
        # (4 unchanged attributes hidden)
    }

  # module.reuploader.aws_iam_role.events_run_task will be destroyed
  # (because aws_iam_role.events_run_task is not in configuration)
  - resource "aws_iam_role" "events_run_task" {
      - arn                   = "arn:aws:iam::905418398257:role/scheduled-service-reuploader-events-run-task-role" -> null
      - assume_role_policy    = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "sts:AssumeRole"
                      - Effect    = "Allow"
                      - Principal = {
                          - Service = "events.amazonaws.com"
                        }
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - create_date           = "2026-06-11T11:11:56Z" -> null
      - force_detach_policies = false -> null
      - id                    = "scheduled-service-reuploader-events-run-task-role" -> null
      - managed_policy_arns   = [] -> null
      - max_session_duration  = 3600 -> null
      - name                  = "scheduled-service-reuploader-events-run-task-role" -> null
      - path                  = "/" -> null
      - tags                  = {
          - "Environment" = "dev"
          - "Name"        = "ooni-tier0-reuploader"
          - "Repository"  = "https://github.com/ooni/devops"
        } -> null
      - tags_all              = {
          - "Environment" = "dev"
          - "Name"        = "ooni-tier0-reuploader"
          - "Repository"  = "https://github.com/ooni/devops"
        } -> null
      - unique_id             = "AROA5FTZELIY7ZPQZTDZ3" -> null
        # (3 unchanged attributes hidden)

      - inline_policy {
          - name   = "scheduled-service-reuploader-events-run-task-policy" -> null
          - policy = jsonencode(
                {
                  - Statement = [
                      - {
                          - Action   = [
                              - "ecs:RunTask",
                              - "iam:PassRole",
                              - "ecs:StartTask",
                              - "ecs:DescribeClusters",
                              - "ecs:DescribeTasks",
                              - "events:TagResource",
                              - "events:PutRule",
                              - "events:PutTargets",
                            ]
                          - Effect   = "Allow"
                          - Resource = "*"
                        },
                    ]
                  - Version   = "2012-10-17"
                }
            ) -> null
        }
    }

  # module.reuploader.aws_iam_role.scheduled_service_task will be destroyed
  # (because aws_iam_role.scheduled_service_task is not in configuration)
  - resource "aws_iam_role" "scheduled_service_task" {
      - arn                   = "arn:aws:iam::905418398257:role/scheduled-service-reuploader-task-role" -> null
      - assume_role_policy    = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "sts:AssumeRole"
                      - Effect    = "Allow"
                      - Principal = {
                          - Service = "ecs-tasks.amazonaws.com"
                        }
                      - Sid       = ""
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - create_date           = "2026-06-11T11:11:56Z" -> null
      - force_detach_policies = false -> null
      - id                    = "scheduled-service-reuploader-task-role" -> null
      - managed_policy_arns   = [] -> null
      - max_session_duration  = 3600 -> null
      - name                  = "scheduled-service-reuploader-task-role" -> null
      - path                  = "/" -> null
      - tags                  = {
          - "Environment" = "dev"
          - "Name"        = "ooni-tier0-reuploader"
          - "Repository"  = "https://github.com/ooni/devops"
        } -> null
      - tags_all              = {
          - "Environment" = "dev"
          - "Name"        = "ooni-tier0-reuploader"
          - "Repository"  = "https://github.com/ooni/devops"
        } -> null
      - unique_id             = "AROA5FTZELIY4XYOFTSHS" -> null
        # (3 unchanged attributes hidden)

      - inline_policy {
          - name   = "oonidevops-dev-task-role" -> null
          - policy = jsonencode(
                {
                  - Statement = [
                      - {
                          - Action   = [
                              - "s3:GetObject",
                            ]
                          - Effect   = "Allow"
                          - Resource = "arn:aws:s3:::ooniprobe-failed-reports-eu-central-1/*"
                          - Sid      = ""
                        },
                      - {
                          - Action   = [
                              - "s3:ListBucket",
                            ]
                          - Effect   = "Allow"
                          - Resource = "arn:aws:s3:::ooniprobe-failed-reports-eu-central-1"
                          - Sid      = ""
                        },
                    ]
                  - Version   = "2012-10-17"
                }
            ) -> null
        }
      - inline_policy {
          - name   = "scheduled-service-reuploader-task-role" -> null
          - policy = jsonencode(
                {
                  - Statement = [
                      - {
                          - Action   = [
                              - "ecs:DeregisterContainerInstance",
                              - "ecs:DiscoverPollEndpoint",
                              - "ecs:Poll",
                              - "ecs:RegisterContainerInstance",
                              - "ecs:Submit*",
                              - "ecs:StartTelemetrySession",
                            ]
                          - Effect   = "Allow"
                          - Resource = [
                              - "*",
                            ]
                          - Sid      = "ecsInstanceRole"
                        },
                      - {
                          - Action   = [
                              - "logs:*",
                              - "cloudwatch:GenerateQuery",
                            ]
                          - Effect   = "Allow"
                          - Resource = "*"
                          - Sid      = "CloudWatchLogsFullAccess"
                        },
                      - {
                          - Action   = [
                              - "secretsmanager:GetResourcePolicy",
                              - "secretsmanager:GetSecretValue",
                              - "secretsmanager:DescribeSecret",
                              - "secretsmanager:ListSecretVersionIds",
                            ]
                          - Effect   = "Allow"
                          - Resource = "*"
                        },
                      - {
                          - Action   = "secretsmanager:ListSecrets"
                          - Effect   = "Allow"
                          - Resource = "*"
                        },
                      - {
                          - Action   = [
                              - "ssm:GetParameter",
                              - "ssm:GetParameters",
                              - "ssm:GetParameterHistory",
                              - "ssm:GetParametersByPath",
                            ]
                          - Effect   = "Allow"
                          - Resource = "arn:aws:ssm:*"
                        },
                      - {
                          - Action   = [
                              - "ec2:Describe*",
                              - "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
                              - "elasticloadbalancing:DeregisterTargets",
                              - "elasticloadbalancing:Describe*",
                              - "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
                              - "elasticloadbalancing:RegisterTargets",
                            ]
                          - Effect   = "Allow"
                          - Resource = "*"
                        },
                      - {
                          - Action   = [
                              - "events:TagResource",
                              - "events:PutRule",
                              - "events:PutTargets",
                            ]
                          - Effect   = "Allow"
                          - Resource = "*"
                        },
                    ]
                  - Version   = "2012-10-17"
                }
            ) -> null
        }
    }

  # module.reuploader.aws_iam_role_policy.events_run_task_policy will be destroyed
  # (because aws_iam_role_policy.events_run_task_policy is not in configuration)
  - resource "aws_iam_role_policy" "events_run_task_policy" {
      - id          = "scheduled-service-reuploader-events-run-task-role:scheduled-service-reuploader-events-run-task-policy" -> null
      - name        = "scheduled-service-reuploader-events-run-task-policy" -> null
      - policy      = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "ecs:RunTask",
                          - "iam:PassRole",
                          - "ecs:StartTask",
                          - "ecs:DescribeClusters",
                          - "ecs:DescribeTasks",
                          - "events:TagResource",
                          - "events:PutRule",
                          - "events:PutTargets",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - role        = "scheduled-service-reuploader-events-run-task-role" -> null
        # (1 unchanged attribute hidden)
    }

  # module.reuploader.aws_iam_role_policy.scheduled_service_task will be destroyed
  # (because aws_iam_role_policy.scheduled_service_task is not in configuration)
  - resource "aws_iam_role_policy" "scheduled_service_task" {
      - id          = "scheduled-service-reuploader-task-role:scheduled-service-reuploader-task-role" -> null
      - name        = "scheduled-service-reuploader-task-role" -> null
      - policy      = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "ecs:DeregisterContainerInstance",
                          - "ecs:DiscoverPollEndpoint",
                          - "ecs:Poll",
                          - "ecs:RegisterContainerInstance",
                          - "ecs:Submit*",
                          - "ecs:StartTelemetrySession",
                        ]
                      - Effect   = "Allow"
                      - Resource = [
                          - "*",
                        ]
                      - Sid      = "ecsInstanceRole"
                    },
                  - {
                      - Action   = [
                          - "logs:*",
                          - "cloudwatch:GenerateQuery",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                      - Sid      = "CloudWatchLogsFullAccess"
                    },
                  - {
                      - Action   = [
                          - "secretsmanager:GetResourcePolicy",
                          - "secretsmanager:GetSecretValue",
                          - "secretsmanager:DescribeSecret",
                          - "secretsmanager:ListSecretVersionIds",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = "secretsmanager:ListSecrets"
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "ssm:GetParameter",
                          - "ssm:GetParameters",
                          - "ssm:GetParameterHistory",
                          - "ssm:GetParametersByPath",
                        ]
                      - Effect   = "Allow"
                      - Resource = "arn:aws:ssm:*"
                    },
                  - {
                      - Action   = [
                          - "ec2:Describe*",
                          - "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
                          - "elasticloadbalancing:DeregisterTargets",
                          - "elasticloadbalancing:Describe*",
                          - "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
                          - "elasticloadbalancing:RegisterTargets",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "events:TagResource",
                          - "events:PutRule",
                          - "events:PutTargets",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - role        = "scheduled-service-reuploader-task-role" -> null
        # (1 unchanged attribute hidden)
    }

  # module.reuploader_builder.aws_codebuild_project.oonidkr will be destroyed
  # (because aws_codebuild_project.oonidkr is not in configuration)
  - resource "aws_codebuild_project" "oonidkr" {
      - arn                    = "arn:aws:codebuild:eu-central-1:905418398257:project/oonidkr-reuploader" -> null
      - badge_enabled          = false -> null
      - build_timeout          = 60 -> null
      - concurrent_build_limit = 1 -> null
      - encryption_key         = "arn:aws:kms:eu-central-1:905418398257:alias/aws/s3" -> null
      - id                     = "arn:aws:codebuild:eu-central-1:905418398257:project/oonidkr-reuploader" -> null
      - name                   = "oonidkr-reuploader" -> null
      - project_visibility     = "PRIVATE" -> null
      - queued_timeout         = 480 -> null
      - service_role           = "arn:aws:iam::905418398257:role/service-role/codebuild-oonidkr-reuploader" -> null
      - tags                   = {} -> null
      - tags_all               = {} -> null
        # (5 unchanged attributes hidden)

      - artifacts {
          - encryption_disabled    = false -> null
            name                   = null
          - override_artifact_name = false -> null
          - type                   = "NO_ARTIFACTS" -> null
            # (6 unchanged attributes hidden)
        }

      - cache {
          - modes    = [] -> null
          - type     = "NO_CACHE" -> null
            # (1 unchanged attribute hidden)
        }

      - environment {
          - compute_type                = "BUILD_GENERAL1_SMALL" -> null
          - image                       = "aws/codebuild/standard:7.0" -> null
          - image_pull_credentials_type = "CODEBUILD" -> null
          - privileged_mode             = true -> null
          - type                        = "LINUX_CONTAINER" -> null
            # (1 unchanged attribute hidden)

          - environment_variable {
              - name  = "ENV_LABEL" -> null
              - type  = "PLAINTEXT" -> null
              - value = "dev" -> null
            }
        }

      - logs_config {
          - cloudwatch_logs {
              - status      = "ENABLED" -> null
                # (2 unchanged attributes hidden)
            }
          - s3_logs {
              - encryption_disabled = false -> null
              - status              = "DISABLED" -> null
                # (2 unchanged attributes hidden)
            }
        }

      - source {
          - buildspec           = "reuploader/buildspec.yml" -> null
          - git_clone_depth     = 1 -> null
          - insecure_ssl        = false -> null
          - location            = "https://github.com/ooni/backend.git" -> null
          - report_build_status = false -> null
          - type                = "GITHUB" -> null

          - git_submodules_config {
              - fetch_submodules = false -> null
            }
        }
    }

  # module.reuploader_builder.aws_codepipeline.oonidkr will be destroyed
  # (because aws_codepipeline.oonidkr is not in configuration)
  - resource "aws_codepipeline" "oonidkr" {
      - arn            = "arn:aws:codepipeline:eu-central-1:905418398257:oonidkr-reuploader" -> null
      - execution_mode = "SUPERSEDED" -> null
      - id             = "oonidkr-reuploader" -> null
      - name           = "oonidkr-reuploader" -> null
      - pipeline_type  = "V2" -> null
      - role_arn       = "arn:aws:iam::905418398257:role/service-role/codepipeline-oonidkr-reuploader" -> null
      - tags           = {} -> null
      - tags_all       = {} -> null

      - artifact_store {
          - location = "codepipeline-ooniapi-eu-central-1-f148ea7b" -> null
          - type     = "S3" -> null
            # (1 unchanged attribute hidden)
        }

      - stage {
          - name = "Source" -> null

          - action {
              - category           = "Source" -> null
              - configuration      = {
                  - "BranchName"           = "add_fastpath_reuploader"
                  - "ConnectionArn"        = "arn:aws:codestar-connections:eu-central-1:905418398257:connection/6bd492f6-c11d-43ec-92b0-24c47700d528"
                  - "DetectChanges"        = "true"
                  - "FullRepositoryId"     = "ooni/backend"
                  - "OutputArtifactFormat" = "CODEBUILD_CLONE_REF"
                } -> null
              - input_artifacts    = [] -> null
              - name               = "Source" -> null
              - namespace          = "SourceVariables" -> null
              - output_artifacts   = [
                  - "SourceArtifact",
                ] -> null
              - owner              = "AWS" -> null
              - provider           = "CodeStarSourceConnection" -> null
              - region             = "eu-central-1" -> null
              - run_order          = 1 -> null
              - timeout_in_minutes = 0 -> null
              - version            = "1" -> null
                # (1 unchanged attribute hidden)
            }
        }
      - stage {
          - name = "Build" -> null

          - action {
              - category           = "Build" -> null
              - configuration      = {
                  - "ProjectName" = "oonidkr-reuploader"
                } -> null
              - input_artifacts    = [
                  - "SourceArtifact",
                ] -> null
              - name               = "Build" -> null
              - namespace          = "BuildVariables" -> null
              - output_artifacts   = [
                  - "BuildArtifact",
                ] -> null
              - owner              = "AWS" -> null
              - provider           = "CodeBuild" -> null
              - region             = "eu-central-1" -> null
              - run_order          = 1 -> null
              - timeout_in_minutes = 0 -> null
              - version            = "1" -> null
                # (1 unchanged attribute hidden)
            }
        }

      - trigger {
          - provider_type = "CodeStarSourceConnection" -> null

          - git_configuration {
              - source_action_name = "Source" -> null

              - push {
                  - branches {
                      - excludes = [] -> null
                      - includes = [
                          - "add_fastpath_reuploader",
                        ] -> null
                    }
                  - file_paths {
                      - excludes = [
                          - "**/README.md",
                        ] -> null
                      - includes = [
                          - "reuploader/**",
                        ] -> null
                    }
                }
            }
        }
    }

  # module.reuploader_builder.aws_iam_policy.codebuild will be destroyed
  # (because aws_iam_policy.codebuild is not in configuration)
  - resource "aws_iam_policy" "codebuild" {
      - arn              = "arn:aws:iam::905418398257:policy/service-role/codebuild-reuploader-eu-central-1" -> null
      - attachment_count = 1 -> null
      - description      = "Policy used in trust relationship with CodeBuild" -> null
      - id               = "arn:aws:iam::905418398257:policy/service-role/codebuild-reuploader-eu-central-1" -> null
      - name             = "codebuild-reuploader-eu-central-1" -> null
      - path             = "/service-role/" -> null
      - policy           = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "logs:CreateLogGroup",
                          - "logs:CreateLogStream",
                          - "logs:PutLogEvents",
                        ]
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:logs:eu-central-1:905418398257:log-group:/aws/codebuild/oonidkr-reuploader",
                          - "arn:aws:logs:eu-central-1:905418398257:log-group:/aws/codebuild/oonidkr-reuploader:*",
                        ]
                    },
                  - {
                      - Action   = [
                          - "s3:PutObject",
                          - "s3:GetObject",
                          - "s3:GetObjectVersion",
                          - "s3:GetBucketAcl",
                          - "s3:GetBucketLocation",
                        ]
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:s3:::codepipeline-ooniapi-eu-central-1-*",
                        ]
                    },
                  - {
                      - Action   = [
                          - "ssmmessages:CreateControlChannel",
                          - "ssmmessages:CreateDataChannel",
                          - "ssmmessages:OpenControlChannel",
                          - "ssmmessages:OpenDataChannel",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "codebuild:CreateReportGroup",
                          - "codebuild:CreateReport",
                          - "codebuild:UpdateReport",
                          - "codebuild:BatchPutTestCases",
                          - "codebuild:BatchPutCodeCoverages",
                        ]
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:codebuild:eu-central-1:905418398257:report-group/oonidkr-reuploader-*",
                        ]
                    },
                  - {
                      - Action   = "codestar-connections:UseConnection"
                      - Effect   = "Allow"
                      - Resource = "arn:aws:codestar-connections:eu-central-1:905418398257:connection/6bd492f6-c11d-43ec-92b0-24c47700d528"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - policy_id        = "ANPA5FTZELIY4OMLUI6OB" -> null
      - tags             = {} -> null
      - tags_all         = {} -> null
        # (1 unchanged attribute hidden)
    }

  # module.reuploader_builder.aws_iam_policy.codepipeline will be destroyed
  # (because aws_iam_policy.codepipeline is not in configuration)
  - resource "aws_iam_policy" "codepipeline" {
      - arn              = "arn:aws:iam::905418398257:policy/service-role/codepipeline-oonidkr-reuploader" -> null
      - attachment_count = 1 -> null
      - description      = "Policy used in trust relationship with CodePipeline" -> null
      - id               = "arn:aws:iam::905418398257:policy/service-role/codepipeline-oonidkr-reuploader" -> null
      - name             = "codepipeline-oonidkr-reuploader" -> null
      - path             = "/service-role/" -> null
      - policy           = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = [
                          - "iam:PassRole",
                        ]
                      - Condition = {
                          - StringEqualsIfExists = {
                              - "iam:PassedToService" = [
                                  - "cloudformation.amazonaws.com",
                                  - "elasticbeanstalk.amazonaws.com",
                                  - "ec2.amazonaws.com",
                                  - "ecs-tasks.amazonaws.com",
                                ]
                            }
                        }
                      - Effect    = "Allow"
                      - Resource  = "*"
                    },
                  - {
                      - Action   = [
                          - "codecommit:CancelUploadArchive",
                          - "codecommit:GetBranch",
                          - "codecommit:GetCommit",
                          - "codecommit:GetRepository",
                          - "codecommit:GetUploadArchiveStatus",
                          - "codecommit:UploadArchive",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "codedeploy:CreateDeployment",
                          - "codedeploy:GetApplication",
                          - "codedeploy:GetApplicationRevision",
                          - "codedeploy:GetDeployment",
                          - "codedeploy:GetDeploymentConfig",
                          - "codedeploy:RegisterApplicationRevision",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "codestar-connections:UseConnection",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "elasticbeanstalk:*",
                          - "ec2:*",
                          - "elasticloadbalancing:*",
                          - "autoscaling:*",
                          - "cloudwatch:*",
                          - "s3:*",
                          - "sns:*",
                          - "cloudformation:*",
                          - "rds:*",
                          - "sqs:*",
                          - "ecs:*",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "lambda:InvokeFunction",
                          - "lambda:ListFunctions",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "opsworks:CreateDeployment",
                          - "opsworks:DescribeApps",
                          - "opsworks:DescribeCommands",
                          - "opsworks:DescribeDeployments",
                          - "opsworks:DescribeInstances",
                          - "opsworks:DescribeStacks",
                          - "opsworks:UpdateApp",
                          - "opsworks:UpdateStack",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "cloudformation:CreateStack",
                          - "cloudformation:DeleteStack",
                          - "cloudformation:DescribeStacks",
                          - "cloudformation:UpdateStack",
                          - "cloudformation:CreateChangeSet",
                          - "cloudformation:DeleteChangeSet",
                          - "cloudformation:DescribeChangeSet",
                          - "cloudformation:ExecuteChangeSet",
                          - "cloudformation:SetStackPolicy",
                          - "cloudformation:ValidateTemplate",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "codebuild:BatchGetBuilds",
                          - "codebuild:StartBuild",
                          - "codebuild:BatchGetBuildBatches",
                          - "codebuild:StartBuildBatch",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "devicefarm:ListProjects",
                          - "devicefarm:ListDevicePools",
                          - "devicefarm:GetRun",
                          - "devicefarm:GetUpload",
                          - "devicefarm:CreateUpload",
                          - "devicefarm:ScheduleRun",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "servicecatalog:ListProvisioningArtifacts",
                          - "servicecatalog:CreateProvisioningArtifact",
                          - "servicecatalog:DescribeProvisioningArtifact",
                          - "servicecatalog:DeleteProvisioningArtifact",
                          - "servicecatalog:UpdateProduct",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "cloudformation:ValidateTemplate",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "ecr:DescribeImages",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "states:DescribeExecution",
                          - "states:DescribeStateMachine",
                          - "states:StartExecution",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                  - {
                      - Action   = [
                          - "appconfig:StartDeployment",
                          - "appconfig:StopDeployment",
                          - "appconfig:GetDeployment",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - policy_id        = "ANPA5FTZELIY2EKKYTPL3" -> null
      - tags             = {} -> null
      - tags_all         = {} -> null
        # (1 unchanged attribute hidden)
    }

  # module.reuploader_builder.aws_iam_role.codebuild will be destroyed
  # (because aws_iam_role.codebuild is not in configuration)
  - resource "aws_iam_role" "codebuild" {
      - arn                   = "arn:aws:iam::905418398257:role/service-role/codebuild-oonidkr-reuploader" -> null
      - assume_role_policy    = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "sts:AssumeRole"
                      - Effect    = "Allow"
                      - Principal = {
                          - Service = "codebuild.amazonaws.com"
                        }
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - create_date           = "2026-06-11T11:11:56Z" -> null
      - force_detach_policies = false -> null
      - id                    = "codebuild-oonidkr-reuploader" -> null
      - managed_policy_arns   = [
          - "arn:aws:iam::905418398257:policy/service-role/codebuild-reuploader-eu-central-1",
          - "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
          - "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
        ] -> null
      - max_session_duration  = 3600 -> null
      - name                  = "codebuild-oonidkr-reuploader" -> null
      - path                  = "/service-role/" -> null
      - tags                  = {} -> null
      - tags_all              = {} -> null
      - unique_id             = "AROA5FTZELIYU7V4RDPS7" -> null
        # (3 unchanged attributes hidden)
    }

  # module.reuploader_builder.aws_iam_role.codepipeline will be destroyed
  # (because aws_iam_role.codepipeline is not in configuration)
  - resource "aws_iam_role" "codepipeline" {
      - arn                   = "arn:aws:iam::905418398257:role/service-role/codepipeline-oonidkr-reuploader" -> null
      - assume_role_policy    = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "sts:AssumeRole"
                      - Effect    = "Allow"
                      - Principal = {
                          - Service = "codepipeline.amazonaws.com"
                        }
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - create_date           = "2026-06-11T11:11:56Z" -> null
      - force_detach_policies = false -> null
      - id                    = "codepipeline-oonidkr-reuploader" -> null
      - managed_policy_arns   = [
          - "arn:aws:iam::905418398257:policy/service-role/codepipeline-oonidkr-reuploader",
        ] -> null
      - max_session_duration  = 3600 -> null
      - name                  = "codepipeline-oonidkr-reuploader" -> null
      - path                  = "/service-role/" -> null
      - tags                  = {} -> null
      - tags_all              = {} -> null
      - unique_id             = "AROA5FTZELIY7XPXXQXQ6" -> null
        # (3 unchanged attributes hidden)
    }

  # module.terraform_state_backend.data.aws_iam_policy_document.aggregated_policy[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "aggregated_policy" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + minified_json             = (known after apply)
      + override_policy_documents = []
      + source_policy_documents   = [
          + (known after apply),
        ]
    }

  # module.terraform_state_backend.data.aws_iam_policy_document.bucket_policy[0] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_iam_policy_document" "bucket_policy" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions   = [
              + "s3:PutObject",
            ]
          + effect    = "Deny"
          + resources = [
              + "arn:aws:s3:::oonidevops-dev-terraform-state/*",
            ]
          + sid       = "DenyIncorrectEncryptionHeader"

          + condition {
              + test     = "StringNotEquals"
              + values   = [
                  + "AES256",
                  + "aws:kms",
                ]
              + variable = "s3:x-amz-server-side-encryption"
            }

          + principals {
              + identifiers = [
                  + "*",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "s3:PutObject",
            ]
          + effect    = "Deny"
          + resources = [
              + "arn:aws:s3:::oonidevops-dev-terraform-state/*",
            ]
          + sid       = "DenyUnEncryptedObjectUploads"

          + condition {
              + test     = "Null"
              + values   = [
                  + "true",
                ]
              + variable = "s3:x-amz-server-side-encryption"
            }

          + principals {
              + identifiers = [
                  + "*",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "s3:*",
            ]
          + effect    = "Deny"
          + resources = [
              + "arn:aws:s3:::oonidevops-dev-terraform-state",
              + "arn:aws:s3:::oonidevops-dev-terraform-state/*",
            ]
          + sid       = "EnforceTlsRequestsOnly"

          + condition {
              + test     = "Bool"
              + values   = [
                  + "false",
                ]
              + variable = "aws:SecureTransport"
            }

          + principals {
              + identifiers = [
                  + "*",
                ]
              + type        = "AWS"
            }
        }
    }

  # module.terraform_state_backend.data.aws_region.current will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_region" "current" {
      + description = (known after apply)
      + endpoint    = (known after apply)
      + id          = (known after apply)
      + name        = (known after apply)
    }

  # module.terraform_state_backend.aws_s3_bucket_policy.default[0] will be updated in-place
  ~ resource "aws_s3_bucket_policy" "default" {
        id     = "oonidevops-dev-terraform-state"
      ~ policy = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "s3:PutObject"
                      - Condition = {
                          - StringNotEquals = {
                              - "s3:x-amz-server-side-encryption" = [
                                  - "AES256",
                                  - "aws:kms",
                                ]
                            }
                        }
                      - Effect    = "Deny"
                      - Principal = {
                          - AWS = "*"
                        }
                      - Resource  = "arn:aws:s3:::oonidevops-dev-terraform-state/*"
                      - Sid       = "DenyIncorrectEncryptionHeader"
                    },
                  - {
                      - Action    = "s3:PutObject"
                      - Condition = {
                          - Null = {
                              - "s3:x-amz-server-side-encryption" = "true"
                            }
                        }
                      - Effect    = "Deny"
                      - Principal = {
                          - AWS = "*"
                        }
                      - Resource  = "arn:aws:s3:::oonidevops-dev-terraform-state/*"
                      - Sid       = "DenyUnEncryptedObjectUploads"
                    },
                  - {
                      - Action    = "s3:*"
                      - Condition = {
                          - Bool = {
                              - "aws:SecureTransport" = "false"
                            }
                        }
                      - Effect    = "Deny"
                      - Principal = {
                          - AWS = "*"
                        }
                      - Resource  = [
                          - "arn:aws:s3:::oonidevops-dev-terraform-state/*",
                          - "arn:aws:s3:::oonidevops-dev-terraform-state",
                        ]
                      - Sid       = "EnforceTlsRequestsOnly"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        # (1 unchanged attribute hidden)
    }

Plan: 0 to add, 4 to change, 13 to destroy.

Warning: Argument is deprecated

  with aws_s3_bucket.anoncred_manifests,
  on main.tf line 260, in resource "aws_s3_bucket" "anoncred_manifests":
 260: resource "aws_s3_bucket" "anoncred_manifests" {

Use the aws_s3_bucket_versioning resource instead

(and 5 more similar warnings elsewhere)

Warning: Deprecated value used

  on ../../modules/ecs_cluster/outputs.tf line 22, in output "container_host_role":
  22:   value = aws_iam_role.container_host

  The deprecation originates from module.ooniapi_cluster.aws_iam_role.container_host.inline_policy

Deprecated resource block "inline_policy" used. Refer to the provider
documentation for details.

(and 7 more similar warnings elsewhere)

Warning: Available Write-only Attribute Alternative

  with module.ooni_monitoring.aws_ssm_parameter.ooni_monitoring_access_key,
  on ../../modules/ooni_monitoring/main.tf line 47, in resource "aws_ssm_parameter" "ooni_monitoring_access_key":
  47:   value = aws_iam_access_key.ooni_monitoring.id

The attribute value has a write-only alternative value_wo available. Use the
write-only alternative of the attribute when possible.

(and one more similar warning elsewhere)
Pusher @aagbsn
Action pull_request
Environment dev
Workflow .github/workflows/check_terraform.yml
Last updated Fri, 19 Jun 2026 10:55:16 GMT

@github-actions

github-actions Bot commented Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Ansible Run Output 🤖

Ansible Playbook Recap 🔍

Ansible playbook output 📖success

Show Execution 

$ ansible-playbook playbook.yml --check --diff -i ../tf/modules/ansible_inventory/inventories/inventory-dev.ini
[WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'
[ERROR]: The role 'geerlingguy.docker' was not found in: /home/runner/work/devops/devops/ansible/roles:/home/runner/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:/home/runner/work/devops/devops/ansible
Origin: /home/runner/work/devops/devops/ansible/deploy-testlists.yml:16:7

14         node_exporter_host: "0.0.0.0"
15         node_exporter_options: ""
16     - role: geerlingguy.docker
         ^ column 7
Pusher @aagbsn
Action pull_request
Working Directory
Workflow .github/workflows/check_ansible.yml
Last updated Fri, 19 Jun 2026 10:55:05 GMT

LDiazN
LDiazN reviewed Jun 17, 2026
View reviewed changes
Comment thread tf/environments/prod/main.tf Outdated
@LDiazN

LDiazN commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Also remember to add this fastpath to monitoring in prometheus:

devops/ansible/roles/prometheus/templates/prometheus.yml

Lines 343 to 348 in bb3d26c

- job_name: "fastpath"
static_configs:
- targets:
- fastpath.dev.ooni.io:9102
- fastpath.prod.ooni.io:9102
- fastpath2.prod.ooni.io:9102

@aagbsn

aagbsn commented Jun 19, 2026

Copy link
Copy Markdown
Contributor Author

Also remember to add this fastpath to monitoring in prometheus:

devops/ansible/roles/prometheus/templates/prometheus.yml

Lines 343 to 348 in bb3d26c

- job_name: "fastpath"
static_configs:
- targets:
- fastpath.dev.ooni.io:9102
- fastpath.prod.ooni.io:9102
- fastpath2.prod.ooni.io:9102

added

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@LDiazN LDiazN LDiazN left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@aagbsn @LDiazN