Fix/deployment issue regarding alarms rework 2

[craigzour]

Summary | Résumé

1-3 sentence description of the changed you're proposing, including a link to
a GitHub Issue # or Trello card if applicable.

---

Description en 1 à 3 phrases de la modification proposée, avec un lien vers le
problème (« issue ») GitHub ou la fiche Trello, le cas échéant.

Test instructions | Instructions pour tester la modification

Sequential steps (1., 2., 3., ...) that describe how to test this change. This
will help a developer test things out without too much detective work. Also,
include any environmental setup steps that aren't in the normal README steps
and/or any time-based elements that this requires.

---

Étapes consécutives (1., 2., 3., …) qui décrivent la façon de tester la
modification. Elles aideront les développeurs à faire des tests sans avoir à
jouer au détective. Veuillez aussi inclure toutes les étapes de configuration
de l’environnement qui ne font pas partie des étapes normales dans le fichier
README et tout élément temporel requis.

[github-actions]

⚠ Terrform update available

Terraform: 1.5.2 (using 1.4.2)
Terragrunt: 0.48.1 (using 0.46.3)

[github-actions]

Staging: alarms

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

⚠️   Warning: resources will be destroyed by this change!

Plan: 21 to add, 0 to change, 12 to destroy

Show summary

CHANGE	NAME
recreate	aws_lambda_function.notify_slack
	aws_lambda_permission.allow_cloudwatch_to_run_lambda
	aws_lambda_permission.notify_slack_critical
	aws_lambda_permission.notify_slack_ok
	aws_lambda_permission.notify_slack_ok_us_east
	aws_lambda_permission.notify_slack_warning
	aws_lambda_permission.notify_slack_warning_us_east
	aws_sns_topic_subscription.topic_critical
	aws_sns_topic_subscription.topic_ok
	aws_sns_topic_subscription.topic_ok_us_east
	aws_sns_topic_subscription.topic_warning
	aws_sns_topic_subscription.topic_warning_us_east
add	aws_cloudwatch_log_group.notify_slack
	aws_cloudwatch_log_subscription_filter.archiver_log_stream
	aws_cloudwatch_log_subscription_filter.audit_log_stream
	aws_cloudwatch_log_subscription_filter.dlq_consumer_log_stream
	aws_cloudwatch_log_subscription_filter.forms_app_log_stream
	aws_cloudwatch_log_subscription_filter.forms_unhandled_error_steam
	aws_cloudwatch_log_subscription_filter.nagware_log_stream
	aws_cloudwatch_log_subscription_filter.reliability_log_stream
	aws_cloudwatch_log_subscription_filter.template_archiver_log_stream

Show plan

Resource actions are indicated with the following symbols:
  + create
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_cloudwatch_log_group.notify_slack will be created
  + resource "aws_cloudwatch_log_group" "notify_slack" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + kms_key_id        = "arn:aws:kms:ca-central-1:687401027353:key/c5c2a1c2-c092-4fa1-8daf-3414f3511b1d"
      + name              = "/aws/lambda/NotifySlack"
      + retention_in_days = 90
      + tags_all          = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.archiver_log_stream will be created
  + resource "aws_cloudwatch_log_subscription_filter" "archiver_log_stream" {
      + destination_arn = (known after apply)
      + distribution    = "ByLogStream"
      + filter_pattern  = "{($.level = \"warn\") || ($.level = \"error\")}"
      + id              = (known after apply)
      + log_group_name  = "/aws/lambda/Archiver"
      + name            = "archiver_log_stream"
      + role_arn        = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.audit_log_stream will be created
  + resource "aws_cloudwatch_log_subscription_filter" "audit_log_stream" {
      + destination_arn = (known after apply)
      + distribution    = "ByLogStream"
      + filter_pattern  = "{($.level = \"warn\") || ($.level = \"error\")}"
      + id              = (known after apply)
      + log_group_name  = "/aws/lambda/AuditLogs"
      + name            = "audit_log_stream"
      + role_arn        = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.dlq_consumer_log_stream will be created
  + resource "aws_cloudwatch_log_subscription_filter" "dlq_consumer_log_stream" {
      + destination_arn = (known after apply)
      + distribution    = "ByLogStream"
      + filter_pattern  = "{($.level = \"warn\") || ($.level = \"error\")}"
      + id              = (known after apply)
      + log_group_name  = "/aws/lambda/DeadLetterQueueConsumer"
      + name            = "dql_consumer_log_stream"
      + role_arn        = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.forms_app_log_stream will be created
  + resource "aws_cloudwatch_log_subscription_filter" "forms_app_log_stream" {
      + destination_arn = (known after apply)
      + distribution    = "ByLogStream"
      + filter_pattern  = "{($.level = \"warn\") || ($.level = \"error\")}"
      + id              = (known after apply)
      + log_group_name  = "Forms"
      + name            = "forms_app_log_stream"
      + role_arn        = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.forms_unhandled_error_steam will be created
  + resource "aws_cloudwatch_log_subscription_filter" "forms_unhandled_error_steam" {
      + destination_arn = (known after apply)
      + distribution    = "ByLogStream"
      + filter_pattern  = "Error -level"
      + id              = (known after apply)
      + log_group_name  = "Forms"
      + name            = "forms_unhandled_error_stream"
      + role_arn        = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.nagware_log_stream will be created
  + resource "aws_cloudwatch_log_subscription_filter" "nagware_log_stream" {
      + destination_arn = (known after apply)
      + distribution    = "ByLogStream"
      + filter_pattern  = "{($.level = \"warn\") || ($.level = \"error\")}"
      + id              = (known after apply)
      + log_group_name  = "/aws/lambda/Nagware"
      + name            = "nagware_log_stream"
      + role_arn        = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.reliability_log_stream will be created
  + resource "aws_cloudwatch_log_subscription_filter" "reliability_log_stream" {
      + destination_arn = (known after apply)
      + distribution    = "ByLogStream"
      + filter_pattern  = "{($.level = \"warn\") || ($.level = \"error\")}"
      + id              = (known after apply)
      + log_group_name  = "/aws/lambda/Reliability"
      + name            = "reliability_log_stream"
      + role_arn        = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.template_archiver_log_stream will be created
  + resource "aws_cloudwatch_log_subscription_filter" "template_archiver_log_stream" {
      + destination_arn = (known after apply)
      + distribution    = "ByLogStream"
      + filter_pattern  = "{($.level = \"warn\") || ($.level = \"error\")}"
      + id              = (known after apply)
      + log_group_name  = "/aws/lambda/ArchiveFormTemplates"
      + name            = "template_archiver_log_stream"
      + role_arn        = (known after apply)
    }

  # aws_lambda_function.notify_slack must be replaced
-/+ resource "aws_lambda_function" "notify_slack" {
      ~ architectures                  = [
          - "x86_64",
        ] -> (known after apply)
      ~ arn                            = "arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS" -> (known after apply)
      ~ function_name                  = "NotifySlackSNS" -> "NotifySlack" # forces replacement
      ~ id                             = "NotifySlackSNS" -> (known after apply)
      ~ invoke_arn                     = "arn:aws:apigateway:ca-central-1:lambda:path/2015-03-31/functions/arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS/invocations" -> (known after apply)
      ~ last_modified                  = "2023-07-11T20:15:07.539+0000" -> (known after apply)
      - layers                         = [] -> null
      ~ qualified_arn                  = "arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS:$LATEST" -> (known after apply)
      + signing_job_arn                = (known after apply)
      + signing_profile_version_arn    = (known after apply)
      ~ source_code_size               = 1608 -> (known after apply)
        tags                           = {
            "CostCentre" = "forms-platform-staging"
            "Terraform"  = "true"
        }
      ~ version                        = "$LATEST" -> (known after apply)
        # (11 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # aws_lambda_permission.allow_cloudwatch_to_run_lambda must be replaced
-/+ resource "aws_lambda_permission" "allow_cloudwatch_to_run_lambda" {
      ~ function_name = "NotifySlackSNS" -> "NotifySlack" # forces replacement
      ~ id            = "AllowExecutionFromCloudWatch" -> (known after apply)
      ~ principal     = "events.amazonaws.com" -> "logs.amazonaws.com" # forces replacement
        # (3 unchanged attributes hidden)
    }

  # aws_lambda_permission.notify_slack_critical must be replaced
-/+ resource "aws_lambda_permission" "notify_slack_critical" {
      ~ function_name = "NotifySlackSNS" -> "NotifySlack" # forces replacement
      ~ id            = "AllowExecutionFromSNSCriticalAlert" -> (known after apply)
        # (4 unchanged attributes hidden)
    }

  # aws_lambda_permission.notify_slack_ok must be replaced
-/+ resource "aws_lambda_permission" "notify_slack_ok" {
      ~ function_name = "NotifySlackSNS" -> "NotifySlack" # forces replacement
      ~ id            = "AllowExecutionFromSNSOkAlert" -> (known after apply)
        # (4 unchanged attributes hidden)
    }

  # aws_lambda_permission.notify_slack_ok_us_east must be replaced
-/+ resource "aws_lambda_permission" "notify_slack_ok_us_east" {
      ~ function_name = "NotifySlackSNS" -> "NotifySlack" # forces replacement
      ~ id            = "AllowExecutionFromSNSOkAlertUSEast" -> (known after apply)
        # (4 unchanged attributes hidden)
    }

  # aws_lambda_permission.notify_slack_warning must be replaced
-/+ resource "aws_lambda_permission" "notify_slack_warning" {
      ~ function_name = "NotifySlackSNS" -> "NotifySlack" # forces replacement
      ~ id            = "AllowExecutionFromSNSWarningAlert" -> (known after apply)
        # (4 unchanged attributes hidden)
    }

  # aws_lambda_permission.notify_slack_warning_us_east must be replaced
-/+ resource "aws_lambda_permission" "notify_slack_warning_us_east" {
      ~ function_name = "NotifySlackSNS" -> "NotifySlack" # forces replacement
      ~ id            = "AllowExecutionFromSNSWarningAlertUSEast" -> (known after apply)
        # (4 unchanged attributes hidden)
    }

  # aws_sns_topic_subscription.topic_critical must be replaced
-/+ resource "aws_sns_topic_subscription" "topic_critical" {
      ~ arn                             = "arn:aws:sns:ca-central-1:687401027353:alert-critical:2f618f4f-fb22-4d75-9b9e-eb790a180e3e" -> (known after apply)
      ~ confirmation_was_authenticated  = true -> (known after apply)
      ~ endpoint                        = "arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS" # forces replacement -> (known after apply)
      ~ id                              = "arn:aws:sns:ca-central-1:687401027353:alert-critical:2f618f4f-fb22-4d75-9b9e-eb790a180e3e" -> (known after apply)
      ~ owner_id                        = "687401027353" -> (known after apply)
      ~ pending_confirmation            = false -> (known after apply)
        # (5 unchanged attributes hidden)
    }

  # aws_sns_topic_subscription.topic_ok must be replaced
-/+ resource "aws_sns_topic_subscription" "topic_ok" {
      ~ arn                             = "arn:aws:sns:ca-central-1:687401027353:alert-ok:674ef27d-9dec-442c-b7f3-fa4a3b7d4328" -> (known after apply)
      ~ confirmation_was_authenticated  = true -> (known after apply)
      ~ endpoint                        = "arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS" # forces replacement -> (known after apply)
      ~ id                              = "arn:aws:sns:ca-central-1:687401027353:alert-ok:674ef27d-9dec-442c-b7f3-fa4a3b7d4328" -> (known after apply)
      ~ owner_id                        = "687401027353" -> (known after apply)
      ~ pending_confirmation            = false -> (known after apply)
        # (5 unchanged attributes hidden)
    }

  # aws_sns_topic_subscription.topic_ok_us_east must be replaced
-/+ resource "aws_sns_topic_subscription" "topic_ok_us_east" {
      ~ arn                             = "arn:aws:sns:us-east-1:687401027353:alert-ok:e34cabe2-edd7-445c-a2b9-afee99493a22" -> (known after apply)
      ~ confirmation_was_authenticated  = true -> (known after apply)
      ~ endpoint                        = "arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS" # forces replacement -> (known after apply)
      ~ id                              = "arn:aws:sns:us-east-1:687401027353:alert-ok:e34cabe2-edd7-445c-a2b9-afee99493a22" -> (known after apply)
      ~ owner_id                        = "687401027353" -> (known after apply)
      ~ pending_confirmation            = false -> (known after apply)
        # (5 unchanged attributes hidden)
    }

  # aws_sns_topic_subscription.topic_warning must be replaced
-/+ resource "aws_sns_topic_subscription" "topic_warning" {
      ~ arn                             = "arn:aws:sns:ca-central-1:687401027353:alert-warning:e44a57ea-2a97-48fa-9e4f-63ef3fb0c630" -> (known after apply)
      ~ confirmation_was_authenticated  = true -> (known after apply)
      ~ endpoint                        = "arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS" # forces replacement -> (known after apply)
      ~ id                              = "arn:aws:sns:ca-central-1:687401027353:alert-warning:e44a57ea-2a97-48fa-9e4f-63ef3fb0c630" -> (known after apply)
      ~ owner_id                        = "687401027353" -> (known after apply)
      ~ pending_confirmation            = false -> (known after apply)
        # (5 unchanged attributes hidden)
    }

  # aws_sns_topic_subscription.topic_warning_us_east must be replaced
-/+ resource "aws_sns_topic_subscription" "topic_warning_us_east" {
      ~ arn                             = "arn:aws:sns:us-east-1:687401027353:alert-warning:ddcaa6db-dda0-4a69-8e01-2a85f79a56c2" -> (known after apply)
      ~ confirmation_was_authenticated  = true -> (known after apply)
      ~ endpoint                        = "arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS" # forces replacement -> (known after apply)
      ~ id                              = "arn:aws:sns:us-east-1:687401027353:alert-warning:ddcaa6db-dda0-4a69-8e01-2a85f79a56c2" -> (known after apply)
      ~ owner_id                        = "687401027353" -> (known after apply)
      ~ pending_confirmation            = false -> (known after apply)
        # (5 unchanged attributes hidden)
    }

Plan: 21 to add, 0 to change, 12 to destroy.

Warning: Argument is deprecated

  with module.athena_bucket.aws_s3_bucket.this,
  on .terraform/modules/athena_bucket/S3/main.tf line 8, in resource "aws_s3_bucket" "this":
   8: resource "aws_s3_bucket" "this" {

Use the aws_s3_bucket_server_side_encryption_configuration resource instead

(and 8 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.notify_slack"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.alb_ddos"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.route53_ddos"]

20 tests, 17 passed, 3 warnings, 0 failures, 0 exceptions