Skip to content

Switch the project to manage the terraform state on S3. - #514

Draft
tim-schilling wants to merge 10 commits into
mainfrom
aws-managed-state
Draft

Switch the project to manage the terraform state on S3.#514
tim-schilling wants to merge 10 commits into
mainfrom
aws-managed-state

Conversation

@tim-schilling

Copy link
Copy Markdown
Member

This moves the terraform state to a dynamo db stored on Tim's AWS account. This allows both the repos and members plans to make changes in the same PR without having to have a separate commit. There are instructions on how to migrate to the AWS configuration in the aws/README.md

This also starts utilizing the 1Password team account by storing sensitive variables in there such as admin emails and the AWS account id.

This moves the terraform state to a dynamo db stored on Tim's AWS
account. This allows both the repos and members plans to make changes
in the same PR without having to have a separate commit. There are
instructions on how to migrate to the AWS configuration in the aws/README.md

This also starts utilizing the 1Password team account by storing sensitive
variables in there such as admin emails and the AWS account id.
tim-schilling and others added 4 commits August 1, 2026 15:31
Resolves conflicts from main's migration from the Terraform to the OpenTofu
dflook actions:

- Keep the OpenTofu actions (tofu-plan/tofu-apply) from main, with the
  AWS OIDC credential step and id-token permission from this branch.
- Keep this branch's removal of the "Commit changes" step in both apply
  workflows: state now lives in S3, so there is nothing to commit back.
  With that step gone the apply jobs no longer need contents: write, and
  the checkout comment about the PAT/persist-credentials interaction no
  longer applies.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012o5Q68D6xFJuenqb2jmGE5
The repository's workflows run OpenTofu (#522), so the manually-applied
aws/ configuration and its docs should too.

- README: tofu init/apply/import, and prose referring to OpenTofu. The
  local state migration steps now use `tofu init -migrate-state` so the
  migrated state is written by the same tool CI runs.
- .terraform.lock.hcl: point at registry.opentofu.org, matching what
  `tofu init` did to the members/repositories lock files in ed55eea. The
  zh: hashes are unchanged (identical artifacts); tofu init backfills the
  additional per-platform h1: hashes on its next run.
- backend.tf: link the OpenTofu S3 backend docs.
- Descriptions and comments that mention Terraform where they mean the
  tool rather than a resource name.

AWS-visible names (the state bucket, lock table, TerraformStateAccess
permission set, and the inline policy names) are deliberately unchanged:
renaming them would destroy and recreate live resources.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012o5Q68D6xFJuenqb2jmGE5
@cunla
cunla deployed to production September 2, 2026 20:03 — with GitHub Actions Active
@cunla

cunla commented Sep 2, 2026

Copy link
Copy Markdown
Member

OpenTofu plan for members

Plan: 145 to add, 0 to change, 0 to destroy. Changes to Outputs.
OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create

OpenTofu will perform the following actions:

  # github_membership.this["2ykwang"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "2ykwang"
    }

  # github_membership.this["Ashish8329"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Ashish8329"
    }

  # github_membership.this["Ceasar15"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Ceasar15"
    }

  # github_membership.this["Chiemezuo"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Chiemezuo"
    }

  # github_membership.this["Daksh777"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Daksh777"
    }

  # github_membership.this["DhavalGojiya"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "DhavalGojiya"
    }

  # github_membership.this["Dresdn"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Dresdn"
    }

  # github_membership.this["EliShteinman"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "EliShteinman"
    }

  # github_membership.this["Faakhir30"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Faakhir30"
    }

  # github_membership.this["FlipperPA"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "FlipperPA"
    }

  # github_membership.this["Freed-Wu"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Freed-Wu"
    }

  # github_membership.this["GaretJax"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "GaretJax"
    }

  # github_membership.this["Haroonhsa007"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Haroonhsa007"
    }

  # github_membership.this["Hopiu"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Hopiu"
    }

  # github_membership.this["Horlawhumy-dev"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Horlawhumy-dev"
    }

  # github_membership.this["Insaida"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Insaida"
    }

  # github_membership.this["JohananOppongAmoateng"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "JohananOppongAmoateng"
    }

  # github_membership.this["Josephchinedu"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Josephchinedu"
    }

  # github_membership.this["Knowledgex187"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Knowledgex187"
    }

  # github_membership.this["M97Chahboun"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "M97Chahboun"
    }

  # github_membership.this["Mogost"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Mogost"
    }

  # github_membership.this["MrCordeiro"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "MrCordeiro"
    }

  # github_membership.this["Nathan-Bransby-NMT"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Nathan-Bransby-NMT"
    }

  # github_membership.this["Natim"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Natim"
    }

  # github_membership.this["Ndungu9039"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Ndungu9039"
    }

  # github_membership.this["RealOrangeOne"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "RealOrangeOne"
    }

  # github_membership.this["SaeedRz96"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "SaeedRz96"
    }

  # github_membership.this["SamChawla"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "SamChawla"
    }

  # github_membership.this["Shrikantgiri25"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Shrikantgiri25"
    }

  # github_membership.this["SinkuKumar"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "SinkuKumar"
    }

  # github_membership.this["Stormheg"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "admin"
+       username             = "Stormheg"
    }

  # github_membership.this["TildaDares"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "TildaDares"
    }

  # github_membership.this["TimothyMalahy"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "TimothyMalahy"
    }

  # github_membership.this["VeldaKiara"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "VeldaKiara"
    }

  # github_membership.this["Violette-Allotey"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Violette-Allotey"
    }

  # github_membership.this["Zakui"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "Zakui"
    }

  # github_membership.this["aayardev"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "aayardev"
    }

  # github_membership.this["adRn-s"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "adRn-s"
    }

  # github_membership.this["adamghill"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "adamghill"
    }

  # github_membership.this["akshayvinchurkar"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "akshayvinchurkar"
    }

  # github_membership.this["albertyw"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "albertyw"
    }

  # github_membership.this["aleksihakli"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "aleksihakli"
    }

  # github_membership.this["alex-dicko"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "alex-dicko"
    }

  # github_membership.this["amirreza-sf80"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "amirreza-sf80"
    }

  # github_membership.this["andoriyaprashant"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "andoriyaprashant"
    }

  # github_membership.this["asherf"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "asherf"
    }

  # github_membership.this["atanioyinbunua"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "atanioyinbunua"
    }

  # github_membership.this["ayimdomnic"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "ayimdomnic"
    }

  # github_membership.this["bahoo"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "bahoo"
    }

  # github_membership.this["bckohan"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "bckohan"
    }

  # github_membership.this["blingblin-g"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "blingblin-g"
    }

  # github_membership.this["browniebroke"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "browniebroke"
    }

  # github_membership.this["bryan-oginga"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "bryan-oginga"
    }

  # github_membership.this["camilonova"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "camilonova"
    }

  # github_membership.this["carltongibson"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "carltongibson"
    }

  # github_membership.this["cgl"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "cgl"
    }

  # github_membership.this["clintonb"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "clintonb"
    }

  # github_membership.this["codingjoe"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "codingjoe"
    }

  # github_membership.this["cunla"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "admin"
+       username             = "cunla"
    }

  # github_membership.this["danmoz"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "danmoz"
    }

  # github_membership.this["ddabble"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "ddabble"
    }

  # github_membership.this["deronnax"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "deronnax"
    }

  # github_membership.this["devatbosch"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "devatbosch"
    }

  # github_membership.this["dgravitate"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "dgravitate"
    }

  # github_membership.this["dmpayton"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "dmpayton"
    }

  # github_membership.this["dr-rompecabezas"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "dr-rompecabezas"
    }

  # github_membership.this["elineda"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "elineda"
    }

  # github_membership.this["federicobond"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "federicobond"
    }

  # github_membership.this["fladi"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "fladi"
    }

  # github_membership.this["forwardyoung"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "forwardyoung"
    }

  # github_membership.this["fsbraun"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "fsbraun"
    }

  # github_membership.this["g-nie"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "g-nie"
    }

  # github_membership.this["gav-fyi"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "gav-fyi"
    }

  # github_membership.this["giovannicimolin"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "giovannicimolin"
    }

  # github_membership.this["input"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "input"
    }

  # github_membership.this["jacklinke"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "jacklinke"
    }

  # github_membership.this["jburns6789"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "jburns6789"
    }

  # github_membership.this["jcjudkins"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "jcjudkins"
    }

  # github_membership.this["jezdez"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "jezdez"
    }

  # github_membership.this["jmgutu"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "jmgutu"
    }

  # github_membership.this["jnovinger"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "jnovinger"
    }

  # github_membership.this["johnatanmoran"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "johnatanmoran"
    }

  # github_membership.this["johnfraney"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "johnfraney"
    }

  # github_membership.this["joshuadavidthomas"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "joshuadavidthomas"
    }

  # github_membership.this["justbackend"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "justbackend"
    }

  # github_membership.this["justinmayer"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "justinmayer"
    }

  # github_membership.this["kevin-brown"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "kevin-brown"
    }

  # github_membership.this["knyghty"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "knyghty"
    }

  # github_membership.this["korfuri"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "korfuri"
    }

  # github_membership.this["kytta"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "kytta"
    }

  # github_membership.this["lander151"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "lander151"
    }

  # github_membership.this["leogregianin"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "leogregianin"
    }

  # github_membership.this["louzt"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "louzt"
    }

  # github_membership.this["luiscontrerasdo"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "luiscontrerasdo"
    }

  # github_membership.this["manelclos"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "manelclos"
    }

  # github_membership.this["marcosalvesdev"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "marcosalvesdev"
    }

  # github_membership.this["matthiask"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "matthiask"
    }

  # github_membership.this["mdehsan873"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "mdehsan873"
    }

  # github_membership.this["mgrdcm"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "mgrdcm"
    }

  # github_membership.this["mgstabrani"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "mgstabrani"
    }

  # github_membership.this["mihrab34"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "mihrab34"
    }

  # github_membership.this["mkalioby"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "mkalioby"
    }

  # github_membership.this["mnislam01"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "mnislam01"
    }

  # github_membership.this["mounirmesselmeni"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "mounirmesselmeni"
    }

  # github_membership.this["mzemlickis"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "mzemlickis"
    }

  # github_membership.this["nanorepublica"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "nanorepublica"
    }

  # github_membership.this["niltonpimentel02"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "niltonpimentel02"
    }

  # github_membership.this["nwanduka"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "nwanduka"
    }

  # github_membership.this["okotdaniel"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "okotdaniel"
    }

  # github_membership.this["oliverandrich"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "oliverandrich"
    }

  # github_membership.this["ontowhee"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "ontowhee"
    }

  # github_membership.this["pauloxnet"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "pauloxnet"
    }

  # github_membership.this["peterthomassen"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "peterthomassen"
    }

  # github_membership.this["pfouque"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "pfouque"
    }

  # github_membership.this["priyapahwa"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "priyapahwa"
    }

  # github_membership.this["riconnon"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "riconnon"
    }

  # github_membership.this["rptmat57"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "rptmat57"
    }

  # github_membership.this["ryancheley"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "admin"
+       username             = "ryancheley"
    }

  # github_membership.this["salty-ivy"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "salty-ivy"
    }

  # github_membership.this["sankarebarri"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "sankarebarri"
    }

  # github_membership.this["sergei-maertens"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "sergei-maertens"
    }

  # github_membership.this["sidmitra"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "sidmitra"
    }

  # github_membership.this["sobolevn"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "sobolevn"
    }

  # github_membership.this["spapas"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "spapas"
    }

  # github_membership.this["stereodamage"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "stereodamage"
    }

  # github_membership.this["sureshvv"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "sureshvv"
    }

  # github_membership.this["testSchilling"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "testSchilling"
    }

  # github_membership.this["thibaudcolas"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "thibaudcolas"
    }

  # github_membership.this["ticosax"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "ticosax"
    }

  # github_membership.this["tim-schilling"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "admin"
+       username             = "tim-schilling"
    }

  # github_membership.this["tintayadev"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "tintayadev"
    }

  # github_membership.this["ulgens"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "ulgens"
    }

  # github_membership.this["unmonoqueteclea"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "unmonoqueteclea"
    }

  # github_membership.this["vacarme"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "vacarme"
    }

  # github_membership.this["vinlawz"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "vinlawz"
    }

  # github_membership.this["viscofuse"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "viscofuse"
    }

  # github_membership.this["whitebumblebee"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "whitebumblebee"
    }

  # github_membership.this["williln"] will be created
+   resource "github_membership" "this" {
+       downgrade_on_destroy = false
+       etag                 = (known after apply)
+       id                   = (known after apply)
+       role                 = "member"
+       username             = "williln"
    }

  # github_organization_role_team.admins_security_manager will be created
+   resource "github_organization_role_team" "admins_security_manager" {
+       id        = (known after apply)
+       role_id   = 138
+       team_slug = (known after apply)
    }

  # github_team.org_designers_team will be created
+   resource "github_team" "org_designers_team" {
+       create_default_maintainer = false
+       description               = "Django Commons designers"
+       etag                      = (known after apply)
+       id                        = (known after apply)
+       members_count             = (known after apply)
+       name                      = "Designers"
+       node_id                   = (known after apply)
+       parent_team_read_id       = (known after apply)
+       parent_team_read_slug     = (known after apply)
+       privacy                   = "closed"
+       slug                      = (known after apply)
    }

  # github_team.org_teams["Admins"] will be created
+   resource "github_team" "org_teams" {
+       create_default_maintainer = false
+       description               = "Django Commons administrators. This team is responsible for the overall management of the organization."
+       etag                      = (known after apply)
+       id                        = (known after apply)
+       members_count             = (known after apply)
+       name                      = "Admins"
+       node_id                   = (known after apply)
+       parent_team_read_id       = (known after apply)
+       parent_team_read_slug     = (known after apply)
+       privacy                   = "closed"
+       slug                      = (known after apply)
    }

  # github_team.org_teams["super-admins"] will be created
+   resource "github_team" "org_teams" {
+       create_default_maintainer = false
+       description               = "Django Commons super administrators. This team is responsible for performing privileged operations."
+       etag                      = (known after apply)
+       id                        = (known after apply)
+       members_count             = (known after apply)
+       name                      = "super-admins"
+       node_id                   = (known after apply)
+       parent_team_read_id       = (known after apply)
+       parent_team_read_slug     = (known after apply)
+       privacy                   = "closed"
+       slug                      = (known after apply)
    }

  # github_team_members.org_designers_team_members will be created
+   resource "github_team_members" "org_designers_team_members" {
+       id      = (known after apply)
+       team_id = (known after apply)

+       members {
+           role     = "member"
+           username = "Daksh777"
        }
+       members {
+           role     = "member"
+           username = "Knowledgex187"
        }
+       members {
+           role     = "member"
+           username = "Ndungu9039"
        }
+       members {
+           role     = "member"
+           username = "Shrikantgiri25"
        }
+       members {
+           role     = "member"
+           username = "Violette-Allotey"
        }
+       members {
+           role     = "member"
+           username = "Zakui"
        }
+       members {
+           role     = "member"
+           username = "akshayvinchurkar"
        }
+       members {
+           role     = "member"
+           username = "federicobond"
        }
+       members {
+           role     = "member"
+           username = "jmgutu"
        }
+       members {
+           role     = "member"
+           username = "johnatanmoran"
        }
+       members {
+           role     = "member"
+           username = "louzt"
        }
+       members {
+           role     = "member"
+           username = "mzemlickis"
        }
+       members {
+           role     = "member"
+           username = "nwanduka"
        }
+       members {
+           role     = "member"
+           username = "okotdaniel"
        }
+       members {
+           role     = "member"
+           username = "tintayadev"
        }
+       members {
+           role     = "member"
+           username = "vinlawz"
        }
+       members {
+           role     = "member"
+           username = "viscofuse"
        }
    }

  # github_team_members.org_team_members["Admins"] will be created
Plan is too large to fit in a PR comment. See the full plan in the workflow log.

📝 Plan generated in Plan org membership changes and list them in a PR #142

cunla added a commit to django-commons-test/membership that referenced this pull request Sep 2, 2026
Resolves conflicts from main's migration from the Terraform to the OpenTofu
dflook actions (#7), matching the resolution used on
django-commons/membership#514:

- Keep the OpenTofu actions (tofu-plan/tofu-apply) from main, with the
  AWS OIDC credential step and id-token permission from this branch.
- Keep this branch's removal of the "Commit changes" step in both apply
  workflows: state now lives in S3, so there is nothing to commit back.
  With that step gone the apply jobs no longer need contents: write, and
  the checkout comment about the PAT/persist-credentials interaction no
  longer applies.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012o5Q68D6xFJuenqb2jmGE5
The previous commit rewrote the lock file by hand, changing only the
registry host and keeping the Terraform registry's checksums. That works
for integrations/github, which OpenTofu mirrors from the same GitHub
release artifacts, but not for hashicorp/aws: registry.opentofu.org
serves its own repackaged, separately-signed builds, so every h1: and
zh: hash differs and `tofu init` fails checksum verification.

Regenerated with `tofu providers lock` (OpenTofu 1.12.6) for
linux_amd64, linux_arm64, darwin_amd64 and darwin_arm64, so the file
covers CI and both Intel and Apple Silicon laptops. Verified with
`tofu init`, `tofu validate` and `tofu fmt -check`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012o5Q68D6xFJuenqb2jmGE5
@cunla
cunla deployed to production September 2, 2026 20:25 — with GitHub Actions Active
@cunla

cunla commented Sep 2, 2026

Copy link
Copy Markdown
Member

@tim-schilling I updated to tofu also the aws stuff.
When running

cd aws
tofu init
op inject -i terraform.tfvars.tpl -o terraform.tfvars
tofu plan

I am getting errors:

│ Error: reading IAM OIDC Provider (arn:aws:iam::270283785597:oidc-provider/token.actions.githubusercontent.com): operation error IAM: GetOpenIDConnectProvider, https response error StatusCode: 403, RequestID: ddb416c8-545b-4500-b965-a7e11cbd3ea3, api error AccessDenied: User: arn:aws:iam::590183653510:user/daniel-cli is not authorized to access this resource

│ with aws_iam_openid_connect_provider.github_actions,
│ on iam.tf line 1, in resource "aws_iam_openid_connect_provider" "github_actions":
│ 1: resource "aws_iam_openid_connect_provider" "github_actions" {



│ Error: reading SSO Permission Set (arn:aws:sso:::permissionSet/ssoins-72235ca62d548a11/ps-7223cd67a3304750,arn:aws:sso:::instance/ssoins-72235ca62d548a11): operation error SSO Admin: DescribePermissionSet, https response error StatusCode: 400, RequestID: 0edadb8e-21dd-480a-b733-3e78c0485902, AccessDeniedException: User: arn:aws:iam::590183653510:user/daniel-cli is not authorized to perform: sso:DescribePermissionSet on resource: arn:aws:sso:::instance/ssoins-72235ca62d548a11 because the resource does not exist in this Region, no resource-based policies allow access, or a resource-based policy explicitly denies access because no resource-based policy allows the sso:DescribePermissionSet action

│ with aws_ssoadmin_permission_set.terraform_state,
│ on identitycenter.tf line 12, in resource "aws_ssoadmin_permission_set" "terraform_state":
│ 12: resource "aws_ssoadmin_permission_set" "terraform_state" {

Is IAM enabled in the AWS account? Do I (arn:aws:iam::590183653510:user/daniel-cli) have permissions?

@cunla
cunla deployed to production September 3, 2026 17:15 — with GitHub Actions Active
@cunla
cunla deployed to production September 3, 2026 17:37 — with GitHub Actions Active
@cunla
cunla deployed to production September 3, 2026 17:43 — with GitHub Actions Active
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants