{
    "format_version": "1.2",
    "terraform_version": "1.15.6",
    "planned_values": {
        "root_module": {
            "resources": [
                {
                    "address": "aws_iam_group.app_group",
                    "mode": "managed",
                    "type": "aws_iam_group",
                    "name": "app_group",
                    "provider_name": "registry.terraform.io/hashicorp/aws",
                    "schema_version": 0,
                    "values": {
                        "name": "app-group",
                        "path": "/"
                    },
                    "sensitive_values": {}
                },
                {
                    "address": "aws_iam_group_policy.app_group_policy",
                    "mode": "managed",
                    "type": "aws_iam_group_policy",
                    "name": "app_group_policy",
                    "provider_name": "registry.terraform.io/hashicorp/aws",
                    "schema_version": 0,
                    "values": {
                        "group": "app-group",
                        "name": "app-group-policy",
                        "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"s3:GetObject\"],\"Effect\":\"Allow\",\"Resource\":\"arn:aws:s3:::my-bucket/*\"}]}"
                    },
                    "sensitive_values": {}
                },
                {
                    "address": "aws_iam_role.app_role",
                    "mode": "managed",
                    "type": "aws_iam_role",
                    "name": "app_role",
                    "provider_name": "registry.terraform.io/hashicorp/aws",
                    "schema_version": 0,
                    "values": {
                        "assume_role_policy": "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ec2.amazonaws.com\"}}],\"Version\":\"2012-10-17\"}",
                        "description": null,
                        "force_detach_policies": false,
                        "max_session_duration": 3600,
                        "name": "app-role",
                        "path": "/",
                        "permissions_boundary": "arn:aws:iam::123456789012:policy/boundary-policy",
                        "tags": null
                    },
                    "sensitive_values": {
                        "inline_policy": [],
                        "managed_policy_arns": [],
                        "tags_all": {}
                    }
                },
                {
                    "address": "aws_iam_role.cross_account_role",
                    "mode": "managed",
                    "type": "aws_iam_role",
                    "name": "cross_account_role",
                    "provider_name": "registry.terraform.io/hashicorp/aws",
                    "schema_version": 0,
                    "values": {
                        "assume_role_policy": "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Condition\":{\"StringEquals\":{\"sts:ExternalId\":\"unique-external-id\"}},\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::999999999999:root\"}}],\"Version\":\"2012-10-17\"}",
                        "description": null,
                        "force_detach_policies": false,
                        "max_session_duration": 3600,
                        "name": "cross-account-role",
                        "path": "/",
                        "permissions_boundary": "arn:aws:iam::123456789012:policy/boundary-policy",
                        "tags": null
                    },
                    "sensitive_values": {
                        "inline_policy": [],
                        "managed_policy_arns": [],
                        "tags_all": {}
                    }
                },
                {
                    "address": "aws_iam_role_policy.scoped_kms",
                    "mode": "managed",
                    "type": "aws_iam_role_policy",
                    "name": "scoped_kms",
                    "provider_name": "registry.terraform.io/hashicorp/aws",
                    "schema_version": 0,
                    "values": {
                        "name": "scoped-kms-policy",
                        "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"kms:Decrypt\"],\"Effect\":\"Allow\",\"Resource\":\"arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd\"}]}",
                        "role": "app-role"
                    },
                    "sensitive_values": {}
                }
            ]
        }
    },
    "resource_changes": [
        {
            "address": "aws_iam_group.app_group",
            "mode": "managed",
            "type": "aws_iam_group",
            "name": "app_group",
            "provider_name": "registry.terraform.io/hashicorp/aws",
            "change": {
                "actions": [
                    "create"
                ],
                "before": null,
                "after": {
                    "name": "app-group",
                    "path": "/"
                },
                "after_unknown": {
                    "arn": true,
                    "id": true,
                    "unique_id": true
                },
                "before_sensitive": false,
                "after_sensitive": {}
            }
        },
        {
            "address": "aws_iam_group_policy.app_group_policy",
            "mode": "managed",
            "type": "aws_iam_group_policy",
            "name": "app_group_policy",
            "provider_name": "registry.terraform.io/hashicorp/aws",
            "change": {
                "actions": [
                    "create"
                ],
                "before": null,
                "after": {
                    "group": "app-group",
                    "name": "app-group-policy",
                    "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"s3:GetObject\"],\"Effect\":\"Allow\",\"Resource\":\"arn:aws:s3:::my-bucket/*\"}]}"
                },
                "after_unknown": {
                    "id": true,
                    "name_prefix": true
                },
                "before_sensitive": false,
                "after_sensitive": {}
            }
        },
        {
            "address": "aws_iam_role.app_role",
            "mode": "managed",
            "type": "aws_iam_role",
            "name": "app_role",
            "provider_name": "registry.terraform.io/hashicorp/aws",
            "change": {
                "actions": [
                    "create"
                ],
                "before": null,
                "after": {
                    "assume_role_policy": "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ec2.amazonaws.com\"}}],\"Version\":\"2012-10-17\"}",
                    "description": null,
                    "force_detach_policies": false,
                    "max_session_duration": 3600,
                    "name": "app-role",
                    "path": "/",
                    "permissions_boundary": "arn:aws:iam::123456789012:policy/boundary-policy",
                    "tags": null
                },
                "after_unknown": {
                    "arn": true,
                    "create_date": true,
                    "id": true,
                    "inline_policy": true,
                    "managed_policy_arns": true,
                    "name_prefix": true,
                    "tags_all": true,
                    "unique_id": true
                },
                "before_sensitive": false,
                "after_sensitive": {
                    "inline_policy": [],
                    "managed_policy_arns": [],
                    "tags_all": {}
                }
            }
        },
        {
            "address": "aws_iam_role.cross_account_role",
            "mode": "managed",
            "type": "aws_iam_role",
            "name": "cross_account_role",
            "provider_name": "registry.terraform.io/hashicorp/aws",
            "change": {
                "actions": [
                    "create"
                ],
                "before": null,
                "after": {
                    "assume_role_policy": "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Condition\":{\"StringEquals\":{\"sts:ExternalId\":\"unique-external-id\"}},\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::999999999999:root\"}}],\"Version\":\"2012-10-17\"}",
                    "description": null,
                    "force_detach_policies": false,
                    "max_session_duration": 3600,
                    "name": "cross-account-role",
                    "path": "/",
                    "permissions_boundary": "arn:aws:iam::123456789012:policy/boundary-policy",
                    "tags": null
                },
                "after_unknown": {
                    "arn": true,
                    "create_date": true,
                    "id": true,
                    "inline_policy": true,
                    "managed_policy_arns": true,
                    "name_prefix": true,
                    "tags_all": true,
                    "unique_id": true
                },
                "before_sensitive": false,
                "after_sensitive": {
                    "inline_policy": [],
                    "managed_policy_arns": [],
                    "tags_all": {}
                }
            }
        },
        {
            "address": "aws_iam_role_policy.scoped_kms",
            "mode": "managed",
            "type": "aws_iam_role_policy",
            "name": "scoped_kms",
            "provider_name": "registry.terraform.io/hashicorp/aws",
            "change": {
                "actions": [
                    "create"
                ],
                "before": null,
                "after": {
                    "name": "scoped-kms-policy",
                    "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"kms:Decrypt\"],\"Effect\":\"Allow\",\"Resource\":\"arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd\"}]}",
                    "role": "app-role"
                },
                "after_unknown": {
                    "id": true,
                    "name_prefix": true
                },
                "before_sensitive": false,
                "after_sensitive": {}
            }
        }
    ],
    "configuration": {
        "provider_config": {
            "aws": {
                "name": "aws",
                "full_name": "registry.terraform.io/hashicorp/aws",
                "version_constraint": "~\u003e 5.0",
                "expressions": {
                    "region": {
                        "constant_value": "ap-south-1"
                    }
                }
            }
        },
        "root_module": {
            "resources": [
                {
                    "address": "aws_iam_group.app_group",
                    "mode": "managed",
                    "type": "aws_iam_group",
                    "name": "app_group",
                    "provider_config_key": "aws",
                    "expressions": {
                        "name": {
                            "constant_value": "app-group"
                        }
                    },
                    "schema_version": 0
                },
                {
                    "address": "aws_iam_group_policy.app_group_policy",
                    "mode": "managed",
                    "type": "aws_iam_group_policy",
                    "name": "app_group_policy",
                    "provider_config_key": "aws",
                    "expressions": {
                        "group": {
                            "references": [
                                "aws_iam_group.app_group.name",
                                "aws_iam_group.app_group"
                            ]
                        },
                        "name": {
                            "constant_value": "app-group-policy"
                        },
                        "policy": {}
                    },
                    "schema_version": 0
                },
                {
                    "address": "aws_iam_role.app_role",
                    "mode": "managed",
                    "type": "aws_iam_role",
                    "name": "app_role",
                    "provider_config_key": "aws",
                    "expressions": {
                        "assume_role_policy": {},
                        "name": {
                            "constant_value": "app-role"
                        },
                        "permissions_boundary": {
                            "constant_value": "arn:aws:iam::123456789012:policy/boundary-policy"
                        }
                    },
                    "schema_version": 0
                },
                {
                    "address": "aws_iam_role.cross_account_role",
                    "mode": "managed",
                    "type": "aws_iam_role",
                    "name": "cross_account_role",
                    "provider_config_key": "aws",
                    "expressions": {
                        "assume_role_policy": {},
                        "name": {
                            "constant_value": "cross-account-role"
                        },
                        "permissions_boundary": {
                            "constant_value": "arn:aws:iam::123456789012:policy/boundary-policy"
                        }
                    },
                    "schema_version": 0
                },
                {
                    "address": "aws_iam_role_policy.scoped_kms",
                    "mode": "managed",
                    "type": "aws_iam_role_policy",
                    "name": "scoped_kms",
                    "provider_config_key": "aws",
                    "expressions": {
                        "name": {
                            "constant_value": "scoped-kms-policy"
                        },
                        "policy": {},
                        "role": {
                            "references": [
                                "aws_iam_role.app_role.name",
                                "aws_iam_role.app_role"
                            ]
                        }
                    },
                    "schema_version": 0
                }
            ]
        }
    },
    "relevant_attributes": [
        {
            "resource": "aws_iam_group.app_group",
            "attribute": [
                "name"
            ]
        },
        {
            "resource": "aws_iam_role.app_role",
            "attribute": [
                "name"
            ]
        }
    ],
    "timestamp": "2026-07-16T09:14:03Z",
    "applyable": true,
    "complete": true,
    "errored": false
}