1

{"format_version":"1.2","terraform_version":"1.15.6","planned_values":{"root_module":{"resources":[{"address":"aws_acm_certificate.good_cert","mode":"managed","type":"aws_acm_certificate","name":"good_cert","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"certificate_authority_arn":null,"certificate_body":null,"certificate_chain":null,"domain_name":"good.example.com","domain_validation_options":[{"domain_name":"good.example.com"}],"early_renewal_duration":null,"key_algorithm":"RSA_2048","private_key":null,"subject_alternative_names":["good.example.com"],"tags":null,"validation_method":"DNS","validation_option":[]},"sensitive_values":{"domain_validation_options":[{}],"options":[],"private_key":true,"renewal_summary":[],"subject_alternative_names":[false],"tags_all":{},"validation_emails":[],"validation_option":[]}},{"address":"aws_ebs_default_kms_key.good_ebs_kms","mode":"managed","type":"aws_ebs_default_kms_key","name":"good_ebs_kms","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"key_arn":"arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd"},"sensitive_values":{}},{"address":"aws_ebs_encryption_by_default.good_ebs","mode":"managed","type":"aws_ebs_encryption_by_default","name":"good_ebs","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"enabled":true},"sensitive_values":{}},{"address":"aws_iam_policy.good_kms_policy","mode":"managed","type":"aws_iam_policy","name":"good_kms_policy","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"description":null,"name":"good-kms-policy","path":"/","policy":"{\"Statement\":[{\"Action\":[\"kms:Decrypt\"],\"Effect\":\"Allow\",\"Resource\":\"arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd\"}],\"Version\":\"2012-10-17\"}","tags":null},"sensitive_values":{"tags_all":{}}},{"address":"aws_kms_key.good_key","mode":"managed","type":"aws_kms_key","name":"good_key","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"bypass_policy_lockout_safety_check":false,"custom_key_store_id":null,"customer_master_key_spec":"SYMMETRIC_DEFAULT","deletion_window_in_days":30,"description":"good key","enable_key_rotation":true,"is_enabled":true,"key_usage":"ENCRYPT_DECRYPT","tags":null,"timeouts":null,"xks_key_id":null},"sensitive_values":{"tags_all":{}}},{"address":"aws_kms_key.good_root_key","mode":"managed","type":"aws_kms_key","name":"good_root_key","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"bypass_policy_lockout_safety_check":false,"custom_key_store_id":null,"customer_master_key_spec":"SYMMETRIC_DEFAULT","deletion_window_in_days":30,"description":"good root key","enable_key_rotation":true,"is_enabled":true,"key_usage":"ENCRYPT_DECRYPT","policy":"{\"Statement\":[{\"Action\":\"kms:*\",\"Condition\":{\"StringEquals\":{\"kms:CallerAccount\":\"123456789012\"}},\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::123456789012:root\"},\"Resource\":\"*\"}],\"Version\":\"2012-10-17\"}","tags":null,"timeouts":null,"xks_key_id":null},"sensitive_values":{"tags_all":{}}},{"address":"aws_s3_bucket.good_bucket","mode":"managed","type":"aws_s3_bucket","name":"good_bucket","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"bucket":"good-ekm-bucket","force_destroy":false,"tags":null,"timeouts":null},"sensitive_values":{"cors_rule":[],"grant":[],"lifecycle_rule":[],"logging":[],"object_lock_configuration":[],"replication_configuration":[],"server_side_encryption_configuration":[],"tags_all":{},"versioning":[],"website":[]}},{"address":"aws_s3_bucket_ownership_controls.good_ownership","mode":"managed","type":"aws_s3_bucket_ownership_controls","name":"good_ownership","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"rule":[{"object_ownership":"BucketOwnerEnforced"}]},"sensitive_values":{"rule":[{}]}},{"address":"aws_s3_bucket_policy.good_policy","mode":"managed","type":"aws_s3_bucket_policy","name":"good_policy","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"policy":"{\"Statement\":[{\"Action\":\"s3:*\",\"Condition\":{\"Bool\":{\"aws:SecureTransport\":\"false\"}},\"Effect\":\"Deny\",\"Principal\":\"*\",\"Resource\":[\"arn:aws:s3:::good-ekm-bucket\",\"arn:aws:s3:::good-ekm-bucket/*\"],\"Sid\":\"DenyNonTLS\"}],\"Version\":\"2012-10-17\"}"},"sensitive_values":{}},{"address":"aws_s3_bucket_public_access_block.good_pab","mode":"managed","type":"aws_s3_bucket_public_access_block","name":"good_pab","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"block_public_acls":true,"block_public_policy":true,"ignore_public_acls":true,"restrict_public_buckets":true},"sensitive_values":{}},{"address":"aws_s3_bucket_server_side_encryption_configuration.good_sse","mode":"managed","type":"aws_s3_bucket_server_side_encryption_configuration","name":"good_sse","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"expected_bucket_owner":null,"rule":[{"apply_server_side_encryption_by_default":[{"kms_master_key_id":"arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd","sse_algorithm":"aws:kms"}],"bucket_key_enabled":true}]},"sensitive_values":{"rule":[{"apply_server_side_encryption_by_default":[{}]}]}},{"address":"aws_secretsmanager_secret.good_secret","mode":"managed","type":"aws_secretsmanager_secret","name":"good_secret","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"description":null,"force_overwrite_replica_secret":false,"kms_key_id":null,"name":"good-secret","recovery_window_in_days":30,"tags":null},"sensitive_values":{"replica":[],"tags_all":{}}},{"address":"aws_secretsmanager_secret_rotation.good_rotation","mode":"managed","type":"aws_secretsmanager_secret_rotation","name":"good_rotation","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":1,"values":{"rotate_immediately":true,"rotation_lambda_arn":"arn:aws:lambda:ap-south-1:123456789012:function:rotate-secret","rotation_rules":[{"automatically_after_days":60,"duration":null,"schedule_expression":null}],"secret_id":"good-secret"},"sensitive_values":{"rotation_rules":[{}]}}]}},"resource_changes":[{"address":"aws_acm_certificate.good_cert","mode":"managed","type":"aws_acm_certificate","name":"good_cert","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"certificate_authority_arn":null,"certificate_body":null,"certificate_chain":null,"domain_name":"good.example.com","domain_validation_options":[{"domain_name":"good.example.com"}],"early_renewal_duration":null,"key_algorithm":"RSA_2048","private_key":null,"subject_alternative_names":["good.example.com"],"tags":null,"validation_method":"DNS","validation_option":[]},"after_unknown":{"arn":true,"domain_validation_options":[{"resource_record_name":true,"resource_record_type":true,"resource_record_value":true}],"id":true,"not_after":true,"not_before":true,"options":true,"pending_renewal":true,"renewal_eligibility":true,"renewal_summary":true,"status":true,"subject_alternative_names":[false],"tags_all":true,"type":true,"validation_emails":true,"validation_option":[]},"before_sensitive":false,"after_sensitive":{"domain_validation_options":[{}],"options":[],"private_key":true,"renewal_summary":[],"subject_alternative_names":[false],"tags_all":{},"validation_emails":[],"validation_option":[]}}},{"address":"aws_ebs_default_kms_key.good_ebs_kms","mode":"managed","type":"aws_ebs_default_kms_key","name":"good_ebs_kms","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"key_arn":"arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd"},"after_unknown":{"id":true},"before_sensitive":false,"after_sensitive":{}}},{"address":"aws_ebs_encryption_by_default.good_ebs","mode":"managed","type":"aws_ebs_encryption_by_default","name":"good_ebs","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"enabled":true},"after_unknown":{"id":true},"before_sensitive":false,"after_sensitive":{}}},{"address":"aws_iam_policy.good_kms_policy","mode":"managed","type":"aws_iam_policy","name":"good_kms_policy","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"description":null,"name":"good-kms-policy","path":"/","policy":"{\"Statement\":[{\"Action\":[\"kms:Decrypt\"],\"Effect\":\"Allow\",\"Resource\":\"arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd\"}],\"Version\":\"2012-10-17\"}","tags":null},"after_unknown":{"arn":true,"attachment_count":true,"id":true,"name_prefix":true,"policy_id":true,"tags_all":true},"before_sensitive":false,"after_sensitive":{"tags_all":{}}}},{"address":"aws_kms_key.good_key","mode":"managed","type":"aws_kms_key","name":"good_key","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"bypass_policy_lockout_safety_check":false,"custom_key_store_id":null,"customer_master_key_spec":"SYMMETRIC_DEFAULT","deletion_window_in_days":30,"description":"good key","enable_key_rotation":true,"is_enabled":true,"key_usage":"ENCRYPT_DECRYPT","tags":null,"timeouts":null,"xks_key_id":null},"after_unknown":{"arn":true,"id":true,"key_id":true,"multi_region":true,"policy":true,"rotation_period_in_days":true,"tags_all":true},"before_sensitive":false,"after_sensitive":{"tags_all":{}}}},{"address":"aws_kms_key.good_root_key","mode":"managed","type":"aws_kms_key","name":"good_root_key","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"bypass_policy_lockout_safety_check":false,"custom_key_store_id":null,"customer_master_key_spec":"SYMMETRIC_DEFAULT","deletion_window_in_days":30,"description":"good root key","enable_key_rotation":true,"is_enabled":true,"key_usage":"ENCRYPT_DECRYPT","policy":"{\"Statement\":[{\"Action\":\"kms:*\",\"Condition\":{\"StringEquals\":{\"kms:CallerAccount\":\"123456789012\"}},\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::123456789012:root\"},\"Resource\":\"*\"}],\"Version\":\"2012-10-17\"}","tags":null,"timeouts":null,"xks_key_id":null},"after_unknown":{"arn":true,"id":true,"key_id":true,"multi_region":true,"rotation_period_in_days":true,"tags_all":true},"before_sensitive":false,"after_sensitive":{"tags_all":{}}}},{"address":"aws_s3_bucket.good_bucket","mode":"managed","type":"aws_s3_bucket","name":"good_bucket","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"bucket":"good-ekm-bucket","force_destroy":false,"tags":null,"timeouts":null},"after_unknown":{"acceleration_status":true,"acl":true,"arn":true,"bucket_domain_name":true,"bucket_prefix":true,"bucket_regional_domain_name":true,"cors_rule":true,"grant":true,"hosted_zone_id":true,"id":true,"lifecycle_rule":true,"logging":true,"object_lock_configuration":true,"object_lock_enabled":true,"policy":true,"region":true,"replication_configuration":true,"request_payer":true,"server_side_encryption_configuration":true,"tags_all":true,"versioning":true,"website":true,"website_domain":true,"website_endpoint":true},"before_sensitive":false,"after_sensitive":{"cors_rule":[],"grant":[],"lifecycle_rule":[],"logging":[],"object_lock_configuration":[],"replication_configuration":[],"server_side_encryption_configuration":[],"tags_all":{},"versioning":[],"website":[]}}},{"address":"aws_s3_bucket_ownership_controls.good_ownership","mode":"managed","type":"aws_s3_bucket_ownership_controls","name":"good_ownership","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"rule":[{"object_ownership":"BucketOwnerEnforced"}]},"after_unknown":{"bucket":true,"id":true,"rule":[{}]},"before_sensitive":false,"after_sensitive":{"rule":[{}]}}},{"address":"aws_s3_bucket_policy.good_policy","mode":"managed","type":"aws_s3_bucket_policy","name":"good_policy","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"policy":"{\"Statement\":[{\"Action\":\"s3:*\",\"Condition\":{\"Bool\":{\"aws:SecureTransport\":\"false\"}},\"Effect\":\"Deny\",\"Principal\":\"*\",\"Resource\":[\"arn:aws:s3:::good-ekm-bucket\",\"arn:aws:s3:::good-ekm-bucket/*\"],\"Sid\":\"DenyNonTLS\"}],\"Version\":\"2012-10-17\"}"},"after_unknown":{"bucket":true,"id":true},"before_sensitive":false,"after_sensitive":{}}},{"address":"aws_s3_bucket_public_access_block.good_pab","mode":"managed","type":"aws_s3_bucket_public_access_block","name":"good_pab","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"block_public_acls":true,"block_public_policy":true,"ignore_public_acls":true,"restrict_public_buckets":true},"after_unknown":{"bucket":true,"id":true},"before_sensitive":false,"after_sensitive":{}}},{"address":"aws_s3_bucket_server_side_encryption_configuration.good_sse","mode":"managed","type":"aws_s3_bucket_server_side_encryption_configuration","name":"good_sse","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"expected_bucket_owner":null,"rule":[{"apply_server_side_encryption_by_default":[{"kms_master_key_id":"arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd","sse_algorithm":"aws:kms"}],"bucket_key_enabled":true}]},"after_unknown":{"bucket":true,"id":true,"rule":[{"apply_server_side_encryption_by_default":[{}]}]},"before_sensitive":false,"after_sensitive":{"rule":[{"apply_server_side_encryption_by_default":[{}]}]}}},{"address":"aws_secretsmanager_secret.good_secret","mode":"managed","type":"aws_secretsmanager_secret","name":"good_secret","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"description":null,"force_overwrite_replica_secret":false,"kms_key_id":null,"name":"good-secret","recovery_window_in_days":30,"tags":null},"after_unknown":{"arn":true,"id":true,"name_prefix":true,"policy":true,"replica":true,"tags_all":true},"before_sensitive":false,"after_sensitive":{"replica":[],"tags_all":{}}}},{"address":"aws_secretsmanager_secret_rotation.good_rotation","mode":"managed","type":"aws_secretsmanager_secret_rotation","name":"good_rotation","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"rotate_immediately":true,"rotation_lambda_arn":"arn:aws:lambda:ap-south-1:123456789012:function:rotate-secret","rotation_rules":[{"automatically_after_days":60,"duration":null,"schedule_expression":null}],"secret_id":"good-secret"},"after_unknown":{"id":true,"rotation_enabled":true,"rotation_rules":[{}]},"before_sensitive":false,"after_sensitive":{"rotation_rules":[{}]}}}],"configuration":{"provider_config":{"aws":{"name":"aws","full_name":"registry.terraform.io/hashicorp/aws","version_constraint":"~\u003e 5.0","expressions":{"region":{"constant_value":"ap-south-1"}}}},"root_module":{"resources":[{"address":"aws_acm_certificate.good_cert","mode":"managed","type":"aws_acm_certificate","name":"good_cert","provider_config_key":"aws","expressions":{"domain_name":{"constant_value":"good.example.com"},"key_algorithm":{"constant_value":"RSA_2048"},"validation_method":{"constant_value":"DNS"}},"schema_version":0},{"address":"aws_ebs_default_kms_key.good_ebs_kms","mode":"managed","type":"aws_ebs_default_kms_key","name":"good_ebs_kms","provider_config_key":"aws","expressions":{"key_arn":{"constant_value":"arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd"}},"schema_version":0},{"address":"aws_ebs_encryption_by_default.good_ebs","mode":"managed","type":"aws_ebs_encryption_by_default","name":"good_ebs","provider_config_key":"aws","expressions":{"enabled":{"constant_value":true}},"schema_version":0},{"address":"aws_iam_policy.good_kms_policy","mode":"managed","type":"aws_iam_policy","name":"good_kms_policy","provider_config_key":"aws","expressions":{"name":{"constant_value":"good-kms-policy"},"policy":{}},"schema_version":0},{"address":"aws_kms_key.good_key","mode":"managed","type":"aws_kms_key","name":"good_key","provider_config_key":"aws","expressions":{"customer_master_key_spec":{"constant_value":"SYMMETRIC_DEFAULT"},"deletion_window_in_days":{"constant_value":30},"description":{"constant_value":"good key"},"enable_key_rotation":{"constant_value":true}},"schema_version":0},{"address":"aws_kms_key.good_root_key","mode":"managed","type":"aws_kms_key","name":"good_root_key","provider_config_key":"aws","expressions":{"customer_master_key_spec":{"constant_value":"SYMMETRIC_DEFAULT"},"deletion_window_in_days":{"constant_value":30},"description":{"constant_value":"good root key"},"enable_key_rotation":{"constant_value":true},"policy":{}},"schema_version":0},{"address":"aws_s3_bucket.good_bucket","mode":"managed","type":"aws_s3_bucket","name":"good_bucket","provider_config_key":"aws","expressions":{"bucket":{"constant_value":"good-ekm-bucket"}},"schema_version":0},{"address":"aws_s3_bucket_ownership_controls.good_ownership","mode":"managed","type":"aws_s3_bucket_ownership_controls","name":"good_ownership","provider_config_key":"aws","expressions":{"bucket":{"references":["aws_s3_bucket.good_bucket.id","aws_s3_bucket.good_bucket"]},"rule":[{"object_ownership":{"constant_value":"BucketOwnerEnforced"}}]},"schema_version":0},{"address":"aws_s3_bucket_policy.good_policy","mode":"managed","type":"aws_s3_bucket_policy","name":"good_policy","provider_config_key":"aws","expressions":{"bucket":{"references":["aws_s3_bucket.good_bucket.id","aws_s3_bucket.good_bucket"]},"policy":{}},"schema_version":0},{"address":"aws_s3_bucket_public_access_block.good_pab","mode":"managed","type":"aws_s3_bucket_public_access_block","name":"good_pab","provider_config_key":"aws","expressions":{"block_public_acls":{"constant_value":true},"block_public_policy":{"constant_value":true},"bucket":{"references":["aws_s3_bucket.good_bucket.id","aws_s3_bucket.good_bucket"]},"ignore_public_acls":{"constant_value":true},"restrict_public_buckets":{"constant_value":true}},"schema_version":0},{"address":"aws_s3_bucket_server_side_encryption_configuration.good_sse","mode":"managed","type":"aws_s3_bucket_server_side_encryption_configuration","name":"good_sse","provider_config_key":"aws","expressions":{"bucket":{"references":["aws_s3_bucket.good_bucket.id","aws_s3_bucket.good_bucket"]},"rule":[{"apply_server_side_encryption_by_default":[{"kms_master_key_id":{"constant_value":"arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd"},"sse_algorithm":{"constant_value":"aws:kms"}}],"bucket_key_enabled":{"constant_value":true}}]},"schema_version":0},{"address":"aws_secretsmanager_secret.good_secret","mode":"managed","type":"aws_secretsmanager_secret","name":"good_secret","provider_config_key":"aws","expressions":{"name":{"constant_value":"good-secret"}},"schema_version":0},{"address":"aws_secretsmanager_secret_rotation.good_rotation","mode":"managed","type":"aws_secretsmanager_secret_rotation","name":"good_rotation","provider_config_key":"aws","expressions":{"rotation_lambda_arn":{"constant_value":"arn:aws:lambda:ap-south-1:123456789012:function:rotate-secret"},"rotation_rules":[{"automatically_after_days":{"constant_value":60}}],"secret_id":{"references":["aws_secretsmanager_secret.good_secret.name","aws_secretsmanager_secret.good_secret"]}},"schema_version":1}]}},"relevant_attributes":[{"resource":"aws_s3_bucket.good_bucket","attribute":["id"]},{"resource":"aws_secretsmanager_secret.good_secret","attribute":["name"]}],"timestamp":"2026-07-17T12:53:07Z","applyable":true,"complete":true,"errored":false}