[dev] Update dependency ec2_ami_id to ami-0db1c5c6dc64eb019

[citygeo-bot]

This PR contains the following updates:

Change	Image
ami-024ee5112d03921e2 → ami-0db1c5c6dc64eb019	al2023-ami-2023.12.20260817.0-kernel-6.12-x86_64

Warnings (1)

Please correct - or verify that you can safely ignore - these warnings before you merge this PR.

• [{"Name":"owner-id","Values":["137112412989"]},{"Name":"name","Values":["al2023-ami-2023*-kernel-6.12-x86_64"]},{"Name":"architecture","Values":["x86_64"]},{"Name":"virtualization-type","Values":["hvm"]}]: Could not determine new digest for update (aws-machine-image package [{"Name":"owner-id","Values":["137112412989"]},{"Name":"name","Values":["al2023-ami-2023*-kernel-6.12-x86_64"]},{"Name":"architecture","Values":["x86_64"]},{"Name":"virtualization-type","Values":["hvm"]}])

---

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Terraform plan output for ./terraform/common

Contains changes: no

Show Plan

data.aws_caller_identity.current: Reading...
data.aws_caller_identity.current: Read complete after 0s [id=975050025792]
aws_kms_key.common: Refreshing state... [id=3d75e1a1-78eb-42a2-80fe-9efc9e5a64b4]
aws_kms_alias.common: Refreshing state... [id=alias/mulesoft]
aws_ssm_parameter.kms_id: Refreshing state... [id=/mulesoft/common/kms_id]
aws_ssm_parameter.kms_arn: Refreshing state... [id=/mulesoft/common/kms_arn]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

Pusher: @citygeo-bot[bot]

[github-actions]

Terraform plan output for ./terraform/env/dev

Contains changes: yes

Show Plan

Terraform will perform the following actions:

  # module.flex_gateway.aws_launch_template.main will be updated in-place
  ~ resource "aws_launch_template" "main" {
      ~ default_version                      = 16 -> (known after apply)
        id                                   = "lt-09cba693c47d96889"
      ~ image_id                             = "ami-024ee5112d03921e2" -> "ami-07ab13a91f7d7a8af"
      ~ latest_version                       = 16 -> (known after apply)
        name                                 = "flex-gateway-dev"
        tags                                 = {
            "Application" = "flex-gateway"
            "ManagedBy"   = "Terraform"
            "Name"        = "flex-gateway-dev"
            "TfEnv"       = "dev"
        }
        # (17 unchanged attributes hidden)

        # (5 unchanged blocks hidden)
    }

  # module.flex_gateway.aws_s3_bucket_server_side_encryption_configuration.main will be updated in-place
  ~ resource "aws_s3_bucket_server_side_encryption_configuration" "main" {
        id                    = "phl-citygeo-flex-gateway-dev"
        # (3 unchanged attributes hidden)

      - rule {
          # At least one attribute in this block is (or was) sensitive,
          # so its contents will not be displayed.
        }
      + rule {
          # At least one attribute in this block is (or was) sensitive,
          # so its contents will not be displayed.
        }
    }

  # module.flex_gateway.aws_s3_object.registration will be updated in-place
  ~ resource "aws_s3_object" "registration" {
      ~ content_base64                = (sensitive value)
        id                            = "phl-citygeo-flex-gateway-dev/registration.yaml"
        tags                          = {}
      + version_id                    = (known after apply)
        # (25 unchanged attributes hidden)
    }

Plan: 0 to add, 3 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

Pusher: @citygeo-bot[bot]

[github-actions]

Terraform plan output for ./terraform/env/prod

Contains changes: yes

Show Plan

Terraform will perform the following actions:

  # module.flex_gateway.aws_s3_bucket_server_side_encryption_configuration.main will be updated in-place
  ~ resource "aws_s3_bucket_server_side_encryption_configuration" "main" {
        id                    = "phl-citygeo-flex-gateway-prod"
        # (3 unchanged attributes hidden)

      - rule {
          # At least one attribute in this block is (or was) sensitive,
          # so its contents will not be displayed.
        }
      + rule {
          # At least one attribute in this block is (or was) sensitive,
          # so its contents will not be displayed.
        }
    }

  # module.flex_gateway.aws_s3_object.registration will be updated in-place
  ~ resource "aws_s3_object" "registration" {
      ~ content_base64                = (sensitive value)
        id                            = "phl-citygeo-flex-gateway-prod/registration.yaml"
        tags                          = {}
      + version_id                    = (known after apply)
        # (25 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

Pusher: @citygeo-bot[bot]

[github-actions]

Terraform plan output for ./terraform/env/test

Contains changes: yes

Show Plan

Terraform will perform the following actions:

  # module.flex_gateway.aws_autoscaling_attachment.main will be created
  + resource "aws_autoscaling_attachment" "main" {
      + autoscaling_group_name = (known after apply)
      + id                     = (known after apply)
      + lb_target_group_arn    = (known after apply)
      + region                 = "us-east-1"
    }

  # module.flex_gateway.aws_autoscaling_group.main will be created
  + resource "aws_autoscaling_group" "main" {
      + arn                              = (known after apply)
      + availability_zones               = (known after apply)
      + default_cooldown                 = (known after apply)
      + desired_capacity                 = (known after apply)
      + force_delete                     = false
      + force_delete_warm_pool           = false
      + health_check_grace_period        = 300
      + health_check_type                = (known after apply)
      + id                               = (known after apply)
      + ignore_failed_scaling_activities = false
      + load_balancers                   = (known after apply)
      + max_size                         = 0
      + metrics_granularity              = "1Minute"
      + min_size                         = 0
      + name                             = "flex-gateway-test"
      + name_prefix                      = (known after apply)
      + predicted_capacity               = (known after apply)
      + protect_from_scale_in            = false
      + region                           = "us-east-1"
      + service_linked_role_arn          = (known after apply)
      + target_group_arns                = (known after apply)
      + vpc_zone_identifier              = [
          + "subnet-0d5478758a826841e",
          + "subnet-0ff7f0642b438fbeb",
        ]
      + wait_for_capacity_timeout        = "10m"
      + warm_pool_size                   = (known after apply)

      + availability_zone_distribution (known after apply)

      + capacity_reservation_specification (known after apply)

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = "$Default"
        }

      + mixed_instances_policy (known after apply)

      + traffic_source (known after apply)
    }

  # module.flex_gateway.aws_cloudwatch_log_group.waf_logs will be created
  + resource "aws_cloudwatch_log_group" "waf_logs" {
      + arn                         = (known after apply)
      + deletion_protection_enabled = (known after apply)
      + id                          = (known after apply)
      + log_group_class             = (known after apply)
      + name                        = "aws-waf-logs-test-flex-gateway"
      + name_prefix                 = (known after apply)
      + region                      = "us-east-1"
      + retention_in_days           = 14
      + skip_destroy                = false
      + tags_all                    = (known after apply)
    }

  # module.flex_gateway.aws_elasticache_replication_group.main will be created
  + resource "aws_elasticache_replication_group" "main" {
      + apply_immediately              = true
      + arn                            = (known after apply)
      + at_rest_encryption_enabled     = (known after apply)
      + auth_token                     = (sensitive value)
      + auth_token_update_strategy     = "ROTATE"
      + auto_minor_version_upgrade     = (known after apply)
      + automatic_failover_enabled     = false
      + cluster_enabled                = (known after apply)
      + cluster_mode                   = "disabled"
      + configuration_endpoint_address = (known after apply)
      + data_tiering_enabled           = (known after apply)
      + description                    = "flex-gateway-test"
      + engine                         = "valkey"
      + engine_version                 = "8.1"
      + engine_version_actual          = (known after apply)
      + global_replication_group_id    = (known after apply)
      + id                             = (known after apply)
      + ip_discovery                   = (known after apply)
      + kms_key_id                     = (sensitive value)
      + maintenance_window             = (known after apply)
      + member_clusters                = (known after apply)
      + multi_az_enabled               = false
      + network_type                   = (known after apply)
      + node_type                      = "cache.t4g.micro"
      + num_cache_clusters             = 1
      + num_node_groups                = (known after apply)
      + parameter_group_name           = "default.valkey8"
      + primary_endpoint_address       = (known after apply)
      + reader_endpoint_address        = (known after apply)
      + region                         = "us-east-1"
      + replicas_per_node_group        = (known after apply)
      + replication_group_id           = "flex-gateway-test"
      + security_group_ids             = (known after apply)
      + security_group_names           = (known after apply)
      + snapshot_window                = (known after apply)
      + subnet_group_name              = "flex-gateway-test"
      + tags                           = {
          + "Application" = "flex-gateway"
          + "ManagedBy"   = "Terraform"
          + "TfEnv"       = "test"
        }
      + tags_all                       = {
          + "Application" = "flex-gateway"
          + "ManagedBy"   = "Terraform"
          + "TfEnv"       = "test"
        }
      + transit_encryption_enabled     = true
      + transit_encryption_mode        = "required"

      + node_group_configuration (known after apply)
    }

  # module.flex_gateway.aws_elasticache_subnet_group.main will be created
  + resource "aws_elasticache_subnet_group" "main" {
      + arn         = (known after apply)
      + description = "Managed by Terraform"
      + id          = (known after apply)
      + name        = "flex-gateway-test"
      + region      = "us-east-1"
      + subnet_ids  = [
          + "subnet-0d5478758a826841e",
          + "subnet-0ff7f0642b438fbeb",
        ]
      + tags        = {
          + "Application" = "flex-gateway"
          + "ManagedBy"   = "Terraform"
          + "TfEnv"       = "test"
        }
      + tags_all    = {
          + "Application" = "flex-gateway"
          + "ManagedBy"   = "Terraform"
          + "TfEnv"       = "test"
        }
      + vpc_id      = (known after apply)
    }

  # module.flex_gateway.aws_iam_instance_profile.ec2 will be created
  + resource "aws_iam_instance_profile" "ec2" {
      + arn         = (known after apply)
      + create_date = (known after apply)
      + id          = (known after apply)
      + name        = "flex-gateway-test-ec2"
      + name_prefix = (known after apply)
      + path        = "/"
      + role        = "flex-gateway-test-ec2"
      + tags_all    = (known after apply)
      + unique_id   = (known after apply)
    }

  # module.flex_gateway.aws_iam_role.ec2 will be created
  + resource "aws_iam_role" "ec2" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "flex-gateway-test-ec2"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags                  = {
          + "Application" = "flex-gateway"
          + "ManagedBy"   = "Terraform"
          + "TfEnv"       = "test"
        }
      + tags_all              = {
          + "Application" = "flex-gateway"
          + "ManagedBy"   = "Terraform"
          + "TfEnv"       = "test"
        }
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # module.flex_gateway.aws_iam_role_policy_attachments_exclusive.ec2 will be created
  + resource "aws_iam_role_policy_attachments_exclusive" "ec2" {
      + policy_arns = [
          + "arn:aws:iam::975050025792:policy/flex-gateway-test-kms",
          + "arn:aws:iam::975050025792:policy/flex-gateway-test-s3",
          + "arn:aws:iam::975050025792:policy/flex-gateway-test-ssm",
          + "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
          + "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess",
        ]
      + role_name   = "flex-gateway-test-ec2"
    }

  # module.flex_gateway.aws_launch_template.main will be created
  + resource "aws_launch_template" "main" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + id                     = (known after apply)
      + image_id               = "ami-024ee5112d03921e2"
      + instance_type          = "t3.small"
      + key_name               = "dev-key"
      + latest_version         = (known after apply)
      + name                   = "flex-gateway-test"
      + name_prefix            = (known after apply)
      + region                 = "us-east-1"
      + tags                   = {
          + "Application" = "flex-gateway"
          + "ManagedBy"   = "Terraform"
          + "Name"        = "flex-gateway-test"
          + "TfEnv"       = "test"
        }
      + tags_all               = {
          + "Application" = "flex-gateway"
          + "ManagedBy"   = "Terraform"
          + "Name"        = "flex-gateway-test"
          + "TfEnv"       = "test"
        }
      + update_default_version = true
      + user_data              = "IyEvYmluL2Jhc2gKZXhlYyA+ID4odGVlIC92YXIvbG9nL3VzZXItZGF0YS5sb2d8bG9nZ2VyIC10IHVzZXItZGF0YSAtcyAyPi9kZXYvY29uc29sZSkgMj4mMQpkbmYgaW5zdGFsbCAteSBnaXQKc3VkbyAtdSBlYzItdXNlciBiYXNoIC1jICdjZCB+OyBnaXQgY2xvbmUgaHR0cHM6Ly9naXRodWIuY29tL0NpdHlPZlBoaWxhZGVscGhpYS9tdWxlc29mdC1mbGV4LWdhdGV3YXktaWFjLmdpdCcKc3VkbyAtdSBlYzItdXNlciBiYXNoIC1jICdjZCB+L211bGVzb2Z0LWZsZXgtZ2F0ZXdheS1pYWM7IGdpdCBjaGVja291dCBtYWluOyBiYXNoIHNlcnZlci9idWlsZC5zaCBmbGV4LWdhdGV3YXkgdGVzdCcK"
      + vpc_security_group_ids = [
          + "sg-000ccbe97e4b2845c",
          + "sg-0014e8d551f6d514b",
        ]

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination      = "true"
              + encrypted                  = "true"
              + iops                       = (known after apply)
              + kms_key_id                 = (sensitive value)
              + throughput                 = (known after apply)
              + volume_initialization_rate = (known after apply)
              + volume_size                = 10
              + volume_type                = "gp3"
            }
        }

      + iam_instance_profile {
          + arn = (known after apply)
        }

      + metadata_options (known after apply)

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Application" = "flex-gateway"
              + "ManagedBy"   = "Terraform"
              + "Name"        = "flex-gateway-test"
              + "TfEnv"       = "test"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Application" = "flex-gateway"
              + "ManagedBy"   = "Terraform"
              + "Name"        = "flex-gateway-test"
              + "TfEnv"       = "test"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Application" = "flex-gateway"
              + "ManagedBy"   = "Terraform"
              + "Name"        = "flex-gateway-test"
              + "TfEnv"       = "test"
            }
        }
    }

  # module.flex_gateway.aws_lb.main will be created
  + resource "aws_lb" "main" {
      + arn                                                          = (known after apply)
      + arn_suffix                                                   = (known after apply)
      + client_keep_alive                                            = 3600
      + desync_mitigation_mode                                       = "defensive"
      + dns_name                                                     = (known after apply)
      + drop_invalid_header_fields                                   = false
      + enable_deletion_protection                                   = false
      + enable_http2                                                 = true
      + enable_tls_version_and_cipher_suite_headers                  = false
      + enable_waf_fail_open                                         = false
      + enable_xff_client_port                                       = false
      + enable_zonal_shift                                           = false
      + enforce_security_group_inbound_rules_on_private_link_traffic = (known after apply)
      + id                                                           = (known after apply)
      + idle_timeout                                                 = 60
      + internal                                                     = false
      + ip_address_type                                              = (known after apply)
      + load_balancer_type                                           = "application"
      + name                                                         = "flex-gateway-test"
      + name_prefix                                                  = (known after apply)
      + preserve_host_header                                         = false
      + region                                                       = "us-east-1"
      + secondary_ips_auto_assigned_per_subnet                       = (known after apply)
      + security_groups                                              = (known after apply)
      + subnets                                                      = [
          + "subnet-021a798c801a6de15",
          + "subnet-04befa32beadb1606",
        ]
      + tags                                                         = {
          + "Application" = "flex-gateway"
          + "ManagedBy"   = "Terraform"
          + "TfEnv"       = "test"
        }
      + tags_all                                                     = {
          + "Application" = "flex-gateway"
          + "ManagedBy"   = "Terraform"
          + "TfEnv"       = "test"
        }
      + vpc_id                                                       = (known after apply)
      + xff_header_processing_mode                                   = "append"
      + zone_id                                                      = (known after apply)

      + subnet_mapping (known after apply)
    }

  # module.flex_gateway.aws_lb_listener.http will be created
  + resource "aws_lb_listener" "http" {
      + arn                                                                   = (known after apply)
      + id                                                                    = (known after apply)
      + load_balancer_arn                                                     = (known after apply)
      + port                                                                  = 80
      + protocol                                                              = "HTTP"
      + region                                                                = "us-east-1"
      + routing_http_request_x_amzn_mtls_clientcert_header_name               = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_issuer_header_name        = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_leaf_header_name          = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_serial_number_header_name = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_subject_header_name       = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_validity_header_name      = (known after apply)
      + routing_http_request_x_amzn_tls_cipher_suite_header_name              = (known after apply)
      + routing_http_request_x_amzn_tls_version_header_name                   = (known after apply)
      + routing_http_response_access_control_allow_credentials_header_value   = (known after apply)
      + routing_http_response_access_control_allow_headers_header_value       = (known after apply)
      + routing_http_response_access_control_allow_methods_header_value       = (known after apply)
      + routing_http_response_access_control_allow_origin_header_value        = (known after apply)
      + routing_http_response_access_control_expose_headers_header_value      = (known after apply)
      + routing_http_response_access_control_max_age_header_value             = (known after apply)
      + routing_http_response_content_security_policy_header_value            = (known after apply)
      + routing_http_response_server_enabled                                  = (known after apply)
      + routing_http_response_strict_transport_security_header_value          = (known after apply)
      + routing_http_response_x_content_type_options_header_value             = (known after apply)
      + routing_http_response_x_frame_options_header_value                    = (known after apply)
      + ssl_policy                                                            = (known after apply)
      + tags_all                                                              = (known after apply)
      + tcp_idle_timeout_seconds                                              = (known after apply)

      + default_action {
          + order = (known after apply)
          + type  = "redirect"

          + redirect {
              + host        = "#{host}"
              + path        = "/#{path}"
              + port        = "443"
              + protocol    = "HTTPS"
              + query       = "#{query}"
              + status_code = "HTTP_301"
            }
        }

      + mutual_authentication (known after apply)
    }

  # module.flex_gateway.aws_lb_listener.https will be created
  + resource "aws_lb_listener" "https" {
      + arn                                                                   = (known after apply)
      + certificate_arn                                                       = "arn:aws:acm:us-east-1:975050025792:certificate/dc0c25c0-84e6-45aa-90b5-590f8bd8296c"
      + id                                                                    = (known after apply)
      + load_balancer_arn                                                     = (known after apply)
      + port                                                                  = 443
      + protocol                                                              = "HTTPS"
      + region                                                                = "us-east-1"
      + routing_http_request_x_amzn_mtls_clientcert_header_name               = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_issuer_header_name        = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_leaf_header_name          = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_serial_number_header_name = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_subject_header_name       = (known after apply)
      + routing_http_request_x_amzn_mtls_clientcert_validity_header_name      = (known after apply)
      + routing_http_request_x_amzn_tls_cipher_suite_header_name              = (known after apply)
      + routing_http_request_x_amzn_tls_version_header_name                   = (known after apply)
      + routing_http_response_access_control_allow_credentials_header_value   = (known after apply)
      + routing_http_response_access_control_allow_headers_header_value       = (known after apply)
      + routing_http_response_access_control_allow_methods_header_value       = (known after apply)
      + routing_http_response_access_control_allow_origin_header_value        = (known after apply)
      + routing_http_response_access_control_expose_headers_header_value      = (known after apply)
      + routing_http_response_access_control_max_age_header_value             = (known after apply)
      + routing_http_response_content_security_policy_header_value            = (known after apply)
      + routing_http_response_server_enabled                                  = (known after apply)
      + routing_http_response_strict_transport_security_header_value          = (known after apply)
      + routing_http_response_x_content_type_options_header_value             = (known after apply)
      + routing_http_response_x_frame_options_header_value                    = (known after apply)
      + ssl_policy                                                            = "ELBSecurityPolicy-TLS13-1-2-Res-2021-06"
      + tags_all                                                              = (known after apply)
      + tcp_idle_timeout_seconds                                              = (known after apply)

      + default_action {
          + order            = (known after apply)
          + target_group_arn = (known after apply)
          + type             = "forward"
        }

      + mutual_authentication (known after apply)
    }

  # module.flex_gateway.aws_lb_target_group.flex_gateway will be created
  + resource "aws_lb_target_group" "flex_gateway" {
      + arn                                = (known after apply)
      + arn_suffix                         = (known after apply)
      + connection_termination             = (known after apply)
      + deregistration_delay               = "300"
      + id                                 = (known after apply)
      + ip_address_type                    = (known after apply)
      + lambda_multi_value_headers_enabled = false
      + load_balancer_arns                 = (known after apply)
      + load_balancing_algorithm_type      = (known after apply)
      + load_balancing_anomaly_mitigation  = (known after apply)
      + load_balancing_cross_zone_enabled  = (known after apply)
      + name                               = "flex-gateway-test-flex-gateway"
      + name_prefix                        = (known after apply)
      + port                               = 8081
      + preserve_client_ip                 = (known after apply)
      + protocol                           = "HTTP"
      + protocol_version                   = (known after apply)
      + proxy_protocol_v2                  = false
      + region                             = "us-east-1"
      + slow_start                         = 0
      + tags_all                           = (known after apply)
      + target_type                        = "instance"
      + vpc_id                             = "vpc-0003c2fc508cbdab4"

      + health_check {
          + enabled             = true
          + healthy_threshold   = 3
          + interval            = 30
          + matcher             = (known after apply)
          + path                = "/custom-health-check.html"
          + port                = "80"
          + protocol            = "HTTP"
          + timeout             = (known after apply)
          + unhealthy_threshold = 3
        }

      + stickiness (known after apply)

      + target_failover (known after apply)

      + target_group_health (known after apply)

      + target_health_state (known after apply)
    }

  # module.flex_gateway.aws_s3_bucket_public_access_block.main will be created
  + resource "aws_s3_bucket_public_access_block" "main" {
      + block_public_acls       = true
      + block_public_policy     = true
      + bucket                  = "phl-citygeo-flex-gateway-test"
      + id                      = (known after apply)
      + ignore_public_acls      = true
      + region                  = "us-east-1"
      + restrict_public_buckets = true
    }

  # module.flex_gateway.aws_s3_bucket_server_side_encryption_configuration.main will be created
  + resource "aws_s3_bucket_server_side_encryption_configuration" "main" {
      + bucket = "phl-citygeo-flex-gateway-test"
      + id     = (known after apply)
      + region = "us-east-1"

      + rule {
          # At least one attribute in this block is (or was) sensitive,
          # so its contents will not be displayed.
        }
    }

  # module.flex_gateway.aws_s3_object.registration will be created
  + resource "aws_s3_object" "registration" {
      + acl                    = (known after apply)
      + arn                    = (known after apply)
      + bucket                 = "phl-citygeo-flex-gateway-test"
      + bucket_key_enabled     = (known after apply)
      + checksum_crc32         = (known after apply)
      + checksum_crc32c        = (known after apply)
      + checksum_crc64nvme     = (known after apply)
      + checksum_sha1          = (known after apply)
      + checksum_sha256        = (known after apply)
      + content_base64         = (sensitive value)
      + content_type           = (known after apply)
      + etag                   = (known after apply)
      + force_destroy          = false
      + id                     = (known after apply)
      + key                    = "registration.yaml"
      + kms_key_id             = (known after apply)
      + region                 = "us-east-1"
      + server_side_encryption = (known after apply)
      + storage_class          = (known after apply)
      + tags_all               = (known after apply)
      + version_id             = (known after apply)
    }

  # module.flex_gateway.aws_security_group.alb will be created
  + resource "aws_security_group" "alb" {
      + arn                    = (known after apply)
      + description            = "SG for ALB"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "flex-gateway-test-alb"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + region                 = "us-east-1"
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Application" = "flex-gateway"
          + "ManagedBy"   = "Terraform"
          + "Name"        = "flex-gateway-test-alb"
          + "TfEnv"       = "test"
        }
      + tags_all               = {
          + "Application" = "flex-gateway"
          + "ManagedBy"   = "Terraform"
          + "Name"        = "flex-gateway-test-alb"
          + "TfEnv"       = "test"
        }
      + vpc_id                 = "vpc-0003c2fc508cbdab4"
    }

  # module.flex_gateway.aws_security_group.redis will be created
  + resource "aws_security_group" "redis" {
      + arn                    = (known after apply)
      + description            = "SG for Elasticache Redis"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "flex-gateway-test-redis"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + region                 = "us-east-1"
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Application" = "flex-gateway"
          + "ManagedBy"   = "Terraform"
          + "Name"        = "flex-gateway-test-redis"
          + "TfEnv"       = "test"
        }
      + tags_all               = {
          + "Application" = "flex-gateway"
          + "ManagedBy"   = "Terraform"
          + "Name"        = "flex-gateway-test-redis"
          + "TfEnv"       = "test"
        }
      + vpc_id                 = "vpc-0003c2fc508cbdab4"
    }

  # module.flex_gateway.aws_ssm_parameter.flex_gateway_tag will be created
  + resource "aws_ssm_parameter" "flex_gateway_tag" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (known after apply)
      + name           = "/flex-gateway/test/flex_gateway_tag"
      + region         = "us-east-1"
      + tags_all       = (known after apply)
      + tier           = (known after apply)
      + type           = "String"
      + value          = (sensitive value)
      + value_wo       = (write-only attribute)
      + version        = (known after apply)
    }

  # module.flex_gateway.aws_ssm_parameter.loki_pw will be created
  + resource "aws_ssm_parameter" "loki_pw" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (sensitive value)
      + name           = "/flex-gateway/test/loki_pw"
      + region         = "us-east-1"
      + tags_all       = (known after apply)
      + tier           = (known after apply)
      + type           = "SecureString"
      + value          = (sensitive value)
      + value_wo       = (write-only attribute)
      + version        = (known after apply)
    }

  # module.flex_gateway.aws_ssm_parameter.loki_user will be created
  + resource "aws_ssm_parameter" "loki_user" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (sensitive value)
      + name           = "/flex-gateway/test/loki_user"
      + region         = "us-east-1"
      + tags_all       = (known after apply)
      + tier           = (known after apply)
      + type           = "SecureString"
      + value          = (sensitive value)
      + value_wo       = (write-only attribute)
      + version        = (known after apply)
    }

  # module.flex_gateway.aws_ssm_parameter.prometheus_pw will be created
  + resource "aws_ssm_parameter" "prometheus_pw" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (sensitive value)
      + name           = "/flex-gateway/test/prometheus_pw"
      + region         = "us-east-1"
      + tags_all       = (known after apply)
      + tier           = (known after apply)
      + type           = "SecureString"
      + value          = (sensitive value)
      + value_wo       = (write-only attribute)
      + version        = (known after apply)
    }

  # module.flex_gateway.aws_ssm_parameter.prometheus_user will be created
  + resource "aws_ssm_parameter" "prometheus_user" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (sensitive value)
      + name           = "/flex-gateway/test/prometheus_user"
      + region         = "us-east-1"
      + tags_all       = (known after apply)
      + tier           = (known after apply)
      + type           = "SecureString"
      + value          = (sensitive value)
      + value_wo       = (write-only attribute)
      + version        = (known after apply)
    }

  # module.flex_gateway.aws_ssm_parameter.redis_endpoint will be created
  + resource "aws_ssm_parameter" "redis_endpoint" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (known after apply)
      + name           = "/flex-gateway/test/redis_endpoint"
      + region         = "us-east-1"
      + tags_all       = (known after apply)
      + tier           = (known after apply)
      + type           = "String"
      + value          = (sensitive value)
      + value_wo       = (write-only attribute)
      + version        = (known after apply)
    }

  # module.flex_gateway.aws_ssm_parameter.redis_pw will be created
  + resource "aws_ssm_parameter" "redis_pw" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (sensitive value)
      + name           = "/flex-gateway/test/redis_pw"
      + region         = "us-east-1"
      + tags_all       = (known after apply)
      + tier           = (known after apply)
      + type           = "SecureString"
      + value          = (sensitive value)
      + value_wo       = (write-only attribute)
      + version        = (known after apply)
    }

  # module.flex_gateway.aws_ssm_parameter.registration_s3_key will be created
  + resource "aws_ssm_parameter" "registration_s3_key" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (known after apply)
      + name           = "/flex-gateway/test/registration_s3_key"
      + region         = "us-east-1"
      + tags_all       = (known after apply)
      + tier           = (known after apply)
      + type           = "String"
      + value          = (sensitive value)
      + value_wo       = (write-only attribute)
      + version        = (known after apply)
    }

  # module.flex_gateway.aws_ssm_parameter.s3_name will be created
  + resource "aws_ssm_parameter" "s3_name" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (known after apply)
      + name           = "/flex-gateway/test/s3_name"
      + region         = "us-east-1"
      + tags_all       = (known after apply)
      + tier           = (known after apply)
      + type           = "String"
      + value          = (sensitive value)
      + value_wo       = (write-only attribute)
      + version        = (known after apply)
    }

  # module.flex_gateway.aws_vpc_security_group_egress_rule.alb_outbound_all_to_ec2 will be created
  + resource "aws_vpc_security_group_egress_rule" "alb_outbound_all_to_ec2" {
      + arn                          = (known after apply)
      + description                  = "Full outbound access to ec2"
      + id                           = (known after apply)
      + ip_protocol                  = "-1"
      + referenced_security_group_id = "sg-000ccbe97e4b2845c"
      + region                       = "us-east-1"
      + security_group_id            = (known after apply)
      + security_group_rule_id       = (known after apply)
      + tags_all                     = {}
    }

  # module.flex_gateway.aws_vpc_security_group_egress_rule.ec2_outbound_all_to_everywhere will be created
  + resource "aws_vpc_security_group_egress_rule" "ec2_outbound_all_to_everywhere" {
      + arn                    = (known after apply)
      + cidr_ipv4              = "0.0.0.0/0"
      + description            = "Full outbound access"
      + id                     = (known after apply)
      + ip_protocol            = "-1"
      + region                 = "us-east-1"
      + security_group_id      = "sg-000ccbe97e4b2845c"
      + security_group_rule_id = (known after apply)
      + tags_all               = {}
    }

  # module.flex_gateway.aws_vpc_security_group_ingress_rule.alb_inbound_http_from_anywhere will be created
  + resource "aws_vpc_security_group_ingress_rule" "alb_inbound_http_from_anywhere" {
      + arn                    = (known after apply)
      + cidr_ipv4              = "0.0.0.0/0"
      + description            = "Inbound http access from anywhere"
      + from_port              = 80
      + id                     = (known after apply)
      + ip_protocol            = "tcp"
      + region                 = "us-east-1"
      + security_group_id      = (known after apply)
      + security_group_rule_id = (known after apply)
      + tags_all               = {}
      + to_port                = 80
    }

  # module.flex_gateway.aws_vpc_security_group_ingress_rule.alb_inbound_https_from_anywhere will be created
  + resource "aws_vpc_security_group_ingress_rule" "alb_inbound_https_from_anywhere" {
      + arn                    = (known after apply)
      + cidr_ipv4              = "0.0.0.0/0"
      + description            = "Inbound https access from anywhere"
      + from_port              = 443
      + id                     = (known after apply)
      + ip_protocol            = "tcp"
      + region                 = "us-east-1"
      + security_group_id      = (known after apply)
      + security_group_rule_id = (known after apply)
      + tags_all               = {}
      + to_port                = 443
    }

  # module.flex_gateway.aws_vpc_security_group_ingress_rule.ec2_inbound_flex_gateway_from_alb will be created
  + resource "aws_vpc_security_group_ingress_rule" "ec2_inbound_flex_gateway_from_alb" {
      + arn                          = (known after apply)
      + description                  = "Inbound http access from ALB"
      + from_port                    = 8081
      + id                           = (known after apply)
      + ip_protocol                  = "tcp"
      + referenced_security_group_id = (known after apply)
      + region                       = "us-east-1"
      + security_group_id            = "sg-000ccbe97e4b2845c"
      + security_group_rule_id       = (known after apply)
      + tags_all                     = {}
      + to_port                      = 8081
    }

  # module.flex_gateway.aws_vpc_security_group_ingress_rule.ec2_inbound_http_from_alb will be created
  + resource "aws_vpc_security_group_ingress_rule" "ec2_inbound_http_from_alb" {
      + arn                          = (known after apply)
      + description                  = "Inbound http access from ALB"
      + from_port                    = 80
      + id                           = (known after apply)
      + ip_protocol                  = "tcp"
      + referenced_security_group_id = (known after apply)
      + region                       = "us-east-1"
      + security_group_id            = "sg-000ccbe97e4b2845c"
      + security_group_rule_id       = (known after apply)
      + tags_all                     = {}
      + to_port                      = 80
    }

  # module.flex_gateway.aws_vpc_security_group_ingress_rule.redis_inbound_redis_from_ec2 will be created
  + resource "aws_vpc_security_group_ingress_rule" "redis_inbound_redis_from_ec2" {
      + arn                          = (known after apply)
      + description                  = "Inbound REDIS access from EC2"
      + from_port                    = 6379
      + id                           = (known after apply)
      + ip_protocol                  = "tcp"
      + referenced_security_group_id = "sg-000ccbe97e4b2845c"
      + region                       = "us-east-1"
      + security_group_id            = (known after apply)
      + security_group_rule_id       = (known after apply)
      + tags_all                     = {}
      + to_port                      = 6379
    }

  # module.flex_gateway.aws_wafv2_web_acl.main will be created
  + resource "aws_wafv2_web_acl" "main" {
      + application_integration_url = (known after apply)
      + arn                         = (known after apply)
      + capacity                    = (known after apply)
      + description                 = "Flex gateway WAF for rate limiting, bot control, and anonymous IP CAPTCHA"
      + id                          = (known after apply)
      + lock_token                  = (known after apply)
      + name                        = "flex-gateway-test-flex-waf"
      + name_prefix                 = (known after apply)
      + region                      = "us-east-1"
      + scope                       = "REGIONAL"
      + tags_all                    = (known after apply)

      + custom_response_body {
          + content      = jsonencode(
                {
                  + error   = "Too Many Requests"
                  + message = "You have exceeded the rate limit for /carto-legacy/"
                }
            )
          + content_type = "APPLICATION_JSON"
          + key          = "CartoRateLimitError"
        }

      + default_action {
          + allow {
            }
        }

      + rule {
          + name     = "Atlas-carto-rate-limit"
          + priority = 4

          + action {
              + block {
                  + custom_response {
                      + custom_response_body_key = "CartoRateLimitError"
                      + response_code            = 429
                    }
                }
            }

          + statement {
              + rate_based_statement {
                  + aggregate_key_type    = "IP"
                  + evaluation_window_sec = 300
                  + limit                 = 200

                  + scope_down_statement {
                      + and_statement {
                          + statement {
                              + byte_match_statement {
                                  + positional_constraint = "EXACTLY"
                                  + search_string         = "https://atlas.phila.gov/"

                                  + field_to_match {
                                      + single_header {
                                          + name = "origin"
                                        }
                                    }

                                  + text_transformation {
                                      + priority = 0
                                      + type     = "LOWERCASE"
                                    }
                                }
                            }
                          + statement {
                              + byte_match_statement {
                                  + positional_constraint = "STARTS_WITH"
                                  + search_string         = "/carto-legacy/"

                                  + field_to_match {
                                      + uri_path {}
                                    }

                                  + text_transformation {
                                      + priority = 0
                                      + type     = "NONE"
                                    }
                                }
                            }
                        }
                    }
                }
            }

          + visibility_config {
              + cloudwatch_metrics_enabled = true
              + metric_name                = "FlexCartoAtlasRateLimit"
              + sampled_requests_enabled   = true
            }
        }
      + rule {
          + name     = "RateLimit-Carto-Aggressive"
          + priority = 5

          + action {
              + block {
                  + custom_response {
                      + custom_response_body_key = "CartoRateLimitError"
                      + response_code            = 429
                    }
                }
            }

          + statement {
              + rate_based_statement {
                  + aggregate_key_type    = "IP"
                  + evaluation_window_sec = 300
                  + limit                 = 10

                  + scope_down_statement {
                      + byte_match_statement {
                          + positional_constraint = "STARTS_WITH"
                          + search_string         = "/carto-legacy/"

                          + field_to_match {
                              + uri_path {}
                            }

                          + text_transformation {
                              + priority = 0
                              + type     = "NONE"
                            }
                        }
                    }
                }
            }

          + visibility_config {
              + cloudwatch_metrics_enabled = true
              + metric_name                = "FlexCartoBotControl"
              + sampled_requests_enabled   = true
            }
        }
      + rule {
          + name     = "RateLimit-DDoS"
          + priority = 10

          + action {
              + block {
                }
            }

          + statement {
              + rate_based_statement {
                  + aggregate_key_type    = "IP"
                  + evaluation_window_sec = 300
                  + limit                 = 5000
                }
            }

          + visibility_config {
              + cloudwatch_metrics_enabled = true
              + metric_name                = "FlexRateLimit"
              + sampled_requests_enabled   = true
            }
        }
      + rule {
          + name     = "AWS-AnonymousIP"
          + priority = 20

          + override_action {
              + none {}
            }

          + statement {
              + managed_rule_group_statement {
                  + name        = "AWSManagedRulesAnonymousIpList"
                  + vendor_name = "AWS"
                    # (1 unchanged attribute hidden)

                  + rule_action_override {
                      + name = "AnonymousIPList"

                      + action_to_use {
                          + captcha {
                            }
                        }
                    }
                }
            }

          + visibility_config {
              + cloudwatch_metrics_enabled = true
              + metric_name                = "FlexAnonymousIP"
              + sampled_requests_enabled   = true
            }
        }
      + rule {
          + name     = "AWS-BotControl"
          + priority = 30

          + override_action {
              + none {}
            }

          + statement {
              + managed_rule_group_statement {
                  + name        = "AWSManagedRulesBotControlRuleSet"
                  + vendor_name = "AWS"
                    # (1 unchanged attribute hidden)

                  + rule_action_override {
                      + name = "CategoryBot"

                      + action_to_use {
                          + captcha {
                            }
                        }
                    }

                  + scope_down_statement {
                      + byte_match_statement {
                          + positional_constraint = "STARTS_WITH"
                          + search_string         = "/carto-legacy/"

                          + field_to_match {
                              + uri_path {}
                            }

                          + text_transformation {
                              + priority = 0
                              + type     = "NONE"
                            }
                        }
                    }
                }
            }

          + visibility_config {
              + cloudwatch_metrics_enabled = true
              + metric_name                = "FlexBotControl"
              + sampled_requests_enabled   = true
            }
        }

      + visibility_config {
          + cloudwatch_metrics_enabled = true
          + metric_name                = "flex_waf"
          + sampled_requests_enabled   = true
        }
    }

  # module.flex_gateway.aws_wafv2_web_acl_association.main will be created
  + resource "aws_wafv2_web_acl_association" "main" {
      + id           = (known after apply)
      + region       = "us-east-1"
      + resource_arn = (known after apply)
      + web_acl_arn  = (known after apply)
    }

  # module.flex_gateway.aws_wafv2_web_acl_logging_configuration.main will be created
  + resource "aws_wafv2_web_acl_logging_configuration" "main" {
      + id                      = (known after apply)
      + log_destination_configs = (known after apply)
      + region                  = "us-east-1"
      + resource_arn            = (known after apply)

      + logging_filter {
          + default_behavior = "DROP"

          + filter {
              + behavior    = "KEEP"
              + requirement = "MEETS_ANY"

              + condition {
                  + action_condition {
                      + action = "BLOCK"
                    }
                }
            }
        }
    }

Plan: 37 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

Pusher: @citygeo-bot[bot]

[citygeo-bot]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.