1

{"format_version":"1.2","terraform_version":"1.15.6","planned_values":{"root_module":{"resources":[{"address":"aws_iam_group.app_group","mode":"managed","type":"aws_iam_group","name":"app_group","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"name":"app-group","path":"/"},"sensitive_values":{}},{"address":"aws_iam_group_policy.app_group_policy","mode":"managed","type":"aws_iam_group_policy","name":"app_group_policy","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"group":"app-group","name":"app-group-policy","policy":"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"s3:GetObject\"],\"Effect\":\"Allow\",\"Resource\":\"arn:aws:s3:::my-bucket/*\"}]}"},"sensitive_values":{}},{"address":"aws_iam_role.app_role","mode":"managed","type":"aws_iam_role","name":"app_role","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"assume_role_policy":"{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ec2.amazonaws.com\"}}],\"Version\":\"2012-10-17\"}","description":null,"force_detach_policies":false,"max_session_duration":3600,"name":"app-role","path":"/","permissions_boundary":"arn:aws:iam::123456789012:policy/boundary-policy","tags":null},"sensitive_values":{"inline_policy":[],"managed_policy_arns":[],"tags_all":{}}},{"address":"aws_iam_role.cross_account_role","mode":"managed","type":"aws_iam_role","name":"cross_account_role","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"assume_role_policy":"{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Condition\":{\"StringEquals\":{\"sts:ExternalId\":\"unique-external-id\"}},\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::999999999999:root\"}}],\"Version\":\"2012-10-17\"}","description":null,"force_detach_policies":false,"max_session_duration":3600,"name":"cross-account-role","path":"/","permissions_boundary":"arn:aws:iam::123456789012:policy/boundary-policy","tags":null},"sensitive_values":{"inline_policy":[],"managed_policy_arns":[],"tags_all":{}}},{"address":"aws_iam_role_policy.scoped_kms","mode":"managed","type":"aws_iam_role_policy","name":"scoped_kms","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"name":"scoped-kms-policy","policy":"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"kms:Decrypt\"],\"Effect\":\"Allow\",\"Resource\":\"arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd\"}]}","role":"app-role"},"sensitive_values":{}}]}},"resource_changes":[{"address":"aws_iam_group.app_group","mode":"managed","type":"aws_iam_group","name":"app_group","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"name":"app-group","path":"/"},"after_unknown":{"arn":true,"id":true,"unique_id":true},"before_sensitive":false,"after_sensitive":{}}},{"address":"aws_iam_group_policy.app_group_policy","mode":"managed","type":"aws_iam_group_policy","name":"app_group_policy","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"group":"app-group","name":"app-group-policy","policy":"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"s3:GetObject\"],\"Effect\":\"Allow\",\"Resource\":\"arn:aws:s3:::my-bucket/*\"}]}"},"after_unknown":{"id":true,"name_prefix":true},"before_sensitive":false,"after_sensitive":{}}},{"address":"aws_iam_role.app_role","mode":"managed","type":"aws_iam_role","name":"app_role","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"assume_role_policy":"{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ec2.amazonaws.com\"}}],\"Version\":\"2012-10-17\"}","description":null,"force_detach_policies":false,"max_session_duration":3600,"name":"app-role","path":"/","permissions_boundary":"arn:aws:iam::123456789012:policy/boundary-policy","tags":null},"after_unknown":{"arn":true,"create_date":true,"id":true,"inline_policy":true,"managed_policy_arns":true,"name_prefix":true,"tags_all":true,"unique_id":true},"before_sensitive":false,"after_sensitive":{"inline_policy":[],"managed_policy_arns":[],"tags_all":{}}}},{"address":"aws_iam_role.cross_account_role","mode":"managed","type":"aws_iam_role","name":"cross_account_role","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"assume_role_policy":"{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Condition\":{\"StringEquals\":{\"sts:ExternalId\":\"unique-external-id\"}},\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::999999999999:root\"}}],\"Version\":\"2012-10-17\"}","description":null,"force_detach_policies":false,"max_session_duration":3600,"name":"cross-account-role","path":"/","permissions_boundary":"arn:aws:iam::123456789012:policy/boundary-policy","tags":null},"after_unknown":{"arn":true,"create_date":true,"id":true,"inline_policy":true,"managed_policy_arns":true,"name_prefix":true,"tags_all":true,"unique_id":true},"before_sensitive":false,"after_sensitive":{"inline_policy":[],"managed_policy_arns":[],"tags_all":{}}}},{"address":"aws_iam_role_policy.scoped_kms","mode":"managed","type":"aws_iam_role_policy","name":"scoped_kms","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"name":"scoped-kms-policy","policy":"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"kms:Decrypt\"],\"Effect\":\"Allow\",\"Resource\":\"arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd\"}]}","role":"app-role"},"after_unknown":{"id":true,"name_prefix":true},"before_sensitive":false,"after_sensitive":{}}}],"configuration":{"provider_config":{"aws":{"name":"aws","full_name":"registry.terraform.io/hashicorp/aws","version_constraint":"~\u003e 5.0","expressions":{"region":{"constant_value":"ap-south-1"}}}},"root_module":{"resources":[{"address":"aws_iam_group.app_group","mode":"managed","type":"aws_iam_group","name":"app_group","provider_config_key":"aws","expressions":{"name":{"constant_value":"app-group"}},"schema_version":0},{"address":"aws_iam_group_policy.app_group_policy","mode":"managed","type":"aws_iam_group_policy","name":"app_group_policy","provider_config_key":"aws","expressions":{"group":{"references":["aws_iam_group.app_group.name","aws_iam_group.app_group"]},"name":{"constant_value":"app-group-policy"},"policy":{}},"schema_version":0},{"address":"aws_iam_role.app_role","mode":"managed","type":"aws_iam_role","name":"app_role","provider_config_key":"aws","expressions":{"assume_role_policy":{},"name":{"constant_value":"app-role"},"permissions_boundary":{"constant_value":"arn:aws:iam::123456789012:policy/boundary-policy"}},"schema_version":0},{"address":"aws_iam_role.cross_account_role","mode":"managed","type":"aws_iam_role","name":"cross_account_role","provider_config_key":"aws","expressions":{"assume_role_policy":{},"name":{"constant_value":"cross-account-role"},"permissions_boundary":{"constant_value":"arn:aws:iam::123456789012:policy/boundary-policy"}},"schema_version":0},{"address":"aws_iam_role_policy.scoped_kms","mode":"managed","type":"aws_iam_role_policy","name":"scoped_kms","provider_config_key":"aws","expressions":{"name":{"constant_value":"scoped-kms-policy"},"policy":{},"role":{"references":["aws_iam_role.app_role.name","aws_iam_role.app_role"]}},"schema_version":0}]}},"relevant_attributes":[{"resource":"aws_iam_group.app_group","attribute":["name"]},{"resource":"aws_iam_role.app_role","attribute":["name"]}],"timestamp":"2026-07-16T09:14:03Z","applyable":true,"complete":true,"errored":false}