PR Custody

feat(security): make integrator API ALB internal (behind Tailscale)

@AgentWrapperdraftchecks n/achecks…feat/internal-api-alb-tailscale → next4 files · +63 −10updated 2w ago

▸Description · 2 noise

Why

The integrator API ALB is internet-facing today (internal = false, SG ingress 0.0.0.0/0 on 80/443, ALB in public subnets). Fargate tasks are already private. Part of Cortex security hardening: there is no reason for the API to be publicly reachable — internal callers are already in-VPC, and operators reach it over Tailscale. Webhooks are being decommissioned (S2), so no public carve-out is needed.

What

modules/ecs-api: two new variables, both defaulting to the legacy internet-facing behavior:
- alb_internal (bool, default false) — when true, aws_lb.api.internal = true and the ALB SG ingress (80/443) is scoped to the VPC CIDR (data.aws_vpc.selected.cidr_block) instead of 0.0.0.0/0.
- alb_subnets (list, default []) — subnets for the ALB; empty falls back to auto-discovered public subnets. Set to private subnets for an internal ALB. This is independent of task_subnets (which place the Fargate tasks).
prod + staging (environments/{prod,staging}/main.tf): alb_internal = true, alb_subnets = module.private_subnets.private_subnet_ids.
No public listener added. No app-code changes.

Before / after exposure

	Before	After (prod/staging)
`aws_lb.api.internal`	`false`	`true`
ALB subnets	public	private
ALB SG ingress 80/443	`0.0.0.0/0`	VPC CIDR only

⚠️ Correction to the task's stated CIDR assumption

The task brief assumed the VPC is 10.0.0.0/16 and that a centralized infra repo bastion advertises it. That does not match integrator's reality — verified in-repo:

Both prod and staging run in the default VPC, 172.31.0.0/16 (environments/prod/main.tf:162, staging uses data.aws_vpc.default).
Integrator's own prod RDS bastion is the Tailscale subnet router (modules/rds, tailscale_auth_key passed in prod). It advertises the VPC CIDR by default (modules/rds/main.tf:537: tailscale_routes = [data.aws_vpc.selected.cidr_block] → 172.31.0.0/16).

Hardcoding 10.0.0.0/16 in the SG would have left the API completely unreachable (that CIDR isn't routed in this VPC). To be robust regardless of the actual CIDR, the SG ingress is derived dynamically from data.aws_vpc.selected.cidr_block. This covers in-VPC callers and tailnet members (the subnet router masquerades tailnet traffic to a VPC-local source IP).

Staging tailnet path — confirmed sufficient

Staging shares the same default VPC (172.31.0.0/16) as prod. The prod bastion's subnet router advertises the whole VPC CIDR, which covers staging's private subnets (172.31.192.0/20, 172.31.208.0/20). Staging needs no separate subnet router — the existing tailnet path reaches it. Staging RDS itself is publicly accessible and runs no bastion, so it relies on prod's router (same as the existing egress arrangement).

Note: unlike task_subnets (gated on cortex_egress_ready because tasks need NAT egress), the internal ALB needs no internet route, so it moves to the private subnets unconditionally in staging.

Tailscale ACL

A dedicated tag:integrator-api ACL in the infra Pulumi repo is not required — the existing route covering the VPC CIDR already permits tailnet members to reach the ALB. This PR is intentionally integrator-terraform-only.

Blast radius

Only tailnet members and in-VPC callers can reach the API after this lands. Internal callers (poller, background runners, other in-VPC services) are already in-VPC, so they are unaffected. The only behavior change is loss of public internet reachability — which is the goal, and is safe given webhooks are decommissioned (S2).

How to Test

terraform fmt -check on the four changed files — clean.
terraform validate in environments/prod and environments/staging — both Success (only pre-existing deprecated-argument warnings).
Review plan before any apply (this is a draft, do not deploy — Cortex is at 0 ECS replicas). Expect: aws_lb.api in-place update (internal false→true is a replacement of the ALB), ALB SG ingress CIDR change, and ALB subnet change.

Pre-Review Checklist

I have self-reviewed this PR

Notes

Merge order: this edits modules/ecs-api/main.tf, shared with S1/S2/S3 — merge this one last to minimize rebase churn.
aws_lb.internal is immutable, so flipping it forces ALB replacement (new DNS name). Anything referencing the ALB DNS should re-read the output after apply.
make fmt clean. make chk fails only on a pre-existing, environmental pyrefly issue (the worktree path lives under a .agent-orchestrator dot-directory, which pyrefly's default **/.[!/.]*/**/* ignore glob matches, excluding the whole checkout). Reproduced identically with my changes stashed; the diff is Terraform-only and touches no Python. Passes on CI's normal checkout path.

🤖 Generated with Claude Code

▸ 2 bot/status comments hidden

@github-actions[bot]2w ago

❌ Terraform Plan: Production

ℹ️ Note: The Plan: 3 to add, 3 to change, 3 to destroy. output is always expected due to a known Terraform AWS provider issue. ECS task definitions show as must be replaced on every plan because the provider stores container definitions in a different order than AWS returns them. This is cosmetic only - real changes (new images, env vars) are still detected correctly.

module.doppler_aws_secrets.data.external.env_vars: Reading...
data.doppler_secrets.github: Reading...
module.github_actions_role.data.tls_certificate.github: Reading...
module.rds.random_password.readonly[0]: Refreshing state... [id=none]
module.doppler_aws_secrets.doppler_environment.config: Refreshing state... [id=integrator.prod]
module.rds.random_password.master[0]: Refreshing state... [id=none]
module.rds.tls_private_key.bastion[0]: Refreshing state... [id=b458af7b383ee8f3e3fcd9aeaac04b321158c3eb]
module.doppler_aws_secrets.aws_iam_role.doppler_secrets_manager: Refreshing state... [id=integrator-prod-doppler-secrets-manager-role]
module.github_actions_role.data.aws_caller_identity.current: Reading...
module.doppler_aws_secrets.data.external.env_vars: Read complete after 1s [id=-]
module.ai_agent_debugging_role.data.aws_caller_identity.current: Reading...
module.ecs_api.data.aws_vpc.selected: Reading...
module.doppler_aws_secrets.aws_iam_policy.doppler_secrets_manager: Refreshing state... [id=arn:aws:iam::256586139593:policy/integrator-prod-doppler-secrets-manager-policy]
module.artifacts_bucket.aws_s3_bucket.this: Refreshing state... [id=integrator-artifacts-prod]
module.knowledge_bucket.aws_s3_bucket.this: Refreshing state... [id=integrator-knowledge-prod]
module.github_actions_role.data.tls_certificate.github: Read complete after 1s [id=96abb9379db1afc8a8677b8d4e606d3560ca4114]
module.github_actions_role.data.aws_caller_identity.current: Read complete after 0s [id=256586139593]
module.rds.aws_secretsmanager_secret.master_password[0]: Refreshing state... [id=arn:aws:secretsmanager:us-east-1:256586139593:secret:integrator/prod/rds-master-password-eUwfvl]
module.rds.aws_iam_role.bastion[0]: Refreshing state... [id=integrator-prod-bastion-role]
module.rds.aws_db_parameter_group.main: Refreshing state... [id=integrator-prod-postgres-20251121153637932500000001]
module.ai_agent_debugging_role.data.aws_caller_identity.current: Read complete after 0s [id=256586139593]
module.rds.aws_secretsmanager_secret.readonly_password[0]: Refreshing state... [id=integrator/prod/rds-readonly-password]
module.ecs_api.aws_cloudwatch_log_group.migrations_lambda_logs: Refreshing state... [id=/aws/lambda/integrator-prod-migrations]
module.ecs_api.aws_s3_bucket.alb_logs[0]: Refreshing state... [id=integrator-prod-alb-logs]
module.ecs_api.aws_iam_role.api_task_execution: Refreshing state... [id=integrator-prod-api-task-execution-role]
module.ecs_api.aws_iam_role.migrations_lambda: Refreshing state... [id=integrator-prod-migrations-lambda-role]
module.ecs_api.aws_ecr_repository.api[0]: Refreshing state... [id=integrator-api]
module.ecs_api.aws_cloudwatch_log_group.api_logs: Refreshing state... [id=/ecs/integrator/prod/api]
module.ecs_api.aws_s3_bucket.migrations: Refreshing state... [id=integrator-prod-migrations]
module.ecs_api.aws_cloudwatch_log_group.migrations_logs: Refreshing state... [id=/ecs/integrator/prod/migrations]
module.ecs_api.aws_iam_policy.ecs_exec: Refreshing state... [id=arn:aws:iam::256586139593:policy/integrator-prod-api-ecs-exec-policy]
module.rds.aws_iam_role.rds_monitoring[0]: Refreshing state... [id=integrator-prod-rds-monitoring-role]
module.rds.aws_secretsmanager_secret.bastion_ssh_key[0]: Refreshing state... [id=arn:aws:secretsmanager:us-east-1:256586139593:secret:integrator/prod/bastion-ssh-key-1KH899]
module.rds.aws_key_pair.bastion[0]: Refreshing state... [id=integrator-prod-bastion-key]
module.ecs_api.aws_cloudwatch_log_group.poller_logs: Refreshing state... [id=/ecs/integrator/prod/poller]
module.rds.data.aws_region.current: Reading...
module.rds.data.aws_region.current: Read complete after 0s [id=us-east-1]
module.ecs_api.data.aws_elb_service_account.main: Reading...
module.ecs_api.data.aws_elb_service_account.main: Read complete after 0s [id=127311923021]
module.private_subnets.data.aws_vpc.default: Reading...
module.bedrock_profiles.data.aws_region.current: Reading...
module.bedrock_profiles.data.aws_region.current: Read complete after 0s [id=us-east-1]
module.ecs_api.data.aws_ecs_cluster.default: Reading...
module.ecs_api.aws_iam_role.api_task: Refreshing state... [id=integrator-prod-api-task-role]
module.ecs_api.data.aws_vpc.selected: Read complete after 0s [id=vpc-0529dea5160deb846]
module.private_subnets.data.aws_availability_zones.available: Reading...
module.rds.data.aws_ami.amazon_linux[0]: Reading...
data.aws_caller_identity.current: Reading...
module.ecs_api.data.aws_caller_identity.current: Reading...
module.ecs_api.data.aws_caller_identity.current: Read complete after 0s [id=256586139593]
module.github_actions_role.aws_iam_openid_connect_provider.github[0]: Refreshing state... [id=arn:aws:iam::256586139593:oidc-provider/token.actions.githubusercontent.com]
data.aws_caller_identity.current: Read complete after 0s [id=256586139593]
module.rds.aws_secretsmanager_secret_version.master_password[0]: Refreshing state... [id=arn:aws:secretsmanager:us-east-1:256586139593:secret:integrator/prod/rds-master-password-eUwfvl|terraform-20260102104323671400000002]
module.private_subnets.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]
module.rds.aws_secretsmanager_secret_version.readonly_password[0]: Refreshing state... [id=integrator/prod/rds-readonly-password|terraform-20260113102854430300000001]
module.doppler_aws_secrets.doppler_integration_aws_secrets_manager.integration: Refreshing state... [id=f8180e75-b756-44ea-94f0-ba14f3f34cf3]
module.doppler_aws_secrets.aws_iam_role_policy_attachment.doppler_secrets_manager: Refreshing state... [id=integrator-prod-doppler-secrets-manager-role-20251117114311112900000001]
module.rds.aws_iam_role_policy_attachment.bastion_ssm[0]: Refreshing state... [id=integrator-prod-bastion-role-20251209065339934800000002]
module.ecs_api.data.aws_ecs_cluster.default: Read complete after 0s [id=arn:aws:ecs:us-east-1:256586139593:cluster/default]
module.rds.aws_iam_instance_profile.bastion[0]: Refreshing state... [id=integrator-prod-bastion-profile]
module.ecs_api.aws_iam_role_policy_attachment.migrations_lambda_basic: Refreshing state... [id=integrator-prod-migrations-lambda-role-20260204170613005600000002]
module.ecs_api.aws_iam_role_policy_attachment.api_task_execution: Refreshing state... [id=integrator-prod-api-task-execution-role-20251119130129752900000001]
module.ecs_api.aws_iam_role_policy_attachment.migrations_lambda_vpc: Refreshing state... [id=integrator-prod-migrations-lambda-role-20260204170613044800000003]
module.ecs_api.aws_ecr_lifecycle_policy.api[0]: Refreshing state... [id=integrator-api]
module.rds.aws_secretsmanager_secret_version.bastion_ssh_key[0]: Refreshing state... [id=arn:aws:secretsmanager:us-east-1:256586139593:secret:integrator/prod/bastion-ssh-key-1KH899|terraform-20251209070355334400000002]
module.rds.aws_iam_role_policy_attachment.rds_monitoring[0]: Refreshing state... [id=integrator-prod-rds-monitoring-role-20251121100809599300000002]
module.ecs_api.data.aws_subnets.public: Reading...
module.ecs_api.aws_lb_target_group.api: Refreshing state... [id=arn:aws:elasticloadbalancing:us-east-1:256586139593:targetgroup/integrator-prod-api-tg/480bcba81e9b7bc4]
module.knowledge_bucket.aws_s3_bucket_public_access_block.this: Refreshing state... [id=integrator-knowledge-prod]
module.knowledge_bucket.aws_s3_bucket_versioning.this[0]: Refreshing state... [id=integrator-knowledge-prod]
module.knowledge_bucket.aws_s3_bucket_server_side_encryption_configuration.this: Refreshing state... [id=integrator-knowledge-prod]
module.knowledge_bucket.aws_s3_bucket_lifecycle_configuration.this: Refreshing state... [id=integrator-knowledge-prod]
module.ecs_api.aws_iam_policy.bedrock_access: Refreshing state... [id=arn:aws:iam::256586139593:policy/integrator-prod-api-bedrock-access]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_EXA_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_EXA_API_KEY]
module.ecs_api.data.aws_subnets.public: Read complete after 0s [id=us-east-1]
module.doppler_aws_secrets.doppler_secret.secrets["FIRECRAWL_API_KEY"]: Refreshing state... [id=integrator.prod.FIRECRAWL_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["APOLLO_URL"]: Refreshing state... [id=integrator.prod.APOLLO_URL]
module.doppler_aws_secrets.doppler_secret.secrets["STATSD_METRICS_FLUSH_WAIT_TIME_SECS"]: Refreshing state... [id=integrator.prod.STATSD_METRICS_FLUSH_WAIT_TIME_SECS]
module.doppler_aws_secrets.doppler_secret.secrets["TWITTER_API_SECRET"]: Refreshing state... [id=integrator.prod.TWITTER_API_SECRET]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_YELP_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_YELP_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["BACKEND_READONLY_URL"]: Refreshing state... [id=integrator.prod.BACKEND_READONLY_URL]
module.private_subnets.data.aws_vpc.default: Read complete after 1s [id=vpc-0529dea5160deb846]
module.doppler_aws_secrets.doppler_secret.secrets["BRANDFETCH_API_KEY"]: Refreshing state... [id=integrator.prod.BRANDFETCH_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["HELICONE_API_KEY"]: Refreshing state... [id=integrator.prod.HELICONE_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["LANGSMITH_TRACING"]: Refreshing state... [id=integrator.prod.LANGSMITH_TRACING]
module.doppler_aws_secrets.doppler_secret.secrets["TOOLS_DATABASE_URL"]: Refreshing state... [id=integrator.prod.TOOLS_DATABASE_URL]
module.doppler_aws_secrets.doppler_secret.secrets["SLACK_BOT_TOKEN"]: Refreshing state... [id=integrator.prod.SLACK_BOT_TOKEN]
module.doppler_aws_secrets.doppler_secret.secrets["WATCHDOG_BATCH_POLLER_DISABLED"]: Refreshing state... [id=integrator.prod.WATCHDOG_BATCH_POLLER_DISABLED]
module.doppler_aws_secrets.doppler_secret.secrets["Z_AI_BASE_URL"]: Refreshing state... [id=integrator.prod.Z_AI_BASE_URL]
module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_PORT"]: Refreshing state... [id=integrator.prod.THERMOS_PORT]
module.doppler_aws_secrets.doppler_secret.secrets["MINIMAX_API_KEY"]: Refreshing state... [id=integrator.prod.MINIMAX_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_ADMIN_TOKEN"]: Refreshing state... [id=integrator.prod.COMPOSIO_ADMIN_TOKEN]
module.doppler_aws_secrets.doppler_secret.secrets["OPENAI_API_KEY"]: Refreshing state... [id=integrator.prod.OPENAI_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_STAGING_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_STAGING_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["LANGSMITH_ENDPOINT"]: Refreshing state... [id=integrator.prod.LANGSMITH_ENDPOINT]
module.doppler_aws_secrets.doppler_secret.secrets["TEST_CONNECTION_ID"]: Refreshing state... [id=integrator.prod.TEST_CONNECTION_ID]
module.doppler_aws_secrets.doppler_secret.secrets["Z_AI_API_KEY"]: Refreshing state... [id=integrator.prod.Z_AI_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["PIPEDREAM_PATH"]: Refreshing state... [id=integrator.prod.PIPEDREAM_PATH]
module.doppler_aws_secrets.doppler_secret.secrets["VERCEL_AI_GATEWAY_API_KEY"]: Refreshing state... [id=integrator.prod.VERCEL_AI_GATEWAY_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["LINEAR_API_KEY"]: Refreshing state... [id=integrator.prod.LINEAR_API_KEY]
module.rds.data.aws_ami.amazon_linux[0]: Read complete after 1s [id=ami-0c0717dff8dafd4ca]
module.doppler_aws_secrets.doppler_secret.secrets["USE_APOLLO_GET_DOWNLOAD_URL_API"]: Refreshing state... [id=integrator.prod.USE_APOLLO_GET_DOWNLOAD_URL_API]
module.doppler_aws_secrets.doppler_secret.secrets["CLICKHOUSE_PASSWORD"]: Refreshing state... [id=integrator.prod.CLICKHOUSE_PASSWORD]
module.doppler_aws_secrets.doppler_secret.secrets["DEEPSEEK_API_KEY"]: Refreshing state... [id=integrator.prod.DEEPSEEK_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_DATABASE"]: Refreshing state... [id=integrator.prod.THERMOS_DATABASE]
module.doppler_aws_secrets.doppler_secret.secrets["DD_API_KEY"]: Refreshing state... [id=integrator.prod.DD_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_GEMINI_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_GEMINI_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["AZURE_OPENAI_ENDPOINT_URL"]: Refreshing state... [id=integrator.prod.AZURE_OPENAI_ENDPOINT_URL]
module.doppler_aws_secrets.doppler_secret.secrets["CLICKHOUSE_USERNAME"]: Refreshing state... [id=integrator.prod.CLICKHOUSE_USERNAME]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_STAGING_ADMIN_TOKEN"]: Refreshing state... [id=integrator.prod.COMPOSIO_STAGING_ADMIN_TOKEN]
module.doppler_aws_secrets.doppler_secret.secrets["DISABLE_MERCURY_CLEANUP"]: Refreshing state... [id=integrator.prod.DISABLE_MERCURY_CLEANUP]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_SERPAPI_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_SERPAPI_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["AZURE_OPENAI_SUBSCRIPTION_KEY"]: Refreshing state... [id=integrator.prod.AZURE_OPENAI_SUBSCRIPTION_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["ANCHOR_API_KEY"]: Refreshing state... [id=integrator.prod.ANCHOR_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["NOTION_API_KEY"]: Refreshing state... [id=integrator.prod.NOTION_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["ZAPIER_PATH"]: Refreshing state... [id=integrator.prod.ZAPIER_PATH]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_SEATGEEK_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_SEATGEEK_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["APOLLO_ADMIN_TOKEN"]: Refreshing state... [id=integrator.prod.APOLLO_ADMIN_TOKEN]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["PERPLEXITY_API_KEY"]: Refreshing state... [id=integrator.prod.PERPLEXITY_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_INSTACART_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_INSTACART_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_USERNAME"]: Refreshing state... [id=integrator.prod.THERMOS_USERNAME]
module.doppler_aws_secrets.doppler_secret.secrets["ANTHROPIC_API_KEY"]: Refreshing state... [id=integrator.prod.ANTHROPIC_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_PASSWORD"]: Refreshing state... [id=integrator.prod.THERMOS_PASSWORD]
module.doppler_aws_secrets.doppler_secret.secrets["LANGSMITH_API_KEY"]: Refreshing state... [id=integrator.prod.LANGSMITH_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["PYTHONPATH"]: Refreshing state... [id=integrator.prod.PYTHONPATH]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_WEBHOOK_SECRET"]: Refreshing state... [id=integrator.prod.COMPOSIO_WEBHOOK_SECRET]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_TAVILY_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_TAVILY_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["DD_APP_KEY"]: Refreshing state... [id=integrator.prod.DD_APP_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["TWITTER_API_KEY"]: Refreshing state... [id=integrator.prod.TWITTER_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["MERCURY_AUTOLOAD"]: Refreshing state... [id=integrator.prod.MERCURY_AUTOLOAD]
module.doppler_aws_secrets.doppler_secret.secrets["KIMI_API_KEY"]: Refreshing state... [id=integrator.prod.KIMI_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["GITHUB_ACCESS_TOKEN"]: Refreshing state... [id=integrator.prod.GITHUB_ACCESS_TOKEN]
module.doppler_aws_secrets.doppler_secret.secrets["GROQ_API_KEY"]: Refreshing state... [id=integrator.prod.GROQ_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["GH_WEBHOOK_SECRET"]: Refreshing state... [id=integrator.prod.GH_WEBHOOK_SECRET]
module.doppler_aws_secrets.doppler_secret.secrets["GITHUB_REVIEWER_TOKEN"]: Refreshing state... [id=integrator.prod.GITHUB_REVIEWER_TOKEN]
module.doppler_aws_secrets.doppler_secret.secrets["ENCRYPTION_KEY"]: Refreshing state... [id=integrator.prod.ENCRYPTION_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_HOST"]: Refreshing state... [id=integrator.prod.THERMOS_HOST]
module.doppler_aws_secrets.doppler_secret.secrets["WATCHDOG_MAX_FIXERS_PER_DAY"]: Refreshing state... [id=integrator.prod.WATCHDOG_MAX_FIXERS_PER_DAY]
module.artifacts_bucket.aws_s3_bucket_public_access_block.this: Refreshing state... [id=integrator-artifacts-prod]
module.artifacts_bucket.aws_s3_bucket_lifecycle_configuration.this: Refreshing state... [id=integrator-artifacts-prod]
module.artifacts_bucket.aws_s3_bucket_server_side_encryption_configuration.this: Refreshing state... [id=integrator-artifacts-prod]
module.github_actions_role.aws_iam_role.github_actions: Refreshing state... [id=integrator-github-actions-prod]
module.ecs_api.aws_iam_role_policy_attachment.api_ecs_exec: Refreshing state... [id=integrator-prod-api-task-role-20260110143245125100000001]
module.bedrock_profiles.aws_bedrock_inference_profile.haiku: Refreshing state... [id=8o8r6d38y4zb]
module.bedrock_profiles.aws_bedrock_inference_profile.opus: Refreshing state... [id=958j2gt23zd8]
module.bedrock_profiles.aws_bedrock_inference_profile.sonnet: Refreshing state... [id=enps8f03v7hs]
module.ecs_api.aws_security_group.alb: Refreshing state... [id=sg-01a98c3baf47519e1]
module.ecs_api.aws_s3_bucket_server_side_encryption_configuration.alb_logs[0]: Refreshing state... [id=integrator-prod-alb-logs]
module.ecs_api.aws_s3_bucket_public_access_block.alb_logs[0]: Refreshing state... [id=integrator-prod-alb-logs]
module.ecs_api.aws_s3_bucket_lifecycle_configuration.alb_logs[0]: Refreshing state... [id=integrator-prod-alb-logs]
module.ecs_api.aws_s3_bucket_public_access_block.migrations: Refreshing state... [id=integrator-prod-migrations]
module.ecs_api.aws_iam_role_policy_attachment.api_bedrock_access: Refreshing state... [id=integrator-prod-api-task-role-20260209135620314900000002]
module.private_subnets.aws_subnet.private[0]: Refreshing state... [id=subnet-0c9ccc78412c4983e]
module.private_subnets.aws_subnet.private[1]: Refreshing state... [id=subnet-0e6efa013fe2ac723]
module.private_subnets.aws_route_table.private[0]: Refreshing state... [id=rtb-0cec1fb4f58eaade7]
module.private_subnets.aws_route_table.private[1]: Refreshing state... [id=rtb-064c596ba9ff03cf1]
module.ecs_api.aws_s3_bucket_policy.alb_logs[0]: Refreshing state... [id=integrator-prod-alb-logs]
data.aws_vpc.default: Reading...
module.ecs_api.aws_security_group.api: Refreshing state... [id=sg-0b340dddce9618955]
aws_eip.cortex_egress[0]: Refreshing state... [id=eipalloc-0874a82ff2576504f]
aws_eip.cortex_egress[1]: Refreshing state... [id=eipalloc-0a8248190a2d88389]
module.rds.data.aws_vpc.selected: Reading...
module.rds.aws_security_group.rds_client[0]: Refreshing state... [id=sg-0a5f38e269947dd2b]
module.ai_agent_debugging_role.aws_iam_role.ai_agent_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod]
module.rds.aws_security_group.bastion[0]: Refreshing state... [id=sg-00fec6e131a7856da]
module.vpc_endpoints.aws_security_group.endpoints: Refreshing state... [id=sg-04f6043bafb1d8f7e]
module.private_subnets.aws_route_table_association.private[0]: Refreshing state... [id=rtbassoc-0965ac73c1c272e6d]
module.private_subnets.aws_route_table_association.private[1]: Refreshing state... [id=rtbassoc-0fe0d16ff694d19bb]
module.github_actions_role.aws_iam_role_policy_attachment.terraform_admin[0]: Refreshing state... [id=integrator-github-actions-prod-20260115155059879900000001]
module.github_actions_role.aws_iam_role_policy.cloudwatch_logs: Refreshing state... [id=integrator-github-actions-prod:integrator-github-actions-prod-cloudwatch-logs-policy]
module.github_actions_role.aws_iam_role_policy.lambda: Refreshing state... [id=integrator-github-actions-prod:integrator-github-actions-prod-lambda-policy]
module.rds.aws_db_subnet_group.main: Refreshing state... [id=integrator-prod-db-subnet-group]
data.aws_vpc.default: Read complete after 0s [id=vpc-0529dea5160deb846]
module.vpc_endpoints.aws_vpc_endpoint.interface["ecr.dkr"]: Refreshing state... [id=vpce-05621b0337f9eee4e]
module.vpc_endpoints.aws_vpc_endpoint.interface["logs"]: Refreshing state... [id=vpce-00e6f05f48fe89dd6]
module.vpc_endpoints.aws_vpc_endpoint.interface["secretsmanager"]: Refreshing state... [id=vpce-06c133d39adfefd16]
github_actions_secret.aws_role_arn: Refreshing state... [id=integrator:AWS_ROLE_ARN_PROD]
module.vpc_endpoints.aws_vpc_endpoint.interface["ecr.api"]: Refreshing state... [id=vpce-0419d4107e3a81888]
module.vpc_endpoints.aws_vpc_endpoint.s3: Refreshing state... [id=vpce-0ec50c23ac29e95c2]
github_actions_secret.ecs_security_groups: Refreshing state... [id=integrator:ECS_SECURITY_GROUPS_PROD]
module.ecs_api.aws_lb.api: Refreshing state... [id=arn:aws:elasticloadbalancing:us-east-1:256586139593:loadbalancer/app/integrator-prod-alb/a90df99d7efaafb4]
data.aws_subnets.public: Reading...
module.rds.data.aws_vpc.selected: Read complete after 0s [id=vpc-0529dea5160deb846]
data.aws_subnet.public_per_az[0]: Reading...
data.aws_subnets.public: Read complete after 0s [id=us-east-1]
data.aws_subnet.public_per_az[1]: Reading...
data.aws_subnet.public_per_az[0]: Read complete after 0s [id=subnet-006a11f7b19901be1]
github_actions_secret.ecs_subnets: Refreshing state... [id=integrator:ECS_SUBNETS_PROD]
module.clickhouse_privatelink.aws_security_group.clickhouse_vpce: Refreshing state... [id=sg-034330929d9d990c1]
module.rds.aws_security_group_rule.bastion_proxy[0]: Refreshing state... [id=sgrule-417166805]
data.aws_subnet.public_per_az[1]: Read complete after 0s [id=subnet-013a9a6febbffa4af]
module.rds.aws_security_group.rds: Refreshing state... [id=sg-0d7ecef877697558c]
aws_nat_gateway.cortex_egress[1]: Refreshing state... [id=nat-020dbeb4949989050]
module.ecs_api.aws_lb_listener.http: Refreshing state... [id=arn:aws:elasticloadbalancing:us-east-1:256586139593:listener/app/integrator-prod-alb/a90df99d7efaafb4/0c03b8bc33aef8d0]
aws_nat_gateway.cortex_egress[0]: Refreshing state... [id=nat-0ff62941aefb0afdb]
module.rds.aws_instance.bastion[0]: Refreshing state... [id=i-0342e072cbf34ad16]
module.clickhouse_privatelink.aws_vpc_endpoint.clickhouse: Refreshing state... [id=vpce-042be8f500c67fba7]
module.rds.aws_db_instance.main: Refreshing state... [id=db-PPFVILK5DKEQIIFO47ASSRDD2A]
aws_route.private_default_via_nat[0]: Refreshing state... [id=r-rtb-0cec1fb4f58eaade71080289494]
aws_route.private_default_via_nat[1]: Refreshing state... [id=r-rtb-064c596ba9ff03cf11080289494]
module.ai_agent_debugging_role.aws_iam_role_policy.iam_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-iam-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.secrets_manager_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-secrets-manager-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.ecr_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-ecr-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.cost_explorer_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-cost-explorer-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.ecs_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-ecs-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.alb_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-alb-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.cloudwatch_logs_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-cloudwatch-logs-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.cloudwatch_metrics_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-cloudwatch-metrics-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.vpc_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-vpc-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.s3_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-s3-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.rds_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-rds-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.deny_privilege_escalation: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-deny-privilege-escalation]
module.rds.null_resource.create_readonly_user[0]: Refreshing state... [id=1172274362782256699]
github_actions_secret.aws_debugging_role_arn: Refreshing state... [id=integrator:AWS_DEBUGGING_ROLE_ARN_PROD]
module.ecs_api.aws_iam_role_policy.migrations_lambda_access: Refreshing state... [id=integrator-prod-migrations-lambda-role:integrator-prod-migrations-lambda-access]
module.ecs_api.aws_lambda_function.migrations: Refreshing state... [id=integrator-prod-migrations]
module.ecs_api.aws_ecs_task_definition.migrations: Refreshing state... [id=integrator-prod-migrations]
module.clickhouse_privatelink.clickhouse_service_private_endpoints_attachment.this: Refreshing state...
module.rds.aws_eip.bastion[0]: Refreshing state... [id=eipalloc-0e0ae9a6a950dc2d6]
module.ecs_background_runner.aws_ecr_repository.background_runner[0]: Refreshing state... [id=integrator-background-runner]
module.ecs_background_runner.aws_cloudwatch_log_group.ecs_task_events: Refreshing state... [id=/aws/events/integrator/prod/ecs-task-state-change]
module.ecs_background_runner.aws_iam_policy.ecs_exec: Refreshing state... [id=arn:aws:iam::256586139593:policy/integrator-prod-ecs-exec-policy]
module.ecs_background_runner.aws_iam_role.task_execution: Refreshing state... [id=integrator-prod-ecs-task-execution-role]
module.ecs_background_runner.aws_iam_policy.s3_knowledge_access: Refreshing state... [id=arn:aws:iam::256586139593:policy/integrator-prod-s3-knowledge-access]
module.ecs_background_runner.aws_ecs_cluster.cluster[0]: Refreshing state... [id=arn:aws:ecs:us-east-1:256586139593:cluster/default]
module.ecs_background_runner.aws_iam_role.task: Refreshing state... [id=integrator-prod-ecs-task-role]
module.ecs_background_runner.aws_iam_policy.bedrock_access: Refreshing state... [id=arn:aws:iam::256586139593:policy/integrator-prod-bedrock-access]
module.ecs_background_runner.aws_cloudwatch_log_group.task_logs: Refreshing state... [id=/ecs/integrator/prod/background-runner]
module.ecs_background_runner.aws_cloudwatch_event_rule.ecs_task_state_change: Refreshing state... [id=integrator-prod-ecs-task-state-change]
module.ecs_background_runner.aws_ecr_lifecycle_policy.background_runner[0]: Refreshing state... [id=integrator-background-runner]
module.github_actions_role.aws_iam_role_policy.ecr: Refreshing state... [id=integrator-github-actions-prod:integrator-github-actions-prod-ecr-policy]
module.ecs_background_runner.aws_iam_role_policy_attachment.bedrock_access: Refreshing state... [id=integrator-prod-ecs-task-role-20260209135620251900000001]
module.ecs_background_runner.aws_iam_role_policy_attachment.ecs_exec: Refreshing state... [id=integrator-prod-ecs-task-role-20251118121957970700000001]
module.ecs_background_runner.aws_iam_role_policy_attachment.s3_knowledge_access: Refreshing state... [id=integrator-prod-ecs-task-role-20260110150021566200000001]
module.ecs_background_runner.aws_iam_role_policy_attachment.task_execution: Refreshing state... [id=integrator-prod-ecs-task-execution-role-20251117132727612500000001]
module.ecs_background_runner.aws_cloudwatch_event_target.ecs_task_state_change_logs: Refreshing state... [id=integrator-prod-ecs-task-state-change-LogTaskStateChanges]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.doppler_aws_secrets.doppler_environment.config has been deleted
  - resource "doppler_environment" "config" {
        id               = "integrator.prod"
        name             = "Prod"
      - slug             = "prod" -> null
        # (2 unchanged attributes hidden)
    }

  # module.doppler_aws_secrets.doppler_integration_aws_secrets_manager.integration has been deleted
  - resource "doppler_integration_aws_secrets_manager" "integration" {
      - id              = "f8180e75-b756-44ea-94f0-ba14f3f34cf3" -> null
        name            = "integrator-prod-aws-secrets-manager"
        # (1 unchanged attribute hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
-/+ destroy and then create replacement
 <= read (data resources)

Terraform planned the following actions, but then encountered a problem:

  # module.doppler_aws_secrets.data.doppler_secrets.existing will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "doppler_secrets" "existing" {
      + config  = "prod"
      + id      = (known after apply)
      + map     = (sensitive value)
      + project = "integrator"
    }

  # module.doppler_aws_secrets.doppler_environment.config will be created
  + resource "doppler_environment" "config" {
      + id               = (known after apply)
      + name             = "Prod"
      + personal_configs = false
      + project          = "integrator"
      + slug             = "prod"
    }

  # module.doppler_aws_secrets.doppler_integration_aws_secrets_manager.integration will be created
  + resource "doppler_integration_aws_secrets_manager" "integration" {
      + assume_role_arn = "arn:aws:iam::256586139593:role/integrator-prod-doppler-secrets-manager-role"
      + id              = (known after apply)
      + name            = "integrator-prod-aws-secrets-manager"
    }

  # module.ecs_api.aws_lb.api must be replaced
-/+ resource "aws_lb" "api" {
      ~ arn                                                          = "arn:aws:elasticloadbalancing:us-east-1:256586139593:loadbalancer/app/integrator-prod-alb/a90df99d7efaafb4" -> (known after apply)
      ~ arn_suffix                                                   = "app/integrator-prod-alb/a90df99d7efaafb4" -> (known after apply)
      ~ dns_name                                                     = "integrator-prod-alb-255052721.us-east-1.elb.amazonaws.com" -> (known after apply)
      - enable_cross_zone_load_balancing                             = true -> null
      + enforce_security_group_inbound_rules_on_private_link_traffic = (known after apply)
      ~ id                                                           = "arn:aws:elasticloadbalancing:us-east-1:256586139593:loadbalancer/app/integrator-prod-alb/a90df99d7efaafb4" -> (known after apply)
      ~ internal                                                     = false -> true # forces replacement
      ~ ip_address_type                                              = "ipv4" -> (known after apply)
        name                                                         = "integrator-prod-alb"
      + name_prefix                                                  = (known after apply)
      ~ subnets                                                      = [
          - "subnet-006a11f7b19901be1",
          - "subnet-013a9a6febbffa4af",
          - "subnet-0167a232e3ca0bda3",
          - "subnet-023ad462e398f7e71",
          - "subnet-031e32528629c9dc1",
          - "subnet-0d79b9a8cbdbe9216",
          + "subnet-0c9ccc78412c4983e",
          + "subnet-0e6efa013fe2ac723",
        ]
        tags                                                         = {
            "Environment" = "prod"
            "ManagedBy"   = "Terraform"
            "Name"        = "integrator-prod-alb"
        }
      ~ vpc_id                                                       = "vpc-0529dea5160deb846" -> (known after apply)
      ~ zone_id                                                      = "Z35SXDOTRQ7X7K" -> (known after apply)
        # (15 unchanged attributes hidden)

      - connection_logs {
          - enabled = false -> null
        }

      - subnet_mapping {
          - subnet_id = "subnet-006a11f7b19901be1" -> null
        }
      - subnet_mapping {
          - subnet_id = "subnet-013a9a6febbffa4af" -> null
        }
      - subnet_mapping {
          - subnet_id = "subnet-0167a232e3ca0bda3" -> null
        }
      - subnet_mapping {
          - subnet_id = "subnet-023ad462e398f7e71" -> null
        }
      - subnet_mapping {
          - subnet_id = "subnet-031e32528629c9dc1" -> null
        }
      - subnet_mapping {
          - subnet_id = "subnet-0d79b9a8cbdbe9216" -> null
        }

        # (1 unchanged block hidden)
    }

  # module.ecs_api.aws_lb_listener.http must be replaced
-/+ resource "aws_lb_listener" "http" {
      ~ arn                                                                   = "arn:aws:elasticloadbalancing:us-east-1:256586139593:listener/app/integrator-prod-alb/a90df99d7efaafb4/0c03b8bc33aef8d0" -> (known after apply)
      ~ id                                                                    = "arn:aws:elasticloadbalancing:us-east-1:256586139593:listener/app/integrator-prod-alb/a90df99d7efaafb4/0c03b8bc33aef8d0" -> (known after apply)
      ~ load_balancer_arn                                                     = "arn:aws:elasticloadbalancing:us-east-1:256586139593:loadbalancer/app/integrator-prod-alb/a90df99d7efaafb4" # forces replacement -> (known after apply) # forces replacement
      + routing_http_request_x_amzn_mtls_clientcert_header_name               = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_issuer_header_name        = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_leaf_header_name          = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_serial_number_header_name = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_subject_header_name       = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_validity_header_name      = (known after apply)
      + routing_http_request_x_amzn_tls_cipher_suite_header_name              = (known after apply)
      + routing_http_request_x_amzn_tls_version_header_name                   = (known after apply)
      + routing_http_response_access_control_allow_credentials_header_value   = (known after apply)
      + routing_http_response_access_control_allow_headers_header_value       = (known after apply)
      + routing_http_response_access_control_allow_methods_header_value       = (known after apply)
      + routing_http_response_access_control_allow_origin_header_value        = (known after apply)
      + routing_http_response_access_control_expose_headers_header_value      = (known after apply)
      + routing_http_response_access_control_max_age_header_value             = (known after apply)
      + routing_http_response_content_security_policy_header_value            = (known after apply)
      ~ routing_http_response_server_enabled                                  = true -> (known after apply)
      + routing_http_response_strict_transport_security_header_value          = (known after apply)
      + routing_http_response_x_content_type_options_header_value             = (known after apply)
      + routing_http_response_x_frame_options_header_value                    = (known after apply)
      + ssl_policy                                                            = (known after apply)
        tags                                                                  = {
            "Environment" = "prod"
            "ManagedBy"   = "Terraform"
            "Name"        = "integrator-prod-http-listener"
        }
      + tcp_idle_timeout_seconds                                              = (known after apply)
        # (3 unchanged attributes hidden)

      ~ default_action {
          ~ order            = 1 -> (known after apply)
            # (2 unchanged attributes hidden)
        }
    }

  # module.ecs_api.aws_security_group.alb will be updated in-place
  ~ resource "aws_security_group" "alb" {
        id                     = "sg-01a98c3baf47519e1"
      ~ ingress                = [
          - {
              - cidr_blocks      = [
                  - "0.0.0.0/0",
                ]
              - description      = "HTTP from internet"
              - from_port        = 80
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 80
            },
          - {
              - cidr_blocks      = [
                  - "0.0.0.0/0",
                ]
              - description      = "HTTPS from internet"
              - from_port        = 443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 443
            },
          + {
              + cidr_blocks      = [
                  + "172.31.0.0/16",
                ]
              + description      = "HTTP from VPC/tailnet"
              + from_port        = 80
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 80
            },
          + {
              + cidr_blocks      = [
                  + "172.31.0.0/16",
                ]
              + description      = "HTTPS from VPC/tailnet"
              + from_port        = 443
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 443
            },
        ]
        name                   = "integrator-prod-alb-sg"
        tags                   = {
            "Environment" = "prod"
            "ManagedBy"   = "Terraform"
            "Name"        = "integrator-prod-alb-sg"
        }
        # (7 unchanged attributes hidden)
    }

  # module.ecs_background_runner.data.aws_caller_identity.current will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_caller_identity" "current" {
      + account_id = (known after apply)
      + arn        = (known after apply)
      + id         = (known after apply)
      + user_id    = (known after apply)
    }

  # module.ecs_background_runner.aws_iam_policy.bedrock_access will be updated in-place
  ~ resource "aws_iam_policy" "bedrock_access" {
        id               = "arn:aws:iam::256586139593:policy/integrator-prod-bedrock-access"
        name             = "integrator-prod-bedrock-access"
      ~ policy           = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "bedrock:InvokeModel",
                          - "bedrock:InvokeModelWithResponseStream",
                        ]
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:bedrock:*::foundation-model/anthropic.*",
                          - "arn:aws:bedrock:*::inference-profile/us.anthropic.*",
                          - "arn:aws:bedrock:*:256586139593:inference-profile/*",
                          - "arn:aws:bedrock:*:256586139593:application-inference-profile/*",
                        ]
                      - Sid      = "BedrockModelInvocation"
                    },
                  - {
                      - Action   = [
                          - "bedrock:ListInferenceProfiles",
                          - "bedrock:GetInferenceProfile",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                      - Sid      = "BedrockListProfiles"
                    },
                  - {
                      - Action   = [
                          - "aws-marketplace:ViewSubscriptions",
                          - "aws-marketplace:Subscribe",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                      - Sid      = "MarketplaceModelAccess"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        tags             = {
            "Environment" = "prod"
            "ManagedBy"   = "Terraform"
            "Name"        = "integrator-prod-bedrock-access"
        }
        # (6 unchanged attributes hidden)
    }

  # module.github_actions_role.aws_iam_openid_connect_provider.github[0] will be updated in-place
  ~ resource "aws_iam_openid_connect_provider" "github" {
        id              = "arn:aws:iam::256586139593:oidc-provider/token.actions.githubusercontent.com"
        tags            = {
            "Environment" = "prod"
            "ManagedBy"   = "Terraform"
            "Name"        = "github-actions-oidc-provider"
        }
      ~ thumbprint_list = [
          - "2b18947a6a9fc7764fd8b5fb18a863b0c6dac24f",
          - "dd55b4520291e276588f0dd02fafd83a7368e0fa",
          - "7560d6f40fa55195f740ee2b1b7c0b4836cbe103",
          + "22ff89586561fc2d52f77491e9f1eff1b80be33e",
          + "9514f4ed3c841c96c43def0f0acbf177405ded12",
        ]
        # (4 unchanged attributes hidden)
    }

  # module.rds.aws_security_group.bastion[0] will be updated in-place
  ~ resource "aws_security_group" "bastion" {
        id                     = "sg-00fec6e131a7856da"
      ~ ingress                = [
          - {
              - cidr_blocks      = [
                  - "172.31.0.0/16",
                ]
              - description      = "Squid proxy access from VPC"
              - from_port        = 3128
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 3128
            },
            # (1 unchanged element hidden)
        ]
        name                   = "integrator-prod-bastion-sg"
        tags                   = {
            "Environment" = "prod"
            "ManagedBy"   = "Terraform"
            "Name"        = "integrator-prod-bastion-sg"
        }
        # (7 unchanged attributes hidden)
    }

Plan: 4 to add, 4 to change, 2 to destroy.

Changes to Outputs:
  ~ api_url                                = "http://integrator-prod-alb-255052721.us-east-1.elb.amazonaws.com" -> (known after apply)

Warning: Argument is deprecated

  with module.datadog_dashboards.datadog_dashboard.cost,
  on ../../modules/datadog-dashboards/cost.tf line 16, in resource "datadog_dashboard" "cost":
  16:     default          = "*"

Use `defaults` instead.

(and 6 more similar warnings elsewhere)

Warning: Doppler Error: Could not find requested environment 'prod'

  with module.doppler_aws_secrets.doppler_environment.config,
  on ../../modules/doppler-aws-secrets/main.tf line 118, in resource "doppler_environment" "config":
 118: resource "doppler_environment" "config" {

Resource was not found, so it was removed from state and is being recreated.

Warning: Doppler Error: Integration not found.

  with module.doppler_aws_secrets.doppler_integration_aws_secrets_manager.integration,
  on ../../modules/doppler-aws-secrets/main.tf line 264, in resource "doppler_integration_aws_secrets_manager" "integration":
 264: resource "doppler_integration_aws_secrets_manager" "integration" {

Resource was not found, so it was removed from state and is being recreated.

Error: 403 Forbidden

  with provider["registry.terraform.io/datadog/datadog"],
  on main.tf line 92, in provider "datadog":
  92: provider "datadog" {


Error: GET https://api.github.com/repos/ComposioHQ/integrator/actions/secrets/AWS_ROLE_ARN_PROD: 401 Bad credentials []

  with github_actions_secret.aws_role_arn,
  on main.tf line 385, in resource "github_actions_secret" "aws_role_arn":
 385: resource "github_actions_secret" "aws_role_arn" {


Error: GET https://api.github.com/repos/ComposioHQ/integrator/actions/secrets/ECS_SUBNETS_PROD: 401 Bad credentials []

  with github_actions_secret.ecs_subnets,
  on main.tf line 391, in resource "github_actions_secret" "ecs_subnets":
 391: resource "github_actions_secret" "ecs_subnets" {


Error: GET https://api.github.com/repos/ComposioHQ/integrator/actions/secrets/ECS_SECURITY_GROUPS_PROD: 401 Bad credentials []

  with github_actions_secret.ecs_security_groups,
  on main.tf line 397, in resource "github_actions_secret" "ecs_security_groups":
 397: resource "github_actions_secret" "ecs_security_groups" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with data.doppler_secrets.github,
  on main.tf line 405, in data "doppler_secrets" "github":
 405: data "doppler_secrets" "github" {


Error: GET https://api.github.com/repos/ComposioHQ/integrator/actions/secrets/AWS_DEBUGGING_ROLE_ARN_PROD: 401 Bad credentials []

  with github_actions_secret.aws_debugging_role_arn,
  on main.tf line 416, in resource "github_actions_secret" "aws_debugging_role_arn":
 416: resource "github_actions_secret" "aws_debugging_role_arn" {


Error: Error Reading ClickHouse Service

  with module.clickhouse_privatelink.clickhouse_service_private_endpoints_attachment.this,
  on ../../modules/clickhouse-privatelink/main.tf line 96, in resource "clickhouse_service_private_endpoints_attachment" "this":
  96: resource "clickhouse_service_private_endpoints_attachment" "this" {

Could not read ClickHouse service private endpoints service
id61132517-259b-4ffa-89af-2442dba95713: status: 401, body:
{"requestId":"15c1d667-75aa-4388-a409-54e21688c7c1","error":"UNAUTHORIZED:
Key is not found","status":401}

Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_SERPAPI_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_STAGING_ADMIN_TOKEN"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["BACKEND_READONLY_URL"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_PORT"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["APOLLO_URL"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_GEMINI_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["CLICKHOUSE_USERNAME"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["ANCHOR_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_TAVILY_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["GITHUB_ACCESS_TOKEN"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["LANGSMITH_TRACING"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["ANTHROPIC_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_WEBHOOK_SECRET"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["KIMI_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_YELP_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["HELICONE_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["TEST_CONNECTION_ID"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["CLICKHOUSE_PASSWORD"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["DD_APP_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["PYTHONPATH"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["GH_WEBHOOK_SECRET"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["GROQ_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_EXA_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["AZURE_OPENAI_ENDPOINT_URL"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["DISABLE_MERCURY_CLEANUP"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["APOLLO_ADMIN_TOKEN"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["PERPLEXITY_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_USERNAME"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["FIRECRAWL_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_INSTACART_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["ENCRYPTION_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["GITHUB_REVIEWER_TOKEN"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["BRANDFETCH_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["DD_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["LINEAR_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_PASSWORD"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["WATCHDOG_MAX_FIXERS_PER_DAY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_DATABASE"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["TOOLS_DATABASE_URL"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["WATCHDOG_BATCH_POLLER_DISABLED"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["AZURE_OPENAI_SUBSCRIPTION_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_SEATGEEK_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler E

... (output truncated)

loading diff…

@github-actions[bot]2w ago

❌ Terraform Plan: Production

ℹ️ Note: The Plan: 3 to add, 3 to change, 3 to destroy. output is always expected due to a known Terraform AWS provider issue. ECS task definitions show as must be replaced on every plan because the provider stores container definitions in a different order than AWS returns them. This is cosmetic only - real changes (new images, env vars) are still detected correctly.

module.doppler_aws_secrets.data.external.env_vars: Reading...
data.doppler_secrets.github: Reading...
module.github_actions_role.data.tls_certificate.github: Reading...
module.rds.random_password.readonly[0]: Refreshing state... [id=none]
module.doppler_aws_secrets.doppler_environment.config: Refreshing state... [id=integrator.prod]
module.rds.random_password.master[0]: Refreshing state... [id=none]
module.rds.tls_private_key.bastion[0]: Refreshing state... [id=b458af7b383ee8f3e3fcd9aeaac04b321158c3eb]
module.doppler_aws_secrets.aws_iam_role.doppler_secrets_manager: Refreshing state... [id=integrator-prod-doppler-secrets-manager-role]
module.github_actions_role.data.aws_caller_identity.current: Reading...
module.doppler_aws_secrets.data.external.env_vars: Read complete after 1s [id=-]
module.ai_agent_debugging_role.data.aws_caller_identity.current: Reading...
module.ecs_api.data.aws_vpc.selected: Reading...
module.doppler_aws_secrets.aws_iam_policy.doppler_secrets_manager: Refreshing state... [id=arn:aws:iam::256586139593:policy/integrator-prod-doppler-secrets-manager-policy]
module.artifacts_bucket.aws_s3_bucket.this: Refreshing state... [id=integrator-artifacts-prod]
module.knowledge_bucket.aws_s3_bucket.this: Refreshing state... [id=integrator-knowledge-prod]
module.github_actions_role.data.tls_certificate.github: Read complete after 1s [id=96abb9379db1afc8a8677b8d4e606d3560ca4114]
module.github_actions_role.data.aws_caller_identity.current: Read complete after 0s [id=256586139593]
module.rds.aws_secretsmanager_secret.master_password[0]: Refreshing state... [id=arn:aws:secretsmanager:us-east-1:256586139593:secret:integrator/prod/rds-master-password-eUwfvl]
module.rds.aws_iam_role.bastion[0]: Refreshing state... [id=integrator-prod-bastion-role]
module.rds.aws_db_parameter_group.main: Refreshing state... [id=integrator-prod-postgres-20251121153637932500000001]
module.ai_agent_debugging_role.data.aws_caller_identity.current: Read complete after 0s [id=256586139593]
module.rds.aws_secretsmanager_secret.readonly_password[0]: Refreshing state... [id=integrator/prod/rds-readonly-password]
module.ecs_api.aws_cloudwatch_log_group.migrations_lambda_logs: Refreshing state... [id=/aws/lambda/integrator-prod-migrations]
module.ecs_api.aws_s3_bucket.alb_logs[0]: Refreshing state... [id=integrator-prod-alb-logs]
module.ecs_api.aws_iam_role.api_task_execution: Refreshing state... [id=integrator-prod-api-task-execution-role]
module.ecs_api.aws_iam_role.migrations_lambda: Refreshing state... [id=integrator-prod-migrations-lambda-role]
module.ecs_api.aws_ecr_repository.api[0]: Refreshing state... [id=integrator-api]
module.ecs_api.aws_cloudwatch_log_group.api_logs: Refreshing state... [id=/ecs/integrator/prod/api]
module.ecs_api.aws_s3_bucket.migrations: Refreshing state... [id=integrator-prod-migrations]
module.ecs_api.aws_cloudwatch_log_group.migrations_logs: Refreshing state... [id=/ecs/integrator/prod/migrations]
module.ecs_api.aws_iam_policy.ecs_exec: Refreshing state... [id=arn:aws:iam::256586139593:policy/integrator-prod-api-ecs-exec-policy]
module.rds.aws_iam_role.rds_monitoring[0]: Refreshing state... [id=integrator-prod-rds-monitoring-role]
module.rds.aws_secretsmanager_secret.bastion_ssh_key[0]: Refreshing state... [id=arn:aws:secretsmanager:us-east-1:256586139593:secret:integrator/prod/bastion-ssh-key-1KH899]
module.rds.aws_key_pair.bastion[0]: Refreshing state... [id=integrator-prod-bastion-key]
module.ecs_api.aws_cloudwatch_log_group.poller_logs: Refreshing state... [id=/ecs/integrator/prod/poller]
module.rds.data.aws_region.current: Reading...
module.rds.data.aws_region.current: Read complete after 0s [id=us-east-1]
module.ecs_api.data.aws_elb_service_account.main: Reading...
module.ecs_api.data.aws_elb_service_account.main: Read complete after 0s [id=127311923021]
module.private_subnets.data.aws_vpc.default: Reading...
module.bedrock_profiles.data.aws_region.current: Reading...
module.bedrock_profiles.data.aws_region.current: Read complete after 0s [id=us-east-1]
module.ecs_api.data.aws_ecs_cluster.default: Reading...
module.ecs_api.aws_iam_role.api_task: Refreshing state... [id=integrator-prod-api-task-role]
module.ecs_api.data.aws_vpc.selected: Read complete after 0s [id=vpc-0529dea5160deb846]
module.private_subnets.data.aws_availability_zones.available: Reading...
module.rds.data.aws_ami.amazon_linux[0]: Reading...
data.aws_caller_identity.current: Reading...
module.ecs_api.data.aws_caller_identity.current: Reading...
module.ecs_api.data.aws_caller_identity.current: Read complete after 0s [id=256586139593]
module.github_actions_role.aws_iam_openid_connect_provider.github[0]: Refreshing state... [id=arn:aws:iam::256586139593:oidc-provider/token.actions.githubusercontent.com]
data.aws_caller_identity.current: Read complete after 0s [id=256586139593]
module.rds.aws_secretsmanager_secret_version.master_password[0]: Refreshing state... [id=arn:aws:secretsmanager:us-east-1:256586139593:secret:integrator/prod/rds-master-password-eUwfvl|terraform-20260102104323671400000002]
module.private_subnets.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]
module.rds.aws_secretsmanager_secret_version.readonly_password[0]: Refreshing state... [id=integrator/prod/rds-readonly-password|terraform-20260113102854430300000001]
module.doppler_aws_secrets.doppler_integration_aws_secrets_manager.integration: Refreshing state... [id=f8180e75-b756-44ea-94f0-ba14f3f34cf3]
module.doppler_aws_secrets.aws_iam_role_policy_attachment.doppler_secrets_manager: Refreshing state... [id=integrator-prod-doppler-secrets-manager-role-20251117114311112900000001]
module.rds.aws_iam_role_policy_attachment.bastion_ssm[0]: Refreshing state... [id=integrator-prod-bastion-role-20251209065339934800000002]
module.ecs_api.data.aws_ecs_cluster.default: Read complete after 0s [id=arn:aws:ecs:us-east-1:256586139593:cluster/default]
module.rds.aws_iam_instance_profile.bastion[0]: Refreshing state... [id=integrator-prod-bastion-profile]
module.ecs_api.aws_iam_role_policy_attachment.migrations_lambda_basic: Refreshing state... [id=integrator-prod-migrations-lambda-role-20260204170613005600000002]
module.ecs_api.aws_iam_role_policy_attachment.api_task_execution: Refreshing state... [id=integrator-prod-api-task-execution-role-20251119130129752900000001]
module.ecs_api.aws_iam_role_policy_attachment.migrations_lambda_vpc: Refreshing state... [id=integrator-prod-migrations-lambda-role-20260204170613044800000003]
module.ecs_api.aws_ecr_lifecycle_policy.api[0]: Refreshing state... [id=integrator-api]
module.rds.aws_secretsmanager_secret_version.bastion_ssh_key[0]: Refreshing state... [id=arn:aws:secretsmanager:us-east-1:256586139593:secret:integrator/prod/bastion-ssh-key-1KH899|terraform-20251209070355334400000002]
module.rds.aws_iam_role_policy_attachment.rds_monitoring[0]: Refreshing state... [id=integrator-prod-rds-monitoring-role-20251121100809599300000002]
module.ecs_api.data.aws_subnets.public: Reading...
module.ecs_api.aws_lb_target_group.api: Refreshing state... [id=arn:aws:elasticloadbalancing:us-east-1:256586139593:targetgroup/integrator-prod-api-tg/480bcba81e9b7bc4]
module.knowledge_bucket.aws_s3_bucket_public_access_block.this: Refreshing state... [id=integrator-knowledge-prod]
module.knowledge_bucket.aws_s3_bucket_versioning.this[0]: Refreshing state... [id=integrator-knowledge-prod]
module.knowledge_bucket.aws_s3_bucket_server_side_encryption_configuration.this: Refreshing state... [id=integrator-knowledge-prod]
module.knowledge_bucket.aws_s3_bucket_lifecycle_configuration.this: Refreshing state... [id=integrator-knowledge-prod]
module.ecs_api.aws_iam_policy.bedrock_access: Refreshing state... [id=arn:aws:iam::256586139593:policy/integrator-prod-api-bedrock-access]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_EXA_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_EXA_API_KEY]
module.ecs_api.data.aws_subnets.public: Read complete after 0s [id=us-east-1]
module.doppler_aws_secrets.doppler_secret.secrets["FIRECRAWL_API_KEY"]: Refreshing state... [id=integrator.prod.FIRECRAWL_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["APOLLO_URL"]: Refreshing state... [id=integrator.prod.APOLLO_URL]
module.doppler_aws_secrets.doppler_secret.secrets["STATSD_METRICS_FLUSH_WAIT_TIME_SECS"]: Refreshing state... [id=integrator.prod.STATSD_METRICS_FLUSH_WAIT_TIME_SECS]
module.doppler_aws_secrets.doppler_secret.secrets["TWITTER_API_SECRET"]: Refreshing state... [id=integrator.prod.TWITTER_API_SECRET]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_YELP_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_YELP_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["BACKEND_READONLY_URL"]: Refreshing state... [id=integrator.prod.BACKEND_READONLY_URL]
module.private_subnets.data.aws_vpc.default: Read complete after 1s [id=vpc-0529dea5160deb846]
module.doppler_aws_secrets.doppler_secret.secrets["BRANDFETCH_API_KEY"]: Refreshing state... [id=integrator.prod.BRANDFETCH_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["HELICONE_API_KEY"]: Refreshing state... [id=integrator.prod.HELICONE_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["LANGSMITH_TRACING"]: Refreshing state... [id=integrator.prod.LANGSMITH_TRACING]
module.doppler_aws_secrets.doppler_secret.secrets["TOOLS_DATABASE_URL"]: Refreshing state... [id=integrator.prod.TOOLS_DATABASE_URL]
module.doppler_aws_secrets.doppler_secret.secrets["SLACK_BOT_TOKEN"]: Refreshing state... [id=integrator.prod.SLACK_BOT_TOKEN]
module.doppler_aws_secrets.doppler_secret.secrets["WATCHDOG_BATCH_POLLER_DISABLED"]: Refreshing state... [id=integrator.prod.WATCHDOG_BATCH_POLLER_DISABLED]
module.doppler_aws_secrets.doppler_secret.secrets["Z_AI_BASE_URL"]: Refreshing state... [id=integrator.prod.Z_AI_BASE_URL]
module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_PORT"]: Refreshing state... [id=integrator.prod.THERMOS_PORT]
module.doppler_aws_secrets.doppler_secret.secrets["MINIMAX_API_KEY"]: Refreshing state... [id=integrator.prod.MINIMAX_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_ADMIN_TOKEN"]: Refreshing state... [id=integrator.prod.COMPOSIO_ADMIN_TOKEN]
module.doppler_aws_secrets.doppler_secret.secrets["OPENAI_API_KEY"]: Refreshing state... [id=integrator.prod.OPENAI_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_STAGING_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_STAGING_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["LANGSMITH_ENDPOINT"]: Refreshing state... [id=integrator.prod.LANGSMITH_ENDPOINT]
module.doppler_aws_secrets.doppler_secret.secrets["TEST_CONNECTION_ID"]: Refreshing state... [id=integrator.prod.TEST_CONNECTION_ID]
module.doppler_aws_secrets.doppler_secret.secrets["Z_AI_API_KEY"]: Refreshing state... [id=integrator.prod.Z_AI_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["PIPEDREAM_PATH"]: Refreshing state... [id=integrator.prod.PIPEDREAM_PATH]
module.doppler_aws_secrets.doppler_secret.secrets["VERCEL_AI_GATEWAY_API_KEY"]: Refreshing state... [id=integrator.prod.VERCEL_AI_GATEWAY_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["LINEAR_API_KEY"]: Refreshing state... [id=integrator.prod.LINEAR_API_KEY]
module.rds.data.aws_ami.amazon_linux[0]: Read complete after 1s [id=ami-0c0717dff8dafd4ca]
module.doppler_aws_secrets.doppler_secret.secrets["USE_APOLLO_GET_DOWNLOAD_URL_API"]: Refreshing state... [id=integrator.prod.USE_APOLLO_GET_DOWNLOAD_URL_API]
module.doppler_aws_secrets.doppler_secret.secrets["CLICKHOUSE_PASSWORD"]: Refreshing state... [id=integrator.prod.CLICKHOUSE_PASSWORD]
module.doppler_aws_secrets.doppler_secret.secrets["DEEPSEEK_API_KEY"]: Refreshing state... [id=integrator.prod.DEEPSEEK_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_DATABASE"]: Refreshing state... [id=integrator.prod.THERMOS_DATABASE]
module.doppler_aws_secrets.doppler_secret.secrets["DD_API_KEY"]: Refreshing state... [id=integrator.prod.DD_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_GEMINI_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_GEMINI_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["AZURE_OPENAI_ENDPOINT_URL"]: Refreshing state... [id=integrator.prod.AZURE_OPENAI_ENDPOINT_URL]
module.doppler_aws_secrets.doppler_secret.secrets["CLICKHOUSE_USERNAME"]: Refreshing state... [id=integrator.prod.CLICKHOUSE_USERNAME]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_STAGING_ADMIN_TOKEN"]: Refreshing state... [id=integrator.prod.COMPOSIO_STAGING_ADMIN_TOKEN]
module.doppler_aws_secrets.doppler_secret.secrets["DISABLE_MERCURY_CLEANUP"]: Refreshing state... [id=integrator.prod.DISABLE_MERCURY_CLEANUP]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_SERPAPI_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_SERPAPI_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["AZURE_OPENAI_SUBSCRIPTION_KEY"]: Refreshing state... [id=integrator.prod.AZURE_OPENAI_SUBSCRIPTION_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["ANCHOR_API_KEY"]: Refreshing state... [id=integrator.prod.ANCHOR_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["NOTION_API_KEY"]: Refreshing state... [id=integrator.prod.NOTION_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["ZAPIER_PATH"]: Refreshing state... [id=integrator.prod.ZAPIER_PATH]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_SEATGEEK_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_SEATGEEK_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["APOLLO_ADMIN_TOKEN"]: Refreshing state... [id=integrator.prod.APOLLO_ADMIN_TOKEN]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["PERPLEXITY_API_KEY"]: Refreshing state... [id=integrator.prod.PERPLEXITY_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_INSTACART_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_INSTACART_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_USERNAME"]: Refreshing state... [id=integrator.prod.THERMOS_USERNAME]
module.doppler_aws_secrets.doppler_secret.secrets["ANTHROPIC_API_KEY"]: Refreshing state... [id=integrator.prod.ANTHROPIC_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_PASSWORD"]: Refreshing state... [id=integrator.prod.THERMOS_PASSWORD]
module.doppler_aws_secrets.doppler_secret.secrets["LANGSMITH_API_KEY"]: Refreshing state... [id=integrator.prod.LANGSMITH_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["PYTHONPATH"]: Refreshing state... [id=integrator.prod.PYTHONPATH]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_WEBHOOK_SECRET"]: Refreshing state... [id=integrator.prod.COMPOSIO_WEBHOOK_SECRET]
module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_TAVILY_API_KEY"]: Refreshing state... [id=integrator.prod.COMPOSIO_TAVILY_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["DD_APP_KEY"]: Refreshing state... [id=integrator.prod.DD_APP_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["TWITTER_API_KEY"]: Refreshing state... [id=integrator.prod.TWITTER_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["MERCURY_AUTOLOAD"]: Refreshing state... [id=integrator.prod.MERCURY_AUTOLOAD]
module.doppler_aws_secrets.doppler_secret.secrets["KIMI_API_KEY"]: Refreshing state... [id=integrator.prod.KIMI_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["GITHUB_ACCESS_TOKEN"]: Refreshing state... [id=integrator.prod.GITHUB_ACCESS_TOKEN]
module.doppler_aws_secrets.doppler_secret.secrets["GROQ_API_KEY"]: Refreshing state... [id=integrator.prod.GROQ_API_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["GH_WEBHOOK_SECRET"]: Refreshing state... [id=integrator.prod.GH_WEBHOOK_SECRET]
module.doppler_aws_secrets.doppler_secret.secrets["GITHUB_REVIEWER_TOKEN"]: Refreshing state... [id=integrator.prod.GITHUB_REVIEWER_TOKEN]
module.doppler_aws_secrets.doppler_secret.secrets["ENCRYPTION_KEY"]: Refreshing state... [id=integrator.prod.ENCRYPTION_KEY]
module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_HOST"]: Refreshing state... [id=integrator.prod.THERMOS_HOST]
module.doppler_aws_secrets.doppler_secret.secrets["WATCHDOG_MAX_FIXERS_PER_DAY"]: Refreshing state... [id=integrator.prod.WATCHDOG_MAX_FIXERS_PER_DAY]
module.artifacts_bucket.aws_s3_bucket_public_access_block.this: Refreshing state... [id=integrator-artifacts-prod]
module.artifacts_bucket.aws_s3_bucket_lifecycle_configuration.this: Refreshing state... [id=integrator-artifacts-prod]
module.artifacts_bucket.aws_s3_bucket_server_side_encryption_configuration.this: Refreshing state... [id=integrator-artifacts-prod]
module.github_actions_role.aws_iam_role.github_actions: Refreshing state... [id=integrator-github-actions-prod]
module.ecs_api.aws_iam_role_policy_attachment.api_ecs_exec: Refreshing state... [id=integrator-prod-api-task-role-20260110143245125100000001]
module.bedrock_profiles.aws_bedrock_inference_profile.haiku: Refreshing state... [id=8o8r6d38y4zb]
module.bedrock_profiles.aws_bedrock_inference_profile.opus: Refreshing state... [id=958j2gt23zd8]
module.bedrock_profiles.aws_bedrock_inference_profile.sonnet: Refreshing state... [id=enps8f03v7hs]
module.ecs_api.aws_security_group.alb: Refreshing state... [id=sg-01a98c3baf47519e1]
module.ecs_api.aws_s3_bucket_server_side_encryption_configuration.alb_logs[0]: Refreshing state... [id=integrator-prod-alb-logs]
module.ecs_api.aws_s3_bucket_public_access_block.alb_logs[0]: Refreshing state... [id=integrator-prod-alb-logs]
module.ecs_api.aws_s3_bucket_lifecycle_configuration.alb_logs[0]: Refreshing state... [id=integrator-prod-alb-logs]
module.ecs_api.aws_s3_bucket_public_access_block.migrations: Refreshing state... [id=integrator-prod-migrations]
module.ecs_api.aws_iam_role_policy_attachment.api_bedrock_access: Refreshing state... [id=integrator-prod-api-task-role-20260209135620314900000002]
module.private_subnets.aws_subnet.private[0]: Refreshing state... [id=subnet-0c9ccc78412c4983e]
module.private_subnets.aws_subnet.private[1]: Refreshing state... [id=subnet-0e6efa013fe2ac723]
module.private_subnets.aws_route_table.private[0]: Refreshing state... [id=rtb-0cec1fb4f58eaade7]
module.private_subnets.aws_route_table.private[1]: Refreshing state... [id=rtb-064c596ba9ff03cf1]
module.ecs_api.aws_s3_bucket_policy.alb_logs[0]: Refreshing state... [id=integrator-prod-alb-logs]
data.aws_vpc.default: Reading...
module.ecs_api.aws_security_group.api: Refreshing state... [id=sg-0b340dddce9618955]
aws_eip.cortex_egress[0]: Refreshing state... [id=eipalloc-0874a82ff2576504f]
aws_eip.cortex_egress[1]: Refreshing state... [id=eipalloc-0a8248190a2d88389]
module.rds.data.aws_vpc.selected: Reading...
module.rds.aws_security_group.rds_client[0]: Refreshing state... [id=sg-0a5f38e269947dd2b]
module.ai_agent_debugging_role.aws_iam_role.ai_agent_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod]
module.rds.aws_security_group.bastion[0]: Refreshing state... [id=sg-00fec6e131a7856da]
module.vpc_endpoints.aws_security_group.endpoints: Refreshing state... [id=sg-04f6043bafb1d8f7e]
module.private_subnets.aws_route_table_association.private[0]: Refreshing state... [id=rtbassoc-0965ac73c1c272e6d]
module.private_subnets.aws_route_table_association.private[1]: Refreshing state... [id=rtbassoc-0fe0d16ff694d19bb]
module.github_actions_role.aws_iam_role_policy_attachment.terraform_admin[0]: Refreshing state... [id=integrator-github-actions-prod-20260115155059879900000001]
module.github_actions_role.aws_iam_role_policy.cloudwatch_logs: Refreshing state... [id=integrator-github-actions-prod:integrator-github-actions-prod-cloudwatch-logs-policy]
module.github_actions_role.aws_iam_role_policy.lambda: Refreshing state... [id=integrator-github-actions-prod:integrator-github-actions-prod-lambda-policy]
module.rds.aws_db_subnet_group.main: Refreshing state... [id=integrator-prod-db-subnet-group]
data.aws_vpc.default: Read complete after 0s [id=vpc-0529dea5160deb846]
module.vpc_endpoints.aws_vpc_endpoint.interface["ecr.dkr"]: Refreshing state... [id=vpce-05621b0337f9eee4e]
module.vpc_endpoints.aws_vpc_endpoint.interface["logs"]: Refreshing state... [id=vpce-00e6f05f48fe89dd6]
module.vpc_endpoints.aws_vpc_endpoint.interface["secretsmanager"]: Refreshing state... [id=vpce-06c133d39adfefd16]
github_actions_secret.aws_role_arn: Refreshing state... [id=integrator:AWS_ROLE_ARN_PROD]
module.vpc_endpoints.aws_vpc_endpoint.interface["ecr.api"]: Refreshing state... [id=vpce-0419d4107e3a81888]
module.vpc_endpoints.aws_vpc_endpoint.s3: Refreshing state... [id=vpce-0ec50c23ac29e95c2]
github_actions_secret.ecs_security_groups: Refreshing state... [id=integrator:ECS_SECURITY_GROUPS_PROD]
module.ecs_api.aws_lb.api: Refreshing state... [id=arn:aws:elasticloadbalancing:us-east-1:256586139593:loadbalancer/app/integrator-prod-alb/a90df99d7efaafb4]
data.aws_subnets.public: Reading...
module.rds.data.aws_vpc.selected: Read complete after 0s [id=vpc-0529dea5160deb846]
data.aws_subnet.public_per_az[0]: Reading...
data.aws_subnets.public: Read complete after 0s [id=us-east-1]
data.aws_subnet.public_per_az[1]: Reading...
data.aws_subnet.public_per_az[0]: Read complete after 0s [id=subnet-006a11f7b19901be1]
github_actions_secret.ecs_subnets: Refreshing state... [id=integrator:ECS_SUBNETS_PROD]
module.clickhouse_privatelink.aws_security_group.clickhouse_vpce: Refreshing state... [id=sg-034330929d9d990c1]
module.rds.aws_security_group_rule.bastion_proxy[0]: Refreshing state... [id=sgrule-417166805]
data.aws_subnet.public_per_az[1]: Read complete after 0s [id=subnet-013a9a6febbffa4af]
module.rds.aws_security_group.rds: Refreshing state... [id=sg-0d7ecef877697558c]
aws_nat_gateway.cortex_egress[1]: Refreshing state... [id=nat-020dbeb4949989050]
module.ecs_api.aws_lb_listener.http: Refreshing state... [id=arn:aws:elasticloadbalancing:us-east-1:256586139593:listener/app/integrator-prod-alb/a90df99d7efaafb4/0c03b8bc33aef8d0]
aws_nat_gateway.cortex_egress[0]: Refreshing state... [id=nat-0ff62941aefb0afdb]
module.rds.aws_instance.bastion[0]: Refreshing state... [id=i-0342e072cbf34ad16]
module.clickhouse_privatelink.aws_vpc_endpoint.clickhouse: Refreshing state... [id=vpce-042be8f500c67fba7]
module.rds.aws_db_instance.main: Refreshing state... [id=db-PPFVILK5DKEQIIFO47ASSRDD2A]
aws_route.private_default_via_nat[0]: Refreshing state... [id=r-rtb-0cec1fb4f58eaade71080289494]
aws_route.private_default_via_nat[1]: Refreshing state... [id=r-rtb-064c596ba9ff03cf11080289494]
module.ai_agent_debugging_role.aws_iam_role_policy.iam_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-iam-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.secrets_manager_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-secrets-manager-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.ecr_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-ecr-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.cost_explorer_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-cost-explorer-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.ecs_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-ecs-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.alb_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-alb-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.cloudwatch_logs_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-cloudwatch-logs-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.cloudwatch_metrics_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-cloudwatch-metrics-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.vpc_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-vpc-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.s3_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-s3-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.rds_debugging: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-rds-policy]
module.ai_agent_debugging_role.aws_iam_role_policy.deny_privilege_escalation: Refreshing state... [id=integrator-ai-agent-debugging-prod:integrator-ai-agent-debugging-prod-deny-privilege-escalation]
module.rds.null_resource.create_readonly_user[0]: Refreshing state... [id=1172274362782256699]
github_actions_secret.aws_debugging_role_arn: Refreshing state... [id=integrator:AWS_DEBUGGING_ROLE_ARN_PROD]
module.ecs_api.aws_iam_role_policy.migrations_lambda_access: Refreshing state... [id=integrator-prod-migrations-lambda-role:integrator-prod-migrations-lambda-access]
module.ecs_api.aws_lambda_function.migrations: Refreshing state... [id=integrator-prod-migrations]
module.ecs_api.aws_ecs_task_definition.migrations: Refreshing state... [id=integrator-prod-migrations]
module.clickhouse_privatelink.clickhouse_service_private_endpoints_attachment.this: Refreshing state...
module.rds.aws_eip.bastion[0]: Refreshing state... [id=eipalloc-0e0ae9a6a950dc2d6]
module.ecs_background_runner.aws_ecr_repository.background_runner[0]: Refreshing state... [id=integrator-background-runner]
module.ecs_background_runner.aws_cloudwatch_log_group.ecs_task_events: Refreshing state... [id=/aws/events/integrator/prod/ecs-task-state-change]
module.ecs_background_runner.aws_iam_policy.ecs_exec: Refreshing state... [id=arn:aws:iam::256586139593:policy/integrator-prod-ecs-exec-policy]
module.ecs_background_runner.aws_iam_role.task_execution: Refreshing state... [id=integrator-prod-ecs-task-execution-role]
module.ecs_background_runner.aws_iam_policy.s3_knowledge_access: Refreshing state... [id=arn:aws:iam::256586139593:policy/integrator-prod-s3-knowledge-access]
module.ecs_background_runner.aws_ecs_cluster.cluster[0]: Refreshing state... [id=arn:aws:ecs:us-east-1:256586139593:cluster/default]
module.ecs_background_runner.aws_iam_role.task: Refreshing state... [id=integrator-prod-ecs-task-role]
module.ecs_background_runner.aws_iam_policy.bedrock_access: Refreshing state... [id=arn:aws:iam::256586139593:policy/integrator-prod-bedrock-access]
module.ecs_background_runner.aws_cloudwatch_log_group.task_logs: Refreshing state... [id=/ecs/integrator/prod/background-runner]
module.ecs_background_runner.aws_cloudwatch_event_rule.ecs_task_state_change: Refreshing state... [id=integrator-prod-ecs-task-state-change]
module.ecs_background_runner.aws_ecr_lifecycle_policy.background_runner[0]: Refreshing state... [id=integrator-background-runner]
module.github_actions_role.aws_iam_role_policy.ecr: Refreshing state... [id=integrator-github-actions-prod:integrator-github-actions-prod-ecr-policy]
module.ecs_background_runner.aws_iam_role_policy_attachment.bedrock_access: Refreshing state... [id=integrator-prod-ecs-task-role-20260209135620251900000001]
module.ecs_background_runner.aws_iam_role_policy_attachment.ecs_exec: Refreshing state... [id=integrator-prod-ecs-task-role-20251118121957970700000001]
module.ecs_background_runner.aws_iam_role_policy_attachment.s3_knowledge_access: Refreshing state... [id=integrator-prod-ecs-task-role-20260110150021566200000001]
module.ecs_background_runner.aws_iam_role_policy_attachment.task_execution: Refreshing state... [id=integrator-prod-ecs-task-execution-role-20251117132727612500000001]
module.ecs_background_runner.aws_cloudwatch_event_target.ecs_task_state_change_logs: Refreshing state... [id=integrator-prod-ecs-task-state-change-LogTaskStateChanges]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.doppler_aws_secrets.doppler_environment.config has been deleted
  - resource "doppler_environment" "config" {
        id               = "integrator.prod"
        name             = "Prod"
      - slug             = "prod" -> null
        # (2 unchanged attributes hidden)
    }

  # module.doppler_aws_secrets.doppler_integration_aws_secrets_manager.integration has been deleted
  - resource "doppler_integration_aws_secrets_manager" "integration" {
      - id              = "f8180e75-b756-44ea-94f0-ba14f3f34cf3" -> null
        name            = "integrator-prod-aws-secrets-manager"
        # (1 unchanged attribute hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
-/+ destroy and then create replacement
 <= read (data resources)

Terraform planned the following actions, but then encountered a problem:

  # module.doppler_aws_secrets.data.doppler_secrets.existing will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "doppler_secrets" "existing" {
      + config  = "prod"
      + id      = (known after apply)
      + map     = (sensitive value)
      + project = "integrator"
    }

  # module.doppler_aws_secrets.doppler_environment.config will be created
  + resource "doppler_environment" "config" {
      + id               = (known after apply)
      + name             = "Prod"
      + personal_configs = false
      + project          = "integrator"
      + slug             = "prod"
    }

  # module.doppler_aws_secrets.doppler_integration_aws_secrets_manager.integration will be created
  + resource "doppler_integration_aws_secrets_manager" "integration" {
      + assume_role_arn = "arn:aws:iam::256586139593:role/integrator-prod-doppler-secrets-manager-role"
      + id              = (known after apply)
      + name            = "integrator-prod-aws-secrets-manager"
    }

  # module.ecs_api.aws_lb.api must be replaced
-/+ resource "aws_lb" "api" {
      ~ arn                                                          = "arn:aws:elasticloadbalancing:us-east-1:256586139593:loadbalancer/app/integrator-prod-alb/a90df99d7efaafb4" -> (known after apply)
      ~ arn_suffix                                                   = "app/integrator-prod-alb/a90df99d7efaafb4" -> (known after apply)
      ~ dns_name                                                     = "integrator-prod-alb-255052721.us-east-1.elb.amazonaws.com" -> (known after apply)
      - enable_cross_zone_load_balancing                             = true -> null
      + enforce_security_group_inbound_rules_on_private_link_traffic = (known after apply)
      ~ id                                                           = "arn:aws:elasticloadbalancing:us-east-1:256586139593:loadbalancer/app/integrator-prod-alb/a90df99d7efaafb4" -> (known after apply)
      ~ internal                                                     = false -> true # forces replacement
      ~ ip_address_type                                              = "ipv4" -> (known after apply)
        name                                                         = "integrator-prod-alb"
      + name_prefix                                                  = (known after apply)
      ~ subnets                                                      = [
          - "subnet-006a11f7b19901be1",
          - "subnet-013a9a6febbffa4af",
          - "subnet-0167a232e3ca0bda3",
          - "subnet-023ad462e398f7e71",
          - "subnet-031e32528629c9dc1",
          - "subnet-0d79b9a8cbdbe9216",
          + "subnet-0c9ccc78412c4983e",
          + "subnet-0e6efa013fe2ac723",
        ]
        tags                                                         = {
            "Environment" = "prod"
            "ManagedBy"   = "Terraform"
            "Name"        = "integrator-prod-alb"
        }
      ~ vpc_id                                                       = "vpc-0529dea5160deb846" -> (known after apply)
      ~ zone_id                                                      = "Z35SXDOTRQ7X7K" -> (known after apply)
        # (15 unchanged attributes hidden)

      - connection_logs {
          - enabled = false -> null
        }

      - subnet_mapping {
          - subnet_id = "subnet-006a11f7b19901be1" -> null
        }
      - subnet_mapping {
          - subnet_id = "subnet-013a9a6febbffa4af" -> null
        }
      - subnet_mapping {
          - subnet_id = "subnet-0167a232e3ca0bda3" -> null
        }
      - subnet_mapping {
          - subnet_id = "subnet-023ad462e398f7e71" -> null
        }
      - subnet_mapping {
          - subnet_id = "subnet-031e32528629c9dc1" -> null
        }
      - subnet_mapping {
          - subnet_id = "subnet-0d79b9a8cbdbe9216" -> null
        }

        # (1 unchanged block hidden)
    }

  # module.ecs_api.aws_lb_listener.http must be replaced
-/+ resource "aws_lb_listener" "http" {
      ~ arn                                                                   = "arn:aws:elasticloadbalancing:us-east-1:256586139593:listener/app/integrator-prod-alb/a90df99d7efaafb4/0c03b8bc33aef8d0" -> (known after apply)
      ~ id                                                                    = "arn:aws:elasticloadbalancing:us-east-1:256586139593:listener/app/integrator-prod-alb/a90df99d7efaafb4/0c03b8bc33aef8d0" -> (known after apply)
      ~ load_balancer_arn                                                     = "arn:aws:elasticloadbalancing:us-east-1:256586139593:loadbalancer/app/integrator-prod-alb/a90df99d7efaafb4" # forces replacement -> (known after apply) # forces replacement
      + routing_http_request_x_amzn_mtls_clientcert_header_name               = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_issuer_header_name        = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_leaf_header_name          = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_serial_number_header_name = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_subject_header_name       = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_validity_header_name      = (known after apply)
      + routing_http_request_x_amzn_tls_cipher_suite_header_name              = (known after apply)
      + routing_http_request_x_amzn_tls_version_header_name                   = (known after apply)
      + routing_http_response_access_control_allow_credentials_header_value   = (known after apply)
      + routing_http_response_access_control_allow_headers_header_value       = (known after apply)
      + routing_http_response_access_control_allow_methods_header_value       = (known after apply)
      + routing_http_response_access_control_allow_origin_header_value        = (known after apply)
      + routing_http_response_access_control_expose_headers_header_value      = (known after apply)
      + routing_http_response_access_control_max_age_header_value             = (known after apply)
      + routing_http_response_content_security_policy_header_value            = (known after apply)
      ~ routing_http_response_server_enabled                                  = true -> (known after apply)
      + routing_http_response_strict_transport_security_header_value          = (known after apply)
      + routing_http_response_x_content_type_options_header_value             = (known after apply)
      + routing_http_response_x_frame_options_header_value                    = (known after apply)
      + ssl_policy                                                            = (known after apply)
        tags                                                                  = {
            "Environment" = "prod"
            "ManagedBy"   = "Terraform"
            "Name"        = "integrator-prod-http-listener"
        }
      + tcp_idle_timeout_seconds                                              = (known after apply)
        # (3 unchanged attributes hidden)

      ~ default_action {
          ~ order            = 1 -> (known after apply)
            # (2 unchanged attributes hidden)
        }
    }

  # module.ecs_api.aws_security_group.alb will be updated in-place
  ~ resource "aws_security_group" "alb" {
        id                     = "sg-01a98c3baf47519e1"
      ~ ingress                = [
          - {
              - cidr_blocks      = [
                  - "0.0.0.0/0",
                ]
              - description      = "HTTP from internet"
              - from_port        = 80
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 80
            },
          - {
              - cidr_blocks      = [
                  - "0.0.0.0/0",
                ]
              - description      = "HTTPS from internet"
              - from_port        = 443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 443
            },
          + {
              + cidr_blocks      = [
                  + "172.31.0.0/16",
                ]
              + description      = "HTTP from VPC/tailnet"
              + from_port        = 80
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 80
            },
          + {
              + cidr_blocks      = [
                  + "172.31.0.0/16",
                ]
              + description      = "HTTPS from VPC/tailnet"
              + from_port        = 443
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 443
            },
        ]
        name                   = "integrator-prod-alb-sg"
        tags                   = {
            "Environment" = "prod"
            "ManagedBy"   = "Terraform"
            "Name"        = "integrator-prod-alb-sg"
        }
        # (7 unchanged attributes hidden)
    }

  # module.ecs_background_runner.data.aws_caller_identity.current will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_caller_identity" "current" {
      + account_id = (known after apply)
      + arn        = (known after apply)
      + id         = (known after apply)
      + user_id    = (known after apply)
    }

  # module.ecs_background_runner.aws_iam_policy.bedrock_access will be updated in-place
  ~ resource "aws_iam_policy" "bedrock_access" {
        id               = "arn:aws:iam::256586139593:policy/integrator-prod-bedrock-access"
        name             = "integrator-prod-bedrock-access"
      ~ policy           = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "bedrock:InvokeModel",
                          - "bedrock:InvokeModelWithResponseStream",
                        ]
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:bedrock:*::foundation-model/anthropic.*",
                          - "arn:aws:bedrock:*::inference-profile/us.anthropic.*",
                          - "arn:aws:bedrock:*:256586139593:inference-profile/*",
                          - "arn:aws:bedrock:*:256586139593:application-inference-profile/*",
                        ]
                      - Sid      = "BedrockModelInvocation"
                    },
                  - {
                      - Action   = [
                          - "bedrock:ListInferenceProfiles",
                          - "bedrock:GetInferenceProfile",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                      - Sid      = "BedrockListProfiles"
                    },
                  - {
                      - Action   = [
                          - "aws-marketplace:ViewSubscriptions",
                          - "aws-marketplace:Subscribe",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                      - Sid      = "MarketplaceModelAccess"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        tags             = {
            "Environment" = "prod"
            "ManagedBy"   = "Terraform"
            "Name"        = "integrator-prod-bedrock-access"
        }
        # (6 unchanged attributes hidden)
    }

  # module.github_actions_role.aws_iam_openid_connect_provider.github[0] will be updated in-place
  ~ resource "aws_iam_openid_connect_provider" "github" {
        id              = "arn:aws:iam::256586139593:oidc-provider/token.actions.githubusercontent.com"
        tags            = {
            "Environment" = "prod"
            "ManagedBy"   = "Terraform"
            "Name"        = "github-actions-oidc-provider"
        }
      ~ thumbprint_list = [
          - "2b18947a6a9fc7764fd8b5fb18a863b0c6dac24f",
          - "dd55b4520291e276588f0dd02fafd83a7368e0fa",
          - "7560d6f40fa55195f740ee2b1b7c0b4836cbe103",
          + "22ff89586561fc2d52f77491e9f1eff1b80be33e",
          + "9514f4ed3c841c96c43def0f0acbf177405ded12",
        ]
        # (4 unchanged attributes hidden)
    }

  # module.rds.aws_security_group.bastion[0] will be updated in-place
  ~ resource "aws_security_group" "bastion" {
        id                     = "sg-00fec6e131a7856da"
      ~ ingress                = [
          - {
              - cidr_blocks      = [
                  - "172.31.0.0/16",
                ]
              - description      = "Squid proxy access from VPC"
              - from_port        = 3128
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 3128
            },
            # (1 unchanged element hidden)
        ]
        name                   = "integrator-prod-bastion-sg"
        tags                   = {
            "Environment" = "prod"
            "ManagedBy"   = "Terraform"
            "Name"        = "integrator-prod-bastion-sg"
        }
        # (7 unchanged attributes hidden)
    }

Plan: 4 to add, 4 to change, 2 to destroy.

Changes to Outputs:
  ~ api_url                                = "http://integrator-prod-alb-255052721.us-east-1.elb.amazonaws.com" -> (known after apply)

Warning: Argument is deprecated

  with module.datadog_dashboards.datadog_dashboard.cost,
  on ../../modules/datadog-dashboards/cost.tf line 16, in resource "datadog_dashboard" "cost":
  16:     default          = "*"

Use `defaults` instead.

(and 6 more similar warnings elsewhere)

Warning: Doppler Error: Could not find requested environment 'prod'

  with module.doppler_aws_secrets.doppler_environment.config,
  on ../../modules/doppler-aws-secrets/main.tf line 118, in resource "doppler_environment" "config":
 118: resource "doppler_environment" "config" {

Resource was not found, so it was removed from state and is being recreated.

Warning: Doppler Error: Integration not found.

  with module.doppler_aws_secrets.doppler_integration_aws_secrets_manager.integration,
  on ../../modules/doppler-aws-secrets/main.tf line 264, in resource "doppler_integration_aws_secrets_manager" "integration":
 264: resource "doppler_integration_aws_secrets_manager" "integration" {

Resource was not found, so it was removed from state and is being recreated.

Error: 403 Forbidden

  with provider["registry.terraform.io/datadog/datadog"],
  on main.tf line 92, in provider "datadog":
  92: provider "datadog" {


Error: GET https://api.github.com/repos/ComposioHQ/integrator/actions/secrets/AWS_ROLE_ARN_PROD: 401 Bad credentials []

  with github_actions_secret.aws_role_arn,
  on main.tf line 385, in resource "github_actions_secret" "aws_role_arn":
 385: resource "github_actions_secret" "aws_role_arn" {


Error: GET https://api.github.com/repos/ComposioHQ/integrator/actions/secrets/ECS_SUBNETS_PROD: 401 Bad credentials []

  with github_actions_secret.ecs_subnets,
  on main.tf line 391, in resource "github_actions_secret" "ecs_subnets":
 391: resource "github_actions_secret" "ecs_subnets" {


Error: GET https://api.github.com/repos/ComposioHQ/integrator/actions/secrets/ECS_SECURITY_GROUPS_PROD: 401 Bad credentials []

  with github_actions_secret.ecs_security_groups,
  on main.tf line 397, in resource "github_actions_secret" "ecs_security_groups":
 397: resource "github_actions_secret" "ecs_security_groups" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with data.doppler_secrets.github,
  on main.tf line 405, in data "doppler_secrets" "github":
 405: data "doppler_secrets" "github" {


Error: GET https://api.github.com/repos/ComposioHQ/integrator/actions/secrets/AWS_DEBUGGING_ROLE_ARN_PROD: 401 Bad credentials []

  with github_actions_secret.aws_debugging_role_arn,
  on main.tf line 416, in resource "github_actions_secret" "aws_debugging_role_arn":
 416: resource "github_actions_secret" "aws_debugging_role_arn" {


Error: Error Reading ClickHouse Service

  with module.clickhouse_privatelink.clickhouse_service_private_endpoints_attachment.this,
  on ../../modules/clickhouse-privatelink/main.tf line 96, in resource "clickhouse_service_private_endpoints_attachment" "this":
  96: resource "clickhouse_service_private_endpoints_attachment" "this" {

Could not read ClickHouse service private endpoints service
id61132517-259b-4ffa-89af-2442dba95713: status: 401, body:
{"requestId":"15c1d667-75aa-4388-a409-54e21688c7c1","error":"UNAUTHORIZED:
Key is not found","status":401}

Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_SERPAPI_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_STAGING_ADMIN_TOKEN"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["BACKEND_READONLY_URL"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_PORT"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["APOLLO_URL"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_GEMINI_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["CLICKHOUSE_USERNAME"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["ANCHOR_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_TAVILY_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["GITHUB_ACCESS_TOKEN"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["LANGSMITH_TRACING"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["ANTHROPIC_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_WEBHOOK_SECRET"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["KIMI_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_YELP_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["HELICONE_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["TEST_CONNECTION_ID"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["CLICKHOUSE_PASSWORD"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["DD_APP_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["PYTHONPATH"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["GH_WEBHOOK_SECRET"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["GROQ_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_EXA_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["AZURE_OPENAI_ENDPOINT_URL"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["DISABLE_MERCURY_CLEANUP"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["APOLLO_ADMIN_TOKEN"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["PERPLEXITY_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_USERNAME"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["FIRECRAWL_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_INSTACART_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["ENCRYPTION_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["GITHUB_REVIEWER_TOKEN"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["BRANDFETCH_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["DD_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["LINEAR_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_API_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_PASSWORD"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["WATCHDOG_MAX_FIXERS_PER_DAY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["THERMOS_DATABASE"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["TOOLS_DATABASE_URL"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["WATCHDOG_BATCH_POLLER_DISABLED"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["AZURE_OPENAI_SUBSCRIPTION_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler Error: This token does not have access to requested config 'prod'

  with module.doppler_aws_secrets.doppler_secret.secrets["COMPOSIO_SEATGEEK_KEY"],
  on ../../modules/doppler-aws-secrets/main.tf line 146, in resource "doppler_secret" "secrets":
 146: resource "doppler_secret" "secrets" {


Error: Doppler E

... (output truncated)

Why

What

Before / after exposure

⚠️ Correction to the task's stated CIDR assumption

Staging tailnet path — confirmed sufficient

Tailscale ACL

Blast radius

How to Test

Pre-Review Checklist

Notes

❌ Terraform Plan: Production

Why

What

Before / after exposure

⚠️ Correction to the task's stated CIDR assumption

Staging tailnet path — confirmed sufficient

Tailscale ACL

Blast radius

How to Test

Pre-Review Checklist

Notes

❌ Terraform Plan: Production

❌ Terraform Plan: Staging