{ "format_version": "1.2", "terraform_version": "1.15.6", "planned_values": { "root_module": { "resources": [ { "address": "aws_acm_certificate.good_cert", "mode": "managed", "type": "aws_acm_certificate", "name": "good_cert", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "certificate_authority_arn": null, "certificate_body": null, "certificate_chain": null, "domain_name": "good.example.com", "domain_validation_options": [ { "domain_name": "good.example.com" } ], "early_renewal_duration": null, "key_algorithm": "RSA_2048", "private_key": null, "subject_alternative_names": [ "good.example.com" ], "tags": null, "validation_method": "DNS", "validation_option": [] }, "sensitive_values": { "domain_validation_options": [ {} ], "options": [], "private_key": true, "renewal_summary": [], "subject_alternative_names": [ false ], "tags_all": {}, "validation_emails": [], "validation_option": [] } }, { "address": "aws_ebs_default_kms_key.good_ebs_kms", "mode": "managed", "type": "aws_ebs_default_kms_key", "name": "good_ebs_kms", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "key_arn": "arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd" }, "sensitive_values": {} }, { "address": "aws_ebs_encryption_by_default.good_ebs", "mode": "managed", "type": "aws_ebs_encryption_by_default", "name": "good_ebs", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "enabled": true }, "sensitive_values": {} }, { "address": "aws_iam_policy.good_kms_policy", "mode": "managed", "type": "aws_iam_policy", "name": "good_kms_policy", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "description": null, "name": "good-kms-policy", "path": "/", "policy": "{\"Statement\":[{\"Action\":[\"kms:Decrypt\"],\"Effect\":\"Allow\",\"Resource\":\"arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd\"}],\"Version\":\"2012-10-17\"}", "tags": null }, "sensitive_values": { "tags_all": {} } }, { "address": "aws_kms_key.good_key", "mode": "managed", "type": "aws_kms_key", "name": "good_key", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "bypass_policy_lockout_safety_check": false, "custom_key_store_id": null, "customer_master_key_spec": "SYMMETRIC_DEFAULT", "deletion_window_in_days": 30, "description": "good key", "enable_key_rotation": true, "is_enabled": true, "key_usage": "ENCRYPT_DECRYPT", "tags": null, "timeouts": null, "xks_key_id": null }, "sensitive_values": { "tags_all": {} } }, { "address": "aws_kms_key.good_root_key", "mode": "managed", "type": "aws_kms_key", "name": "good_root_key", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "bypass_policy_lockout_safety_check": false, "custom_key_store_id": null, "customer_master_key_spec": "SYMMETRIC_DEFAULT", "deletion_window_in_days": 30, "description": "good root key", "enable_key_rotation": true, "is_enabled": true, "key_usage": "ENCRYPT_DECRYPT", "policy": "{\"Statement\":[{\"Action\":\"kms:*\",\"Condition\":{\"StringEquals\":{\"kms:CallerAccount\":\"123456789012\"}},\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::123456789012:root\"},\"Resource\":\"*\"}],\"Version\":\"2012-10-17\"}", "tags": null, "timeouts": null, "xks_key_id": null }, "sensitive_values": { "tags_all": {} } }, { "address": "aws_s3_bucket.good_bucket", "mode": "managed", "type": "aws_s3_bucket", "name": "good_bucket", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "bucket": "good-ekm-bucket", "force_destroy": false, "tags": null, "timeouts": null }, "sensitive_values": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } }, { "address": "aws_s3_bucket_ownership_controls.good_ownership", "mode": "managed", "type": "aws_s3_bucket_ownership_controls", "name": "good_ownership", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "rule": [ { "object_ownership": "BucketOwnerEnforced" } ] }, "sensitive_values": { "rule": [ {} ] } }, { "address": "aws_s3_bucket_policy.good_policy", "mode": "managed", "type": "aws_s3_bucket_policy", "name": "good_policy", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "policy": "{\"Statement\":[{\"Action\":\"s3:*\",\"Condition\":{\"Bool\":{\"aws:SecureTransport\":\"false\"}},\"Effect\":\"Deny\",\"Principal\":\"*\",\"Resource\":[\"arn:aws:s3:::good-ekm-bucket\",\"arn:aws:s3:::good-ekm-bucket/*\"],\"Sid\":\"DenyNonTLS\"}],\"Version\":\"2012-10-17\"}" }, "sensitive_values": {} }, { "address": "aws_s3_bucket_public_access_block.good_pab", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "good_pab", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true }, "sensitive_values": {} }, { "address": "aws_s3_bucket_server_side_encryption_configuration.good_sse", "mode": "managed", "type": "aws_s3_bucket_server_side_encryption_configuration", "name": "good_sse", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "expected_bucket_owner": null, "rule": [ { "apply_server_side_encryption_by_default": [ { "kms_master_key_id": "arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd", "sse_algorithm": "aws:kms" } ], "bucket_key_enabled": true } ] }, "sensitive_values": { "rule": [ { "apply_server_side_encryption_by_default": [ {} ] } ] } }, { "address": "aws_secretsmanager_secret.good_secret", "mode": "managed", "type": "aws_secretsmanager_secret", "name": "good_secret", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "description": null, "force_overwrite_replica_secret": false, "kms_key_id": null, "name": "good-secret", "recovery_window_in_days": 30, "tags": null }, "sensitive_values": { "replica": [], "tags_all": {} } }, { "address": "aws_secretsmanager_secret_rotation.good_rotation", "mode": "managed", "type": "aws_secretsmanager_secret_rotation", "name": "good_rotation", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 1, "values": { "rotate_immediately": true, "rotation_lambda_arn": "arn:aws:lambda:ap-south-1:123456789012:function:rotate-secret", "rotation_rules": [ { "automatically_after_days": 60, "duration": null, "schedule_expression": null } ], "secret_id": "good-secret" }, "sensitive_values": { "rotation_rules": [ {} ] } } ] } }, "resource_changes": [ { "address": "aws_acm_certificate.good_cert", "mode": "managed", "type": "aws_acm_certificate", "name": "good_cert", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "certificate_authority_arn": null, "certificate_body": null, "certificate_chain": null, "domain_name": "good.example.com", "domain_validation_options": [ { "domain_name": "good.example.com" } ], "early_renewal_duration": null, "key_algorithm": "RSA_2048", "private_key": null, "subject_alternative_names": [ "good.example.com" ], "tags": null, "validation_method": "DNS", "validation_option": [] }, "after_unknown": { "arn": true, "domain_validation_options": [ { "resource_record_name": true, "resource_record_type": true, "resource_record_value": true } ], "id": true, "not_after": true, "not_before": true, "options": true, "pending_renewal": true, "renewal_eligibility": true, "renewal_summary": true, "status": true, "subject_alternative_names": [ false ], "tags_all": true, "type": true, "validation_emails": true, "validation_option": [] }, "before_sensitive": false, "after_sensitive": { "domain_validation_options": [ {} ], "options": [], "private_key": true, "renewal_summary": [], "subject_alternative_names": [ false ], "tags_all": {}, "validation_emails": [], "validation_option": [] } } }, { "address": "aws_ebs_default_kms_key.good_ebs_kms", "mode": "managed", "type": "aws_ebs_default_kms_key", "name": "good_ebs_kms", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "key_arn": "arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd" }, "after_unknown": { "id": true }, "before_sensitive": false, "after_sensitive": {} } }, { "address": "aws_ebs_encryption_by_default.good_ebs", "mode": "managed", "type": "aws_ebs_encryption_by_default", "name": "good_ebs", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "enabled": true }, "after_unknown": { "id": true }, "before_sensitive": false, "after_sensitive": {} } }, { "address": "aws_iam_policy.good_kms_policy", "mode": "managed", "type": "aws_iam_policy", "name": "good_kms_policy", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": null, "name": "good-kms-policy", "path": "/", "policy": "{\"Statement\":[{\"Action\":[\"kms:Decrypt\"],\"Effect\":\"Allow\",\"Resource\":\"arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd\"}],\"Version\":\"2012-10-17\"}", "tags": null }, "after_unknown": { "arn": true, "attachment_count": true, "id": true, "name_prefix": true, "policy_id": true, "tags_all": true }, "before_sensitive": false, "after_sensitive": { "tags_all": {} } } }, { "address": "aws_kms_key.good_key", "mode": "managed", "type": "aws_kms_key", "name": "good_key", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "bypass_policy_lockout_safety_check": false, "custom_key_store_id": null, "customer_master_key_spec": "SYMMETRIC_DEFAULT", "deletion_window_in_days": 30, "description": "good key", "enable_key_rotation": true, "is_enabled": true, "key_usage": "ENCRYPT_DECRYPT", "tags": null, "timeouts": null, "xks_key_id": null }, "after_unknown": { "arn": true, "id": true, "key_id": true, "multi_region": true, "policy": true, "rotation_period_in_days": true, "tags_all": true }, "before_sensitive": false, "after_sensitive": { "tags_all": {} } } }, { "address": "aws_kms_key.good_root_key", "mode": "managed", "type": "aws_kms_key", "name": "good_root_key", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "bypass_policy_lockout_safety_check": false, "custom_key_store_id": null, "customer_master_key_spec": "SYMMETRIC_DEFAULT", "deletion_window_in_days": 30, "description": "good root key", "enable_key_rotation": true, "is_enabled": true, "key_usage": "ENCRYPT_DECRYPT", "policy": "{\"Statement\":[{\"Action\":\"kms:*\",\"Condition\":{\"StringEquals\":{\"kms:CallerAccount\":\"123456789012\"}},\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::123456789012:root\"},\"Resource\":\"*\"}],\"Version\":\"2012-10-17\"}", "tags": null, "timeouts": null, "xks_key_id": null }, "after_unknown": { "arn": true, "id": true, "key_id": true, "multi_region": true, "rotation_period_in_days": true, "tags_all": true }, "before_sensitive": false, "after_sensitive": { "tags_all": {} } } }, { "address": "aws_s3_bucket.good_bucket", "mode": "managed", "type": "aws_s3_bucket", "name": "good_bucket", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "bucket": "good-ekm-bucket", "force_destroy": false, "tags": null, "timeouts": null }, "after_unknown": { "acceleration_status": true, "acl": true, "arn": true, "bucket_domain_name": true, "bucket_prefix": true, "bucket_regional_domain_name": true, "cors_rule": true, "grant": true, "hosted_zone_id": true, "id": true, "lifecycle_rule": true, "logging": true, "object_lock_configuration": true, "object_lock_enabled": true, "policy": true, "region": true, "replication_configuration": true, "request_payer": true, "server_side_encryption_configuration": true, "tags_all": true, "versioning": true, "website": true, "website_domain": true, "website_endpoint": true }, "before_sensitive": false, "after_sensitive": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } } }, { "address": "aws_s3_bucket_ownership_controls.good_ownership", "mode": "managed", "type": "aws_s3_bucket_ownership_controls", "name": "good_ownership", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "rule": [ { "object_ownership": "BucketOwnerEnforced" } ] }, "after_unknown": { "bucket": true, "id": true, "rule": [ {} ] }, "before_sensitive": false, "after_sensitive": { "rule": [ {} ] } } }, { "address": "aws_s3_bucket_policy.good_policy", "mode": "managed", "type": "aws_s3_bucket_policy", "name": "good_policy", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "policy": "{\"Statement\":[{\"Action\":\"s3:*\",\"Condition\":{\"Bool\":{\"aws:SecureTransport\":\"false\"}},\"Effect\":\"Deny\",\"Principal\":\"*\",\"Resource\":[\"arn:aws:s3:::good-ekm-bucket\",\"arn:aws:s3:::good-ekm-bucket/*\"],\"Sid\":\"DenyNonTLS\"}],\"Version\":\"2012-10-17\"}" }, "after_unknown": { "bucket": true, "id": true }, "before_sensitive": false, "after_sensitive": {} } }, { "address": "aws_s3_bucket_public_access_block.good_pab", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "good_pab", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true }, "after_unknown": { "bucket": true, "id": true }, "before_sensitive": false, "after_sensitive": {} } }, { "address": "aws_s3_bucket_server_side_encryption_configuration.good_sse", "mode": "managed", "type": "aws_s3_bucket_server_side_encryption_configuration", "name": "good_sse", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "expected_bucket_owner": null, "rule": [ { "apply_server_side_encryption_by_default": [ { "kms_master_key_id": "arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd", "sse_algorithm": "aws:kms" } ], "bucket_key_enabled": true } ] }, "after_unknown": { "bucket": true, "id": true, "rule": [ { "apply_server_side_encryption_by_default": [ {} ] } ] }, "before_sensitive": false, "after_sensitive": { "rule": [ { "apply_server_side_encryption_by_default": [ {} ] } ] } } }, { "address": "aws_secretsmanager_secret.good_secret", "mode": "managed", "type": "aws_secretsmanager_secret", "name": "good_secret", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": null, "force_overwrite_replica_secret": false, "kms_key_id": null, "name": "good-secret", "recovery_window_in_days": 30, "tags": null }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "policy": true, "replica": true, "tags_all": true }, "before_sensitive": false, "after_sensitive": { "replica": [], "tags_all": {} } } }, { "address": "aws_secretsmanager_secret_rotation.good_rotation", "mode": "managed", "type": "aws_secretsmanager_secret_rotation", "name": "good_rotation", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "rotate_immediately": true, "rotation_lambda_arn": "arn:aws:lambda:ap-south-1:123456789012:function:rotate-secret", "rotation_rules": [ { "automatically_after_days": 60, "duration": null, "schedule_expression": null } ], "secret_id": "good-secret" }, "after_unknown": { "id": true, "rotation_enabled": true, "rotation_rules": [ {} ] }, "before_sensitive": false, "after_sensitive": { "rotation_rules": [ {} ] } } } ], "configuration": { "provider_config": { "aws": { "name": "aws", "full_name": "registry.terraform.io/hashicorp/aws", "version_constraint": "~\u003e 5.0", "expressions": { "region": { "constant_value": "ap-south-1" } } } }, "root_module": { "resources": [ { "address": "aws_acm_certificate.good_cert", "mode": "managed", "type": "aws_acm_certificate", "name": "good_cert", "provider_config_key": "aws", "expressions": { "domain_name": { "constant_value": "good.example.com" }, "key_algorithm": { "constant_value": "RSA_2048" }, "validation_method": { "constant_value": "DNS" } }, "schema_version": 0 }, { "address": "aws_ebs_default_kms_key.good_ebs_kms", "mode": "managed", "type": "aws_ebs_default_kms_key", "name": "good_ebs_kms", "provider_config_key": "aws", "expressions": { "key_arn": { "constant_value": "arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd" } }, "schema_version": 0 }, { "address": "aws_ebs_encryption_by_default.good_ebs", "mode": "managed", "type": "aws_ebs_encryption_by_default", "name": "good_ebs", "provider_config_key": "aws", "expressions": { "enabled": { "constant_value": true } }, "schema_version": 0 }, { "address": "aws_iam_policy.good_kms_policy", "mode": "managed", "type": "aws_iam_policy", "name": "good_kms_policy", "provider_config_key": "aws", "expressions": { "name": { "constant_value": "good-kms-policy" }, "policy": {} }, "schema_version": 0 }, { "address": "aws_kms_key.good_key", "mode": "managed", "type": "aws_kms_key", "name": "good_key", "provider_config_key": "aws", "expressions": { "customer_master_key_spec": { "constant_value": "SYMMETRIC_DEFAULT" }, "deletion_window_in_days": { "constant_value": 30 }, "description": { "constant_value": "good key" }, "enable_key_rotation": { "constant_value": true } }, "schema_version": 0 }, { "address": "aws_kms_key.good_root_key", "mode": "managed", "type": "aws_kms_key", "name": "good_root_key", "provider_config_key": "aws", "expressions": { "customer_master_key_spec": { "constant_value": "SYMMETRIC_DEFAULT" }, "deletion_window_in_days": { "constant_value": 30 }, "description": { "constant_value": "good root key" }, "enable_key_rotation": { "constant_value": true }, "policy": {} }, "schema_version": 0 }, { "address": "aws_s3_bucket.good_bucket", "mode": "managed", "type": "aws_s3_bucket", "name": "good_bucket", "provider_config_key": "aws", "expressions": { "bucket": { "constant_value": "good-ekm-bucket" } }, "schema_version": 0 }, { "address": "aws_s3_bucket_ownership_controls.good_ownership", "mode": "managed", "type": "aws_s3_bucket_ownership_controls", "name": "good_ownership", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.good_bucket.id", "aws_s3_bucket.good_bucket" ] }, "rule": [ { "object_ownership": { "constant_value": "BucketOwnerEnforced" } } ] }, "schema_version": 0 }, { "address": "aws_s3_bucket_policy.good_policy", "mode": "managed", "type": "aws_s3_bucket_policy", "name": "good_policy", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.good_bucket.id", "aws_s3_bucket.good_bucket" ] }, "policy": {} }, "schema_version": 0 }, { "address": "aws_s3_bucket_public_access_block.good_pab", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "good_pab", "provider_config_key": "aws", "expressions": { "block_public_acls": { "constant_value": true }, "block_public_policy": { "constant_value": true }, "bucket": { "references": [ "aws_s3_bucket.good_bucket.id", "aws_s3_bucket.good_bucket" ] }, "ignore_public_acls": { "constant_value": true }, "restrict_public_buckets": { "constant_value": true } }, "schema_version": 0 }, { "address": "aws_s3_bucket_server_side_encryption_configuration.good_sse", "mode": "managed", "type": "aws_s3_bucket_server_side_encryption_configuration", "name": "good_sse", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.good_bucket.id", "aws_s3_bucket.good_bucket" ] }, "rule": [ { "apply_server_side_encryption_by_default": [ { "kms_master_key_id": { "constant_value": "arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd" }, "sse_algorithm": { "constant_value": "aws:kms" } } ], "bucket_key_enabled": { "constant_value": true } } ] }, "schema_version": 0 }, { "address": "aws_secretsmanager_secret.good_secret", "mode": "managed", "type": "aws_secretsmanager_secret", "name": "good_secret", "provider_config_key": "aws", "expressions": { "name": { "constant_value": "good-secret" } }, "schema_version": 0 }, { "address": "aws_secretsmanager_secret_rotation.good_rotation", "mode": "managed", "type": "aws_secretsmanager_secret_rotation", "name": "good_rotation", "provider_config_key": "aws", "expressions": { "rotation_lambda_arn": { "constant_value": "arn:aws:lambda:ap-south-1:123456789012:function:rotate-secret" }, "rotation_rules": [ { "automatically_after_days": { "constant_value": 60 } } ], "secret_id": { "references": [ "aws_secretsmanager_secret.good_secret.name", "aws_secretsmanager_secret.good_secret" ] } }, "schema_version": 1 } ] } }, "relevant_attributes": [ { "resource": "aws_s3_bucket.good_bucket", "attribute": [ "id" ] }, { "resource": "aws_secretsmanager_secret.good_secret", "attribute": [ "name" ] } ], "timestamp": "2026-07-17T12:53:07Z", "applyable": true, "complete": true, "errored": false }