Repository: wri/project-zeno-deploy
Pull request #10: PZB-13: Setup environments for staging / prod 
Author: login: batpad
Created: 2025-04-08T04:37:14Z | Merged: 2025-04-23T10:39:23Z

Refs https://gfw.atlassian.net/jira/software/projects/PZB/boards/97/backlog?selectedIssue=PZB-13

Started with the terraform changes to pass the `environment` variable through and having the separate `.tfvars` files for staging / prod.

Next I'll work on the Github workflow to separate out the passing of secrets, etc. to helm.

@sunu can you just sanity check this bit and let me know if this is what you had in mind?




Diff:
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index cfeb440..c2a83fa 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -3,17 +3,22 @@ on:
   push:
     branches:
       - main
+      - develop
   pull_request:
     branches:
       - main
-  workflow_dispatch: # allows to manually run the workflow from the Actions tab
+      - develop
+  workflow_dispatch: # keeping this to allow manual runs
 jobs:
   Deploy:
     name: 'Deploy Terraform and Helm'
     runs-on: ubuntu-latest
+    environment:  ${{ (github.event_name == 'pull_request' && github.base_ref || github.ref_name) == 'main' && 'production' || 'staging' }}
     env:
       AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
       AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      # Sets the ENVIRONMENT variable to "production" if push or PR is to main, else, "staging" (if push is to 'develop')
+      ENVIRONMENT: ${{ (github.event_name == 'pull_request' && github.base_ref || github.ref_name) == 'main' && 'production' || 'staging' }}
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -25,8 +30,6 @@ jobs:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: us-east-1
-      - name: Configure kubeconfig
-        run: aws eks update-kubeconfig --region us-east-1 --name zeno-production-cluster
       - name: Setup Terraform
         uses: hashicorp/setup-terraform@v2
         with:
@@ -38,7 +41,10 @@ jobs:
       - name: Terraform Init
         id: init
         working-directory: ./terraform
-        run: terraform init
+        run: |
+          STATE_PATH=${{ env.ENVIRONMENT == 'production' && 'prod' || env.ENVIRONMENT }}
+          terraform init \
+            -backend-config="key=terraform/state/${STATE_PATH}/terraform.tfstate"
       - name: Terraform Validate
         id: validate
         working-directory: ./terraform
@@ -47,7 +53,7 @@ jobs:
         id: plan
         working-directory: ./terraform
         if: github.event_name == 'pull_request'
-        run: terraform plan -no-color -input=false
+        run: terraform plan -var-file="${{ env.ENVIRONMENT }}.tfvars" -no-color -input=false
         continue-on-error: true
       - name: Update Pull Request
         uses: actions/github-script@v6
@@ -79,38 +85,85 @@ jobs:
              body: output
            })
       - name: Terraform Plan Status
-        working-directory: ./terraform
         if: steps.plan.outcome == 'failure'
-        run: exit 1
+        run: |
+          echo "Terraform plan failed. See above for error details."
+          exit 1
       - name: Terraform Apply
         working-directory: ./terraform
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        run: terraform apply -auto-approve
+        if: |
+          github.event_name == 'push' && 
+          (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
+        run: terraform apply -var-file="${{ env.ENVIRONMENT }}.tfvars" -auto-approve
+      - name: Configure kubeconfig
+        if: |
+          github.event_name == 'push' && 
+          (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
+        run: aws eks update-kubeconfig --region us-east-1 --name zeno-${{ env.ENVIRONMENT }}-cluster
       - name: Update Helm Repos
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: |
+          github.event_name == 'push' && 
+          (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
         working-directory: ./helm
         run: |
+          helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
+          helm repo add jetstack https://charts.jetstack.io
           helm repo add ollama-helm https://otwld.github.io/ollama-helm/
           helm repo add langfuse https://langfuse.github.io/langfuse-k8s
           helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
           helm repo add grafana https://grafana.github.io/helm-charts
           helm repo update
+      - name: Helm Deploy Ingress Nginx
+        if: |
+          github.event_name == 'push' && 
+          (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
+        working-directory: ./helm
+        run: >
+          helm upgrade --install 
+          ingress-nginx
+          ingress-nginx/ingress-nginx
+          --version 4.11.3
+          --namespace ingress-nginx
+          --create-namespace
+          -f support/ingress-nginx/values.yaml
+          -f support/ingress-nginx/values-${{ env.ENVIRONMENT }}.yaml
+      - name: Helm Deploy Cert Manager
+        if: |
+          github.event_name == 'push' && 
+          (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
+        working-directory: ./helm
+        run: >
+          helm upgrade --install 
+          cert-manager
+          jetstack/cert-manager
+          --version v1.16.1
+          --namespace cert-manager
+          --create-namespace
+          -f support/cert-manager/values.yaml
+          -f support/cert-manager/values-${{ env.ENVIRONMENT }}.yaml
       - name: Helm Deploy Ollama
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: |
+          github.event_name == 'push' && 
+          (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
         working-directory: ./helm
         run: helm upgrade --install ollama ollama-helm/ollama --version 0.69.0 -f ollama/values.yaml
       - name: Helm Deploy Langfuse
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: |
+          github.event_name == 'push' && 
+          (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
         working-directory: ./helm
         run: >
           helm upgrade --install langfuse langfuse/langfuse 
           --version 0.8.0
-          -f langfuse/values.yaml 
+          -f langfuse/values.yaml
+          -f langfuse/values-${{ env.ENVIRONMENT }}.yaml
           --set postgresql.auth.password=${{ secrets.DATABASE_PASSWORD }} 
           --set langfuse.nextauth.secret=${{ secrets.LANGFUSE_NEXTAUTH_SECRET }} 
           --set langfuse.salt=${{ secrets.LANGFUSE_SALT }}
       - name: Helm Deploy Kube Prometheus Stack
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: |
+          github.event_name == 'push' && 
+          (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
         working-directory: ./helm
         run: >
           helm upgrade --install
@@ -120,9 +173,12 @@ jobs:
           --create-namespace
           prometheus-community/kube-prometheus-stack
           -f support/kube-prometheus-stack/values.yaml
+          -f support/kube-prometheus-stack/values-${{ env.ENVIRONMENT }}.yaml
           --set grafana.adminPassword=${{ secrets.GRAFANA_ADMIN_PASSWORD }}
       - name: Helm Deploy Loki
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: |
+          github.event_name == 'push' && 
+          (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
         working-directory: ./helm
         run: >
           helm upgrade --install
@@ -132,13 +188,15 @@ jobs:
           loki
           grafana/loki-stack
           -f support/loki/loki-values.yaml
+          -f support/loki/loki-values-${{ env.ENVIRONMENT }}.yaml
       # Deploy Zeno instances
-      - name: Helm Deploy Zeno
+      - name: Helm Deploy Zeno Production
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         working-directory: ./helm
         run: >
           helm upgrade --install zeno ./zeno
           -f zeno/values.yaml
+          -f zeno/values-${{ env.ENVIRONMENT }}.yaml
           --set secrets.langfuse.INIT_USER_PASSWORD=${{ secrets.LANGFUSE_INIT_USER_PASSWORD }}
           --set secrets.langfuse.INIT_PROJECT_SECRET_KEY=${{ secrets.LANGFUSE_INIT_PROJECT_SECRET_KEY }}
           --set secrets.langfuse.INIT_PROJECT_PUBLIC_KEY=${{ secrets.LANGFUSE_INIT_PROJECT_PUBLIC_KEY }}
@@ -151,23 +209,45 @@ jobs:
           --set secrets.api.GFW_DATA_API_KEY=${{ secrets.GFW_DATA_API_KEY }}
           --set secrets.api.GFW_DATA_API_USER_ID=${{ secrets.GFW_DATA_API_USER_ID }}
           --set secrets.api.ELEVENLABS_API_KEY=${{ secrets.ELEVENLABS_API_KEY }}
-      - name: Helm Deploy Zeno Dev Instance
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        working-directory: ./helm
-        run: >
-          helm upgrade --install zeno-dev ./zeno
-          -f zeno/values-dev.yaml
-          --namespace zeno-dev
-          --create-namespace
-          --set secrets.langfuse.INIT_USER_PASSWORD=${{ secrets.LANGFUSE_INIT_USER_PASSWORD }}
-          --set secrets.langfuse.INIT_PROJECT_SECRET_KEY=${{ secrets.DEV_LANGFUSE_INIT_PROJECT_SECRET_KEY }}
-          --set secrets.langfuse.INIT_PROJECT_PUBLIC_KEY=${{ secrets.DEV_LANGFUSE_INIT_PROJECT_PUBLIC_KEY }}
-          --set secrets.api.OPENAI_API_KEY=${{ secrets.OPENAI_API_KEY }}
-          --set secrets.api.ANTHROPIC_API_KEY=${{ secrets.ANTHROPIC_API_KEY }}
-          --set secrets.api.AWS_ACCESS_KEY_ID=${{ secrets.S3_READONLY_AWS_ACCESS_KEY_ID }}
-          --set secrets.api.AWS_SECRET_ACCESS_KEY=${{ secrets.S3_READONLY_AWS_SECRET_ACCESS_KEY }}
-          --set secrets.api.GEE_SERVICE_ACCOUNT_JSON=${{ secrets.GEE_SERVICE_ACCOUNT_JSON }}
-          --set secrets.api.MAPBOX_API_TOKEN=${{ secrets.MAPBOX_API_TOKEN }}
-          --set secrets.api.GFW_DATA_API_KEY=${{ secrets.GFW_DATA_API_KEY }}
-          --set secrets.api.GFW_DATA_API_USER_ID=${{ secrets.GFW_DATA_API_USER_ID }}
-          --set secrets.api.ELEVENLABS_API_KEY=${{ secrets.ELEVENLABS_API_KEY }}
+
+      # - name: Helm Deploy Zeno Staging
+      #   if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
+      #   working-directory: ./helm
+      #   run: >
+      #     helm upgrade --install zeno ./zeno
+      #     -f zeno/values.yaml
+      #     -f zeno/values-${{ env.ENVIRONMENT }}.yaml
+      #     --set secrets.langfuse.INIT_USER_PASSWORD=${{ secrets.STAGING_LANGFUSE_INIT_USER_PASSWORD }}
+      #     --set secrets.langfuse.INIT_PROJECT_SECRET_KEY=${{ secrets.STAGING_LANGFUSE_INIT_PROJECT_SECRET_KEY }}
+      #     --set secrets.langfuse.INIT_PROJECT_PUBLIC_KEY=${{ secrets.STAGING_LANGFUSE_INIT_PROJECT_PUBLIC_KEY }}
+      #     --set secrets.api.OPENAI_API_KEY=${{ secrets.STAGING_OPENAI_API_KEY }}
+      #     --set secrets.api.ANTHROPIC_API_KEY=${{ secrets.STAGING_ANTHROPIC_API_KEY }}
+      #     --set secrets.api.AWS_ACCESS_KEY_ID=${{ secrets.STAGING_S3_READONLY_AWS_ACCESS_KEY_ID }}
+      #     --set secrets.api.AWS_SECRET_ACCESS_KEY=${{ secrets.STAGING_S3_READONLY_AWS_SECRET_ACCESS_KEY }}
+      #     --set secrets.api.GEE_SERVICE_ACCOUNT_JSON=${{ secrets.STAGING_GEE_SERVICE_ACCOUNT_JSON }}
+      #     --set secrets.api.MAPBOX_API_TOKEN=${{ secrets.STAGING_MAPBOX_API_TOKEN }}
+      #     --set secrets.api.GFW_DATA_API_KEY=${{ secrets.STAGING_GFW_DATA_API_KEY }}
+      #     --set secrets.api.GFW_DATA_API_USER_ID=${{ secrets.STAGING_GFW_DATA_API_USER_ID }}
+      #     --set secrets.api.ELEVENLABS_API_KEY=${{ secrets.STAGING_ELEVENLABS_API_KEY }}
+
+      
+      # - name: Helm Deploy Zeno Dev Instance
+      #   if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+      #   working-directory: ./helm
+      #   run: >
+      #     helm upgrade --install zeno-dev ./zeno
+      #     -f zeno/values-dev.yaml
+      #     --namespace zeno-dev
+      #     --create-namespace
+      #     --set secrets.langfuse.INIT_USER_PASSWORD=${{ secrets.LANGFUSE_INIT_USER_PASSWORD }}
+      #     --set secrets.langfuse.INIT_PROJECT_SECRET_KEY=${{ secrets.DEV_LANGFUSE_INIT_PROJECT_SECRET_KEY }}
+      #     --set secrets.langfuse.INIT_PROJECT_PUBLIC_KEY=${{ secrets.DEV_LANGFUSE_INIT_PROJECT_PUBLIC_KEY }}
+      #     --set secrets.api.OPENAI_API_KEY=${{ secrets.OPENAI_API_KEY }}
+      #     --set secrets.api.ANTHROPIC_API_KEY=${{ secrets.ANTHROPIC_API_KEY }}
+      #     --set secrets.api.AWS_ACCESS_KEY_ID=${{ secrets.S3_READONLY_AWS_ACCESS_KEY_ID }}
+      #     --set secrets.api.AWS_SECRET_ACCESS_KEY=${{ secrets.S3_READONLY_AWS_SECRET_ACCESS_KEY }}
+      #     --set secrets.api.GEE_SERVICE_ACCOUNT_JSON=${{ secrets.GEE_SERVICE_ACCOUNT_JSON }}
+      #     --set secrets.api.MAPBOX_API_TOKEN=${{ secrets.MAPBOX_API_TOKEN }}
+      #     --set secrets.api.GFW_DATA_API_KEY=${{ secrets.GFW_DATA_API_KEY }}
+      #     --set secrets.api.GFW_DATA_API_USER_ID=${{ secrets.GFW_DATA_API_USER_ID }}
+      #     --set secrets.api.ELEVENLABS_API_KEY=${{ secrets.ELEVENLABS_API_KEY }}
diff --git a/helm/langfuse/values-production.yaml b/helm/langfuse/values-production.yaml
new file mode 100644
index 0000000..36e58ab
--- /dev/null
+++ b/helm/langfuse/values-production.yaml
@@ -0,0 +1,2 @@
+postgresql:
+  host: zeno-db.cv2oy6g4svaz.us-east-1.rds.amazonaws.com
\ No newline at end of file
diff --git a/helm/langfuse/values-staging.yaml b/helm/langfuse/values-staging.yaml
new file mode 100644
index 0000000..1b1f7b3
--- /dev/null
+++ b/helm/langfuse/values-staging.yaml
@@ -0,0 +1,2 @@
+postgresql:
+  host: zeno-db-staging.cv2oy6g4svaz.us-east-1.rds.amazonaws.com
\ No newline at end of file
diff --git a/helm/langfuse/values.yaml b/helm/langfuse/values.yaml
index 85029f0..3b90b81 100644
--- a/helm/langfuse/values.yaml
+++ b/helm/langfuse/values.yaml
@@ -45,4 +45,4 @@ postgresql:
     username: postgres
     password:
     database: langfuse
-  host: zeno-db.cv2oy6g4svaz.us-east-1.rds.amazonaws.com
+  host:
diff --git a/helm/ollama/values-production.yaml b/helm/ollama/values-production.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/helm/ollama/values-staging.yaml b/helm/ollama/values-staging.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/helm/support/cert-manager/values-production.yaml b/helm/support/cert-manager/values-production.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/helm/support/cert-manager/values-staging.yaml b/helm/support/cert-manager/values-staging.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/helm/support/cert-manager/values.yaml b/helm/support/cert-manager/values.yaml
new file mode 100644
index 0000000..1b4551c
--- /dev/null
+++ b/helm/support/cert-manager/values.yaml
@@ -0,0 +1 @@
+installCRDs: true
diff --git a/helm/support/ingress-nginx/values-production.yaml b/helm/support/ingress-nginx/values-production.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/helm/support/ingress-nginx/values-staging.yaml b/helm/support/ingress-nginx/values-staging.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/helm/support/ingress-nginx/values.yaml b/helm/support/ingress-nginx/values.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/helm/support/kube-prometheus-stack/values-production.yaml b/helm/support/kube-prometheus-stack/values-production.yaml
new file mode 100644
index 0000000..0145a73
--- /dev/null
+++ b/helm/support/kube-prometheus-stack/values-production.yaml
@@ -0,0 +1,7 @@
+grafana:
+  ingress:
+    hosts:
+      - grafana.zeno.ds.io
+    tls:
+        hosts:
+          - grafana.zeno.ds.io
\ No newline at end of file
diff --git a/helm/support/kube-prometheus-stack/values-staging.yaml b/helm/support/kube-prometheus-stack/values-staging.yaml
new file mode 100644
index 0000000..ce4a010
--- /dev/null
+++ b/helm/support/kube-prometheus-stack/values-staging.yaml
@@ -0,0 +1,7 @@
+grafana:
+  ingress:
+    hosts:
+      - grafana.zeno-staging.ds.io
+    tls:
+        hosts:
+          - grafana.zeno-staging.ds.io
\ No newline at end of file
diff --git a/helm/support/loki/loki-values-production.yaml b/helm/support/loki/loki-values-production.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/helm/support/loki/loki-values-staging.yaml b/helm/support/loki/loki-values-staging.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/helm/zeno/values-dev.yaml b/helm/zeno/values-dev.yaml
deleted file mode 100644
index 435d57b..0000000
--- a/helm/zeno/values-dev.yaml
+++ /dev/null
@@ -1,36 +0,0 @@
-config:
-  enable_tls: true
-  # we will use the existing cluster issuer from default namespace
-  create_cert_manager_issuer: false
-
-secrets:
-  langfuse:
-    INIT_USER_PASSWORD:
-    INIT_PROJECT_SECRET_KEY:
-    INIT_PROJECT_PUBLIC_KEY:
-  api:
-    OPENAI_API_KEY:
-    ANTHROPIC_API_KEY:
-    AWS_ACCESS_KEY_ID:
-    AWS_SECRET_ACCESS_KEY:
-    GEE_SERVICE_ACCOUNT_JSON:
-    GFW_DATA_API_KEY:
-    GFW_DATA_API_USER_ID:
-
-langfuse:
-  enabled: false
-
-api:
-  host: dev.api.zeno.ds.io
-  replicas: 1
-  image:
-    repository: public.ecr.aws/b7u8b0a6/project-zeno/zeno
-    tag: 2757f359105a9738086f1d07ac2e8200cca9675d
-  config:
-    LANGFUSE_HOST: https://langfuse.zeno.ds.io
-    OLLAMA_BASE_URL: http://ollama.default.svc.cluster.local:11434
-
-streamlit:
-  host: dev.streamlit.zeno.ds.io
-  config:
-    API_BASE_URL: https://dev.api.zeno.ds.io
diff --git a/helm/zeno/values-production.yaml b/helm/zeno/values-production.yaml
new file mode 100644
index 0000000..7634748
--- /dev/null
+++ b/helm/zeno/values-production.yaml
@@ -0,0 +1,15 @@
+langfuse:
+  host: langfuse.zeno.ds.io
+
+api:
+  host: api.zeno.ds.io
+  image:
+    tag: 8582c04cfc6c8c77a433bea31cd640322fcb20a1
+  config:
+    LANGFUSE_HOST: https://langfuse.zeno.ds.io
+    OLLAMA_BASE_URL: http://ollama.default.svc.cluster.local:11434
+
+streamlit:
+  host: streamlit.zeno.ds.io
+  config:
+    API_BASE_URL: https://api.zeno.ds.io
\ No newline at end of file
diff --git a/helm/zeno/values-staging.yaml b/helm/zeno/values-staging.yaml
new file mode 100644
index 0000000..5b31bf3
--- /dev/null
+++ b/helm/zeno/values-staging.yaml
@@ -0,0 +1,16 @@
+langfuse:
+  enabled: true
+  host: langfuse.zeno-staging.ds.io
+
+api:
+  host: api.zeno-staging.ds.io
+  image:
+    tag: 8582c04cfc6c8c77a433bea31cd640322fcb20a1
+  config:
+    LANGFUSE_HOST: https://langfuse.zen-staging.ds.io
+    OLLAMA_BASE_URL: http://ollama.default.svc.cluster.local:11434
+
+streamlit:
+  host: streamlit.zeno-staging.ds.io
+  config:
+    API_BASE_URL: https://api.zeno-staging.ds.io
\ No newline at end of file
diff --git a/terraform/backend.tf b/terraform/backend.tf
index d5a93ee..7b7ac3b 100644
--- a/terraform/backend.tf
+++ b/terraform/backend.tf
@@ -1,7 +1,7 @@
 terraform {
     backend "s3" {
         bucket = "tf-state-project-zeno"
-        key = "terraform/state/prod/terraform.tfstate"
+        # key = "terraform/state/${terraform.workspace}/terraform.tfstate"
         region = "us-east-1"
     }
 }
\ No newline at end of file
diff --git a/terraform/main.tf b/terraform/main.tf
index ee6d7be..a3d1c63 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -1,3 +1,6 @@
 module "resources" {
-    source = "./resources/"
+    source = "./resources"
+    
+    environment = var.environment
+    aws_region      = var.aws_region
 }
\ No newline at end of file
diff --git a/terraform/production.tfvars b/terraform/production.tfvars
new file mode 100644
index 0000000..f2d3246
--- /dev/null
+++ b/terraform/production.tfvars
@@ -0,0 +1 @@
+environment = "production" 
\ No newline at end of file
diff --git a/terraform/resources/eks.tf b/terraform/resources/eks.tf
index 8aa0d6f..1862b6f 100644
--- a/terraform/resources/eks.tf
+++ b/terraform/resources/eks.tf
@@ -1,5 +1,5 @@
 provider "aws" {
-    region = var.region
+    region = var.aws_region
 }
 
 provider "kubernetes" {
@@ -56,7 +56,9 @@ module "eks" {
 
   cluster_addons = {
     aws-ebs-csi-driver = {
-      most_recent = true
+      # Pinning version to avoid unexpected updates to EKS via terraform
+      # Explicitly update this to update version
+      addon_version = "v1.40.1-eksbuild.1"
     }
   }
 
diff --git a/terraform/resources/helm.tf b/terraform/resources/helm.tf
index a8a7dad..99efb63 100644
--- a/terraform/resources/helm.tf
+++ b/terraform/resources/helm.tf
@@ -1,3 +1,4 @@
+/*
 provider "helm" {
   kubernetes {
     host = module.eks.cluster_endpoint
@@ -10,26 +11,4 @@ provider "helm" {
     }
   }
 }
-
-resource "helm_release" "zeno-ingress-nginx" {
-  name = "ingress-nginx"
-  repository = "https://kubernetes.github.io/ingress-nginx"
-  chart = "ingress-nginx"
-  version = "4.11.3"
-  namespace = "ingress-nginx"
-  create_namespace = true
-}
-
-resource "helm_release" "zeno-cert-manager" {
-  name = "cert-manager"
-  repository = "https://charts.jetstack.io"
-  chart = "cert-manager"
-  version = "v1.16.1"
-  namespace = "cert-manager"
-  create_namespace = true
-
-  set {
-    name  = "installCRDs"
-    value = true
-  }
-}
+*/
\ No newline at end of file
diff --git a/terraform/resources/outputs.tf b/terraform/resources/outputs.tf
index 63fe8e5..a6a6ecc 100644
--- a/terraform/resources/outputs.tf
+++ b/terraform/resources/outputs.tf
@@ -10,7 +10,7 @@ output "cluster_security_group_id" {
 
 output "region" {
   description = "AWS region"
-  value = var.region
+  value = var.aws_region
 }
 
 output "cluster_name" {
diff --git a/terraform/resources/providers.tf b/terraform/resources/providers.tf
index 2eb3a3c..9ad6b6a 100644
--- a/terraform/resources/providers.tf
+++ b/terraform/resources/providers.tf
@@ -14,10 +14,12 @@ terraform {
       source  = "hashicorp/kubernetes"
       version = "~> 2.33"
     }
-
+/*
     helm = {
       source  = "hashicorp/helm"
       version = "~> 2.16"
     }
+*/
+
   }
-}
\ No newline at end of file
+}
diff --git a/terraform/resources/variables.tf b/terraform/resources/variables.tf
index d4e50b9..4e08b30 100644
--- a/terraform/resources/variables.tf
+++ b/terraform/resources/variables.tf
@@ -1,11 +1,13 @@
 variable "environment" {
     description = "The environment to deploy to"
     default = "production"
+    type = string
 }
 
-variable "region" {
+variable "aws_region" {
     description = "The region to deploy to"
     default = "us-east-1"
+    type = string
 }
 
 locals {
diff --git a/terraform/staging.tfvars b/terraform/staging.tfvars
new file mode 100644
index 0000000..c422594
--- /dev/null
+++ b/terraform/staging.tfvars
@@ -0,0 +1 @@
+environment = "staging" 
\ No newline at end of file
diff --git a/terraform/variables.tf b/terraform/variables.tf
index e69de29..98c5789 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -0,0 +1,10 @@
+variable "environment" {
+  description = "Environment name (staging or production)"
+  type        = string
+}
+
+variable "aws_region" {
+  description = "AWS region"
+  type        = string
+  default     = "us-east-1"
+}


Reviews:
user: login: sunu
body: @batpad yes, this looks good to me so far. Next, we should make the required changes to the github actions.

One thing I missed when we last talked is that currently we import an existing RDS instance into terraform. It's not used by the backend; only by Langfuse. (https://github.com/wri/project-zeno-deploy/blob/1d5227f01828db90f855a51e33bc8345577c9ee5/terraform/resources/rds.tf#L2)

Since we will introduce auth and persistence this phase, we should provision separate databases through Terraform. It's fine to do that as part of a separate PR though.
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-08T06:11:07Z
user: login: sunu
body: @batpad this looks good to me. After we make sure the kubeconfig configuration step is not hardcoded to use the production cluster, (and optionally the helm installs disabled/ skipped for develop / commented out) this should be good to merge!
state: CHANGES_REQUESTED
author_association: COLLABORATOR
submitted_at: 2025-04-11T09:42:50Z
user: login: batpad
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-11T09:54:11Z
user: login: batpad
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-11T09:55:51Z
user: login: sunu
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-11T10:16:45Z
user: login: batpad
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-11T13:09:39Z
user: login: sunu
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-17T08:54:31Z
user: login: sunu
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-04-23T07:05:30Z

Review comments:
diff_hunk: @@ -0,0 +1,10 @@
+variable "environment" {
+  description = "Environment name (staging or production)"
+  type        = string
+}
+
+variable "aws_region" {
path: terraform/variables.tf
user: login: sunu
body: Just a nit pick: "aws_region" is defined but not used right now. We should pass this into "resources" in main.tf to make sure this is used.
created_at: 2025-04-08T05:59:33Z
author_association: COLLABORATOR
diff_hunk: @@ -151,23 +171,45 @@ jobs:
           --set secrets.api.GFW_DATA_API_KEY=${{ secrets.GFW_DATA_API_KEY }}
           --set secrets.api.GFW_DATA_API_USER_ID=${{ secrets.GFW_DATA_API_USER_ID }}
           --set secrets.api.ELEVENLABS_API_KEY=${{ secrets.ELEVENLABS_API_KEY }}
-      - name: Helm Deploy Zeno Dev Instance
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+
+      - name: Helm Deploy Zeno Staging
+        if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
         working-directory: ./helm
         run: >
-          helm upgrade --install zeno-dev ./zeno
-          -f zeno/values-dev.yaml
-          --namespace zeno-dev
-          --create-namespace
-          --set secrets.langfuse.INIT_USER_PASSWORD=${{ secrets.LANGFUSE_INIT_USER_PASSWORD }}
-          --set secrets.langfuse.INIT_PROJECT_SECRET_KEY=${{ secrets.DEV_LANGFUSE_INIT_PROJECT_SECRET_KEY }}
-          --set secrets.langfuse.INIT_PROJECT_PUBLIC_KEY=${{ secrets.DEV_LANGFUSE_INIT_PROJECT_PUBLIC_KEY }}
-          --set secrets.api.OPENAI_API_KEY=${{ secrets.OPENAI_API_KEY }}
-          --set secrets.api.ANTHROPIC_API_KEY=${{ secrets.ANTHROPIC_API_KEY }}
-          --set secrets.api.AWS_ACCESS_KEY_ID=${{ secrets.S3_READONLY_AWS_ACCESS_KEY_ID }}
-          --set secrets.api.AWS_SECRET_ACCESS_KEY=${{ secrets.S3_READONLY_AWS_SECRET_ACCESS_KEY }}
-          --set secrets.api.GEE_SERVICE_ACCOUNT_JSON=${{ secrets.GEE_SERVICE_ACCOUNT_JSON }}
-          --set secrets.api.MAPBOX_API_TOKEN=${{ secrets.MAPBOX_API_TOKEN }}
-          --set secrets.api.GFW_DATA_API_KEY=${{ secrets.GFW_DATA_API_KEY }}
-          --set secrets.api.GFW_DATA_API_USER_ID=${{ secrets.GFW_DATA_API_USER_ID }}
-          --set secrets.api.ELEVENLABS_API_KEY=${{ secrets.ELEVENLABS_API_KEY }}
+          helm upgrade --install zeno ./zeno
+          -f zeno/values.yaml
+          -f zeno/values-${{ env.ENVIRONMENT }}.yaml
+          --set secrets.langfuse.INIT_USER_PASSWORD=${{ secrets.STAGING_LANGFUSE_INIT_USER_PASSWORD }}
+          --set secrets.langfuse.INIT_PROJECT_SECRET_KEY=${{ secrets.STAGING_LANGFUSE_INIT_PROJECT_SECRET_KEY }}
+          --set secrets.langfuse.INIT_PROJECT_PUBLIC_KEY=${{ secrets.STAGING_LANGFUSE_INIT_PROJECT_PUBLIC_KEY }}
+          --set secrets.api.OPENAI_API_KEY=${{ secrets.STAGING_OPENAI_API_KEY }}
+          --set secrets.api.ANTHROPIC_API_KEY=${{ secrets.STAGING_ANTHROPIC_API_KEY }}
+          --set secrets.api.AWS_ACCESS_KEY_ID=${{ secrets.STAGING_S3_READONLY_AWS_ACCESS_KEY_ID }}
+          --set secrets.api.AWS_SECRET_ACCESS_KEY=${{ secrets.STAGING_S3_READONLY_AWS_SECRET_ACCESS_KEY }}
+          --set secrets.api.GEE_SERVICE_ACCOUNT_JSON=${{ secrets.STAGING_GEE_SERVICE_ACCOUNT_JSON }}
+          --set secrets.api.MAPBOX_API_TOKEN=${{ secrets.STAGING_MAPBOX_API_TOKEN }}
+          --set secrets.api.GFW_DATA_API_KEY=${{ secrets.STAGING_GFW_DATA_API_KEY }}
+          --set secrets.api.GFW_DATA_API_USER_ID=${{ secrets.STAGING_GFW_DATA_API_USER_ID }}
+          --set secrets.api.ELEVENLABS_API_KEY=${{ secrets.STAGING_ELEVENLABS_API_KEY }}
path: .github/workflows/deploy.yaml
user: login: sunu
body: @batpad I don't think these secrets are defined yet. So this helm install step will fail.
created_at: 2025-04-11T09:22:24Z
author_association: COLLABORATOR
path: .github/workflows/deploy.yaml
user: login: sunu
body: @batpad - we should make sure the kubeconfig step grabs creds for the right cluster. Right now it’s hardcoded to production, but staging won’t exist yet on the first run. Maybe we skip kubeconfig configuration and Helm install for now, get the Terraform changes merged to create the cluster. We can re-enable them in a follow-up PR after the staging cluster is in place
created_at: 2025-04-11T09:33:58Z
author_association: COLLABORATOR
path: helm/langfuse/values-production.yaml
user: login: sunu
body: ideally, we should create an umbrella chart, declare langfuse, ollama, prometheus stack etc as dependencies. We can then have a single values file for each environment with sections for different services instead of so many.

But let's do that in a separate PR
created_at: 2025-04-11T09:39:26Z
author_association: COLLABORATOR
diff_hunk: @@ -151,23 +171,45 @@ jobs:
           --set secrets.api.GFW_DATA_API_KEY=${{ secrets.GFW_DATA_API_KEY }}
           --set secrets.api.GFW_DATA_API_USER_ID=${{ secrets.GFW_DATA_API_USER_ID }}
           --set secrets.api.ELEVENLABS_API_KEY=${{ secrets.ELEVENLABS_API_KEY }}
-      - name: Helm Deploy Zeno Dev Instance
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+
+      - name: Helm Deploy Zeno Staging
+        if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
         working-directory: ./helm
         run: >
-          helm upgrade --install zeno-dev ./zeno
-          -f zeno/values-dev.yaml
-          --namespace zeno-dev
-          --create-namespace
-          --set secrets.langfuse.INIT_USER_PASSWORD=${{ secrets.LANGFUSE_INIT_USER_PASSWORD }}
-          --set secrets.langfuse.INIT_PROJECT_SECRET_KEY=${{ secrets.DEV_LANGFUSE_INIT_PROJECT_SECRET_KEY }}
-          --set secrets.langfuse.INIT_PROJECT_PUBLIC_KEY=${{ secrets.DEV_LANGFUSE_INIT_PROJECT_PUBLIC_KEY }}
-          --set secrets.api.OPENAI_API_KEY=${{ secrets.OPENAI_API_KEY }}
-          --set secrets.api.ANTHROPIC_API_KEY=${{ secrets.ANTHROPIC_API_KEY }}
-          --set secrets.api.AWS_ACCESS_KEY_ID=${{ secrets.S3_READONLY_AWS_ACCESS_KEY_ID }}
-          --set secrets.api.AWS_SECRET_ACCESS_KEY=${{ secrets.S3_READONLY_AWS_SECRET_ACCESS_KEY }}
-          --set secrets.api.GEE_SERVICE_ACCOUNT_JSON=${{ secrets.GEE_SERVICE_ACCOUNT_JSON }}
-          --set secrets.api.MAPBOX_API_TOKEN=${{ secrets.MAPBOX_API_TOKEN }}
-          --set secrets.api.GFW_DATA_API_KEY=${{ secrets.GFW_DATA_API_KEY }}
-          --set secrets.api.GFW_DATA_API_USER_ID=${{ secrets.GFW_DATA_API_USER_ID }}
-          --set secrets.api.ELEVENLABS_API_KEY=${{ secrets.ELEVENLABS_API_KEY }}
+          helm upgrade --install zeno ./zeno
+          -f zeno/values.yaml
+          -f zeno/values-${{ env.ENVIRONMENT }}.yaml
+          --set secrets.langfuse.INIT_USER_PASSWORD=${{ secrets.STAGING_LANGFUSE_INIT_USER_PASSWORD }}
+          --set secrets.langfuse.INIT_PROJECT_SECRET_KEY=${{ secrets.STAGING_LANGFUSE_INIT_PROJECT_SECRET_KEY }}
+          --set secrets.langfuse.INIT_PROJECT_PUBLIC_KEY=${{ secrets.STAGING_LANGFUSE_INIT_PROJECT_PUBLIC_KEY }}
+          --set secrets.api.OPENAI_API_KEY=${{ secrets.STAGING_OPENAI_API_KEY }}
+          --set secrets.api.ANTHROPIC_API_KEY=${{ secrets.STAGING_ANTHROPIC_API_KEY }}
+          --set secrets.api.AWS_ACCESS_KEY_ID=${{ secrets.STAGING_S3_READONLY_AWS_ACCESS_KEY_ID }}
+          --set secrets.api.AWS_SECRET_ACCESS_KEY=${{ secrets.STAGING_S3_READONLY_AWS_SECRET_ACCESS_KEY }}
+          --set secrets.api.GEE_SERVICE_ACCOUNT_JSON=${{ secrets.STAGING_GEE_SERVICE_ACCOUNT_JSON }}
+          --set secrets.api.MAPBOX_API_TOKEN=${{ secrets.STAGING_MAPBOX_API_TOKEN }}
+          --set secrets.api.GFW_DATA_API_KEY=${{ secrets.STAGING_GFW_DATA_API_KEY }}
+          --set secrets.api.GFW_DATA_API_USER_ID=${{ secrets.STAGING_GFW_DATA_API_USER_ID }}
+          --set secrets.api.ELEVENLABS_API_KEY=${{ secrets.STAGING_ELEVENLABS_API_KEY }}
path: .github/workflows/deploy.yaml
user: login: batpad
body: Yes :) - @leothomas do you feel you can go ahead and populate these in Github Secrets? Happy to sync.
created_at: 2025-04-11T09:54:11Z
author_association: COLLABORATOR
path: .github/workflows/deploy.yaml
user: login: batpad
body: Ah, good catch about `kubeconfig`, some-how missed that.

So I changed this right now to pick the cluster name based on the `ENVIRONMENT` - can you just check that looks fine (for the long-term)?

I see what you're saying about doing a bit of commenting and re-deploying when we do merge to `develop` - maybe we can figure out long-term how to do this better, but for now this makes sense - when deploying, will comment out the `kubeconfig` bit as well as the `helm installs`, let it just run terraform and setup the cluster, and then will uncomment the lines to get kubeconfig for the right cluster and do the helm install.
created_at: 2025-04-11T09:55:50Z
author_association: COLLABORATOR
path: .github/workflows/deploy.yaml
user: login: sunu
body: Yes, looks good now!
created_at: 2025-04-11T10:16:45Z
author_association: COLLABORATOR
path: .github/workflows/deploy.yaml
user: login: batpad
body: As discussed, I'll move the helm charts being installed by `terraform` to `helm install` statements to keep things consistent across our helm installs, and then we can move the `kubeconfig` to after the terraform step.

We can then hopefully merge this PR without having to do any weird commenting out dance.

After that, I can make a separate PR to consolidate all the helm installs into a single chart with dependencies so we can consolidate values files, etc.
created_at: 2025-04-11T13:09:39Z
author_association: COLLABORATOR
diff_hunk: @@ -1,7 +1,7 @@
 terraform {
     backend "s3" {
         bucket = "tf-state-project-zeno"
-        key = "terraform/state/prod/terraform.tfstate"
+        key = "terraform/state/${terraform.workspace}/terraform.tfstate"
path: terraform/backend.tf
user: login: sunu
body: we don't seem to be setting the workspace anywhere unless I'm missing something
created_at: 2025-04-17T08:51:09Z
author_association: COLLABORATOR
diff_hunk: @@ -38,7 +41,10 @@ jobs:
       - name: Terraform Init
         id: init
         working-directory: ./terraform
-        run: terraform init
+        run: |
+          STATE_PATH=${{ env.ENVIRONMENT == 'production' && 'prod' || env.ENVIRONMENT }}
+          terraform init \
+            -backend-config="key=terraform/state/${STATE_PATH}/terraform.tfstate"
path: .github/workflows/deploy.yaml
user: login: sunu
body: do we need `-backend-config` if we're using terraform workspace to select the appropriate key in `backend.tf`?
created_at: 2025-04-17T08:52:41Z
author_association: COLLABORATOR

PR comments:
user: login: github-actions[bot]
created_at: 2025-04-08T04:37:55Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`failure`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-09T09:31:31Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`success`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.vpc.aws_vpc.this[0]: Refreshing state... [id=vpc-0f6151e1ec7ed4b96]
module.resources.data.aws_caller_identity.current: Reading...
module.resources.data.aws_availability_zones.available: Reading...
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.aws_cloudwatch_log_group.this[0]: Refreshing state... [id=/aws/eks/zeno-production-cluster/cluster]
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.aws_iam_role.this[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002]
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001]
module.resources.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]
module.resources.data.aws_db_instance.zeno-db: Read complete after 0s [id=zeno-db]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459658300000004]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459683600000005]
module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0]: Reading...
module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0]: Read complete after 0s [id=2695086987]
module.resources.module.eks.module.kms.aws_kms_key.this[0]: Refreshing state... [id=8cd9f3d5-f6e1-49ff-a032-da1528c9daa4]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150038690000000b]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500015800000007]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151459701100000006]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500094000000009]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150080180000000c]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150036100000000a]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150083720000000d]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500034600000008]
module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"]: Refreshing state... [id=alias/eks/zeno-production-cluster]
module.resources.module.eks.aws_iam_policy.cluster_encryption[0]: Refreshing state... [id=arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013]
module.resources.module.vpc.aws_default_route_table.default[0]: Refreshing state... [id=rtb-0dca056b5cb3f4bdc]
module.resources.module.vpc.aws_default_security_group.this[0]: Refreshing state... [id=sg-02f79d9422c79d174]
module.resources.module.vpc.aws_internet_gateway.this[0]: Refreshing state... [id=igw-0721a42d5f02f490a]
module.resources.module.vpc.aws_subnet.public[1]: Refreshing state... [id=subnet-060bb06a5c8393f81]
module.resources.module.vpc.aws_subnet.public[0]: Refreshing state... [id=subnet-0b2d1b545f702eceb]
module.resources.module.vpc.aws_subnet.public[2]: Refreshing state... [id=subnet-0aad369235ab19564]
module.resources.module.vpc.aws_default_network_acl.this[0]: Refreshing state... [id=acl-01d72c016ec1365bf]
module.resources.module.eks.aws_security_group.cluster[0]: Refreshing state... [id=sg-0bd86b2d1d4c494db]
module.resources.module.vpc.aws_route_table.private[0]: Refreshing state... [id=rtb-0e06cd84685011ff8]
module.resources.module.eks.aws_security_group.node[0]: Refreshing state... [id=sg-01e99d583cc16bbd6]
module.resources.module.vpc.aws_route_table.public[0]: Refreshing state... [id=rtb-0f703710ef8983d5a]
module.resources.module.vpc.aws_subnet.private[0]: Refreshing state... [id=subnet-00564600fc0109d5f]
module.resources.module.vpc.aws_subnet.private[1]: Refreshing state... [id=subnet-0c9a24adf6985b148]
module.resources.module.vpc.aws_subnet.private[2]: Refreshing state... [id=subnet-0e9ba580b832e58ab]
module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151528958300000014]
module.resources.module.vpc.aws_eip.nat[0]: Refreshing state... [id=eipalloc-04e1927500c13e36f]
module.resources.module.vpc.aws_route.public_internet_gateway[0]: Refreshing state... [id=r-rtb-0f703710ef8983d5a1080289494]
module.resources.module.vpc.aws_route_table_association.public[0]: Refreshing state... [id=rtbassoc-0527a821acc8b2d5d]
module.resources.module.vpc.aws_route_table_association.public[2]: Refreshing state... [id=rtbassoc-0f01ab3ef8fb36172]
module.resources.module.vpc.aws_route_table_association.public[1]: Refreshing state... [id=rtbassoc-05a8a28a38e5d35a9]
module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"]: Refreshing state... [id=sgrule-3648003083]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"]: Refreshing state... [id=sgrule-3210305847]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"]: Refreshing state... [id=sgrule-2982503749]
module.resources.module.eks.aws_security_group_rule.node["egress_all"]: Refreshing state... [id=sgrule-3638724160]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"]: Refreshing state... [id=sgrule-887369126]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"]: Refreshing state... [id=sgrule-1125720652]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"]: Refreshing state... [id=sgrule-4255533616]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"]: Refreshing state... [id=sgrule-1048699024]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"]: Refreshing state... [id=sgrule-666374535]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"]: Refreshing state... [id=sgrule-2598257535]
module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"]: Refreshing state... [id=sgrule-334661475]
module.resources.module.vpc.aws_route_table_association.private[0]: Refreshing state... [id=rtbassoc-006325e67577ba7cb]
module.resources.module.vpc.aws_route_table_association.private[1]: Refreshing state... [id=rtbassoc-03cbd09508fae031c]
module.resources.module.vpc.aws_route_table_association.private[2]: Refreshing state... [id=rtbassoc-0dbcf7c72bb07f949]
module.resources.module.vpc.aws_nat_gateway.this[0]: Refreshing state... [id=nat-0fe07f0eb9fb2161d]
module.resources.module.vpc.aws_route.private_nat_gateway[0]: Refreshing state... [id=r-rtb-0e06cd84685011ff81080289494]
module.resources.module.eks.aws_eks_cluster.this[0]: Refreshing state... [id=zeno-production-cluster]
module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"]: Reading...
module.resources.module.eks.data.tls_certificate.this[0]: Reading...
module.resources.module.eks.time_sleep.this[0]: Refreshing state... [id=2024-11-24T15:26:39Z]
module.resources.helm_release.zeno-ingress-nginx: Refreshing state... [id=ingress-nginx]
module.resources.helm_release.zeno-cert-manager: Refreshing state... [id=cert-manager]
module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=6616271754968722364]
module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=8124355570844009309]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0]: Refreshing state... [id=lt-099de2edeeea863c8]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0]: Refreshing state... [id=lt-0fdd12ec7c2965609]
module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"]: Read complete after 0s [id=aws-ebs-csi-driver]
module.resources.module.eks.data.tls_certificate.this[0]: Read complete after 0s [id=922877a0975ad078a65b8ff11ebc47b8311945c7]
module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0]: Refreshing state... [id=arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:default-20241124152646072500000019]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:regular-2024112415264607270000001b]
module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"]: Refreshing state... [id=zeno-production-cluster:aws-ebs-csi-driver]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.resources.module.eks.aws_eks_cluster.this[0] has changed
  ~ resource "aws_eks_cluster" "this" {
        id                            = "zeno-production-cluster"
        name                          = "zeno-production-cluster"
      ~ platform_version              = "eks.20" -> "eks.21"
        tags                          = {
            "terraform-aws-modules" = "eks"
        }
        # (11 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"] will be updated in-place
  ~ resource "aws_eks_addon" "this" {
      ~ addon_version               = "v1.40.1-eksbuild.1" -> "v1.41.0-eksbuild.1"
        id                          = "zeno-production-cluster:aws-ebs-csi-driver"
        tags                        = {}
        # (9 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: batpad
created_at: 2025-04-09T09:40:12Z
body: @sunu I've made the changes required to the Github Actions workflow. Can you please do another review?

I guess next steps would be:

 - Create a `develop` branch and make this PR to `develop`
 - Add secrets for `STAGING_` values to Github Secrets - @leothomas I will need your help with that - essentially, all the github secrets will need corresponding `STAGING_<secret_name>` secret values, that would be used as the secrets for staging
  - Merge to develop and 🙏 
  
 Also, to be clear on what this does:

On pull requests made to `develop` or `main`, it will just validate the terraform and post a message in the PR with a failure (like it currently does, except it will also do this on PRs made to `develop`).

On pushes to `develop`, it will update / create a new `staging` terraform stack, including a new cluster. It will then helm install all the same helm dependencies that are installed on prod - ollama, prometheus, etc. It will then, for `develop` do a helm install of Zeno with secrets for staging.

On pushes to `main`, it will deploy to production like before.

I think I will do one more thing here before it's fully ready:

Setup custom `values-production.yaml` and `values-staging.yaml` files for all the dependencies as well as the main Project Zeno app so that we can set different resources, etc. for staging and production easily. @sunu does that make sense?

cc @leothomas @01painadam 
author_association: COLLABORATOR
user: login: batpad
created_at: 2025-04-09T09:41:42Z
body: > Since we will introduce auth and persistence this phase, we should provision separate databases through Terraform. It's fine to do that as part of a separate PR though.

Haa - good catch @sunu - let's outline the needs for the separate database, users table, also things like how we handle migrations, etc. in a separate ticket. I think it's fine to have that as a separate PR.
author_association: COLLABORATOR
user: login: batpad
created_at: 2025-04-09T09:43:54Z
body: Hmm @sunu looking at the above `terraform plan` output, I see terraform will also attempt to do a Kubernetes upgrade. Are we comfortable with this? Or should we make a separate ticket to ignore certain lifecycle changes or so to prevent this from happening automatically?
author_association: COLLABORATOR
user: login: sunu
created_at: 2025-04-09T09:53:05Z
body: @batpad yes, lets put that in a lifecycle ignore_changes block
author_association: COLLABORATOR
user: login: github-actions[bot]
created_at: 2025-04-11T05:01:04Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`success`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.data.aws_availability_zones.available: Reading...
module.resources.data.aws_caller_identity.current: Reading...
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.module.vpc.aws_vpc.this[0]: Refreshing state... [id=vpc-0f6151e1ec7ed4b96]
module.resources.module.eks.aws_cloudwatch_log_group.this[0]: Refreshing state... [id=/aws/eks/zeno-production-cluster/cluster]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.module.eks.aws_iam_role.this[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002]
module.resources.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]
module.resources.data.aws_db_instance.zeno-db: Read complete after 0s [id=zeno-db]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459683600000005]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459658300000004]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500034600000008]
module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150083720000000d]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500094000000009]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500015800000007]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150038690000000b]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150080180000000c]
module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0]: Read complete after 0s [id=2695086987]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150036100000000a]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151459701100000006]
module.resources.module.eks.module.kms.aws_kms_key.this[0]: Refreshing state... [id=8cd9f3d5-f6e1-49ff-a032-da1528c9daa4]
module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"]: Refreshing state... [id=alias/eks/zeno-production-cluster]
module.resources.module.eks.aws_iam_policy.cluster_encryption[0]: Refreshing state... [id=arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013]
module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151528958300000014]
module.resources.module.vpc.aws_default_security_group.this[0]: Refreshing state... [id=sg-02f79d9422c79d174]
module.resources.module.vpc.aws_default_route_table.default[0]: Refreshing state... [id=rtb-0dca056b5cb3f4bdc]
module.resources.module.vpc.aws_subnet.public[1]: Refreshing state... [id=subnet-060bb06a5c8393f81]
module.resources.module.vpc.aws_default_network_acl.this[0]: Refreshing state... [id=acl-01d72c016ec1365bf]
module.resources.module.vpc.aws_subnet.public[0]: Refreshing state... [id=subnet-0b2d1b545f702eceb]
module.resources.module.vpc.aws_subnet.public[2]: Refreshing state... [id=subnet-0aad369235ab19564]
module.resources.module.vpc.aws_route_table.private[0]: Refreshing state... [id=rtb-0e06cd84685011ff8]
module.resources.module.vpc.aws_internet_gateway.this[0]: Refreshing state... [id=igw-0721a42d5f02f490a]
module.resources.module.vpc.aws_subnet.private[0]: Refreshing state... [id=subnet-00564600fc0109d5f]
module.resources.module.eks.aws_security_group.node[0]: Refreshing state... [id=sg-01e99d583cc16bbd6]
module.resources.module.vpc.aws_subnet.private[1]: Refreshing state... [id=subnet-0c9a24adf6985b148]
module.resources.module.vpc.aws_subnet.private[2]: Refreshing state... [id=subnet-0e9ba580b832e58ab]
module.resources.module.vpc.aws_route_table.public[0]: Refreshing state... [id=rtb-0f703710ef8983d5a]
module.resources.module.eks.aws_security_group.cluster[0]: Refreshing state... [id=sg-0bd86b2d1d4c494db]
module.resources.module.vpc.aws_eip.nat[0]: Refreshing state... [id=eipalloc-04e1927500c13e36f]
module.resources.module.vpc.aws_route_table_association.public[2]: Refreshing state... [id=rtbassoc-0f01ab3ef8fb36172]
module.resources.module.vpc.aws_route_table_association.public[0]: Refreshing state... [id=rtbassoc-0527a821acc8b2d5d]
module.resources.module.vpc.aws_route_table_association.public[1]: Refreshing state... [id=rtbassoc-05a8a28a38e5d35a9]
module.resources.module.vpc.aws_route.public_internet_gateway[0]: Refreshing state... [id=r-rtb-0f703710ef8983d5a1080289494]
module.resources.module.vpc.aws_route_table_association.private[1]: Refreshing state... [id=rtbassoc-03cbd09508fae031c]
module.resources.module.vpc.aws_route_table_association.private[2]: Refreshing state... [id=rtbassoc-0dbcf7c72bb07f949]
module.resources.module.vpc.aws_route_table_association.private[0]: Refreshing state... [id=rtbassoc-006325e67577ba7cb]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"]: Refreshing state... [id=sgrule-2598257535]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"]: Refreshing state... [id=sgrule-666374535]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"]: Refreshing state... [id=sgrule-1048699024]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"]: Refreshing state... [id=sgrule-3210305847]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"]: Refreshing state... [id=sgrule-1125720652]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"]: Refreshing state... [id=sgrule-2982503749]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"]: Refreshing state... [id=sgrule-887369126]
module.resources.module.eks.aws_security_group_rule.node["egress_all"]: Refreshing state... [id=sgrule-3638724160]
module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"]: Refreshing state... [id=sgrule-3648003083]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"]: Refreshing state... [id=sgrule-4255533616]
module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"]: Refreshing state... [id=sgrule-334661475]
module.resources.module.vpc.aws_nat_gateway.this[0]: Refreshing state... [id=nat-0fe07f0eb9fb2161d]
module.resources.module.vpc.aws_route.private_nat_gateway[0]: Refreshing state... [id=r-rtb-0e06cd84685011ff81080289494]
module.resources.module.eks.aws_eks_cluster.this[0]: Refreshing state... [id=zeno-production-cluster]
module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"]: Reading...
module.resources.module.eks.data.tls_certificate.this[0]: Reading...
module.resources.module.eks.time_sleep.this[0]: Refreshing state... [id=2024-11-24T15:26:39Z]
module.resources.helm_release.zeno-ingress-nginx: Refreshing state... [id=ingress-nginx]
module.resources.helm_release.zeno-cert-manager: Refreshing state... [id=cert-manager]
module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=8124355570844009309]
module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=6616271754968722364]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0]: Refreshing state... [id=lt-099de2edeeea863c8]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0]: Refreshing state... [id=lt-0fdd12ec7c2965609]
module.resources.module.eks.data.tls_certificate.this[0]: Read complete after 0s [id=922877a0975ad078a65b8ff11ebc47b8311945c7]
module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0]: Refreshing state... [id=arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2]
module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"]: Read complete after 0s [id=aws-ebs-csi-driver]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:regular-2024112415264607270000001b]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:default-20241124152646072500000019]
module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"]: Refreshing state... [id=zeno-production-cluster:aws-ebs-csi-driver]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.resources.module.eks.aws_eks_cluster.this[0] has changed
  ~ resource "aws_eks_cluster" "this" {
        id                            = "zeno-production-cluster"
        name                          = "zeno-production-cluster"
      ~ platform_version              = "eks.20" -> "eks.21"
        tags                          = {
            "terraform-aws-modules" = "eks"
        }
        # (11 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"] will be updated in-place
  ~ resource "aws_eks_addon" "this" {
      ~ addon_version               = "v1.40.1-eksbuild.1" -> "v1.41.0-eksbuild.1"
        id                          = "zeno-production-cluster:aws-ebs-csi-driver"
        tags                        = {}
        # (9 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: batpad
created_at: 2025-04-11T06:05:16Z
body: I made the change to let each helm service be over-ridden by environment-specific `values` files - so each of the helm services can now have custom (non-secret) values for staging / production in a `values-staging.yaml` and `values-production.yaml` that will over-ride values in the default `values.yaml` (cc @leothomas)

> @batpad yes, lets put that in a lifecycle ignore_changes block

This PR would be ready, but I got into a bit of a hole trying to fix this terraform issue - this `platform_version` thing is a bit of a weird one and I don't think I fully understand how to do this cleanly. Apparently, the way to ignore this change is to do something like:

```
  resource_overrides = {
    aws_eks_cluster.this = {
      lifecycle = {
        ignore_changes = ["platform_version"]
      }
    }
  }
```

This seems a bit weird to me though and @sunu I'd want to run it by you. I tried:

 - Pinning `platform_version` to the current version to prevent unwanted updates. This didn't work since `platform_version` is not actually a valid parameter, its a computed attribute.
 - Just putting `platform_version` in a lifecycle `ignore_changes` block doesn't work either.

@sunu would love to take a small step back here and figure out what best to do.
author_association: COLLABORATOR
user: login: github-actions[bot]
created_at: 2025-04-11T09:00:35Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`success`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.data.aws_availability_zones.available: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.module.vpc.aws_vpc.this[0]: Refreshing state... [id=vpc-0f6151e1ec7ed4b96]
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.aws_cloudwatch_log_group.this[0]: Refreshing state... [id=/aws/eks/zeno-production-cluster/cluster]
module.resources.module.eks.aws_iam_role.this[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002]
module.resources.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001]
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]
module.resources.data.aws_db_instance.zeno-db: Read complete after 0s [id=zeno-db]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459658300000004]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459683600000005]
module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0]: Reading...
module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0]: Read complete after 0s [id=2695086987]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150083720000000d]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500034600000008]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150036100000000a]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151459701100000006]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500015800000007]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150038690000000b]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150080180000000c]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500094000000009]
module.resources.module.eks.module.kms.aws_kms_key.this[0]: Refreshing state... [id=8cd9f3d5-f6e1-49ff-a032-da1528c9daa4]
module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"]: Refreshing state... [id=alias/eks/zeno-production-cluster]
module.resources.module.eks.aws_iam_policy.cluster_encryption[0]: Refreshing state... [id=arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013]
module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151528958300000014]
module.resources.module.vpc.aws_default_security_group.this[0]: Refreshing state... [id=sg-02f79d9422c79d174]
module.resources.module.vpc.aws_default_route_table.default[0]: Refreshing state... [id=rtb-0dca056b5cb3f4bdc]
module.resources.module.vpc.aws_default_network_acl.this[0]: Refreshing state... [id=acl-01d72c016ec1365bf]
module.resources.module.vpc.aws_internet_gateway.this[0]: Refreshing state... [id=igw-0721a42d5f02f490a]
module.resources.module.vpc.aws_subnet.private[2]: Refreshing state... [id=subnet-0e9ba580b832e58ab]
module.resources.module.vpc.aws_subnet.private[1]: Refreshing state... [id=subnet-0c9a24adf6985b148]
module.resources.module.vpc.aws_subnet.private[0]: Refreshing state... [id=subnet-00564600fc0109d5f]
module.resources.module.eks.aws_security_group.cluster[0]: Refreshing state... [id=sg-0bd86b2d1d4c494db]
module.resources.module.vpc.aws_route_table.private[0]: Refreshing state... [id=rtb-0e06cd84685011ff8]
module.resources.module.eks.aws_security_group.node[0]: Refreshing state... [id=sg-01e99d583cc16bbd6]
module.resources.module.vpc.aws_subnet.public[0]: Refreshing state... [id=subnet-0b2d1b545f702eceb]
module.resources.module.vpc.aws_subnet.public[2]: Refreshing state... [id=subnet-0aad369235ab19564]
module.resources.module.vpc.aws_subnet.public[1]: Refreshing state... [id=subnet-060bb06a5c8393f81]
module.resources.module.vpc.aws_route_table.public[0]: Refreshing state... [id=rtb-0f703710ef8983d5a]
module.resources.module.vpc.aws_eip.nat[0]: Refreshing state... [id=eipalloc-04e1927500c13e36f]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"]: Refreshing state... [id=sgrule-3210305847]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"]: Refreshing state... [id=sgrule-1125720652]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"]: Refreshing state... [id=sgrule-1048699024]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"]: Refreshing state... [id=sgrule-2982503749]
module.resources.module.eks.aws_security_group_rule.node["egress_all"]: Refreshing state... [id=sgrule-3638724160]
module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"]: Refreshing state... [id=sgrule-3648003083]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"]: Refreshing state... [id=sgrule-2598257535]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"]: Refreshing state... [id=sgrule-887369126]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"]: Refreshing state... [id=sgrule-4255533616]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"]: Refreshing state... [id=sgrule-666374535]
module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"]: Refreshing state... [id=sgrule-334661475]
module.resources.module.vpc.aws_route_table_association.private[0]: Refreshing state... [id=rtbassoc-006325e67577ba7cb]
module.resources.module.vpc.aws_route_table_association.private[1]: Refreshing state... [id=rtbassoc-03cbd09508fae031c]
module.resources.module.vpc.aws_route_table_association.private[2]: Refreshing state... [id=rtbassoc-0dbcf7c72bb07f949]
module.resources.module.vpc.aws_route.public_internet_gateway[0]: Refreshing state... [id=r-rtb-0f703710ef8983d5a1080289494]
module.resources.module.vpc.aws_route_table_association.public[1]: Refreshing state... [id=rtbassoc-05a8a28a38e5d35a9]
module.resources.module.vpc.aws_route_table_association.public[0]: Refreshing state... [id=rtbassoc-0527a821acc8b2d5d]
module.resources.module.vpc.aws_route_table_association.public[2]: Refreshing state... [id=rtbassoc-0f01ab3ef8fb36172]
module.resources.module.vpc.aws_nat_gateway.this[0]: Refreshing state... [id=nat-0fe07f0eb9fb2161d]
module.resources.module.eks.aws_eks_cluster.this[0]: Refreshing state... [id=zeno-production-cluster]
module.resources.module.vpc.aws_route.private_nat_gateway[0]: Refreshing state... [id=r-rtb-0e06cd84685011ff81080289494]
module.resources.module.eks.data.tls_certificate.this[0]: Reading...
module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"]: Reading...
module.resources.module.eks.time_sleep.this[0]: Refreshing state... [id=2024-11-24T15:26:39Z]
module.resources.helm_release.zeno-cert-manager: Refreshing state... [id=cert-manager]
module.resources.helm_release.zeno-ingress-nginx: Refreshing state... [id=ingress-nginx]
module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=8124355570844009309]
module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=6616271754968722364]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0]: Refreshing state... [id=lt-099de2edeeea863c8]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0]: Refreshing state... [id=lt-0fdd12ec7c2965609]
module.resources.module.eks.data.tls_certificate.this[0]: Read complete after 1s [id=922877a0975ad078a65b8ff11ebc47b8311945c7]
module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0]: Refreshing state... [id=arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2]
module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"]: Read complete after 1s [id=aws-ebs-csi-driver]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:default-20241124152646072500000019]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:regular-2024112415264607270000001b]
module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"]: Refreshing state... [id=zeno-production-cluster:aws-ebs-csi-driver]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-11T10:20:40Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`failure`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.data.aws_caller_identity.current: Reading...
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.data.aws_availability_zones.available: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.aws_cloudwatch_log_group.this[0]: Refreshing state... [id=/aws/eks/zeno-production-cluster/cluster]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.vpc.aws_vpc.this[0]: Refreshing state... [id=vpc-0f6151e1ec7ed4b96]
module.resources.module.eks.aws_iam_role.this[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002]
module.resources.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001]
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 0s [id=084375562450]
module.resources.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]
module.resources.data.aws_db_instance.zeno-db: Read complete after 0s [id=zeno-db]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150083720000000d]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500034600000008]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500094000000009]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150038690000000b]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150036100000000a]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150080180000000c]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151459701100000006]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500015800000007]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459658300000004]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459683600000005]
module.resources.module.eks.module.kms.aws_kms_key.this[0]: Refreshing state... [id=8cd9f3d5-f6e1-49ff-a032-da1528c9daa4]
module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"]: Refreshing state... [id=alias/eks/zeno-production-cluster]
module.resources.module.eks.aws_iam_policy.cluster_encryption[0]: Refreshing state... [id=arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013]
module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151528958300000014]
module.resources.module.vpc.aws_default_route_table.default[0]: Refreshing state... [id=rtb-0dca056b5cb3f4bdc]
module.resources.module.vpc.aws_default_security_group.this[0]: Refreshing state... [id=sg-02f79d9422c79d174]
module.resources.module.vpc.aws_default_network_acl.this[0]: Refreshing state... [id=acl-01d72c016ec1365bf]
module.resources.module.vpc.aws_internet_gateway.this[0]: Refreshing state... [id=igw-0721a42d5f02f490a]
module.resources.module.vpc.aws_subnet.private[0]: Refreshing state... [id=subnet-00564600fc0109d5f]
module.resources.module.vpc.aws_subnet.private[2]: Refreshing state... [id=subnet-0e9ba580b832e58ab]
module.resources.module.vpc.aws_subnet.private[1]: Refreshing state... [id=subnet-0c9a24adf6985b148]
module.resources.module.vpc.aws_route_table.public[0]: Refreshing state... [id=rtb-0f703710ef8983d5a]
module.resources.module.eks.aws_security_group.cluster[0]: Refreshing state... [id=sg-0bd86b2d1d4c494db]
module.resources.module.eks.aws_security_group.node[0]: Refreshing state... [id=sg-01e99d583cc16bbd6]
module.resources.module.vpc.aws_subnet.public[2]: Refreshing state... [id=subnet-0aad369235ab19564]
module.resources.module.vpc.aws_subnet.public[0]: Refreshing state... [id=subnet-0b2d1b545f702eceb]
module.resources.module.vpc.aws_subnet.public[1]: Refreshing state... [id=subnet-060bb06a5c8393f81]
module.resources.module.vpc.aws_route_table.private[0]: Refreshing state... [id=rtb-0e06cd84685011ff8]
module.resources.module.vpc.aws_eip.nat[0]: Refreshing state... [id=eipalloc-04e1927500c13e36f]
module.resources.module.vpc.aws_route.public_internet_gateway[0]: Refreshing state... [id=r-rtb-0f703710ef8983d5a1080289494]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"]: Refreshing state... [id=sgrule-2598257535]
module.resources.module.eks.aws_security_group_rule.node["egress_all"]: Refreshing state... [id=sgrule-3638724160]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"]: Refreshing state... [id=sgrule-666374535]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"]: Refreshing state... [id=sgrule-3210305847]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"]: Refreshing state... [id=sgrule-2982503749]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"]: Refreshing state... [id=sgrule-4255533616]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"]: Refreshing state... [id=sgrule-1048699024]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"]: Refreshing state... [id=sgrule-1125720652]
module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"]: Refreshing state... [id=sgrule-3648003083]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"]: Refreshing state... [id=sgrule-887369126]
module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"]: Refreshing state... [id=sgrule-334661475]
module.resources.module.vpc.aws_route_table_association.private[2]: Refreshing state... [id=rtbassoc-0dbcf7c72bb07f949]
module.resources.module.vpc.aws_route_table_association.private[0]: Refreshing state... [id=rtbassoc-006325e67577ba7cb]
module.resources.module.vpc.aws_route_table_association.private[1]: Refreshing state... [id=rtbassoc-03cbd09508fae031c]
module.resources.module.vpc.aws_route_table_association.public[2]: Refreshing state... [id=rtbassoc-0f01ab3ef8fb36172]
module.resources.module.vpc.aws_route_table_association.public[1]: Refreshing state... [id=rtbassoc-05a8a28a38e5d35a9]
module.resources.module.vpc.aws_route_table_association.public[0]: Refreshing state... [id=rtbassoc-0527a821acc8b2d5d]
module.resources.module.vpc.aws_nat_gateway.this[0]: Refreshing state... [id=nat-0fe07f0eb9fb2161d]
module.resources.module.vpc.aws_route.private_nat_gateway[0]: Refreshing state... [id=r-rtb-0e06cd84685011ff81080289494]
module.resources.module.eks.aws_eks_cluster.this[0]: Refreshing state... [id=zeno-production-cluster]
module.resources.module.eks.time_sleep.this[0]: Refreshing state... [id=2024-11-24T15:26:39Z]
module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0]: Refreshing state... [id=arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2]
module.resources.helm_release.zeno-cert-manager: Refreshing state... [id=cert-manager]
module.resources.helm_release.zeno-ingress-nginx: Refreshing state... [id=ingress-nginx]
module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=6616271754968722364]
module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=8124355570844009309]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0]: Refreshing state... [id=lt-0fdd12ec7c2965609]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0]: Refreshing state... [id=lt-099de2edeeea863c8]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:regular-2024112415264607270000001b]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:default-20241124152646072500000019]
module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"]: Refreshing state... [id=zeno-production-cluster:aws-ebs-csi-driver]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.resources.module.eks.aws_eks_cluster.this[0] has changed
  ~ resource "aws_eks_cluster" "this" {
        id                            = "zeno-production-cluster"
        name                          = "zeno-production-cluster"
      ~ platform_version              = "eks.20" -> "eks.21"
        tags                          = {
            "terraform-aws-modules" = "eks"
        }
        # (11 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement
+/- create replacement and then destroy
 <= read (data resources)

Terraform planned the following actions, but then encountered a problem:

  # module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_eks_addon_version" "this" {
      + addon_name         = "aws-ebs-csi-driver"
      + id                 = (known after apply)
      + kubernetes_version = "1.31"
      + version            = (known after apply)
    }

  # module.resources.module.eks.data.tls_certificate.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "tls_certificate" "this" {
      + certificates = (known after apply)
      + id           = (known after apply)
      + url          = (known after apply)
    }

  # module.resources.module.eks.aws_cloudwatch_log_group.this[0] must be replaced
+/- resource "aws_cloudwatch_log_group" "this" {
      ~ arn               = "arn:aws:logs:us-east-1:084375562450:log-group:/aws/eks/zeno-production-cluster/cluster" -> (known after apply)
      ~ id                = "/aws/eks/zeno-production-cluster/cluster" -> (known after apply)
      ~ log_group_class   = "STANDARD" -> (known after apply)
      ~ name              = "/aws/eks/zeno-production-cluster/cluster" -> "/aws/eks/zeno-staging-cluster/cluster" # forces replacement
      + name_prefix       = (known after apply)
      ~ tags              = {
          ~ "Name" = "/aws/eks/zeno-production-cluster/cluster" -> "/aws/eks/zeno-staging-cluster/cluster"
        }
      ~ tags_all          = {
          ~ "Name" = "/aws/eks/zeno-production-cluster/cluster" -> "/aws/eks/zeno-staging-cluster/cluster"
        }
        # (2 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"] must be replaced
-/+ resource "aws_eks_addon" "this" {
      ~ arn                         = "arn:aws:eks:us-east-1:084375562450:addon/zeno-production-cluster/aws-ebs-csi-driver/22c9af65-086f-8e8a-463f-07f929aa54f7" -> (known after apply)
      ~ cluster_name                = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      + configuration_values        = (known after apply)
      ~ created_at                  = "2024-11-24T15:28:41Z" -> (known after apply)
      ~ id                          = "zeno-production-cluster:aws-ebs-csi-driver" -> (known after apply)
      ~ modified_at                 = "2025-03-22T16:38:23Z" -> (known after apply)
      - tags                        = {} -> null
      ~ tags_all                    = {} -> (known after apply)
        # (5 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.resources.module.eks.aws_eks_cluster.this[0] must be replaced
+/- resource "aws_eks_cluster" "this" {
      ~ arn                           = "arn:aws:eks:us-east-1:084375562450:cluster/zeno-production-cluster" -> (known after apply)
      ~ certificate_authority         = [
          - {
              - data = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJUkNaSXRwS1ZZb1l3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TkRFeE1qUXhOVEUxTVRaYUZ3MHpOREV4TWpJeE5USXdNVFphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURyd3hFZ2pJTERkK1BSVmR0cy9FVWU1WXVMZVV2TlBxV1U4VDg0aGRYUWVDajdRdmxKYk5GRGYxM3AKNk1MZnhDTzBycmEzb05rV0htaXN3R1ZFUEpWREJTcG90VGxacGhvRHpKa0N4akNDc0F3TUxyNVV1T0R4UzZkUwpZOGYzSDhRVlBIRWRMakR0VlFJWVpTdkE5ZDFSUFBvVWhvcHdJYWFNNG1MTE1VUmlwUnEyNndZeVRXemFQWW9XCkdZV3doNC9QVldVcktNRkVEeGEzMGl5aDRwQi8rUWF5ejdkV2xyeDY4U0VZMjJIckN2MzUvSTFzWHFDZ3NTL2UKaGZHTW1iZUs4UFMyaytGUWhJQXZTTnRTZGt1a1lra2Y4d1dIUTRkaDdOaWpVU3QrUlNBUWd1eENhSUNqUWtxRwo5ckk1Q3J4Z1djbE41QVR2UnpuUHlHak9SaUxsQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJRU01GVzBSR3IzQlJwNE5rM1JBVkN2dk44aDdUQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQTZCV0dLSkNUYgp4MnFscTc0Tm5JL0w3aEt6MUVkWGdESnF0b1pXbTdCNmMvY055T0xJQUNmd21tOWVvRGJqMnpHVHc5OFhTVm84CkFEQmxTWHVSb2dTUi9RY2IxeEpVWnFVcHRXM2dNYWRvMjhZNnZVY0s0aG9lL3pPaDZDczlIMEdoVkxaNU9RaXgKVHYrSHRBM0ZlTWNuUFV6SWJUNXd1ZVVoUG41bnVVTkVwejAvaGNQL2JrM00rVWxMK1RNMnkwM0lmWEZhL21mLwpiV1kzK0RCUUhVa0svSlJ1T2hjRDhrUkdZV0RRMTQ5K2kxdlpSTE9BL2tlblFidXc1ZThNOFNiTmFQcXVsd2JVCjdLZjZ6dm50ZlhDa0R1Vkw0NGFWdWlXa2pnQWQrckZyaHFDd3BSRnRhMmtqdlNtQTRmaFI5SHF5L0wrRHZ0S2kKRTJDdVByU2w4TEVOCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
            },
        ] -> (known after apply)
      + cluster_id                    = (known after apply)
      ~ created_at                    = "2024-11-24T15:15:33Z" -> (known after apply)
      ~ endpoint                      = "https://085DFD0C5701406346D03AB1EA5B38F2.gr7.us-east-1.eks.amazonaws.com" -> (known after apply)
      ~ id                            = "zeno-production-cluster" -> (known after apply)
      ~ identity                      = [
          - {
              - oidc = [
                  - {
                      - issuer = "https://oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2"
                    },
                ]
            },
        ] -> (known after apply)
      ~ name                          = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      ~ platform_version              = "eks.21" -> (known after apply)
      ~ role_arn                      = "arn:aws:iam::084375562450:role/zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
      ~ status                        = "ACTIVE" -> (known after apply)
        tags                          = {
            "terraform-aws-modules" = "eks"
        }
        # (4 unchanged attributes hidden)

      ~ kubernetes_network_config {
          ~ service_ipv4_cidr = "172.20.0.0/16" -> (known after apply)
          + service_ipv6_cidr = (known after apply)
            # (1 unchanged attribute hidden)

          - elastic_load_balancing {
              - enabled = false -> null
            }
        }

      - upgrade_policy {
          - support_type = "EXTENDED" -> null
        }

      ~ vpc_config {
          ~ cluster_security_group_id = "sg-0e489d72b61ec1d2e" -> (known after apply)
          ~ security_group_ids        = [
              - "sg-0bd86b2d1d4c494db",
            ] -> (known after apply)
          ~ vpc_id                    = "vpc-0f6151e1ec7ed4b96" -> (known after apply)
            # (4 unchanged attributes hidden)
        }

        # (3 unchanged blocks hidden)
    }

  # module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0] must be replaced
-/+ resource "aws_iam_openid_connect_provider" "oidc_provider" {
      ~ arn             = "arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2" -> (known after apply)
      ~ id              = "arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2" -> (known after apply)
      ~ tags            = {
          ~ "Name" = "zeno-production-cluster-eks-irsa" -> "zeno-staging-cluster-eks-irsa"
        }
      ~ tags_all        = {
          ~ "Name" = "zeno-production-cluster-eks-irsa" -> "zeno-staging-cluster-eks-irsa"
        }
      ~ thumbprint_list = [
          - "9e99a48a9960b14926bb7f3b02e22da2b0ab7280",
        ] -> (known after apply)
      ~ url             = "oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2" # forces replacement -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.aws_iam_policy.cluster_encryption[0] must be replaced
-/+ resource "aws_iam_policy" "cluster_encryption" {
      ~ arn              = "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" -> (known after apply)
      ~ attachment_count = 1 -> (known after apply)
      ~ id               = "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" -> (known after apply)
      ~ name             = "zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" -> (known after apply)
      ~ name_prefix      = "zeno-production-cluster-cluster-ClusterEncryption" -> "zeno-staging-cluster-cluster-ClusterEncryption" # forces replacement
      ~ policy_id        = "ANPARHJJM5DJBAVDHQOZA" -> (known after apply)
      - tags             = {} -> null
      ~ tags_all         = {} -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_iam_role.this[0] must be replaced
+/- resource "aws_iam_role" "this" {
      ~ arn                   = "arn:aws:iam::084375562450:role/zeno-production-cluster-cluster-20241124151456720400000002" -> (known after apply)
      ~ create_date           = "2024-11-24T15:14:58Z" -> (known after apply)
      ~ id                    = "zeno-production-cluster-cluster-20241124151456720400000002" -> (known after apply)
      ~ managed_policy_arns   = [
          - "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013",
          - "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
          - "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
        ] -> (known after apply)
      ~ name                  = "zeno-production-cluster-cluster-20241124151456720400000002" -> (known after apply)
      ~ name_prefix           = "zeno-production-cluster-cluster-" -> "zeno-staging-cluster-cluster-" # forces replacement
      - tags                  = {} -> null
      ~ tags_all              = {} -> (known after apply)
      ~ unique_id             = "AROARHJJM5DJLHROOUMBV" -> (known after apply)
        # (4 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0] must be replaced
-/+ resource "aws_iam_role_policy_attachment" "cluster_encryption" {
      ~ id         = "zeno-production-cluster-cluster-20241124151456720400000002-20241124151528958300000014" -> (known after apply)
      ~ policy_arn = "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" # forces replacement -> (known after apply) # forces replacement
      ~ role       = "zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"] must be replaced
+/- resource "aws_iam_role_policy_attachment" "this" {
      ~ id         = "zeno-production-cluster-cluster-20241124151456720400000002-20241124151459683600000005" -> (known after apply)
      ~ role       = "zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"] must be replaced
+/- resource "aws_iam_role_policy_attachment" "this" {
      ~ id         = "zeno-production-cluster-cluster-20241124151456720400000002-20241124151459658300000004" -> (known after apply)
      ~ role       = "zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.aws_security_group.cluster[0] must be replaced
+/- resource "aws_security_group" "cluster" {
      ~ arn                    = "arn:aws:ec2:us-east-1:084375562450:security-group/sg-0bd86b2d1d4c494db" -> (known after apply)
      ~ egress                 = [] -> (known after apply)
      ~ id                     = "sg-0bd86b2d1d4c494db" -> (known after apply)
      ~ ingress                = [
          - {
              - cidr_blocks      = []
              - description      = "Node groups to cluster API"
              - from_port        = 443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-01e99d583cc16bbd6",
                ]
              - self             = false
              - to_port          = 443
            },
        ] -> (known after apply)
      ~ name                   = "zeno-production-cluster-cluster-20241124151514397900000010" -> (known after apply)
      ~ name_prefix            = "zeno-production-cluster-cluster-" -> "zeno-staging-cluster-cluster-" # forces replacement
      ~ owner_id               = "084375562450" -> (known after apply)
      ~ tags                   = {
          ~ "Name" = "zeno-production-cluster-cluster" -> "zeno-staging-cluster-cluster"
        }
      ~ tags_all               = {
          ~ "Name" = "zeno-production-cluster-cluster" -> "zeno-staging-cluster-cluster"
        }
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group.node[0] must be replaced
+/- resource "aws_security_group" "node" {
      ~ arn                    = "arn:aws:ec2:us-east-1:084375562450:security-group/sg-01e99d583cc16bbd6" -> (known after apply)
      ~ egress                 = [
          - {
              - cidr_blocks      = [
                  - "0.0.0.0/0",
                ]
              - description      = "Allow all egress"
              - from_port        = 0
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "-1"
              - security_groups  = []
              - self             = false
              - to_port          = 0
            },
        ] -> (known after apply)
      ~ id                     = "sg-01e99d583cc16bbd6" -> (known after apply)
      ~ ingress                = [
          - {
              - cidr_blocks      = []
              - description      = ""
              - from_port        = 0
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "-1"
              - security_groups  = [
                  - "sg-0722c1b29c08baf08",
                ]
              - self             = false
              - to_port          = 0
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 4443/tcp webhook"
              - from_port        = 4443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 4443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 6443/tcp webhook"
              - from_port        = 6443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 6443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 8443/tcp webhook"
              - from_port        = 8443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 8443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 9443/tcp webhook"
              - from_port        = 9443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 9443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node groups"
              - from_port        = 443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node kubelets"
              - from_port        = 10250
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 10250
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to RDS"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = true
              - to_port          = 5432
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to node CoreDNS UDP"
              - from_port        = 53
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "udp"
              - security_groups  = []
              - self             = true
              - to_port          = 53
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to node CoreDNS"
              - from_port        = 53
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = true
              - to_port          = 53
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to node ingress on ephemeral ports"
              - from_port        = 1025
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = true
              - to_port          = 65535
            },
        ] -> (known after apply)
      ~ name                   = "zeno-production-cluster-node-20241124151514429400000011" -> (known after apply)
      ~ name_prefix            = "zeno-production-cluster-node-" -> "zeno-staging-cluster-node-" # forces replacement
      ~ owner_id               = "084375562450" -> (known after apply)
      ~ tags                   = {
          ~ "Name"                                          = "zeno-production-cluster-node" -> "zeno-staging-cluster-node"
          - "kubernetes.io/cluster/zeno-production-cluster" = "owned" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "owned"
        }
      ~ tags_all               = {
          ~ "Name"                                          = "zeno-production-cluster-node" -> "zeno-staging-cluster-node"
          - "kubernetes.io/cluster/zeno-production-cluster" = "owned" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "owned"
        }
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"] must be replaced
+/- resource "aws_security_group_rule" "cluster" {
      ~ id                       = "sgrule-334661475" -> (known after apply)
      ~ security_group_id        = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-077c6317fd13fd294" -> (known after apply)
      ~ source_security_group_id = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
        # (6 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["egress_all"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-3638724160" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0b7ba3c3750a2d301" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (8 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-2982503749" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0072b01bd821ccff9" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-4255533616" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-04c38b4259acb9dd8" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-887369126" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-02dd245b7e5994733" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-666374535" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0db9463bfbacd3579" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-1125720652" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-064993144390ad6f9" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-3210305847" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0c0752ac8089880f1" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-3648003083" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0ece1a17f0c8a91ba" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-1048699024" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-033e24265326cb0d2" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-2598257535" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-095a9eedb908604cf" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.time_sleep.this[0] must be replaced
+/- resource "time_sleep" "this" {
      ~ id              = "2024-11-24T15:26:39Z" -> (known after apply)
      ~ triggers        = { # forces replacement
          ~ "cluster_certificate_authority_data" = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJUkNaSXRwS1ZZb1l3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TkRFeE1qUXhOVEUxTVRaYUZ3MHpOREV4TWpJeE5USXdNVFphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURyd3hFZ2pJTERkK1BSVmR0cy9FVWU1WXVMZVV2TlBxV1U4VDg0aGRYUWVDajdRdmxKYk5GRGYxM3AKNk1MZnhDTzBycmEzb05rV0htaXN3R1ZFUEpWREJTcG90VGxacGhvRHpKa0N4akNDc0F3TUxyNVV1T0R4UzZkUwpZOGYzSDhRVlBIRWRMakR0VlFJWVpTdkE5ZDFSUFBvVWhvcHdJYWFNNG1MTE1VUmlwUnEyNndZeVRXemFQWW9XCkdZV3doNC9QVldVcktNRkVEeGEzMGl5aDRwQi8rUWF5ejdkV2xyeDY4U0VZMjJIckN2MzUvSTFzWHFDZ3NTL2UKaGZHTW1iZUs4UFMyaytGUWhJQXZTTnRTZGt1a1lra2Y4d1dIUTRkaDdOaWpVU3QrUlNBUWd1eENhSUNqUWtxRwo5ckk1Q3J4Z1djbE41QVR2UnpuUHlHak9SaUxsQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJRU01GVzBSR3IzQlJwNE5rM1JBVkN2dk44aDdUQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQTZCV0dLSkNUYgp4MnFscTc0Tm5JL0w3aEt6MUVkWGdESnF0b1pXbTdCNmMvY055T0xJQUNmd21tOWVvRGJqMnpHVHc5OFhTVm84CkFEQmxTWHVSb2dTUi9RY2IxeEpVWnFVcHRXM2dNYWRvMjhZNnZVY0s0aG9lL3pPaDZDczlIMEdoVkxaNU9RaXgKVHYrSHRBM0ZlTWNuUFV6SWJUNXd1ZVVoUG41bnVVTkVwejAvaGNQL2JrM00rVWxMK1RNMnkwM0lmWEZhL21mLwpiV1kzK0RCUUhVa0svSlJ1T2hjRDhrUkdZV0RRMTQ5K2kxdlpSTE9BL2tlblFidXc1ZThNOFNiTmFQcXVsd2JVCjdLZjZ6dm50ZlhDa0R1Vkw0NGFWdWlXa2pnQWQrckZyaHFDd3BSRnRhMmtqdlNtQTRmaFI5SHF5L0wrRHZ0S2kKRTJDdVByU2w4TEVOCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K" -> (known after apply)
          ~ "cluster_endpoint"                   = "https://085DFD0C5701406346D03AB1EA5B38F2.gr7.us-east-1.eks.amazonaws.com" -> (known after apply)
          ~ "cluster_name"                       = "zeno-production-cluster" -> "zeno-staging-cluster"
          ~ "cluster_service_cidr"               = "172.20.0.0/16" -> (known after apply)
            # (1 unchanged element hidden)
        }
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.vpc.aws_default_network_acl.this[0] will be updated in-place
  ~ resource "aws_default_network_acl" "this" {
        id                     = "acl-01d72c016ec1365bf"
      ~ tags                   = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
      ~ tags_all               = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
        # (5 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.resources.module.vpc.aws_default_route_table.default[0] will be updated in-place
  ~ resource "aws_default_route_table" "default" {
        id                     = "rtb-0dca056b5cb3f4bdc"
      ~ tags                   = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
      ~ tags_all               = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
        # (6 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.resources.module.vpc.aws_default_security_group.this[0] will be updated in-place
  ~ resource "aws_default_security_group" "this" {
        id                     = "sg-02f79d9422c79d174"
        name                   = "default"
      ~ tags                   = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
      ~ tags_all               = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_eip.nat[0] will be updated in-place
  ~ resource "aws_eip" "nat" {
        id                   = "eipalloc-04e1927500c13e36f"
      ~ tags                 = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
      ~ tags_all             = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
        # (12 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_internet_gateway.this[0] will be updated in-place
  ~ resource "aws_internet_gateway" "this" {
        id       = "igw-0721a42d5f02f490a"
      ~ tags     = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
      ~ tags_all = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_nat_gateway.this[0] will be updated in-place
  ~ resource "aws_nat_gateway" "this" {
        id                                 = "nat-0fe07f0eb9fb2161d"
      ~ tags                               = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
      ~ tags_all                           = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
        # (10 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_route_table.private[0] will be updated in-place
  ~ resource "aws_route_table" "private" {
        id               = "rtb-0e06cd84685011ff8"
      ~ tags             = {
          ~ "Name" = "vpc-zeno-production-private" -> "vpc-zeno-staging-private"
        }
      ~ tags_all         = {
          ~ "Name" = "vpc-zeno-production-private" -> "vpc-zeno-staging-private"
        }
        # (5 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_route_table.public[0] will be updated in-place
  ~ resource "aws_route_table" "public" {
        id               = "rtb-0f703710ef8983d5a"
      ~ tags             = {
          ~ "Name" = "vpc-zeno-production-public" -> "vpc-zeno-staging-public"
        }
      ~ tags_all         = {
          ~ "Name" = "vpc-zeno-production-public" -> "vpc-zeno-staging-public"
        }
        # (5 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.private[0] will be updated in-place
  ~ resource "aws_subnet" "private" {
        id                                             = "subnet-00564600fc0109d5f"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1a" -> "vpc-zeno-staging-private-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/internal-elb"               = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1a" -> "vpc-zeno-staging-private-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.private[1] will be updated in-place
  ~ resource "aws_subnet" "private" {
        id                                             = "subnet-0c9a24adf6985b148"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1b" -> "vpc-zeno-staging-private-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/internal-elb"               = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1b" -> "vpc-zeno-staging-private-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.private[2] will be updated in-place
  ~ resource "aws_subnet" "private" {
        id                                             = "subnet-0e9ba580b832e58ab"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1c" -> "vpc-zeno-staging-private-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/internal-elb"               = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1c" -> "vpc-zeno-staging-private-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.public[0] will be updated in-place
  ~ resource "aws_subnet" "public" {
        id                                             = "subnet-0b2d1b545f702eceb"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1a" -> "vpc-zeno-staging-public-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/elb"                        = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1a" -> "vpc-zeno-staging-public-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.public[1] will be updated in-place
  ~ resource "aws_subnet" "public" {
        id                                             = "subnet-060bb06a5c8393f81"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1b" -> "vpc-zeno-staging-public-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/elb"                        = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1b" -> "vpc-zeno-staging-public-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.public[2] will be updated in-place
  ~ resource "aws_subnet" "public" {
        id                                             = "subnet-0aad369235ab19564"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1c" -> "vpc-zeno-staging-public-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/elb"                        = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1c" -> "vpc-zeno-staging-public-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_vpc.this[0] will be updated in-place
  ~ resource "aws_vpc" "this" {
        id                                   = "vpc-0f6151e1ec7ed4b96"
      ~ tags                                 = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
      ~ tags_all                             = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
        # (14 unchanged attributes hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0] must be replaced
+/- resource "aws_eks_node_group" "this" {
      ~ arn                    = "arn:aws:eks:us-east-1:084375562450:nodegroup/zeno-production-cluster/default-20241124152646072500000019/02c9af64-288d-0382-1221-3ef1d3e95d2c" -> (known after apply)
      ~ capacity_type          = "ON_DEMAND" -> (known after apply)
      ~ cluster_name           = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      ~ disk_size              = 0 -> (known after apply)
      ~ id                     = "zeno-production-cluster:default-20241124152646072500000019" -> (known after apply)
      - labels                 = {} -> null
      ~ node_group_name        = "default-20241124152646072500000019" -> (known after apply)
      ~ release_version        = "1.31.2-20241115" -> (known after apply)
      ~ resources              = [
          - {
              - autoscaling_groups              = [
                  - {
                      - name = "eks-default-20241124152646072500000019-02c9af64-288d-0382-1221-3ef1d3e95d2c"
                    },
                ]
              - remote_access_security_group_id = ""
            },
        ] -> (known after apply)
      ~ status                 = "ACTIVE" -> (known after apply)
        tags                   = {
            "Name" = "default"
        }
        # (7 unchanged attributes hidden)

      ~ launch_template {
            id      = "lt-0fdd12ec7c2965609"
          ~ name    = "default-20241124152643442800000015" -> (known after apply)
          ~ version = "2" -> (known after apply)
        }

      ~ update_config {
          - max_unavailable            = 0 -> null
            # (1 unchanged attribute hidden)
        }

        # (2 unchanged blocks hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0] will be updated in-place
  ~ resource "aws_launch_template" "this" {
      ~ default_version         = 2 -> (known after apply)
        id                      = "lt-0fdd12ec7c2965609"
      ~ latest_version          = 2 -> (known after apply)
        name                    = "default-20241124152643442800000015"
        tags                    = {}
      ~ vpc_security_group_ids  = [
          - "sg-01e99d583cc16bbd6",
        ] -> (known after apply)
        # (8 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0] must be replaced
+/- resource "aws_eks_node_group" "this" {
      ~ arn                    = "arn:aws:eks:us-east-1:084375562450:nodegroup/zeno-production-cluster/regular-2024112415264607270000001b/12c9af64-288c-45dc-a2cc-27f36a2c775c" -> (known after apply)
      ~ capacity_type          = "ON_DEMAND" -> (known after apply)
      ~ cluster_name           = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      ~ disk_size              = 0 -> (known after apply)
      ~ id                     = "zeno-production-cluster:regular-2024112415264607270000001b" -> (known after apply)
      - labels                 = {} -> null
      ~ node_group_name        = "regular-2024112415264607270000001b" -> (known after apply)
      ~ release_version        = "1.31.2-20241115" -> (known after apply)
      ~ resources              = [
          - {
              - autoscaling_groups              = [
                  - {
                      - name = "eks-regular-2024112415264607270000001b-12c9af64-288c-45dc-a2cc-27f36a2c775c"
                    },
                ]
              - remote_access_security_group_id = ""
            },
        ] -> (known after apply)
      ~ status                 = "ACTIVE" -> (known after apply)
        tags                   = {
            "Name" = "regular"
        }
        # (7 unchanged attributes hidden)

      ~ launch_template {
            id      = "lt-099de2edeeea863c8"
          ~ name    = "regular-20241124152643442900000017" -> (known after apply)
          ~ version = "2" -> (known after apply)
        }

      - node_repair_config {
          - enabled = true -> null
        }

      ~ scaling_config {
          ~ desired_size = 2 -> 1
            # (2 unchanged attributes hidden)
        }

      ~ update_config {
          - max_unavailable            = 0 -> null
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0] will be updated in-place
  ~ resource "aws_launch_template" "this" {
      ~ default_version         = 2 -> (known after apply)
        id                      = "lt-099de2edeeea863c8"
      ~ latest_version          = 2 -> (known after apply)
        name                    = "regular-20241124152643442900000017"
        tags                    = {}
      ~ vpc_security_group_ids  = [
          - "sg-01e99d583cc16bbd6",
        ] -> (known after apply)
        # (8 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + minified_json             = (known after apply)
      + override_policy_documents = []
      + source_policy_documents   = []

      + statement {
          + actions   = [
              + "kms:*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "Default"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:root",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:CancelKeyDeletion",
              + "kms:Create*",
              + "kms:Delete*",
              + "kms:Describe*",
              + "kms:Disable*",
              + "kms:Enable*",
              + "kms:Get*",
              + "kms:ImportKeyMaterial",
              + "kms:List*",
              + "kms:Put*",
              + "kms:ReplicateKey",
              + "kms:Revoke*",
              + "kms:ScheduleKeyDeletion",
              + "kms:TagResource",
              + "kms:UntagResource",
              + "kms:Update*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyAdministration"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:user/tarashish@developmentseed.org",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:Decrypt",
              + "kms:DescribeKey",
              + "kms:Encrypt",
              + "kms:GenerateDataKey*",
              + "kms:ReEncrypt*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyUsage"

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"] must be replaced
-/+ resource "aws_kms_alias" "this" {
      ~ arn            = "arn:aws:kms:us-east-1:084375562450:alias/eks/zeno-production-cluster" -> (known after apply)
      ~ id             = "alias/eks/zeno-production-cluster" -> (known after apply)
      ~ name           = "alias/eks/zeno-production-cluster" -> "alias/eks/zeno-staging-cluster" # forces replacement
      + name_prefix    = (known after apply)
      ~ target_key_arn = "arn:aws:kms:us-east-1:084375562450:key/8cd9f3d5-f6e1-49ff-a032-da1528c9daa4" -> (known after apply)
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.module.kms.aws_kms_key.this[0] will be updated in-place
  ~ resource "aws_kms_key" "this" {
      ~ description                        = "zeno-production-cluster cluster encryption key" -> "zeno-staging-cluster cluster encryption key"
        id                                 = "8cd9f3d5-f6e1-49ff-a032-da1528c9daa4"
      ~ policy                             = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "kms:*"
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::084375562450:root"
                        }
                      - Resource  = "*"
                      - Sid       = "Default"
                    },
                  - {
                      - Action    = [
                          - "kms:Update*",
                          - "kms:UntagResource",
                          - "kms:TagResource",
                          - "kms:ScheduleKeyDeletion",
                          - "kms:Revoke*",
                          - "kms:ReplicateKey",
                          - "kms:Put*",
                          - "kms:List*",
                          - "kms:ImportKeyMaterial",
                          - "kms:Get*",
                          - "kms:Enable*",
                          - "kms:Disable*",
                          - "kms:Describe*",
                          - "kms:Delete*",
                          - "kms:Create*",
                          - "kms:CancelKeyDeletion",
                        ]
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::084375562450:user/tarashish@developmentseed.org"
                        }
                      - Resource  = "*"
                      - Sid       = "KeyAdministration"
                    },
                  - {
                      - Action    = [
                          - "kms:ReEncrypt*",
                          - "kms:GenerateDataKey*",
                          - "kms:Encrypt",
                          - "kms:DescribeKey",
                          - "kms:Decrypt",
                        ]
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::084375562450:role/zeno-production-cluster-cluster-20241124151456720400000002"
                        }
                      - Resource  = "*"
                      - Sid       = "KeyUsage"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        tags                               = {
            "terraform-aws-modules" = "eks"
        }
        # (10 unchanged attributes hidden)
    }

Plan: 26 to add, 18 to change, 26 to destroy.

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-11T10:23:01Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`failure`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.data.aws_caller_identity.current: Reading...
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.data.aws_availability_zones.available: Reading...
module.resources.module.eks.aws_cloudwatch_log_group.this[0]: Refreshing state... [id=/aws/eks/zeno-production-cluster/cluster]
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.vpc.aws_vpc.this[0]: Refreshing state... [id=vpc-0f6151e1ec7ed4b96]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.aws_iam_role.this[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003]
module.resources.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001]
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]
module.resources.data.aws_db_instance.zeno-db: Read complete after 0s [id=zeno-db]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150083720000000d]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500034600000008]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151459701100000006]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500015800000007]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150038690000000b]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500094000000009]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150036100000000a]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150080180000000c]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459683600000005]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459658300000004]
module.resources.module.eks.module.kms.aws_kms_key.this[0]: Refreshing state... [id=8cd9f3d5-f6e1-49ff-a032-da1528c9daa4]
module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"]: Refreshing state... [id=alias/eks/zeno-production-cluster]
module.resources.module.eks.aws_iam_policy.cluster_encryption[0]: Refreshing state... [id=arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013]
module.resources.module.vpc.aws_default_security_group.this[0]: Refreshing state... [id=sg-02f79d9422c79d174]
module.resources.module.vpc.aws_default_network_acl.this[0]: Refreshing state... [id=acl-01d72c016ec1365bf]
module.resources.module.vpc.aws_route_table.private[0]: Refreshing state... [id=rtb-0e06cd84685011ff8]
module.resources.module.vpc.aws_route_table.public[0]: Refreshing state... [id=rtb-0f703710ef8983d5a]
module.resources.module.vpc.aws_subnet.private[1]: Refreshing state... [id=subnet-0c9a24adf6985b148]
module.resources.module.vpc.aws_subnet.private[2]: Refreshing state... [id=subnet-0e9ba580b832e58ab]
module.resources.module.vpc.aws_subnet.private[0]: Refreshing state... [id=subnet-00564600fc0109d5f]
module.resources.module.vpc.aws_default_route_table.default[0]: Refreshing state... [id=rtb-0dca056b5cb3f4bdc]
module.resources.module.eks.aws_security_group.node[0]: Refreshing state... [id=sg-01e99d583cc16bbd6]
module.resources.module.vpc.aws_subnet.public[0]: Refreshing state... [id=subnet-0b2d1b545f702eceb]
module.resources.module.vpc.aws_subnet.public[1]: Refreshing state... [id=subnet-060bb06a5c8393f81]
module.resources.module.vpc.aws_subnet.public[2]: Refreshing state... [id=subnet-0aad369235ab19564]
module.resources.module.vpc.aws_internet_gateway.this[0]: Refreshing state... [id=igw-0721a42d5f02f490a]
module.resources.module.eks.aws_security_group.cluster[0]: Refreshing state... [id=sg-0bd86b2d1d4c494db]
module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151528958300000014]
module.resources.module.vpc.aws_route_table_association.private[1]: Refreshing state... [id=rtbassoc-03cbd09508fae031c]
module.resources.module.vpc.aws_route_table_association.private[0]: Refreshing state... [id=rtbassoc-006325e67577ba7cb]
module.resources.module.vpc.aws_route_table_association.private[2]: Refreshing state... [id=rtbassoc-0dbcf7c72bb07f949]
module.resources.module.vpc.aws_eip.nat[0]: Refreshing state... [id=eipalloc-04e1927500c13e36f]
module.resources.module.vpc.aws_route.public_internet_gateway[0]: Refreshing state... [id=r-rtb-0f703710ef8983d5a1080289494]
module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"]: Refreshing state... [id=sgrule-334661475]
module.resources.module.eks.aws_security_group_rule.node["egress_all"]: Refreshing state... [id=sgrule-3638724160]
module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"]: Refreshing state... [id=sgrule-3648003083]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"]: Refreshing state... [id=sgrule-2982503749]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"]: Refreshing state... [id=sgrule-1125720652]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"]: Refreshing state... [id=sgrule-3210305847]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"]: Refreshing state... [id=sgrule-2598257535]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"]: Refreshing state... [id=sgrule-4255533616]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"]: Refreshing state... [id=sgrule-887369126]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"]: Refreshing state... [id=sgrule-666374535]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"]: Refreshing state... [id=sgrule-1048699024]
module.resources.module.vpc.aws_route_table_association.public[0]: Refreshing state... [id=rtbassoc-0527a821acc8b2d5d]
module.resources.module.vpc.aws_route_table_association.public[1]: Refreshing state... [id=rtbassoc-05a8a28a38e5d35a9]
module.resources.module.vpc.aws_route_table_association.public[2]: Refreshing state... [id=rtbassoc-0f01ab3ef8fb36172]
module.resources.module.vpc.aws_nat_gateway.this[0]: Refreshing state... [id=nat-0fe07f0eb9fb2161d]
module.resources.module.vpc.aws_route.private_nat_gateway[0]: Refreshing state... [id=r-rtb-0e06cd84685011ff81080289494]
module.resources.module.eks.aws_eks_cluster.this[0]: Refreshing state... [id=zeno-production-cluster]
module.resources.module.eks.time_sleep.this[0]: Refreshing state... [id=2024-11-24T15:26:39Z]
module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0]: Refreshing state... [id=arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2]
module.resources.helm_release.zeno-ingress-nginx: Refreshing state... [id=ingress-nginx]
module.resources.helm_release.zeno-cert-manager: Refreshing state... [id=cert-manager]
module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=6616271754968722364]
module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=8124355570844009309]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0]: Refreshing state... [id=lt-0fdd12ec7c2965609]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0]: Refreshing state... [id=lt-099de2edeeea863c8]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:regular-2024112415264607270000001b]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:default-20241124152646072500000019]
module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"]: Refreshing state... [id=zeno-production-cluster:aws-ebs-csi-driver]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.resources.module.eks.aws_eks_cluster.this[0] has changed
  ~ resource "aws_eks_cluster" "this" {
        id                            = "zeno-production-cluster"
        name                          = "zeno-production-cluster"
      ~ platform_version              = "eks.20" -> "eks.21"
        tags                          = {
            "terraform-aws-modules" = "eks"
        }
        # (11 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement
+/- create replacement and then destroy
 <= read (data resources)

Terraform planned the following actions, but then encountered a problem:

  # module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_eks_addon_version" "this" {
      + addon_name         = "aws-ebs-csi-driver"
      + id                 = (known after apply)
      + kubernetes_version = "1.31"
      + version            = (known after apply)
    }

  # module.resources.module.eks.data.tls_certificate.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "tls_certificate" "this" {
      + certificates = (known after apply)
      + id           = (known after apply)
      + url          = (known after apply)
    }

  # module.resources.module.eks.aws_cloudwatch_log_group.this[0] must be replaced
+/- resource "aws_cloudwatch_log_group" "this" {
      ~ arn               = "arn:aws:logs:us-east-1:084375562450:log-group:/aws/eks/zeno-production-cluster/cluster" -> (known after apply)
      ~ id                = "/aws/eks/zeno-production-cluster/cluster" -> (known after apply)
      ~ log_group_class   = "STANDARD" -> (known after apply)
      ~ name              = "/aws/eks/zeno-production-cluster/cluster" -> "/aws/eks/zeno-staging-cluster/cluster" # forces replacement
      + name_prefix       = (known after apply)
      ~ tags              = {
          ~ "Name" = "/aws/eks/zeno-production-cluster/cluster" -> "/aws/eks/zeno-staging-cluster/cluster"
        }
      ~ tags_all          = {
          ~ "Name" = "/aws/eks/zeno-production-cluster/cluster" -> "/aws/eks/zeno-staging-cluster/cluster"
        }
        # (2 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"] must be replaced
-/+ resource "aws_eks_addon" "this" {
      ~ arn                         = "arn:aws:eks:us-east-1:084375562450:addon/zeno-production-cluster/aws-ebs-csi-driver/22c9af65-086f-8e8a-463f-07f929aa54f7" -> (known after apply)
      ~ cluster_name                = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      + configuration_values        = (known after apply)
      ~ created_at                  = "2024-11-24T15:28:41Z" -> (known after apply)
      ~ id                          = "zeno-production-cluster:aws-ebs-csi-driver" -> (known after apply)
      ~ modified_at                 = "2025-03-22T16:38:23Z" -> (known after apply)
      - tags                        = {} -> null
      ~ tags_all                    = {} -> (known after apply)
        # (5 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.resources.module.eks.aws_eks_cluster.this[0] must be replaced
+/- resource "aws_eks_cluster" "this" {
      ~ arn                           = "arn:aws:eks:us-east-1:084375562450:cluster/zeno-production-cluster" -> (known after apply)
      ~ certificate_authority         = [
          - {
              - data = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJUkNaSXRwS1ZZb1l3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TkRFeE1qUXhOVEUxTVRaYUZ3MHpOREV4TWpJeE5USXdNVFphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURyd3hFZ2pJTERkK1BSVmR0cy9FVWU1WXVMZVV2TlBxV1U4VDg0aGRYUWVDajdRdmxKYk5GRGYxM3AKNk1MZnhDTzBycmEzb05rV0htaXN3R1ZFUEpWREJTcG90VGxacGhvRHpKa0N4akNDc0F3TUxyNVV1T0R4UzZkUwpZOGYzSDhRVlBIRWRMakR0VlFJWVpTdkE5ZDFSUFBvVWhvcHdJYWFNNG1MTE1VUmlwUnEyNndZeVRXemFQWW9XCkdZV3doNC9QVldVcktNRkVEeGEzMGl5aDRwQi8rUWF5ejdkV2xyeDY4U0VZMjJIckN2MzUvSTFzWHFDZ3NTL2UKaGZHTW1iZUs4UFMyaytGUWhJQXZTTnRTZGt1a1lra2Y4d1dIUTRkaDdOaWpVU3QrUlNBUWd1eENhSUNqUWtxRwo5ckk1Q3J4Z1djbE41QVR2UnpuUHlHak9SaUxsQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJRU01GVzBSR3IzQlJwNE5rM1JBVkN2dk44aDdUQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQTZCV0dLSkNUYgp4MnFscTc0Tm5JL0w3aEt6MUVkWGdESnF0b1pXbTdCNmMvY055T0xJQUNmd21tOWVvRGJqMnpHVHc5OFhTVm84CkFEQmxTWHVSb2dTUi9RY2IxeEpVWnFVcHRXM2dNYWRvMjhZNnZVY0s0aG9lL3pPaDZDczlIMEdoVkxaNU9RaXgKVHYrSHRBM0ZlTWNuUFV6SWJUNXd1ZVVoUG41bnVVTkVwejAvaGNQL2JrM00rVWxMK1RNMnkwM0lmWEZhL21mLwpiV1kzK0RCUUhVa0svSlJ1T2hjRDhrUkdZV0RRMTQ5K2kxdlpSTE9BL2tlblFidXc1ZThNOFNiTmFQcXVsd2JVCjdLZjZ6dm50ZlhDa0R1Vkw0NGFWdWlXa2pnQWQrckZyaHFDd3BSRnRhMmtqdlNtQTRmaFI5SHF5L0wrRHZ0S2kKRTJDdVByU2w4TEVOCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
            },
        ] -> (known after apply)
      + cluster_id                    = (known after apply)
      ~ created_at                    = "2024-11-24T15:15:33Z" -> (known after apply)
      ~ endpoint                      = "https://085DFD0C5701406346D03AB1EA5B38F2.gr7.us-east-1.eks.amazonaws.com" -> (known after apply)
      ~ id                            = "zeno-production-cluster" -> (known after apply)
      ~ identity                      = [
          - {
              - oidc = [
                  - {
                      - issuer = "https://oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2"
                    },
                ]
            },
        ] -> (known after apply)
      ~ name                          = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      ~ platform_version              = "eks.21" -> (known after apply)
      ~ role_arn                      = "arn:aws:iam::084375562450:role/zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
      ~ status                        = "ACTIVE" -> (known after apply)
        tags                          = {
            "terraform-aws-modules" = "eks"
        }
        # (4 unchanged attributes hidden)

      ~ kubernetes_network_config {
          ~ service_ipv4_cidr = "172.20.0.0/16" -> (known after apply)
          + service_ipv6_cidr = (known after apply)
            # (1 unchanged attribute hidden)

          - elastic_load_balancing {
              - enabled = false -> null
            }
        }

      - upgrade_policy {
          - support_type = "EXTENDED" -> null
        }

      ~ vpc_config {
          ~ cluster_security_group_id = "sg-0e489d72b61ec1d2e" -> (known after apply)
          ~ security_group_ids        = [
              - "sg-0bd86b2d1d4c494db",
            ] -> (known after apply)
          ~ vpc_id                    = "vpc-0f6151e1ec7ed4b96" -> (known after apply)
            # (4 unchanged attributes hidden)
        }

        # (3 unchanged blocks hidden)
    }

  # module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0] must be replaced
-/+ resource "aws_iam_openid_connect_provider" "oidc_provider" {
      ~ arn             = "arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2" -> (known after apply)
      ~ id              = "arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2" -> (known after apply)
      ~ tags            = {
          ~ "Name" = "zeno-production-cluster-eks-irsa" -> "zeno-staging-cluster-eks-irsa"
        }
      ~ tags_all        = {
          ~ "Name" = "zeno-production-cluster-eks-irsa" -> "zeno-staging-cluster-eks-irsa"
        }
      ~ thumbprint_list = [
          - "9e99a48a9960b14926bb7f3b02e22da2b0ab7280",
        ] -> (known after apply)
      ~ url             = "oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2" # forces replacement -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.aws_iam_policy.cluster_encryption[0] must be replaced
-/+ resource "aws_iam_policy" "cluster_encryption" {
      ~ arn              = "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" -> (known after apply)
      ~ attachment_count = 1 -> (known after apply)
      ~ id               = "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" -> (known after apply)
      ~ name             = "zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" -> (known after apply)
      ~ name_prefix      = "zeno-production-cluster-cluster-ClusterEncryption" -> "zeno-staging-cluster-cluster-ClusterEncryption" # forces replacement
      ~ policy_id        = "ANPARHJJM5DJBAVDHQOZA" -> (known after apply)
      - tags             = {} -> null
      ~ tags_all         = {} -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_iam_role.this[0] must be replaced
+/- resource "aws_iam_role" "this" {
      ~ arn                   = "arn:aws:iam::084375562450:role/zeno-production-cluster-cluster-20241124151456720400000002" -> (known after apply)
      ~ create_date           = "2024-11-24T15:14:58Z" -> (known after apply)
      ~ id                    = "zeno-production-cluster-cluster-20241124151456720400000002" -> (known after apply)
      ~ managed_policy_arns   = [
          - "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013",
          - "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
          - "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
        ] -> (known after apply)
      ~ name                  = "zeno-production-cluster-cluster-20241124151456720400000002" -> (known after apply)
      ~ name_prefix           = "zeno-production-cluster-cluster-" -> "zeno-staging-cluster-cluster-" # forces replacement
      - tags                  = {} -> null
      ~ tags_all              = {} -> (known after apply)
      ~ unique_id             = "AROARHJJM5DJLHROOUMBV" -> (known after apply)
        # (4 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0] must be replaced
-/+ resource "aws_iam_role_policy_attachment" "cluster_encryption" {
      ~ id         = "zeno-production-cluster-cluster-20241124151456720400000002-20241124151528958300000014" -> (known after apply)
      ~ policy_arn = "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" # forces replacement -> (known after apply) # forces replacement
      ~ role       = "zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"] must be replaced
+/- resource "aws_iam_role_policy_attachment" "this" {
      ~ id         = "zeno-production-cluster-cluster-20241124151456720400000002-20241124151459683600000005" -> (known after apply)
      ~ role       = "zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"] must be replaced
+/- resource "aws_iam_role_policy_attachment" "this" {
      ~ id         = "zeno-production-cluster-cluster-20241124151456720400000002-20241124151459658300000004" -> (known after apply)
      ~ role       = "zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.aws_security_group.cluster[0] must be replaced
+/- resource "aws_security_group" "cluster" {
      ~ arn                    = "arn:aws:ec2:us-east-1:084375562450:security-group/sg-0bd86b2d1d4c494db" -> (known after apply)
      ~ egress                 = [] -> (known after apply)
      ~ id                     = "sg-0bd86b2d1d4c494db" -> (known after apply)
      ~ ingress                = [
          - {
              - cidr_blocks      = []
              - description      = "Node groups to cluster API"
              - from_port        = 443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-01e99d583cc16bbd6",
                ]
              - self             = false
              - to_port          = 443
            },
        ] -> (known after apply)
      ~ name                   = "zeno-production-cluster-cluster-20241124151514397900000010" -> (known after apply)
      ~ name_prefix            = "zeno-production-cluster-cluster-" -> "zeno-staging-cluster-cluster-" # forces replacement
      ~ owner_id               = "084375562450" -> (known after apply)
      ~ tags                   = {
          ~ "Name" = "zeno-production-cluster-cluster" -> "zeno-staging-cluster-cluster"
        }
      ~ tags_all               = {
          ~ "Name" = "zeno-production-cluster-cluster" -> "zeno-staging-cluster-cluster"
        }
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group.node[0] must be replaced
+/- resource "aws_security_group" "node" {
      ~ arn                    = "arn:aws:ec2:us-east-1:084375562450:security-group/sg-01e99d583cc16bbd6" -> (known after apply)
      ~ egress                 = [
          - {
              - cidr_blocks      = [
                  - "0.0.0.0/0",
                ]
              - description      = "Allow all egress"
              - from_port        = 0
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "-1"
              - security_groups  = []
              - self             = false
              - to_port          = 0
            },
        ] -> (known after apply)
      ~ id                     = "sg-01e99d583cc16bbd6" -> (known after apply)
      ~ ingress                = [
          - {
              - cidr_blocks      = []
              - description      = ""
              - from_port        = 0
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "-1"
              - security_groups  = [
                  - "sg-0722c1b29c08baf08",
                ]
              - self             = false
              - to_port          = 0
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 4443/tcp webhook"
              - from_port        = 4443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 4443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 6443/tcp webhook"
              - from_port        = 6443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 6443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 8443/tcp webhook"
              - from_port        = 8443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 8443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 9443/tcp webhook"
              - from_port        = 9443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 9443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node groups"
              - from_port        = 443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node kubelets"
              - from_port        = 10250
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 10250
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to RDS"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = true
              - to_port          = 5432
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to node CoreDNS UDP"
              - from_port        = 53
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "udp"
              - security_groups  = []
              - self             = true
              - to_port          = 53
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to node CoreDNS"
              - from_port        = 53
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = true
              - to_port          = 53
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to node ingress on ephemeral ports"
              - from_port        = 1025
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = true
              - to_port          = 65535
            },
        ] -> (known after apply)
      ~ name                   = "zeno-production-cluster-node-20241124151514429400000011" -> (known after apply)
      ~ name_prefix            = "zeno-production-cluster-node-" -> "zeno-staging-cluster-node-" # forces replacement
      ~ owner_id               = "084375562450" -> (known after apply)
      ~ tags                   = {
          ~ "Name"                                          = "zeno-production-cluster-node" -> "zeno-staging-cluster-node"
          - "kubernetes.io/cluster/zeno-production-cluster" = "owned" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "owned"
        }
      ~ tags_all               = {
          ~ "Name"                                          = "zeno-production-cluster-node" -> "zeno-staging-cluster-node"
          - "kubernetes.io/cluster/zeno-production-cluster" = "owned" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "owned"
        }
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"] must be replaced
+/- resource "aws_security_group_rule" "cluster" {
      ~ id                       = "sgrule-334661475" -> (known after apply)
      ~ security_group_id        = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-077c6317fd13fd294" -> (known after apply)
      ~ source_security_group_id = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
        # (6 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["egress_all"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-3638724160" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0b7ba3c3750a2d301" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (8 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-2982503749" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0072b01bd821ccff9" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-4255533616" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-04c38b4259acb9dd8" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-887369126" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-02dd245b7e5994733" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-666374535" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0db9463bfbacd3579" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-1125720652" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-064993144390ad6f9" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-3210305847" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0c0752ac8089880f1" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-3648003083" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0ece1a17f0c8a91ba" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-1048699024" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-033e24265326cb0d2" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-2598257535" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-095a9eedb908604cf" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.time_sleep.this[0] must be replaced
+/- resource "time_sleep" "this" {
      ~ id              = "2024-11-24T15:26:39Z" -> (known after apply)
      ~ triggers        = { # forces replacement
          ~ "cluster_certificate_authority_data" = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJUkNaSXRwS1ZZb1l3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TkRFeE1qUXhOVEUxTVRaYUZ3MHpOREV4TWpJeE5USXdNVFphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURyd3hFZ2pJTERkK1BSVmR0cy9FVWU1WXVMZVV2TlBxV1U4VDg0aGRYUWVDajdRdmxKYk5GRGYxM3AKNk1MZnhDTzBycmEzb05rV0htaXN3R1ZFUEpWREJTcG90VGxacGhvRHpKa0N4akNDc0F3TUxyNVV1T0R4UzZkUwpZOGYzSDhRVlBIRWRMakR0VlFJWVpTdkE5ZDFSUFBvVWhvcHdJYWFNNG1MTE1VUmlwUnEyNndZeVRXemFQWW9XCkdZV3doNC9QVldVcktNRkVEeGEzMGl5aDRwQi8rUWF5ejdkV2xyeDY4U0VZMjJIckN2MzUvSTFzWHFDZ3NTL2UKaGZHTW1iZUs4UFMyaytGUWhJQXZTTnRTZGt1a1lra2Y4d1dIUTRkaDdOaWpVU3QrUlNBUWd1eENhSUNqUWtxRwo5ckk1Q3J4Z1djbE41QVR2UnpuUHlHak9SaUxsQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJRU01GVzBSR3IzQlJwNE5rM1JBVkN2dk44aDdUQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQTZCV0dLSkNUYgp4MnFscTc0Tm5JL0w3aEt6MUVkWGdESnF0b1pXbTdCNmMvY055T0xJQUNmd21tOWVvRGJqMnpHVHc5OFhTVm84CkFEQmxTWHVSb2dTUi9RY2IxeEpVWnFVcHRXM2dNYWRvMjhZNnZVY0s0aG9lL3pPaDZDczlIMEdoVkxaNU9RaXgKVHYrSHRBM0ZlTWNuUFV6SWJUNXd1ZVVoUG41bnVVTkVwejAvaGNQL2JrM00rVWxMK1RNMnkwM0lmWEZhL21mLwpiV1kzK0RCUUhVa0svSlJ1T2hjRDhrUkdZV0RRMTQ5K2kxdlpSTE9BL2tlblFidXc1ZThNOFNiTmFQcXVsd2JVCjdLZjZ6dm50ZlhDa0R1Vkw0NGFWdWlXa2pnQWQrckZyaHFDd3BSRnRhMmtqdlNtQTRmaFI5SHF5L0wrRHZ0S2kKRTJDdVByU2w4TEVOCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K" -> (known after apply)
          ~ "cluster_endpoint"                   = "https://085DFD0C5701406346D03AB1EA5B38F2.gr7.us-east-1.eks.amazonaws.com" -> (known after apply)
          ~ "cluster_name"                       = "zeno-production-cluster" -> "zeno-staging-cluster"
          ~ "cluster_service_cidr"               = "172.20.0.0/16" -> (known after apply)
            # (1 unchanged element hidden)
        }
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.vpc.aws_default_network_acl.this[0] will be updated in-place
  ~ resource "aws_default_network_acl" "this" {
        id                     = "acl-01d72c016ec1365bf"
      ~ tags                   = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
      ~ tags_all               = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
        # (5 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.resources.module.vpc.aws_default_route_table.default[0] will be updated in-place
  ~ resource "aws_default_route_table" "default" {
        id                     = "rtb-0dca056b5cb3f4bdc"
      ~ tags                   = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
      ~ tags_all               = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
        # (6 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.resources.module.vpc.aws_default_security_group.this[0] will be updated in-place
  ~ resource "aws_default_security_group" "this" {
        id                     = "sg-02f79d9422c79d174"
        name                   = "default"
      ~ tags                   = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
      ~ tags_all               = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_eip.nat[0] will be updated in-place
  ~ resource "aws_eip" "nat" {
        id                   = "eipalloc-04e1927500c13e36f"
      ~ tags                 = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
      ~ tags_all             = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
        # (12 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_internet_gateway.this[0] will be updated in-place
  ~ resource "aws_internet_gateway" "this" {
        id       = "igw-0721a42d5f02f490a"
      ~ tags     = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
      ~ tags_all = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_nat_gateway.this[0] will be updated in-place
  ~ resource "aws_nat_gateway" "this" {
        id                                 = "nat-0fe07f0eb9fb2161d"
      ~ tags                               = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
      ~ tags_all                           = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
        # (10 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_route_table.private[0] will be updated in-place
  ~ resource "aws_route_table" "private" {
        id               = "rtb-0e06cd84685011ff8"
      ~ tags             = {
          ~ "Name" = "vpc-zeno-production-private" -> "vpc-zeno-staging-private"
        }
      ~ tags_all         = {
          ~ "Name" = "vpc-zeno-production-private" -> "vpc-zeno-staging-private"
        }
        # (5 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_route_table.public[0] will be updated in-place
  ~ resource "aws_route_table" "public" {
        id               = "rtb-0f703710ef8983d5a"
      ~ tags             = {
          ~ "Name" = "vpc-zeno-production-public" -> "vpc-zeno-staging-public"
        }
      ~ tags_all         = {
          ~ "Name" = "vpc-zeno-production-public" -> "vpc-zeno-staging-public"
        }
        # (5 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.private[0] will be updated in-place
  ~ resource "aws_subnet" "private" {
        id                                             = "subnet-00564600fc0109d5f"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1a" -> "vpc-zeno-staging-private-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/internal-elb"               = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1a" -> "vpc-zeno-staging-private-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.private[1] will be updated in-place
  ~ resource "aws_subnet" "private" {
        id                                             = "subnet-0c9a24adf6985b148"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1b" -> "vpc-zeno-staging-private-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/internal-elb"               = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1b" -> "vpc-zeno-staging-private-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.private[2] will be updated in-place
  ~ resource "aws_subnet" "private" {
        id                                             = "subnet-0e9ba580b832e58ab"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1c" -> "vpc-zeno-staging-private-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/internal-elb"               = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1c" -> "vpc-zeno-staging-private-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.public[0] will be updated in-place
  ~ resource "aws_subnet" "public" {
        id                                             = "subnet-0b2d1b545f702eceb"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1a" -> "vpc-zeno-staging-public-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/elb"                        = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1a" -> "vpc-zeno-staging-public-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.public[1] will be updated in-place
  ~ resource "aws_subnet" "public" {
        id                                             = "subnet-060bb06a5c8393f81"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1b" -> "vpc-zeno-staging-public-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/elb"                        = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1b" -> "vpc-zeno-staging-public-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.public[2] will be updated in-place
  ~ resource "aws_subnet" "public" {
        id                                             = "subnet-0aad369235ab19564"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1c" -> "vpc-zeno-staging-public-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/elb"                        = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1c" -> "vpc-zeno-staging-public-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_vpc.this[0] will be updated in-place
  ~ resource "aws_vpc" "this" {
        id                                   = "vpc-0f6151e1ec7ed4b96"
      ~ tags                                 = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
      ~ tags_all                             = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
        # (14 unchanged attributes hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0] must be replaced
+/- resource "aws_eks_node_group" "this" {
      ~ arn                    = "arn:aws:eks:us-east-1:084375562450:nodegroup/zeno-production-cluster/default-20241124152646072500000019/02c9af64-288d-0382-1221-3ef1d3e95d2c" -> (known after apply)
      ~ capacity_type          = "ON_DEMAND" -> (known after apply)
      ~ cluster_name           = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      ~ disk_size              = 0 -> (known after apply)
      ~ id                     = "zeno-production-cluster:default-20241124152646072500000019" -> (known after apply)
      - labels                 = {} -> null
      ~ node_group_name        = "default-20241124152646072500000019" -> (known after apply)
      ~ release_version        = "1.31.2-20241115" -> (known after apply)
      ~ resources              = [
          - {
              - autoscaling_groups              = [
                  - {
                      - name = "eks-default-20241124152646072500000019-02c9af64-288d-0382-1221-3ef1d3e95d2c"
                    },
                ]
              - remote_access_security_group_id = ""
            },
        ] -> (known after apply)
      ~ status                 = "ACTIVE" -> (known after apply)
        tags                   = {
            "Name" = "default"
        }
        # (7 unchanged attributes hidden)

      ~ launch_template {
            id      = "lt-0fdd12ec7c2965609"
          ~ name    = "default-20241124152643442800000015" -> (known after apply)
          ~ version = "2" -> (known after apply)
        }

      ~ update_config {
          - max_unavailable            = 0 -> null
            # (1 unchanged attribute hidden)
        }

        # (2 unchanged blocks hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0] will be updated in-place
  ~ resource "aws_launch_template" "this" {
      ~ default_version         = 2 -> (known after apply)
        id                      = "lt-0fdd12ec7c2965609"
      ~ latest_version          = 2 -> (known after apply)
        name                    = "default-20241124152643442800000015"
        tags                    = {}
      ~ vpc_security_group_ids  = [
          - "sg-01e99d583cc16bbd6",
        ] -> (known after apply)
        # (8 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0] must be replaced
+/- resource "aws_eks_node_group" "this" {
      ~ arn                    = "arn:aws:eks:us-east-1:084375562450:nodegroup/zeno-production-cluster/regular-2024112415264607270000001b/12c9af64-288c-45dc-a2cc-27f36a2c775c" -> (known after apply)
      ~ capacity_type          = "ON_DEMAND" -> (known after apply)
      ~ cluster_name           = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      ~ disk_size              = 0 -> (known after apply)
      ~ id                     = "zeno-production-cluster:regular-2024112415264607270000001b" -> (known after apply)
      - labels                 = {} -> null
      ~ node_group_name        = "regular-2024112415264607270000001b" -> (known after apply)
      ~ release_version        = "1.31.2-20241115" -> (known after apply)
      ~ resources              = [
          - {
              - autoscaling_groups              = [
                  - {
                      - name = "eks-regular-2024112415264607270000001b-12c9af64-288c-45dc-a2cc-27f36a2c775c"
                    },
                ]
              - remote_access_security_group_id = ""
            },
        ] -> (known after apply)
      ~ status                 = "ACTIVE" -> (known after apply)
        tags                   = {
            "Name" = "regular"
        }
        # (7 unchanged attributes hidden)

      ~ launch_template {
            id      = "lt-099de2edeeea863c8"
          ~ name    = "regular-20241124152643442900000017" -> (known after apply)
          ~ version = "2" -> (known after apply)
        }

      - node_repair_config {
          - enabled = true -> null
        }

      ~ scaling_config {
          ~ desired_size = 2 -> 1
            # (2 unchanged attributes hidden)
        }

      ~ update_config {
          - max_unavailable            = 0 -> null
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0] will be updated in-place
  ~ resource "aws_launch_template" "this" {
      ~ default_version         = 2 -> (known after apply)
        id                      = "lt-099de2edeeea863c8"
      ~ latest_version          = 2 -> (known after apply)
        name                    = "regular-20241124152643442900000017"
        tags                    = {}
      ~ vpc_security_group_ids  = [
          - "sg-01e99d583cc16bbd6",
        ] -> (known after apply)
        # (8 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + minified_json             = (known after apply)
      + override_policy_documents = []
      + source_policy_documents   = []

      + statement {
          + actions   = [
              + "kms:*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "Default"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:root",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:CancelKeyDeletion",
              + "kms:Create*",
              + "kms:Delete*",
              + "kms:Describe*",
              + "kms:Disable*",
              + "kms:Enable*",
              + "kms:Get*",
              + "kms:ImportKeyMaterial",
              + "kms:List*",
              + "kms:Put*",
              + "kms:ReplicateKey",
              + "kms:Revoke*",
              + "kms:ScheduleKeyDeletion",
              + "kms:TagResource",
              + "kms:UntagResource",
              + "kms:Update*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyAdministration"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:user/tarashish@developmentseed.org",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:Decrypt",
              + "kms:DescribeKey",
              + "kms:Encrypt",
              + "kms:GenerateDataKey*",
              + "kms:ReEncrypt*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyUsage"

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"] must be replaced
-/+ resource "aws_kms_alias" "this" {
      ~ arn            = "arn:aws:kms:us-east-1:084375562450:alias/eks/zeno-production-cluster" -> (known after apply)
      ~ id             = "alias/eks/zeno-production-cluster" -> (known after apply)
      ~ name           = "alias/eks/zeno-production-cluster" -> "alias/eks/zeno-staging-cluster" # forces replacement
      + name_prefix    = (known after apply)
      ~ target_key_arn = "arn:aws:kms:us-east-1:084375562450:key/8cd9f3d5-f6e1-49ff-a032-da1528c9daa4" -> (known after apply)
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.module.kms.aws_kms_key.this[0] will be updated in-place
  ~ resource "aws_kms_key" "this" {
      ~ description                        = "zeno-production-cluster cluster encryption key" -> "zeno-staging-cluster cluster encryption key"
        id                                 = "8cd9f3d5-f6e1-49ff-a032-da1528c9daa4"
      ~ policy                             = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "kms:*"
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::084375562450:root"
                        }
                      - Resource  = "*"
                      - Sid       = "Default"
                    },
                  - {
                      - Action    = [
                          - "kms:Update*",
                          - "kms:UntagResource",
                          - "kms:TagResource",
                          - "kms:ScheduleKeyDeletion",
                          - "kms:Revoke*",
                          - "kms:ReplicateKey",
                          - "kms:Put*",
                          - "kms:List*",
                          - "kms:ImportKeyMaterial",
                          - "kms:Get*",
                          - "kms:Enable*",
                          - "kms:Disable*",
                          - "kms:Describe*",
                          - "kms:Delete*",
                          - "kms:Create*",
                          - "kms:CancelKeyDeletion",
                        ]
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::084375562450:user/tarashish@developmentseed.org"
                        }
                      - Resource  = "*"
                      - Sid       = "KeyAdministration"
                    },
                  - {
                      - Action    = [
                          - "kms:ReEncrypt*",
                          - "kms:GenerateDataKey*",
                          - "kms:Encrypt",
                          - "kms:DescribeKey",
                          - "kms:Decrypt",
                        ]
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::084375562450:role/zeno-production-cluster-cluster-20241124151456720400000002"
                        }
                      - Resource  = "*"
                      - Sid       = "KeyUsage"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        tags                               = {
            "terraform-aws-modules" = "eks"
        }
        # (10 unchanged attributes hidden)
    }

Plan: 26 to add, 18 to change, 26 to destroy.

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-11T10:24:40Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`failure`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.module.vpc.aws_vpc.this[0]: Refreshing state... [id=vpc-0f6151e1ec7ed4b96]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.aws_cloudwatch_log_group.this[0]: Refreshing state... [id=/aws/eks/zeno-production-cluster/cluster]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.data.aws_caller_identity.current: Reading...
module.resources.data.aws_availability_zones.available: Reading...
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.module.eks.aws_iam_role.this[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 0s [id=084375562450]
module.resources.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459658300000004]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459683600000005]
module.resources.module.eks.module.kms.aws_kms_key.this[0]: Refreshing state... [id=8cd9f3d5-f6e1-49ff-a032-da1528c9daa4]
module.resources.data.aws_db_instance.zeno-db: Read complete after 1s [id=zeno-db]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500034600000008]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500015800000007]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150083720000000d]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150038690000000b]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150036100000000a]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151459701100000006]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150080180000000c]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500094000000009]
module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"]: Refreshing state... [id=alias/eks/zeno-production-cluster]
module.resources.module.eks.aws_iam_policy.cluster_encryption[0]: Refreshing state... [id=arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013]
module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151528958300000014]
module.resources.module.vpc.aws_default_route_table.default[0]: Refreshing state... [id=rtb-0dca056b5cb3f4bdc]
module.resources.module.vpc.aws_default_security_group.this[0]: Refreshing state... [id=sg-02f79d9422c79d174]
module.resources.module.eks.aws_security_group.cluster[0]: Refreshing state... [id=sg-0bd86b2d1d4c494db]
module.resources.module.vpc.aws_route_table.public[0]: Refreshing state... [id=rtb-0f703710ef8983d5a]
module.resources.module.vpc.aws_default_network_acl.this[0]: Refreshing state... [id=acl-01d72c016ec1365bf]
module.resources.module.vpc.aws_subnet.private[0]: Refreshing state... [id=subnet-00564600fc0109d5f]
module.resources.module.vpc.aws_subnet.private[1]: Refreshing state... [id=subnet-0c9a24adf6985b148]
module.resources.module.vpc.aws_internet_gateway.this[0]: Refreshing state... [id=igw-0721a42d5f02f490a]
module.resources.module.vpc.aws_subnet.private[2]: Refreshing state... [id=subnet-0e9ba580b832e58ab]
module.resources.module.eks.aws_security_group.node[0]: Refreshing state... [id=sg-01e99d583cc16bbd6]
module.resources.module.vpc.aws_subnet.public[0]: Refreshing state... [id=subnet-0b2d1b545f702eceb]
module.resources.module.vpc.aws_route_table.private[0]: Refreshing state... [id=rtb-0e06cd84685011ff8]
module.resources.module.vpc.aws_subnet.public[1]: Refreshing state... [id=subnet-060bb06a5c8393f81]
module.resources.module.vpc.aws_subnet.public[2]: Refreshing state... [id=subnet-0aad369235ab19564]
module.resources.module.vpc.aws_route.public_internet_gateway[0]: Refreshing state... [id=r-rtb-0f703710ef8983d5a1080289494]
module.resources.module.vpc.aws_eip.nat[0]: Refreshing state... [id=eipalloc-04e1927500c13e36f]
module.resources.module.vpc.aws_route_table_association.private[2]: Refreshing state... [id=rtbassoc-0dbcf7c72bb07f949]
module.resources.module.vpc.aws_route_table_association.private[1]: Refreshing state... [id=rtbassoc-03cbd09508fae031c]
module.resources.module.vpc.aws_route_table_association.private[0]: Refreshing state... [id=rtbassoc-006325e67577ba7cb]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"]: Refreshing state... [id=sgrule-1125720652]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"]: Refreshing state... [id=sgrule-2982503749]
module.resources.module.eks.aws_security_group_rule.node["egress_all"]: Refreshing state... [id=sgrule-3638724160]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"]: Refreshing state... [id=sgrule-666374535]
module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"]: Refreshing state... [id=sgrule-3648003083]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"]: Refreshing state... [id=sgrule-1048699024]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"]: Refreshing state... [id=sgrule-3210305847]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"]: Refreshing state... [id=sgrule-4255533616]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"]: Refreshing state... [id=sgrule-887369126]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"]: Refreshing state... [id=sgrule-2598257535]
module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"]: Refreshing state... [id=sgrule-334661475]
module.resources.module.vpc.aws_route_table_association.public[2]: Refreshing state... [id=rtbassoc-0f01ab3ef8fb36172]
module.resources.module.vpc.aws_route_table_association.public[0]: Refreshing state... [id=rtbassoc-0527a821acc8b2d5d]
module.resources.module.vpc.aws_route_table_association.public[1]: Refreshing state... [id=rtbassoc-05a8a28a38e5d35a9]
module.resources.module.vpc.aws_nat_gateway.this[0]: Refreshing state... [id=nat-0fe07f0eb9fb2161d]
module.resources.module.vpc.aws_route.private_nat_gateway[0]: Refreshing state... [id=r-rtb-0e06cd84685011ff81080289494]
module.resources.module.eks.aws_eks_cluster.this[0]: Refreshing state... [id=zeno-production-cluster]
module.resources.module.eks.time_sleep.this[0]: Refreshing state... [id=2024-11-24T15:26:39Z]
module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0]: Refreshing state... [id=arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2]
module.resources.helm_release.zeno-ingress-nginx: Refreshing state... [id=ingress-nginx]
module.resources.helm_release.zeno-cert-manager: Refreshing state... [id=cert-manager]
module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=6616271754968722364]
module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=8124355570844009309]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0]: Refreshing state... [id=lt-099de2edeeea863c8]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0]: Refreshing state... [id=lt-0fdd12ec7c2965609]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:default-20241124152646072500000019]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:regular-2024112415264607270000001b]
module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"]: Refreshing state... [id=zeno-production-cluster:aws-ebs-csi-driver]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.resources.module.eks.aws_eks_cluster.this[0] has changed
  ~ resource "aws_eks_cluster" "this" {
        id                            = "zeno-production-cluster"
        name                          = "zeno-production-cluster"
      ~ platform_version              = "eks.20" -> "eks.21"
        tags                          = {
            "terraform-aws-modules" = "eks"
        }
        # (11 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement
+/- create replacement and then destroy
 <= read (data resources)

Terraform planned the following actions, but then encountered a problem:

  # module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_eks_addon_version" "this" {
      + addon_name         = "aws-ebs-csi-driver"
      + id                 = (known after apply)
      + kubernetes_version = "1.31"
      + version            = (known after apply)
    }

  # module.resources.module.eks.data.tls_certificate.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "tls_certificate" "this" {
      + certificates = (known after apply)
      + id           = (known after apply)
      + url          = (known after apply)
    }

  # module.resources.module.eks.aws_cloudwatch_log_group.this[0] must be replaced
+/- resource "aws_cloudwatch_log_group" "this" {
      ~ arn               = "arn:aws:logs:us-east-1:084375562450:log-group:/aws/eks/zeno-production-cluster/cluster" -> (known after apply)
      ~ id                = "/aws/eks/zeno-production-cluster/cluster" -> (known after apply)
      ~ log_group_class   = "STANDARD" -> (known after apply)
      ~ name              = "/aws/eks/zeno-production-cluster/cluster" -> "/aws/eks/zeno-staging-cluster/cluster" # forces replacement
      + name_prefix       = (known after apply)
      ~ tags              = {
          ~ "Name" = "/aws/eks/zeno-production-cluster/cluster" -> "/aws/eks/zeno-staging-cluster/cluster"
        }
      ~ tags_all          = {
          ~ "Name" = "/aws/eks/zeno-production-cluster/cluster" -> "/aws/eks/zeno-staging-cluster/cluster"
        }
        # (2 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"] must be replaced
-/+ resource "aws_eks_addon" "this" {
      ~ arn                         = "arn:aws:eks:us-east-1:084375562450:addon/zeno-production-cluster/aws-ebs-csi-driver/22c9af65-086f-8e8a-463f-07f929aa54f7" -> (known after apply)
      ~ cluster_name                = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      + configuration_values        = (known after apply)
      ~ created_at                  = "2024-11-24T15:28:41Z" -> (known after apply)
      ~ id                          = "zeno-production-cluster:aws-ebs-csi-driver" -> (known after apply)
      ~ modified_at                 = "2025-03-22T16:38:23Z" -> (known after apply)
      - tags                        = {} -> null
      ~ tags_all                    = {} -> (known after apply)
        # (5 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.resources.module.eks.aws_eks_cluster.this[0] must be replaced
+/- resource "aws_eks_cluster" "this" {
      ~ arn                           = "arn:aws:eks:us-east-1:084375562450:cluster/zeno-production-cluster" -> (known after apply)
      ~ certificate_authority         = [
          - {
              - data = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJUkNaSXRwS1ZZb1l3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TkRFeE1qUXhOVEUxTVRaYUZ3MHpOREV4TWpJeE5USXdNVFphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURyd3hFZ2pJTERkK1BSVmR0cy9FVWU1WXVMZVV2TlBxV1U4VDg0aGRYUWVDajdRdmxKYk5GRGYxM3AKNk1MZnhDTzBycmEzb05rV0htaXN3R1ZFUEpWREJTcG90VGxacGhvRHpKa0N4akNDc0F3TUxyNVV1T0R4UzZkUwpZOGYzSDhRVlBIRWRMakR0VlFJWVpTdkE5ZDFSUFBvVWhvcHdJYWFNNG1MTE1VUmlwUnEyNndZeVRXemFQWW9XCkdZV3doNC9QVldVcktNRkVEeGEzMGl5aDRwQi8rUWF5ejdkV2xyeDY4U0VZMjJIckN2MzUvSTFzWHFDZ3NTL2UKaGZHTW1iZUs4UFMyaytGUWhJQXZTTnRTZGt1a1lra2Y4d1dIUTRkaDdOaWpVU3QrUlNBUWd1eENhSUNqUWtxRwo5ckk1Q3J4Z1djbE41QVR2UnpuUHlHak9SaUxsQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJRU01GVzBSR3IzQlJwNE5rM1JBVkN2dk44aDdUQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQTZCV0dLSkNUYgp4MnFscTc0Tm5JL0w3aEt6MUVkWGdESnF0b1pXbTdCNmMvY055T0xJQUNmd21tOWVvRGJqMnpHVHc5OFhTVm84CkFEQmxTWHVSb2dTUi9RY2IxeEpVWnFVcHRXM2dNYWRvMjhZNnZVY0s0aG9lL3pPaDZDczlIMEdoVkxaNU9RaXgKVHYrSHRBM0ZlTWNuUFV6SWJUNXd1ZVVoUG41bnVVTkVwejAvaGNQL2JrM00rVWxMK1RNMnkwM0lmWEZhL21mLwpiV1kzK0RCUUhVa0svSlJ1T2hjRDhrUkdZV0RRMTQ5K2kxdlpSTE9BL2tlblFidXc1ZThNOFNiTmFQcXVsd2JVCjdLZjZ6dm50ZlhDa0R1Vkw0NGFWdWlXa2pnQWQrckZyaHFDd3BSRnRhMmtqdlNtQTRmaFI5SHF5L0wrRHZ0S2kKRTJDdVByU2w4TEVOCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
            },
        ] -> (known after apply)
      + cluster_id                    = (known after apply)
      ~ created_at                    = "2024-11-24T15:15:33Z" -> (known after apply)
      ~ endpoint                      = "https://085DFD0C5701406346D03AB1EA5B38F2.gr7.us-east-1.eks.amazonaws.com" -> (known after apply)
      ~ id                            = "zeno-production-cluster" -> (known after apply)
      ~ identity                      = [
          - {
              - oidc = [
                  - {
                      - issuer = "https://oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2"
                    },
                ]
            },
        ] -> (known after apply)
      ~ name                          = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      ~ platform_version              = "eks.21" -> (known after apply)
      ~ role_arn                      = "arn:aws:iam::084375562450:role/zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
      ~ status                        = "ACTIVE" -> (known after apply)
        tags                          = {
            "terraform-aws-modules" = "eks"
        }
        # (4 unchanged attributes hidden)

      ~ kubernetes_network_config {
          ~ service_ipv4_cidr = "172.20.0.0/16" -> (known after apply)
          + service_ipv6_cidr = (known after apply)
            # (1 unchanged attribute hidden)

          - elastic_load_balancing {
              - enabled = false -> null
            }
        }

      - upgrade_policy {
          - support_type = "EXTENDED" -> null
        }

      ~ vpc_config {
          ~ cluster_security_group_id = "sg-0e489d72b61ec1d2e" -> (known after apply)
          ~ security_group_ids        = [
              - "sg-0bd86b2d1d4c494db",
            ] -> (known after apply)
          ~ vpc_id                    = "vpc-0f6151e1ec7ed4b96" -> (known after apply)
            # (4 unchanged attributes hidden)
        }

        # (3 unchanged blocks hidden)
    }

  # module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0] must be replaced
-/+ resource "aws_iam_openid_connect_provider" "oidc_provider" {
      ~ arn             = "arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2" -> (known after apply)
      ~ id              = "arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2" -> (known after apply)
      ~ tags            = {
          ~ "Name" = "zeno-production-cluster-eks-irsa" -> "zeno-staging-cluster-eks-irsa"
        }
      ~ tags_all        = {
          ~ "Name" = "zeno-production-cluster-eks-irsa" -> "zeno-staging-cluster-eks-irsa"
        }
      ~ thumbprint_list = [
          - "9e99a48a9960b14926bb7f3b02e22da2b0ab7280",
        ] -> (known after apply)
      ~ url             = "oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2" # forces replacement -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.aws_iam_policy.cluster_encryption[0] must be replaced
-/+ resource "aws_iam_policy" "cluster_encryption" {
      ~ arn              = "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" -> (known after apply)
      ~ attachment_count = 1 -> (known after apply)
      ~ id               = "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" -> (known after apply)
      ~ name             = "zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" -> (known after apply)
      ~ name_prefix      = "zeno-production-cluster-cluster-ClusterEncryption" -> "zeno-staging-cluster-cluster-ClusterEncryption" # forces replacement
      ~ policy_id        = "ANPARHJJM5DJBAVDHQOZA" -> (known after apply)
      - tags             = {} -> null
      ~ tags_all         = {} -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_iam_role.this[0] must be replaced
+/- resource "aws_iam_role" "this" {
      ~ arn                   = "arn:aws:iam::084375562450:role/zeno-production-cluster-cluster-20241124151456720400000002" -> (known after apply)
      ~ create_date           = "2024-11-24T15:14:58Z" -> (known after apply)
      ~ id                    = "zeno-production-cluster-cluster-20241124151456720400000002" -> (known after apply)
      ~ managed_policy_arns   = [
          - "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013",
          - "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
          - "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
        ] -> (known after apply)
      ~ name                  = "zeno-production-cluster-cluster-20241124151456720400000002" -> (known after apply)
      ~ name_prefix           = "zeno-production-cluster-cluster-" -> "zeno-staging-cluster-cluster-" # forces replacement
      - tags                  = {} -> null
      ~ tags_all              = {} -> (known after apply)
      ~ unique_id             = "AROARHJJM5DJLHROOUMBV" -> (known after apply)
        # (4 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0] must be replaced
-/+ resource "aws_iam_role_policy_attachment" "cluster_encryption" {
      ~ id         = "zeno-production-cluster-cluster-20241124151456720400000002-20241124151528958300000014" -> (known after apply)
      ~ policy_arn = "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" # forces replacement -> (known after apply) # forces replacement
      ~ role       = "zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"] must be replaced
+/- resource "aws_iam_role_policy_attachment" "this" {
      ~ id         = "zeno-production-cluster-cluster-20241124151456720400000002-20241124151459683600000005" -> (known after apply)
      ~ role       = "zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"] must be replaced
+/- resource "aws_iam_role_policy_attachment" "this" {
      ~ id         = "zeno-production-cluster-cluster-20241124151456720400000002-20241124151459658300000004" -> (known after apply)
      ~ role       = "zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.aws_security_group.cluster[0] must be replaced
+/- resource "aws_security_group" "cluster" {
      ~ arn                    = "arn:aws:ec2:us-east-1:084375562450:security-group/sg-0bd86b2d1d4c494db" -> (known after apply)
      ~ egress                 = [] -> (known after apply)
      ~ id                     = "sg-0bd86b2d1d4c494db" -> (known after apply)
      ~ ingress                = [
          - {
              - cidr_blocks      = []
              - description      = "Node groups to cluster API"
              - from_port        = 443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-01e99d583cc16bbd6",
                ]
              - self             = false
              - to_port          = 443
            },
        ] -> (known after apply)
      ~ name                   = "zeno-production-cluster-cluster-20241124151514397900000010" -> (known after apply)
      ~ name_prefix            = "zeno-production-cluster-cluster-" -> "zeno-staging-cluster-cluster-" # forces replacement
      ~ owner_id               = "084375562450" -> (known after apply)
      ~ tags                   = {
          ~ "Name" = "zeno-production-cluster-cluster" -> "zeno-staging-cluster-cluster"
        }
      ~ tags_all               = {
          ~ "Name" = "zeno-production-cluster-cluster" -> "zeno-staging-cluster-cluster"
        }
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group.node[0] must be replaced
+/- resource "aws_security_group" "node" {
      ~ arn                    = "arn:aws:ec2:us-east-1:084375562450:security-group/sg-01e99d583cc16bbd6" -> (known after apply)
      ~ egress                 = [
          - {
              - cidr_blocks      = [
                  - "0.0.0.0/0",
                ]
              - description      = "Allow all egress"
              - from_port        = 0
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "-1"
              - security_groups  = []
              - self             = false
              - to_port          = 0
            },
        ] -> (known after apply)
      ~ id                     = "sg-01e99d583cc16bbd6" -> (known after apply)
      ~ ingress                = [
          - {
              - cidr_blocks      = []
              - description      = ""
              - from_port        = 0
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "-1"
              - security_groups  = [
                  - "sg-0722c1b29c08baf08",
                ]
              - self             = false
              - to_port          = 0
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 4443/tcp webhook"
              - from_port        = 4443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 4443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 6443/tcp webhook"
              - from_port        = 6443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 6443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 8443/tcp webhook"
              - from_port        = 8443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 8443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 9443/tcp webhook"
              - from_port        = 9443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 9443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node groups"
              - from_port        = 443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node kubelets"
              - from_port        = 10250
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 10250
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to RDS"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = true
              - to_port          = 5432
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to node CoreDNS UDP"
              - from_port        = 53
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "udp"
              - security_groups  = []
              - self             = true
              - to_port          = 53
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to node CoreDNS"
              - from_port        = 53
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = true
              - to_port          = 53
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to node ingress on ephemeral ports"
              - from_port        = 1025
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = true
              - to_port          = 65535
            },
        ] -> (known after apply)
      ~ name                   = "zeno-production-cluster-node-20241124151514429400000011" -> (known after apply)
      ~ name_prefix            = "zeno-production-cluster-node-" -> "zeno-staging-cluster-node-" # forces replacement
      ~ owner_id               = "084375562450" -> (known after apply)
      ~ tags                   = {
          ~ "Name"                                          = "zeno-production-cluster-node" -> "zeno-staging-cluster-node"
          - "kubernetes.io/cluster/zeno-production-cluster" = "owned" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "owned"
        }
      ~ tags_all               = {
          ~ "Name"                                          = "zeno-production-cluster-node" -> "zeno-staging-cluster-node"
          - "kubernetes.io/cluster/zeno-production-cluster" = "owned" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "owned"
        }
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"] must be replaced
+/- resource "aws_security_group_rule" "cluster" {
      ~ id                       = "sgrule-334661475" -> (known after apply)
      ~ security_group_id        = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-077c6317fd13fd294" -> (known after apply)
      ~ source_security_group_id = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
        # (6 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["egress_all"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-3638724160" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0b7ba3c3750a2d301" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (8 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-2982503749" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0072b01bd821ccff9" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-4255533616" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-04c38b4259acb9dd8" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-887369126" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-02dd245b7e5994733" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-666374535" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0db9463bfbacd3579" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-1125720652" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-064993144390ad6f9" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-3210305847" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0c0752ac8089880f1" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-3648003083" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0ece1a17f0c8a91ba" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-1048699024" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-033e24265326cb0d2" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-2598257535" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-095a9eedb908604cf" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.time_sleep.this[0] must be replaced
+/- resource "time_sleep" "this" {
      ~ id              = "2024-11-24T15:26:39Z" -> (known after apply)
      ~ triggers        = { # forces replacement
          ~ "cluster_certificate_authority_data" = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJUkNaSXRwS1ZZb1l3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TkRFeE1qUXhOVEUxTVRaYUZ3MHpOREV4TWpJeE5USXdNVFphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURyd3hFZ2pJTERkK1BSVmR0cy9FVWU1WXVMZVV2TlBxV1U4VDg0aGRYUWVDajdRdmxKYk5GRGYxM3AKNk1MZnhDTzBycmEzb05rV0htaXN3R1ZFUEpWREJTcG90VGxacGhvRHpKa0N4akNDc0F3TUxyNVV1T0R4UzZkUwpZOGYzSDhRVlBIRWRMakR0VlFJWVpTdkE5ZDFSUFBvVWhvcHdJYWFNNG1MTE1VUmlwUnEyNndZeVRXemFQWW9XCkdZV3doNC9QVldVcktNRkVEeGEzMGl5aDRwQi8rUWF5ejdkV2xyeDY4U0VZMjJIckN2MzUvSTFzWHFDZ3NTL2UKaGZHTW1iZUs4UFMyaytGUWhJQXZTTnRTZGt1a1lra2Y4d1dIUTRkaDdOaWpVU3QrUlNBUWd1eENhSUNqUWtxRwo5ckk1Q3J4Z1djbE41QVR2UnpuUHlHak9SaUxsQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJRU01GVzBSR3IzQlJwNE5rM1JBVkN2dk44aDdUQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQTZCV0dLSkNUYgp4MnFscTc0Tm5JL0w3aEt6MUVkWGdESnF0b1pXbTdCNmMvY055T0xJQUNmd21tOWVvRGJqMnpHVHc5OFhTVm84CkFEQmxTWHVSb2dTUi9RY2IxeEpVWnFVcHRXM2dNYWRvMjhZNnZVY0s0aG9lL3pPaDZDczlIMEdoVkxaNU9RaXgKVHYrSHRBM0ZlTWNuUFV6SWJUNXd1ZVVoUG41bnVVTkVwejAvaGNQL2JrM00rVWxMK1RNMnkwM0lmWEZhL21mLwpiV1kzK0RCUUhVa0svSlJ1T2hjRDhrUkdZV0RRMTQ5K2kxdlpSTE9BL2tlblFidXc1ZThNOFNiTmFQcXVsd2JVCjdLZjZ6dm50ZlhDa0R1Vkw0NGFWdWlXa2pnQWQrckZyaHFDd3BSRnRhMmtqdlNtQTRmaFI5SHF5L0wrRHZ0S2kKRTJDdVByU2w4TEVOCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K" -> (known after apply)
          ~ "cluster_endpoint"                   = "https://085DFD0C5701406346D03AB1EA5B38F2.gr7.us-east-1.eks.amazonaws.com" -> (known after apply)
          ~ "cluster_name"                       = "zeno-production-cluster" -> "zeno-staging-cluster"
          ~ "cluster_service_cidr"               = "172.20.0.0/16" -> (known after apply)
            # (1 unchanged element hidden)
        }
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.vpc.aws_default_network_acl.this[0] will be updated in-place
  ~ resource "aws_default_network_acl" "this" {
        id                     = "acl-01d72c016ec1365bf"
      ~ tags                   = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
      ~ tags_all               = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
        # (5 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.resources.module.vpc.aws_default_route_table.default[0] will be updated in-place
  ~ resource "aws_default_route_table" "default" {
        id                     = "rtb-0dca056b5cb3f4bdc"
      ~ tags                   = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
      ~ tags_all               = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
        # (6 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.resources.module.vpc.aws_default_security_group.this[0] will be updated in-place
  ~ resource "aws_default_security_group" "this" {
        id                     = "sg-02f79d9422c79d174"
        name                   = "default"
      ~ tags                   = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
      ~ tags_all               = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_eip.nat[0] will be updated in-place
  ~ resource "aws_eip" "nat" {
        id                   = "eipalloc-04e1927500c13e36f"
      ~ tags                 = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
      ~ tags_all             = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
        # (12 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_internet_gateway.this[0] will be updated in-place
  ~ resource "aws_internet_gateway" "this" {
        id       = "igw-0721a42d5f02f490a"
      ~ tags     = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
      ~ tags_all = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_nat_gateway.this[0] will be updated in-place
  ~ resource "aws_nat_gateway" "this" {
        id                                 = "nat-0fe07f0eb9fb2161d"
      ~ tags                               = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
      ~ tags_all                           = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
        # (10 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_route_table.private[0] will be updated in-place
  ~ resource "aws_route_table" "private" {
        id               = "rtb-0e06cd84685011ff8"
      ~ tags             = {
          ~ "Name" = "vpc-zeno-production-private" -> "vpc-zeno-staging-private"
        }
      ~ tags_all         = {
          ~ "Name" = "vpc-zeno-production-private" -> "vpc-zeno-staging-private"
        }
        # (5 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_route_table.public[0] will be updated in-place
  ~ resource "aws_route_table" "public" {
        id               = "rtb-0f703710ef8983d5a"
      ~ tags             = {
          ~ "Name" = "vpc-zeno-production-public" -> "vpc-zeno-staging-public"
        }
      ~ tags_all         = {
          ~ "Name" = "vpc-zeno-production-public" -> "vpc-zeno-staging-public"
        }
        # (5 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.private[0] will be updated in-place
  ~ resource "aws_subnet" "private" {
        id                                             = "subnet-00564600fc0109d5f"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1a" -> "vpc-zeno-staging-private-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/internal-elb"               = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1a" -> "vpc-zeno-staging-private-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.private[1] will be updated in-place
  ~ resource "aws_subnet" "private" {
        id                                             = "subnet-0c9a24adf6985b148"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1b" -> "vpc-zeno-staging-private-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/internal-elb"               = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1b" -> "vpc-zeno-staging-private-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.private[2] will be updated in-place
  ~ resource "aws_subnet" "private" {
        id                                             = "subnet-0e9ba580b832e58ab"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1c" -> "vpc-zeno-staging-private-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/internal-elb"               = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1c" -> "vpc-zeno-staging-private-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.public[0] will be updated in-place
  ~ resource "aws_subnet" "public" {
        id                                             = "subnet-0b2d1b545f702eceb"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1a" -> "vpc-zeno-staging-public-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/elb"                        = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1a" -> "vpc-zeno-staging-public-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.public[1] will be updated in-place
  ~ resource "aws_subnet" "public" {
        id                                             = "subnet-060bb06a5c8393f81"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1b" -> "vpc-zeno-staging-public-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/elb"                        = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1b" -> "vpc-zeno-staging-public-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.public[2] will be updated in-place
  ~ resource "aws_subnet" "public" {
        id                                             = "subnet-0aad369235ab19564"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1c" -> "vpc-zeno-staging-public-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/elb"                        = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1c" -> "vpc-zeno-staging-public-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_vpc.this[0] will be updated in-place
  ~ resource "aws_vpc" "this" {
        id                                   = "vpc-0f6151e1ec7ed4b96"
      ~ tags                                 = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
      ~ tags_all                             = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
        # (14 unchanged attributes hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0] must be replaced
+/- resource "aws_eks_node_group" "this" {
      ~ arn                    = "arn:aws:eks:us-east-1:084375562450:nodegroup/zeno-production-cluster/default-20241124152646072500000019/02c9af64-288d-0382-1221-3ef1d3e95d2c" -> (known after apply)
      ~ capacity_type          = "ON_DEMAND" -> (known after apply)
      ~ cluster_name           = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      ~ disk_size              = 0 -> (known after apply)
      ~ id                     = "zeno-production-cluster:default-20241124152646072500000019" -> (known after apply)
      - labels                 = {} -> null
      ~ node_group_name        = "default-20241124152646072500000019" -> (known after apply)
      ~ release_version        = "1.31.2-20241115" -> (known after apply)
      ~ resources              = [
          - {
              - autoscaling_groups              = [
                  - {
                      - name = "eks-default-20241124152646072500000019-02c9af64-288d-0382-1221-3ef1d3e95d2c"
                    },
                ]
              - remote_access_security_group_id = ""
            },
        ] -> (known after apply)
      ~ status                 = "ACTIVE" -> (known after apply)
        tags                   = {
            "Name" = "default"
        }
        # (7 unchanged attributes hidden)

      ~ launch_template {
            id      = "lt-0fdd12ec7c2965609"
          ~ name    = "default-20241124152643442800000015" -> (known after apply)
          ~ version = "2" -> (known after apply)
        }

      ~ update_config {
          - max_unavailable            = 0 -> null
            # (1 unchanged attribute hidden)
        }

        # (2 unchanged blocks hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0] will be updated in-place
  ~ resource "aws_launch_template" "this" {
      ~ default_version         = 2 -> (known after apply)
        id                      = "lt-0fdd12ec7c2965609"
      ~ latest_version          = 2 -> (known after apply)
        name                    = "default-20241124152643442800000015"
        tags                    = {}
      ~ vpc_security_group_ids  = [
          - "sg-01e99d583cc16bbd6",
        ] -> (known after apply)
        # (8 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0] must be replaced
+/- resource "aws_eks_node_group" "this" {
      ~ arn                    = "arn:aws:eks:us-east-1:084375562450:nodegroup/zeno-production-cluster/regular-2024112415264607270000001b/12c9af64-288c-45dc-a2cc-27f36a2c775c" -> (known after apply)
      ~ capacity_type          = "ON_DEMAND" -> (known after apply)
      ~ cluster_name           = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      ~ disk_size              = 0 -> (known after apply)
      ~ id                     = "zeno-production-cluster:regular-2024112415264607270000001b" -> (known after apply)
      - labels                 = {} -> null
      ~ node_group_name        = "regular-2024112415264607270000001b" -> (known after apply)
      ~ release_version        = "1.31.2-20241115" -> (known after apply)
      ~ resources              = [
          - {
              - autoscaling_groups              = [
                  - {
                      - name = "eks-regular-2024112415264607270000001b-12c9af64-288c-45dc-a2cc-27f36a2c775c"
                    },
                ]
              - remote_access_security_group_id = ""
            },
        ] -> (known after apply)
      ~ status                 = "ACTIVE" -> (known after apply)
        tags                   = {
            "Name" = "regular"
        }
        # (7 unchanged attributes hidden)

      ~ launch_template {
            id      = "lt-099de2edeeea863c8"
          ~ name    = "regular-20241124152643442900000017" -> (known after apply)
          ~ version = "2" -> (known after apply)
        }

      - node_repair_config {
          - enabled = true -> null
        }

      ~ scaling_config {
          ~ desired_size = 2 -> 1
            # (2 unchanged attributes hidden)
        }

      ~ update_config {
          - max_unavailable            = 0 -> null
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0] will be updated in-place
  ~ resource "aws_launch_template" "this" {
      ~ default_version         = 2 -> (known after apply)
        id                      = "lt-099de2edeeea863c8"
      ~ latest_version          = 2 -> (known after apply)
        name                    = "regular-20241124152643442900000017"
        tags                    = {}
      ~ vpc_security_group_ids  = [
          - "sg-01e99d583cc16bbd6",
        ] -> (known after apply)
        # (8 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + minified_json             = (known after apply)
      + override_policy_documents = []
      + source_policy_documents   = []

      + statement {
          + actions   = [
              + "kms:*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "Default"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:root",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:CancelKeyDeletion",
              + "kms:Create*",
              + "kms:Delete*",
              + "kms:Describe*",
              + "kms:Disable*",
              + "kms:Enable*",
              + "kms:Get*",
              + "kms:ImportKeyMaterial",
              + "kms:List*",
              + "kms:Put*",
              + "kms:ReplicateKey",
              + "kms:Revoke*",
              + "kms:ScheduleKeyDeletion",
              + "kms:TagResource",
              + "kms:UntagResource",
              + "kms:Update*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyAdministration"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:user/tarashish@developmentseed.org",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:Decrypt",
              + "kms:DescribeKey",
              + "kms:Encrypt",
              + "kms:GenerateDataKey*",
              + "kms:ReEncrypt*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyUsage"

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"] must be replaced
-/+ resource "aws_kms_alias" "this" {
      ~ arn            = "arn:aws:kms:us-east-1:084375562450:alias/eks/zeno-production-cluster" -> (known after apply)
      ~ id             = "alias/eks/zeno-production-cluster" -> (known after apply)
      ~ name           = "alias/eks/zeno-production-cluster" -> "alias/eks/zeno-staging-cluster" # forces replacement
      + name_prefix    = (known after apply)
      ~ target_key_arn = "arn:aws:kms:us-east-1:084375562450:key/8cd9f3d5-f6e1-49ff-a032-da1528c9daa4" -> (known after apply)
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.module.kms.aws_kms_key.this[0] will be updated in-place
  ~ resource "aws_kms_key" "this" {
      ~ description                        = "zeno-production-cluster cluster encryption key" -> "zeno-staging-cluster cluster encryption key"
        id                                 = "8cd9f3d5-f6e1-49ff-a032-da1528c9daa4"
      ~ policy                             = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "kms:*"
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::084375562450:root"
                        }
                      - Resource  = "*"
                      - Sid       = "Default"
                    },
                  - {
                      - Action    = [
                          - "kms:Update*",
                          - "kms:UntagResource",
                          - "kms:TagResource",
                          - "kms:ScheduleKeyDeletion",
                          - "kms:Revoke*",
                          - "kms:ReplicateKey",
                          - "kms:Put*",
                          - "kms:List*",
                          - "kms:ImportKeyMaterial",
                          - "kms:Get*",
                          - "kms:Enable*",
                          - "kms:Disable*",
                          - "kms:Describe*",
                          - "kms:Delete*",
                          - "kms:Create*",
                          - "kms:CancelKeyDeletion",
                        ]
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::084375562450:user/tarashish@developmentseed.org"
                        }
                      - Resource  = "*"
                      - Sid       = "KeyAdministration"
                    },
                  - {
                      - Action    = [
                          - "kms:ReEncrypt*",
                          - "kms:GenerateDataKey*",
                          - "kms:Encrypt",
                          - "kms:DescribeKey",
                          - "kms:Decrypt",
                        ]
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::084375562450:role/zeno-production-cluster-cluster-20241124151456720400000002"
                        }
                      - Resource  = "*"
                      - Sid       = "KeyUsage"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        tags                               = {
            "terraform-aws-modules" = "eks"
        }
        # (10 unchanged attributes hidden)
    }

Plan: 26 to add, 18 to change, 26 to destroy.

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-11T10:25:39Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`failure`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.data.aws_availability_zones.available: Reading...
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.module.eks.aws_cloudwatch_log_group.this[0]: Refreshing state... [id=/aws/eks/zeno-production-cluster/cluster]
module.resources.module.vpc.aws_vpc.this[0]: Refreshing state... [id=vpc-0f6151e1ec7ed4b96]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003]
module.resources.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.aws_iam_role.this[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.data.aws_availability_zones.available: Read complete after 1s [id=us-east-1]
module.resources.data.aws_db_instance.zeno-db: Read complete after 1s [id=zeno-db]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500034600000008]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150083720000000d]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150080180000000c]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150038690000000b]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500094000000009]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150036100000000a]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151459701100000006]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500015800000007]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459683600000005]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459658300000004]
module.resources.module.eks.module.kms.aws_kms_key.this[0]: Refreshing state... [id=8cd9f3d5-f6e1-49ff-a032-da1528c9daa4]
module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"]: Refreshing state... [id=alias/eks/zeno-production-cluster]
module.resources.module.eks.aws_iam_policy.cluster_encryption[0]: Refreshing state... [id=arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013]
module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151528958300000014]
module.resources.module.vpc.aws_default_network_acl.this[0]: Refreshing state... [id=acl-01d72c016ec1365bf]
module.resources.module.vpc.aws_default_route_table.default[0]: Refreshing state... [id=rtb-0dca056b5cb3f4bdc]
module.resources.module.vpc.aws_default_security_group.this[0]: Refreshing state... [id=sg-02f79d9422c79d174]
module.resources.module.vpc.aws_route_table.private[0]: Refreshing state... [id=rtb-0e06cd84685011ff8]
module.resources.module.vpc.aws_subnet.public[1]: Refreshing state... [id=subnet-060bb06a5c8393f81]
module.resources.module.vpc.aws_subnet.public[2]: Refreshing state... [id=subnet-0aad369235ab19564]
module.resources.module.vpc.aws_subnet.public[0]: Refreshing state... [id=subnet-0b2d1b545f702eceb]
module.resources.module.vpc.aws_subnet.private[1]: Refreshing state... [id=subnet-0c9a24adf6985b148]
module.resources.module.eks.aws_security_group.node[0]: Refreshing state... [id=sg-01e99d583cc16bbd6]
module.resources.module.vpc.aws_subnet.private[2]: Refreshing state... [id=subnet-0e9ba580b832e58ab]
module.resources.module.vpc.aws_subnet.private[0]: Refreshing state... [id=subnet-00564600fc0109d5f]
module.resources.module.vpc.aws_route_table.public[0]: Refreshing state... [id=rtb-0f703710ef8983d5a]
module.resources.module.vpc.aws_internet_gateway.this[0]: Refreshing state... [id=igw-0721a42d5f02f490a]
module.resources.module.eks.aws_security_group.cluster[0]: Refreshing state... [id=sg-0bd86b2d1d4c494db]
module.resources.module.vpc.aws_eip.nat[0]: Refreshing state... [id=eipalloc-04e1927500c13e36f]
module.resources.module.vpc.aws_route_table_association.private[0]: Refreshing state... [id=rtbassoc-006325e67577ba7cb]
module.resources.module.vpc.aws_route_table_association.private[1]: Refreshing state... [id=rtbassoc-03cbd09508fae031c]
module.resources.module.vpc.aws_route_table_association.private[2]: Refreshing state... [id=rtbassoc-0dbcf7c72bb07f949]
module.resources.module.vpc.aws_route.public_internet_gateway[0]: Refreshing state... [id=r-rtb-0f703710ef8983d5a1080289494]
module.resources.module.vpc.aws_route_table_association.public[2]: Refreshing state... [id=rtbassoc-0f01ab3ef8fb36172]
module.resources.module.vpc.aws_route_table_association.public[1]: Refreshing state... [id=rtbassoc-05a8a28a38e5d35a9]
module.resources.module.vpc.aws_route_table_association.public[0]: Refreshing state... [id=rtbassoc-0527a821acc8b2d5d]
module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"]: Refreshing state... [id=sgrule-3648003083]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"]: Refreshing state... [id=sgrule-2598257535]
module.resources.module.eks.aws_security_group_rule.node["egress_all"]: Refreshing state... [id=sgrule-3638724160]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"]: Refreshing state... [id=sgrule-4255533616]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"]: Refreshing state... [id=sgrule-887369126]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"]: Refreshing state... [id=sgrule-666374535]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"]: Refreshing state... [id=sgrule-2982503749]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"]: Refreshing state... [id=sgrule-1125720652]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"]: Refreshing state... [id=sgrule-3210305847]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"]: Refreshing state... [id=sgrule-1048699024]
module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"]: Refreshing state... [id=sgrule-334661475]
module.resources.module.vpc.aws_nat_gateway.this[0]: Refreshing state... [id=nat-0fe07f0eb9fb2161d]
module.resources.module.vpc.aws_route.private_nat_gateway[0]: Refreshing state... [id=r-rtb-0e06cd84685011ff81080289494]
module.resources.module.eks.aws_eks_cluster.this[0]: Refreshing state... [id=zeno-production-cluster]
module.resources.module.eks.time_sleep.this[0]: Refreshing state... [id=2024-11-24T15:26:39Z]
module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0]: Refreshing state... [id=arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2]
module.resources.helm_release.zeno-cert-manager: Refreshing state... [id=cert-manager]
module.resources.helm_release.zeno-ingress-nginx: Refreshing state... [id=ingress-nginx]
module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=8124355570844009309]
module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=6616271754968722364]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0]: Refreshing state... [id=lt-099de2edeeea863c8]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0]: Refreshing state... [id=lt-0fdd12ec7c2965609]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:default-20241124152646072500000019]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:regular-2024112415264607270000001b]
module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"]: Refreshing state... [id=zeno-production-cluster:aws-ebs-csi-driver]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.resources.module.eks.aws_eks_cluster.this[0] has changed
  ~ resource "aws_eks_cluster" "this" {
        id                            = "zeno-production-cluster"
        name                          = "zeno-production-cluster"
      ~ platform_version              = "eks.20" -> "eks.21"
        tags                          = {
            "terraform-aws-modules" = "eks"
        }
        # (11 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement
+/- create replacement and then destroy
 <= read (data resources)

Terraform planned the following actions, but then encountered a problem:

  # module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_eks_addon_version" "this" {
      + addon_name         = "aws-ebs-csi-driver"
      + id                 = (known after apply)
      + kubernetes_version = "1.31"
      + version            = (known after apply)
    }

  # module.resources.module.eks.data.tls_certificate.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "tls_certificate" "this" {
      + certificates = (known after apply)
      + id           = (known after apply)
      + url          = (known after apply)
    }

  # module.resources.module.eks.aws_cloudwatch_log_group.this[0] must be replaced
+/- resource "aws_cloudwatch_log_group" "this" {
      ~ arn               = "arn:aws:logs:us-east-1:084375562450:log-group:/aws/eks/zeno-production-cluster/cluster" -> (known after apply)
      ~ id                = "/aws/eks/zeno-production-cluster/cluster" -> (known after apply)
      ~ log_group_class   = "STANDARD" -> (known after apply)
      ~ name              = "/aws/eks/zeno-production-cluster/cluster" -> "/aws/eks/zeno-staging-cluster/cluster" # forces replacement
      + name_prefix       = (known after apply)
      ~ tags              = {
          ~ "Name" = "/aws/eks/zeno-production-cluster/cluster" -> "/aws/eks/zeno-staging-cluster/cluster"
        }
      ~ tags_all          = {
          ~ "Name" = "/aws/eks/zeno-production-cluster/cluster" -> "/aws/eks/zeno-staging-cluster/cluster"
        }
        # (2 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"] must be replaced
-/+ resource "aws_eks_addon" "this" {
      ~ arn                         = "arn:aws:eks:us-east-1:084375562450:addon/zeno-production-cluster/aws-ebs-csi-driver/22c9af65-086f-8e8a-463f-07f929aa54f7" -> (known after apply)
      ~ cluster_name                = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      + configuration_values        = (known after apply)
      ~ created_at                  = "2024-11-24T15:28:41Z" -> (known after apply)
      ~ id                          = "zeno-production-cluster:aws-ebs-csi-driver" -> (known after apply)
      ~ modified_at                 = "2025-03-22T16:38:23Z" -> (known after apply)
      - tags                        = {} -> null
      ~ tags_all                    = {} -> (known after apply)
        # (5 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.resources.module.eks.aws_eks_cluster.this[0] must be replaced
+/- resource "aws_eks_cluster" "this" {
      ~ arn                           = "arn:aws:eks:us-east-1:084375562450:cluster/zeno-production-cluster" -> (known after apply)
      ~ certificate_authority         = [
          - {
              - data = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJUkNaSXRwS1ZZb1l3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TkRFeE1qUXhOVEUxTVRaYUZ3MHpOREV4TWpJeE5USXdNVFphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURyd3hFZ2pJTERkK1BSVmR0cy9FVWU1WXVMZVV2TlBxV1U4VDg0aGRYUWVDajdRdmxKYk5GRGYxM3AKNk1MZnhDTzBycmEzb05rV0htaXN3R1ZFUEpWREJTcG90VGxacGhvRHpKa0N4akNDc0F3TUxyNVV1T0R4UzZkUwpZOGYzSDhRVlBIRWRMakR0VlFJWVpTdkE5ZDFSUFBvVWhvcHdJYWFNNG1MTE1VUmlwUnEyNndZeVRXemFQWW9XCkdZV3doNC9QVldVcktNRkVEeGEzMGl5aDRwQi8rUWF5ejdkV2xyeDY4U0VZMjJIckN2MzUvSTFzWHFDZ3NTL2UKaGZHTW1iZUs4UFMyaytGUWhJQXZTTnRTZGt1a1lra2Y4d1dIUTRkaDdOaWpVU3QrUlNBUWd1eENhSUNqUWtxRwo5ckk1Q3J4Z1djbE41QVR2UnpuUHlHak9SaUxsQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJRU01GVzBSR3IzQlJwNE5rM1JBVkN2dk44aDdUQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQTZCV0dLSkNUYgp4MnFscTc0Tm5JL0w3aEt6MUVkWGdESnF0b1pXbTdCNmMvY055T0xJQUNmd21tOWVvRGJqMnpHVHc5OFhTVm84CkFEQmxTWHVSb2dTUi9RY2IxeEpVWnFVcHRXM2dNYWRvMjhZNnZVY0s0aG9lL3pPaDZDczlIMEdoVkxaNU9RaXgKVHYrSHRBM0ZlTWNuUFV6SWJUNXd1ZVVoUG41bnVVTkVwejAvaGNQL2JrM00rVWxMK1RNMnkwM0lmWEZhL21mLwpiV1kzK0RCUUhVa0svSlJ1T2hjRDhrUkdZV0RRMTQ5K2kxdlpSTE9BL2tlblFidXc1ZThNOFNiTmFQcXVsd2JVCjdLZjZ6dm50ZlhDa0R1Vkw0NGFWdWlXa2pnQWQrckZyaHFDd3BSRnRhMmtqdlNtQTRmaFI5SHF5L0wrRHZ0S2kKRTJDdVByU2w4TEVOCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
            },
        ] -> (known after apply)
      + cluster_id                    = (known after apply)
      ~ created_at                    = "2024-11-24T15:15:33Z" -> (known after apply)
      ~ endpoint                      = "https://085DFD0C5701406346D03AB1EA5B38F2.gr7.us-east-1.eks.amazonaws.com" -> (known after apply)
      ~ id                            = "zeno-production-cluster" -> (known after apply)
      ~ identity                      = [
          - {
              - oidc = [
                  - {
                      - issuer = "https://oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2"
                    },
                ]
            },
        ] -> (known after apply)
      ~ name                          = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      ~ platform_version              = "eks.21" -> (known after apply)
      ~ role_arn                      = "arn:aws:iam::084375562450:role/zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
      ~ status                        = "ACTIVE" -> (known after apply)
        tags                          = {
            "terraform-aws-modules" = "eks"
        }
        # (4 unchanged attributes hidden)

      ~ kubernetes_network_config {
          ~ service_ipv4_cidr = "172.20.0.0/16" -> (known after apply)
          + service_ipv6_cidr = (known after apply)
            # (1 unchanged attribute hidden)

          - elastic_load_balancing {
              - enabled = false -> null
            }
        }

      - upgrade_policy {
          - support_type = "EXTENDED" -> null
        }

      ~ vpc_config {
          ~ cluster_security_group_id = "sg-0e489d72b61ec1d2e" -> (known after apply)
          ~ security_group_ids        = [
              - "sg-0bd86b2d1d4c494db",
            ] -> (known after apply)
          ~ vpc_id                    = "vpc-0f6151e1ec7ed4b96" -> (known after apply)
            # (4 unchanged attributes hidden)
        }

        # (3 unchanged blocks hidden)
    }

  # module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0] must be replaced
-/+ resource "aws_iam_openid_connect_provider" "oidc_provider" {
      ~ arn             = "arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2" -> (known after apply)
      ~ id              = "arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2" -> (known after apply)
      ~ tags            = {
          ~ "Name" = "zeno-production-cluster-eks-irsa" -> "zeno-staging-cluster-eks-irsa"
        }
      ~ tags_all        = {
          ~ "Name" = "zeno-production-cluster-eks-irsa" -> "zeno-staging-cluster-eks-irsa"
        }
      ~ thumbprint_list = [
          - "9e99a48a9960b14926bb7f3b02e22da2b0ab7280",
        ] -> (known after apply)
      ~ url             = "oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2" # forces replacement -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.aws_iam_policy.cluster_encryption[0] must be replaced
-/+ resource "aws_iam_policy" "cluster_encryption" {
      ~ arn              = "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" -> (known after apply)
      ~ attachment_count = 1 -> (known after apply)
      ~ id               = "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" -> (known after apply)
      ~ name             = "zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" -> (known after apply)
      ~ name_prefix      = "zeno-production-cluster-cluster-ClusterEncryption" -> "zeno-staging-cluster-cluster-ClusterEncryption" # forces replacement
      ~ policy_id        = "ANPARHJJM5DJBAVDHQOZA" -> (known after apply)
      - tags             = {} -> null
      ~ tags_all         = {} -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_iam_role.this[0] must be replaced
+/- resource "aws_iam_role" "this" {
      ~ arn                   = "arn:aws:iam::084375562450:role/zeno-production-cluster-cluster-20241124151456720400000002" -> (known after apply)
      ~ create_date           = "2024-11-24T15:14:58Z" -> (known after apply)
      ~ id                    = "zeno-production-cluster-cluster-20241124151456720400000002" -> (known after apply)
      ~ managed_policy_arns   = [
          - "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013",
          - "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
          - "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
        ] -> (known after apply)
      ~ name                  = "zeno-production-cluster-cluster-20241124151456720400000002" -> (known after apply)
      ~ name_prefix           = "zeno-production-cluster-cluster-" -> "zeno-staging-cluster-cluster-" # forces replacement
      - tags                  = {} -> null
      ~ tags_all              = {} -> (known after apply)
      ~ unique_id             = "AROARHJJM5DJLHROOUMBV" -> (known after apply)
        # (4 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0] must be replaced
-/+ resource "aws_iam_role_policy_attachment" "cluster_encryption" {
      ~ id         = "zeno-production-cluster-cluster-20241124151456720400000002-20241124151528958300000014" -> (known after apply)
      ~ policy_arn = "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" # forces replacement -> (known after apply) # forces replacement
      ~ role       = "zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"] must be replaced
+/- resource "aws_iam_role_policy_attachment" "this" {
      ~ id         = "zeno-production-cluster-cluster-20241124151456720400000002-20241124151459683600000005" -> (known after apply)
      ~ role       = "zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"] must be replaced
+/- resource "aws_iam_role_policy_attachment" "this" {
      ~ id         = "zeno-production-cluster-cluster-20241124151456720400000002-20241124151459658300000004" -> (known after apply)
      ~ role       = "zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.aws_security_group.cluster[0] must be replaced
+/- resource "aws_security_group" "cluster" {
      ~ arn                    = "arn:aws:ec2:us-east-1:084375562450:security-group/sg-0bd86b2d1d4c494db" -> (known after apply)
      ~ egress                 = [] -> (known after apply)
      ~ id                     = "sg-0bd86b2d1d4c494db" -> (known after apply)
      ~ ingress                = [
          - {
              - cidr_blocks      = []
              - description      = "Node groups to cluster API"
              - from_port        = 443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-01e99d583cc16bbd6",
                ]
              - self             = false
              - to_port          = 443
            },
        ] -> (known after apply)
      ~ name                   = "zeno-production-cluster-cluster-20241124151514397900000010" -> (known after apply)
      ~ name_prefix            = "zeno-production-cluster-cluster-" -> "zeno-staging-cluster-cluster-" # forces replacement
      ~ owner_id               = "084375562450" -> (known after apply)
      ~ tags                   = {
          ~ "Name" = "zeno-production-cluster-cluster" -> "zeno-staging-cluster-cluster"
        }
      ~ tags_all               = {
          ~ "Name" = "zeno-production-cluster-cluster" -> "zeno-staging-cluster-cluster"
        }
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group.node[0] must be replaced
+/- resource "aws_security_group" "node" {
      ~ arn                    = "arn:aws:ec2:us-east-1:084375562450:security-group/sg-01e99d583cc16bbd6" -> (known after apply)
      ~ egress                 = [
          - {
              - cidr_blocks      = [
                  - "0.0.0.0/0",
                ]
              - description      = "Allow all egress"
              - from_port        = 0
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "-1"
              - security_groups  = []
              - self             = false
              - to_port          = 0
            },
        ] -> (known after apply)
      ~ id                     = "sg-01e99d583cc16bbd6" -> (known after apply)
      ~ ingress                = [
          - {
              - cidr_blocks      = []
              - description      = ""
              - from_port        = 0
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "-1"
              - security_groups  = [
                  - "sg-0722c1b29c08baf08",
                ]
              - self             = false
              - to_port          = 0
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 4443/tcp webhook"
              - from_port        = 4443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 4443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 6443/tcp webhook"
              - from_port        = 6443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 6443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 8443/tcp webhook"
              - from_port        = 8443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 8443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 9443/tcp webhook"
              - from_port        = 9443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 9443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node groups"
              - from_port        = 443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node kubelets"
              - from_port        = 10250
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 10250
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to RDS"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = true
              - to_port          = 5432
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to node CoreDNS UDP"
              - from_port        = 53
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "udp"
              - security_groups  = []
              - self             = true
              - to_port          = 53
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to node CoreDNS"
              - from_port        = 53
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = true
              - to_port          = 53
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to node ingress on ephemeral ports"
              - from_port        = 1025
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = true
              - to_port          = 65535
            },
        ] -> (known after apply)
      ~ name                   = "zeno-production-cluster-node-20241124151514429400000011" -> (known after apply)
      ~ name_prefix            = "zeno-production-cluster-node-" -> "zeno-staging-cluster-node-" # forces replacement
      ~ owner_id               = "084375562450" -> (known after apply)
      ~ tags                   = {
          ~ "Name"                                          = "zeno-production-cluster-node" -> "zeno-staging-cluster-node"
          - "kubernetes.io/cluster/zeno-production-cluster" = "owned" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "owned"
        }
      ~ tags_all               = {
          ~ "Name"                                          = "zeno-production-cluster-node" -> "zeno-staging-cluster-node"
          - "kubernetes.io/cluster/zeno-production-cluster" = "owned" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "owned"
        }
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"] must be replaced
+/- resource "aws_security_group_rule" "cluster" {
      ~ id                       = "sgrule-334661475" -> (known after apply)
      ~ security_group_id        = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-077c6317fd13fd294" -> (known after apply)
      ~ source_security_group_id = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
        # (6 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["egress_all"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-3638724160" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0b7ba3c3750a2d301" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (8 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-2982503749" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0072b01bd821ccff9" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-4255533616" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-04c38b4259acb9dd8" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-887369126" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-02dd245b7e5994733" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-666374535" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0db9463bfbacd3579" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-1125720652" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-064993144390ad6f9" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-3210305847" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0c0752ac8089880f1" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-3648003083" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0ece1a17f0c8a91ba" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-1048699024" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-033e24265326cb0d2" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-2598257535" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-095a9eedb908604cf" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.time_sleep.this[0] must be replaced
+/- resource "time_sleep" "this" {
      ~ id              = "2024-11-24T15:26:39Z" -> (known after apply)
      ~ triggers        = { # forces replacement
          ~ "cluster_certificate_authority_data" = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJUkNaSXRwS1ZZb1l3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TkRFeE1qUXhOVEUxTVRaYUZ3MHpOREV4TWpJeE5USXdNVFphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURyd3hFZ2pJTERkK1BSVmR0cy9FVWU1WXVMZVV2TlBxV1U4VDg0aGRYUWVDajdRdmxKYk5GRGYxM3AKNk1MZnhDTzBycmEzb05rV0htaXN3R1ZFUEpWREJTcG90VGxacGhvRHpKa0N4akNDc0F3TUxyNVV1T0R4UzZkUwpZOGYzSDhRVlBIRWRMakR0VlFJWVpTdkE5ZDFSUFBvVWhvcHdJYWFNNG1MTE1VUmlwUnEyNndZeVRXemFQWW9XCkdZV3doNC9QVldVcktNRkVEeGEzMGl5aDRwQi8rUWF5ejdkV2xyeDY4U0VZMjJIckN2MzUvSTFzWHFDZ3NTL2UKaGZHTW1iZUs4UFMyaytGUWhJQXZTTnRTZGt1a1lra2Y4d1dIUTRkaDdOaWpVU3QrUlNBUWd1eENhSUNqUWtxRwo5ckk1Q3J4Z1djbE41QVR2UnpuUHlHak9SaUxsQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJRU01GVzBSR3IzQlJwNE5rM1JBVkN2dk44aDdUQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQTZCV0dLSkNUYgp4MnFscTc0Tm5JL0w3aEt6MUVkWGdESnF0b1pXbTdCNmMvY055T0xJQUNmd21tOWVvRGJqMnpHVHc5OFhTVm84CkFEQmxTWHVSb2dTUi9RY2IxeEpVWnFVcHRXM2dNYWRvMjhZNnZVY0s0aG9lL3pPaDZDczlIMEdoVkxaNU9RaXgKVHYrSHRBM0ZlTWNuUFV6SWJUNXd1ZVVoUG41bnVVTkVwejAvaGNQL2JrM00rVWxMK1RNMnkwM0lmWEZhL21mLwpiV1kzK0RCUUhVa0svSlJ1T2hjRDhrUkdZV0RRMTQ5K2kxdlpSTE9BL2tlblFidXc1ZThNOFNiTmFQcXVsd2JVCjdLZjZ6dm50ZlhDa0R1Vkw0NGFWdWlXa2pnQWQrckZyaHFDd3BSRnRhMmtqdlNtQTRmaFI5SHF5L0wrRHZ0S2kKRTJDdVByU2w4TEVOCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K" -> (known after apply)
          ~ "cluster_endpoint"                   = "https://085DFD0C5701406346D03AB1EA5B38F2.gr7.us-east-1.eks.amazonaws.com" -> (known after apply)
          ~ "cluster_name"                       = "zeno-production-cluster" -> "zeno-staging-cluster"
          ~ "cluster_service_cidr"               = "172.20.0.0/16" -> (known after apply)
            # (1 unchanged element hidden)
        }
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.vpc.aws_default_network_acl.this[0] will be updated in-place
  ~ resource "aws_default_network_acl" "this" {
        id                     = "acl-01d72c016ec1365bf"
      ~ tags                   = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
      ~ tags_all               = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
        # (5 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.resources.module.vpc.aws_default_route_table.default[0] will be updated in-place
  ~ resource "aws_default_route_table" "default" {
        id                     = "rtb-0dca056b5cb3f4bdc"
      ~ tags                   = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
      ~ tags_all               = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
        # (6 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.resources.module.vpc.aws_default_security_group.this[0] will be updated in-place
  ~ resource "aws_default_security_group" "this" {
        id                     = "sg-02f79d9422c79d174"
        name                   = "default"
      ~ tags                   = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
      ~ tags_all               = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_eip.nat[0] will be updated in-place
  ~ resource "aws_eip" "nat" {
        id                   = "eipalloc-04e1927500c13e36f"
      ~ tags                 = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
      ~ tags_all             = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
        # (12 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_internet_gateway.this[0] will be updated in-place
  ~ resource "aws_internet_gateway" "this" {
        id       = "igw-0721a42d5f02f490a"
      ~ tags     = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
      ~ tags_all = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_nat_gateway.this[0] will be updated in-place
  ~ resource "aws_nat_gateway" "this" {
        id                                 = "nat-0fe07f0eb9fb2161d"
      ~ tags                               = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
      ~ tags_all                           = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
        # (10 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_route_table.private[0] will be updated in-place
  ~ resource "aws_route_table" "private" {
        id               = "rtb-0e06cd84685011ff8"
      ~ tags             = {
          ~ "Name" = "vpc-zeno-production-private" -> "vpc-zeno-staging-private"
        }
      ~ tags_all         = {
          ~ "Name" = "vpc-zeno-production-private" -> "vpc-zeno-staging-private"
        }
        # (5 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_route_table.public[0] will be updated in-place
  ~ resource "aws_route_table" "public" {
        id               = "rtb-0f703710ef8983d5a"
      ~ tags             = {
          ~ "Name" = "vpc-zeno-production-public" -> "vpc-zeno-staging-public"
        }
      ~ tags_all         = {
          ~ "Name" = "vpc-zeno-production-public" -> "vpc-zeno-staging-public"
        }
        # (5 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.private[0] will be updated in-place
  ~ resource "aws_subnet" "private" {
        id                                             = "subnet-00564600fc0109d5f"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1a" -> "vpc-zeno-staging-private-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/internal-elb"               = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1a" -> "vpc-zeno-staging-private-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.private[1] will be updated in-place
  ~ resource "aws_subnet" "private" {
        id                                             = "subnet-0c9a24adf6985b148"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1b" -> "vpc-zeno-staging-private-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/internal-elb"               = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1b" -> "vpc-zeno-staging-private-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.private[2] will be updated in-place
  ~ resource "aws_subnet" "private" {
        id                                             = "subnet-0e9ba580b832e58ab"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1c" -> "vpc-zeno-staging-private-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/internal-elb"               = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1c" -> "vpc-zeno-staging-private-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.public[0] will be updated in-place
  ~ resource "aws_subnet" "public" {
        id                                             = "subnet-0b2d1b545f702eceb"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1a" -> "vpc-zeno-staging-public-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/elb"                        = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1a" -> "vpc-zeno-staging-public-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.public[1] will be updated in-place
  ~ resource "aws_subnet" "public" {
        id                                             = "subnet-060bb06a5c8393f81"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1b" -> "vpc-zeno-staging-public-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/elb"                        = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1b" -> "vpc-zeno-staging-public-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.public[2] will be updated in-place
  ~ resource "aws_subnet" "public" {
        id                                             = "subnet-0aad369235ab19564"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1c" -> "vpc-zeno-staging-public-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/elb"                        = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1c" -> "vpc-zeno-staging-public-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_vpc.this[0] will be updated in-place
  ~ resource "aws_vpc" "this" {
        id                                   = "vpc-0f6151e1ec7ed4b96"
      ~ tags                                 = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
      ~ tags_all                             = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
        # (14 unchanged attributes hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0] must be replaced
+/- resource "aws_eks_node_group" "this" {
      ~ arn                    = "arn:aws:eks:us-east-1:084375562450:nodegroup/zeno-production-cluster/default-20241124152646072500000019/02c9af64-288d-0382-1221-3ef1d3e95d2c" -> (known after apply)
      ~ capacity_type          = "ON_DEMAND" -> (known after apply)
      ~ cluster_name           = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      ~ disk_size              = 0 -> (known after apply)
      ~ id                     = "zeno-production-cluster:default-20241124152646072500000019" -> (known after apply)
      - labels                 = {} -> null
      ~ node_group_name        = "default-20241124152646072500000019" -> (known after apply)
      ~ release_version        = "1.31.2-20241115" -> (known after apply)
      ~ resources              = [
          - {
              - autoscaling_groups              = [
                  - {
                      - name = "eks-default-20241124152646072500000019-02c9af64-288d-0382-1221-3ef1d3e95d2c"
                    },
                ]
              - remote_access_security_group_id = ""
            },
        ] -> (known after apply)
      ~ status                 = "ACTIVE" -> (known after apply)
        tags                   = {
            "Name" = "default"
        }
        # (7 unchanged attributes hidden)

      ~ launch_template {
            id      = "lt-0fdd12ec7c2965609"
          ~ name    = "default-20241124152643442800000015" -> (known after apply)
          ~ version = "2" -> (known after apply)
        }

      ~ update_config {
          - max_unavailable            = 0 -> null
            # (1 unchanged attribute hidden)
        }

        # (2 unchanged blocks hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0] will be updated in-place
  ~ resource "aws_launch_template" "this" {
      ~ default_version         = 2 -> (known after apply)
        id                      = "lt-0fdd12ec7c2965609"
      ~ latest_version          = 2 -> (known after apply)
        name                    = "default-20241124152643442800000015"
        tags                    = {}
      ~ vpc_security_group_ids  = [
          - "sg-01e99d583cc16bbd6",
        ] -> (known after apply)
        # (8 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0] must be replaced
+/- resource "aws_eks_node_group" "this" {
      ~ arn                    = "arn:aws:eks:us-east-1:084375562450:nodegroup/zeno-production-cluster/regular-2024112415264607270000001b/12c9af64-288c-45dc-a2cc-27f36a2c775c" -> (known after apply)
      ~ capacity_type          = "ON_DEMAND" -> (known after apply)
      ~ cluster_name           = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      ~ disk_size              = 0 -> (known after apply)
      ~ id                     = "zeno-production-cluster:regular-2024112415264607270000001b" -> (known after apply)
      - labels                 = {} -> null
      ~ node_group_name        = "regular-2024112415264607270000001b" -> (known after apply)
      ~ release_version        = "1.31.2-20241115" -> (known after apply)
      ~ resources              = [
          - {
              - autoscaling_groups              = [
                  - {
                      - name = "eks-regular-2024112415264607270000001b-12c9af64-288c-45dc-a2cc-27f36a2c775c"
                    },
                ]
              - remote_access_security_group_id = ""
            },
        ] -> (known after apply)
      ~ status                 = "ACTIVE" -> (known after apply)
        tags                   = {
            "Name" = "regular"
        }
        # (7 unchanged attributes hidden)

      ~ launch_template {
            id      = "lt-099de2edeeea863c8"
          ~ name    = "regular-20241124152643442900000017" -> (known after apply)
          ~ version = "2" -> (known after apply)
        }

      - node_repair_config {
          - enabled = true -> null
        }

      ~ scaling_config {
          ~ desired_size = 2 -> 1
            # (2 unchanged attributes hidden)
        }

      ~ update_config {
          - max_unavailable            = 0 -> null
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0] will be updated in-place
  ~ resource "aws_launch_template" "this" {
      ~ default_version         = 2 -> (known after apply)
        id                      = "lt-099de2edeeea863c8"
      ~ latest_version          = 2 -> (known after apply)
        name                    = "regular-20241124152643442900000017"
        tags                    = {}
      ~ vpc_security_group_ids  = [
          - "sg-01e99d583cc16bbd6",
        ] -> (known after apply)
        # (8 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + minified_json             = (known after apply)
      + override_policy_documents = []
      + source_policy_documents   = []

      + statement {
          + actions   = [
              + "kms:*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "Default"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:root",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:CancelKeyDeletion",
              + "kms:Create*",
              + "kms:Delete*",
              + "kms:Describe*",
              + "kms:Disable*",
              + "kms:Enable*",
              + "kms:Get*",
              + "kms:ImportKeyMaterial",
              + "kms:List*",
              + "kms:Put*",
              + "kms:ReplicateKey",
              + "kms:Revoke*",
              + "kms:ScheduleKeyDeletion",
              + "kms:TagResource",
              + "kms:UntagResource",
              + "kms:Update*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyAdministration"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:user/tarashish@developmentseed.org",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:Decrypt",
              + "kms:DescribeKey",
              + "kms:Encrypt",
              + "kms:GenerateDataKey*",
              + "kms:ReEncrypt*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyUsage"

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"] must be replaced
-/+ resource "aws_kms_alias" "this" {
      ~ arn            = "arn:aws:kms:us-east-1:084375562450:alias/eks/zeno-production-cluster" -> (known after apply)
      ~ id             = "alias/eks/zeno-production-cluster" -> (known after apply)
      ~ name           = "alias/eks/zeno-production-cluster" -> "alias/eks/zeno-staging-cluster" # forces replacement
      + name_prefix    = (known after apply)
      ~ target_key_arn = "arn:aws:kms:us-east-1:084375562450:key/8cd9f3d5-f6e1-49ff-a032-da1528c9daa4" -> (known after apply)
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.module.kms.aws_kms_key.this[0] will be updated in-place
  ~ resource "aws_kms_key" "this" {
      ~ description                        = "zeno-production-cluster cluster encryption key" -> "zeno-staging-cluster cluster encryption key"
        id                                 = "8cd9f3d5-f6e1-49ff-a032-da1528c9daa4"
      ~ policy                             = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "kms:*"
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::084375562450:root"
                        }
                      - Resource  = "*"
                      - Sid       = "Default"
                    },
                  - {
                      - Action    = [
                          - "kms:Update*",
                          - "kms:UntagResource",
                          - "kms:TagResource",
                          - "kms:ScheduleKeyDeletion",
                          - "kms:Revoke*",
                          - "kms:ReplicateKey",
                          - "kms:Put*",
                          - "kms:List*",
                          - "kms:ImportKeyMaterial",
                          - "kms:Get*",
                          - "kms:Enable*",
                          - "kms:Disable*",
                          - "kms:Describe*",
                          - "kms:Delete*",
                          - "kms:Create*",
                          - "kms:CancelKeyDeletion",
                        ]
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::084375562450:user/tarashish@developmentseed.org"
                        }
                      - Resource  = "*"
                      - Sid       = "KeyAdministration"
                    },
                  - {
                      - Action    = [
                          - "kms:ReEncrypt*",
                          - "kms:GenerateDataKey*",
                          - "kms:Encrypt",
                          - "kms:DescribeKey",
                          - "kms:Decrypt",
                        ]
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::084375562450:role/zeno-production-cluster-cluster-20241124151456720400000002"
                        }
                      - Resource  = "*"
                      - Sid       = "KeyUsage"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        tags                               = {
            "terraform-aws-modules" = "eks"
        }
        # (10 unchanged attributes hidden)
    }

Plan: 26 to add, 18 to change, 26 to destroy.

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-14T08:46:03Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`failure`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-14T08:47:16Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`failure`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-14T09:02:53Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`failure`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-14T09:06:37Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`failure`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-14T09:12:18Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`failure`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-14T09:18:21Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`failure`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.aws_cloudwatch_log_group.this[0]: Refreshing state... [id=/aws/eks/zeno-production-cluster/cluster]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.data.aws_availability_zones.available: Reading...
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.vpc.aws_vpc.this[0]: Refreshing state... [id=vpc-0f6151e1ec7ed4b96]
module.resources.data.aws_caller_identity.current: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.aws_iam_role.this[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002]
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 0s [id=084375562450]
module.resources.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500094000000009]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150036100000000a]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150083720000000d]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500015800000007]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151459701100000006]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150080180000000c]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=regular-eks-node-group-20241124151456720300000001-2024112415150038690000000b]
module.resources.data.aws_db_instance.zeno-db: Read complete after 0s [id=zeno-db]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"]: Refreshing state... [id=default-eks-node-group-20241124151456720600000003-20241124151500034600000008]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459658300000004]
module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151459683600000005]
module.resources.module.eks.module.kms.aws_kms_key.this[0]: Refreshing state... [id=8cd9f3d5-f6e1-49ff-a032-da1528c9daa4]
module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"]: Refreshing state... [id=alias/eks/zeno-production-cluster]
module.resources.module.eks.aws_iam_policy.cluster_encryption[0]: Refreshing state... [id=arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013]
module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0]: Refreshing state... [id=zeno-production-cluster-cluster-20241124151456720400000002-20241124151528958300000014]
module.resources.module.vpc.aws_default_route_table.default[0]: Refreshing state... [id=rtb-0dca056b5cb3f4bdc]
module.resources.module.vpc.aws_default_network_acl.this[0]: Refreshing state... [id=acl-01d72c016ec1365bf]
module.resources.module.eks.aws_security_group.cluster[0]: Refreshing state... [id=sg-0bd86b2d1d4c494db]
module.resources.module.vpc.aws_route_table.private[0]: Refreshing state... [id=rtb-0e06cd84685011ff8]
module.resources.module.vpc.aws_default_security_group.this[0]: Refreshing state... [id=sg-02f79d9422c79d174]
module.resources.module.vpc.aws_subnet.private[2]: Refreshing state... [id=subnet-0e9ba580b832e58ab]
module.resources.module.vpc.aws_route_table.public[0]: Refreshing state... [id=rtb-0f703710ef8983d5a]
module.resources.module.vpc.aws_subnet.private[0]: Refreshing state... [id=subnet-00564600fc0109d5f]
module.resources.module.eks.aws_security_group.node[0]: Refreshing state... [id=sg-01e99d583cc16bbd6]
module.resources.module.vpc.aws_subnet.private[1]: Refreshing state... [id=subnet-0c9a24adf6985b148]
module.resources.module.vpc.aws_internet_gateway.this[0]: Refreshing state... [id=igw-0721a42d5f02f490a]
module.resources.module.vpc.aws_subnet.public[0]: Refreshing state... [id=subnet-0b2d1b545f702eceb]
module.resources.module.vpc.aws_subnet.public[1]: Refreshing state... [id=subnet-060bb06a5c8393f81]
module.resources.module.vpc.aws_subnet.public[2]: Refreshing state... [id=subnet-0aad369235ab19564]
module.resources.module.vpc.aws_eip.nat[0]: Refreshing state... [id=eipalloc-04e1927500c13e36f]
module.resources.module.vpc.aws_route.public_internet_gateway[0]: Refreshing state... [id=r-rtb-0f703710ef8983d5a1080289494]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"]: Refreshing state... [id=sgrule-3210305847]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"]: Refreshing state... [id=sgrule-1125720652]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"]: Refreshing state... [id=sgrule-1048699024]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"]: Refreshing state... [id=sgrule-2982503749]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"]: Refreshing state... [id=sgrule-666374535]
module.resources.module.eks.aws_security_group_rule.node["egress_all"]: Refreshing state... [id=sgrule-3638724160]
module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"]: Refreshing state... [id=sgrule-2598257535]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"]: Refreshing state... [id=sgrule-887369126]
module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"]: Refreshing state... [id=sgrule-3648003083]
module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"]: Refreshing state... [id=sgrule-4255533616]
module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"]: Refreshing state... [id=sgrule-334661475]
module.resources.module.vpc.aws_route_table_association.private[1]: Refreshing state... [id=rtbassoc-03cbd09508fae031c]
module.resources.module.vpc.aws_route_table_association.private[0]: Refreshing state... [id=rtbassoc-006325e67577ba7cb]
module.resources.module.vpc.aws_route_table_association.private[2]: Refreshing state... [id=rtbassoc-0dbcf7c72bb07f949]
module.resources.module.vpc.aws_route_table_association.public[0]: Refreshing state... [id=rtbassoc-0527a821acc8b2d5d]
module.resources.module.vpc.aws_route_table_association.public[1]: Refreshing state... [id=rtbassoc-05a8a28a38e5d35a9]
module.resources.module.vpc.aws_route_table_association.public[2]: Refreshing state... [id=rtbassoc-0f01ab3ef8fb36172]
module.resources.module.vpc.aws_nat_gateway.this[0]: Refreshing state... [id=nat-0fe07f0eb9fb2161d]
module.resources.module.vpc.aws_route.private_nat_gateway[0]: Refreshing state... [id=r-rtb-0e06cd84685011ff81080289494]
module.resources.module.eks.aws_eks_cluster.this[0]: Refreshing state... [id=zeno-production-cluster]
module.resources.module.eks.time_sleep.this[0]: Refreshing state... [id=2024-11-24T15:26:39Z]
module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0]: Refreshing state... [id=arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2]
module.resources.helm_release.zeno-ingress-nginx: Refreshing state... [id=ingress-nginx]
module.resources.helm_release.zeno-cert-manager: Refreshing state... [id=cert-manager]
module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=6616271754968722364]
module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr: Refreshing state... [id=8124355570844009309]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0]: Refreshing state... [id=lt-099de2edeeea863c8]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0]: Refreshing state... [id=lt-0fdd12ec7c2965609]
module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:default-20241124152646072500000019]
module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0]: Refreshing state... [id=zeno-production-cluster:regular-2024112415264607270000001b]
module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"]: Refreshing state... [id=zeno-production-cluster:aws-ebs-csi-driver]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.resources.module.eks.aws_eks_cluster.this[0] has changed
  ~ resource "aws_eks_cluster" "this" {
        id                            = "zeno-production-cluster"
        name                          = "zeno-production-cluster"
      ~ platform_version              = "eks.20" -> "eks.21"
        tags                          = {
            "terraform-aws-modules" = "eks"
        }
        # (11 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement
+/- create replacement and then destroy
 <= read (data resources)

Terraform planned the following actions, but then encountered a problem:

  # module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_eks_addon_version" "this" {
      + addon_name         = "aws-ebs-csi-driver"
      + id                 = (known after apply)
      + kubernetes_version = "1.31"
      + version            = (known after apply)
    }

  # module.resources.module.eks.data.tls_certificate.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "tls_certificate" "this" {
      + certificates = (known after apply)
      + id           = (known after apply)
      + url          = (known after apply)
    }

  # module.resources.module.eks.aws_cloudwatch_log_group.this[0] must be replaced
+/- resource "aws_cloudwatch_log_group" "this" {
      ~ arn               = "arn:aws:logs:us-east-1:084375562450:log-group:/aws/eks/zeno-production-cluster/cluster" -> (known after apply)
      ~ id                = "/aws/eks/zeno-production-cluster/cluster" -> (known after apply)
      ~ log_group_class   = "STANDARD" -> (known after apply)
      ~ name              = "/aws/eks/zeno-production-cluster/cluster" -> "/aws/eks/zeno-staging-cluster/cluster" # forces replacement
      + name_prefix       = (known after apply)
      ~ tags              = {
          ~ "Name" = "/aws/eks/zeno-production-cluster/cluster" -> "/aws/eks/zeno-staging-cluster/cluster"
        }
      ~ tags_all          = {
          ~ "Name" = "/aws/eks/zeno-production-cluster/cluster" -> "/aws/eks/zeno-staging-cluster/cluster"
        }
        # (2 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"] must be replaced
-/+ resource "aws_eks_addon" "this" {
      ~ arn                         = "arn:aws:eks:us-east-1:084375562450:addon/zeno-production-cluster/aws-ebs-csi-driver/22c9af65-086f-8e8a-463f-07f929aa54f7" -> (known after apply)
      ~ cluster_name                = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      + configuration_values        = (known after apply)
      ~ created_at                  = "2024-11-24T15:28:41Z" -> (known after apply)
      ~ id                          = "zeno-production-cluster:aws-ebs-csi-driver" -> (known after apply)
      ~ modified_at                 = "2025-03-22T16:38:23Z" -> (known after apply)
      - tags                        = {} -> null
      ~ tags_all                    = {} -> (known after apply)
        # (5 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.resources.module.eks.aws_eks_cluster.this[0] must be replaced
+/- resource "aws_eks_cluster" "this" {
      ~ arn                           = "arn:aws:eks:us-east-1:084375562450:cluster/zeno-production-cluster" -> (known after apply)
      ~ certificate_authority         = [
          - {
              - data = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJUkNaSXRwS1ZZb1l3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TkRFeE1qUXhOVEUxTVRaYUZ3MHpOREV4TWpJeE5USXdNVFphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURyd3hFZ2pJTERkK1BSVmR0cy9FVWU1WXVMZVV2TlBxV1U4VDg0aGRYUWVDajdRdmxKYk5GRGYxM3AKNk1MZnhDTzBycmEzb05rV0htaXN3R1ZFUEpWREJTcG90VGxacGhvRHpKa0N4akNDc0F3TUxyNVV1T0R4UzZkUwpZOGYzSDhRVlBIRWRMakR0VlFJWVpTdkE5ZDFSUFBvVWhvcHdJYWFNNG1MTE1VUmlwUnEyNndZeVRXemFQWW9XCkdZV3doNC9QVldVcktNRkVEeGEzMGl5aDRwQi8rUWF5ejdkV2xyeDY4U0VZMjJIckN2MzUvSTFzWHFDZ3NTL2UKaGZHTW1iZUs4UFMyaytGUWhJQXZTTnRTZGt1a1lra2Y4d1dIUTRkaDdOaWpVU3QrUlNBUWd1eENhSUNqUWtxRwo5ckk1Q3J4Z1djbE41QVR2UnpuUHlHak9SaUxsQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJRU01GVzBSR3IzQlJwNE5rM1JBVkN2dk44aDdUQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQTZCV0dLSkNUYgp4MnFscTc0Tm5JL0w3aEt6MUVkWGdESnF0b1pXbTdCNmMvY055T0xJQUNmd21tOWVvRGJqMnpHVHc5OFhTVm84CkFEQmxTWHVSb2dTUi9RY2IxeEpVWnFVcHRXM2dNYWRvMjhZNnZVY0s0aG9lL3pPaDZDczlIMEdoVkxaNU9RaXgKVHYrSHRBM0ZlTWNuUFV6SWJUNXd1ZVVoUG41bnVVTkVwejAvaGNQL2JrM00rVWxMK1RNMnkwM0lmWEZhL21mLwpiV1kzK0RCUUhVa0svSlJ1T2hjRDhrUkdZV0RRMTQ5K2kxdlpSTE9BL2tlblFidXc1ZThNOFNiTmFQcXVsd2JVCjdLZjZ6dm50ZlhDa0R1Vkw0NGFWdWlXa2pnQWQrckZyaHFDd3BSRnRhMmtqdlNtQTRmaFI5SHF5L0wrRHZ0S2kKRTJDdVByU2w4TEVOCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
            },
        ] -> (known after apply)
      + cluster_id                    = (known after apply)
      ~ created_at                    = "2024-11-24T15:15:33Z" -> (known after apply)
      ~ endpoint                      = "https://085DFD0C5701406346D03AB1EA5B38F2.gr7.us-east-1.eks.amazonaws.com" -> (known after apply)
      ~ id                            = "zeno-production-cluster" -> (known after apply)
      ~ identity                      = [
          - {
              - oidc = [
                  - {
                      - issuer = "https://oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2"
                    },
                ]
            },
        ] -> (known after apply)
      ~ name                          = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      ~ platform_version              = "eks.21" -> (known after apply)
      ~ role_arn                      = "arn:aws:iam::084375562450:role/zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
      ~ status                        = "ACTIVE" -> (known after apply)
        tags                          = {
            "terraform-aws-modules" = "eks"
        }
        # (4 unchanged attributes hidden)

      ~ kubernetes_network_config {
          ~ service_ipv4_cidr = "172.20.0.0/16" -> (known after apply)
          + service_ipv6_cidr = (known after apply)
            # (1 unchanged attribute hidden)

          - elastic_load_balancing {
              - enabled = false -> null
            }
        }

      - upgrade_policy {
          - support_type = "EXTENDED" -> null
        }

      ~ vpc_config {
          ~ cluster_security_group_id = "sg-0e489d72b61ec1d2e" -> (known after apply)
          ~ security_group_ids        = [
              - "sg-0bd86b2d1d4c494db",
            ] -> (known after apply)
          ~ vpc_id                    = "vpc-0f6151e1ec7ed4b96" -> (known after apply)
            # (4 unchanged attributes hidden)
        }

        # (3 unchanged blocks hidden)
    }

  # module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0] must be replaced
-/+ resource "aws_iam_openid_connect_provider" "oidc_provider" {
      ~ arn             = "arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2" -> (known after apply)
      ~ id              = "arn:aws:iam::084375562450:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2" -> (known after apply)
      ~ tags            = {
          ~ "Name" = "zeno-production-cluster-eks-irsa" -> "zeno-staging-cluster-eks-irsa"
        }
      ~ tags_all        = {
          ~ "Name" = "zeno-production-cluster-eks-irsa" -> "zeno-staging-cluster-eks-irsa"
        }
      ~ thumbprint_list = [
          - "9e99a48a9960b14926bb7f3b02e22da2b0ab7280",
        ] -> (known after apply)
      ~ url             = "oidc.eks.us-east-1.amazonaws.com/id/085DFD0C5701406346D03AB1EA5B38F2" # forces replacement -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.aws_iam_policy.cluster_encryption[0] must be replaced
-/+ resource "aws_iam_policy" "cluster_encryption" {
      ~ arn              = "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" -> (known after apply)
      ~ attachment_count = 1 -> (known after apply)
      ~ id               = "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" -> (known after apply)
      ~ name             = "zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" -> (known after apply)
      ~ name_prefix      = "zeno-production-cluster-cluster-ClusterEncryption" -> "zeno-staging-cluster-cluster-ClusterEncryption" # forces replacement
      ~ policy_id        = "ANPARHJJM5DJBAVDHQOZA" -> (known after apply)
      - tags             = {} -> null
      ~ tags_all         = {} -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_iam_role.this[0] must be replaced
+/- resource "aws_iam_role" "this" {
      ~ arn                   = "arn:aws:iam::084375562450:role/zeno-production-cluster-cluster-20241124151456720400000002" -> (known after apply)
      ~ create_date           = "2024-11-24T15:14:58Z" -> (known after apply)
      ~ id                    = "zeno-production-cluster-cluster-20241124151456720400000002" -> (known after apply)
      ~ managed_policy_arns   = [
          - "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013",
          - "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
          - "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
        ] -> (known after apply)
      ~ name                  = "zeno-production-cluster-cluster-20241124151456720400000002" -> (known after apply)
      ~ name_prefix           = "zeno-production-cluster-cluster-" -> "zeno-staging-cluster-cluster-" # forces replacement
      - tags                  = {} -> null
      ~ tags_all              = {} -> (known after apply)
      ~ unique_id             = "AROARHJJM5DJLHROOUMBV" -> (known after apply)
        # (4 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0] must be replaced
-/+ resource "aws_iam_role_policy_attachment" "cluster_encryption" {
      ~ id         = "zeno-production-cluster-cluster-20241124151456720400000002-20241124151528958300000014" -> (known after apply)
      ~ policy_arn = "arn:aws:iam::084375562450:policy/zeno-production-cluster-cluster-ClusterEncryption20241124151527601700000013" # forces replacement -> (known after apply) # forces replacement
      ~ role       = "zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"] must be replaced
+/- resource "aws_iam_role_policy_attachment" "this" {
      ~ id         = "zeno-production-cluster-cluster-20241124151456720400000002-20241124151459683600000005" -> (known after apply)
      ~ role       = "zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"] must be replaced
+/- resource "aws_iam_role_policy_attachment" "this" {
      ~ id         = "zeno-production-cluster-cluster-20241124151456720400000002-20241124151459658300000004" -> (known after apply)
      ~ role       = "zeno-production-cluster-cluster-20241124151456720400000002" # forces replacement -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.aws_security_group.cluster[0] must be replaced
+/- resource "aws_security_group" "cluster" {
      ~ arn                    = "arn:aws:ec2:us-east-1:084375562450:security-group/sg-0bd86b2d1d4c494db" -> (known after apply)
      ~ egress                 = [] -> (known after apply)
      ~ id                     = "sg-0bd86b2d1d4c494db" -> (known after apply)
      ~ ingress                = [
          - {
              - cidr_blocks      = []
              - description      = "Node groups to cluster API"
              - from_port        = 443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-01e99d583cc16bbd6",
                ]
              - self             = false
              - to_port          = 443
            },
        ] -> (known after apply)
      ~ name                   = "zeno-production-cluster-cluster-20241124151514397900000010" -> (known after apply)
      ~ name_prefix            = "zeno-production-cluster-cluster-" -> "zeno-staging-cluster-cluster-" # forces replacement
      ~ owner_id               = "084375562450" -> (known after apply)
      ~ tags                   = {
          ~ "Name" = "zeno-production-cluster-cluster" -> "zeno-staging-cluster-cluster"
        }
      ~ tags_all               = {
          ~ "Name" = "zeno-production-cluster-cluster" -> "zeno-staging-cluster-cluster"
        }
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group.node[0] must be replaced
+/- resource "aws_security_group" "node" {
      ~ arn                    = "arn:aws:ec2:us-east-1:084375562450:security-group/sg-01e99d583cc16bbd6" -> (known after apply)
      ~ egress                 = [
          - {
              - cidr_blocks      = [
                  - "0.0.0.0/0",
                ]
              - description      = "Allow all egress"
              - from_port        = 0
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "-1"
              - security_groups  = []
              - self             = false
              - to_port          = 0
            },
        ] -> (known after apply)
      ~ id                     = "sg-01e99d583cc16bbd6" -> (known after apply)
      ~ ingress                = [
          - {
              - cidr_blocks      = []
              - description      = ""
              - from_port        = 0
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "-1"
              - security_groups  = [
                  - "sg-0722c1b29c08baf08",
                ]
              - self             = false
              - to_port          = 0
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 4443/tcp webhook"
              - from_port        = 4443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 4443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 6443/tcp webhook"
              - from_port        = 6443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 6443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 8443/tcp webhook"
              - from_port        = 8443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 8443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node 9443/tcp webhook"
              - from_port        = 9443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 9443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node groups"
              - from_port        = 443
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 443
            },
          - {
              - cidr_blocks      = []
              - description      = "Cluster API to node kubelets"
              - from_port        = 10250
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0bd86b2d1d4c494db",
                ]
              - self             = false
              - to_port          = 10250
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to RDS"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = true
              - to_port          = 5432
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to node CoreDNS UDP"
              - from_port        = 53
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "udp"
              - security_groups  = []
              - self             = true
              - to_port          = 53
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to node CoreDNS"
              - from_port        = 53
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = true
              - to_port          = 53
            },
          - {
              - cidr_blocks      = []
              - description      = "Node to node ingress on ephemeral ports"
              - from_port        = 1025
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = true
              - to_port          = 65535
            },
        ] -> (known after apply)
      ~ name                   = "zeno-production-cluster-node-20241124151514429400000011" -> (known after apply)
      ~ name_prefix            = "zeno-production-cluster-node-" -> "zeno-staging-cluster-node-" # forces replacement
      ~ owner_id               = "084375562450" -> (known after apply)
      ~ tags                   = {
          ~ "Name"                                          = "zeno-production-cluster-node" -> "zeno-staging-cluster-node"
          - "kubernetes.io/cluster/zeno-production-cluster" = "owned" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "owned"
        }
      ~ tags_all               = {
          ~ "Name"                                          = "zeno-production-cluster-node" -> "zeno-staging-cluster-node"
          - "kubernetes.io/cluster/zeno-production-cluster" = "owned" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "owned"
        }
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"] must be replaced
+/- resource "aws_security_group_rule" "cluster" {
      ~ id                       = "sgrule-334661475" -> (known after apply)
      ~ security_group_id        = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-077c6317fd13fd294" -> (known after apply)
      ~ source_security_group_id = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
        # (6 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["egress_all"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-3638724160" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0b7ba3c3750a2d301" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (8 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-2982503749" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0072b01bd821ccff9" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-4255533616" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-04c38b4259acb9dd8" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-887369126" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-02dd245b7e5994733" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-666374535" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0db9463bfbacd3579" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-1125720652" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-064993144390ad6f9" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-3210305847" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0c0752ac8089880f1" -> (known after apply)
      ~ source_security_group_id = "sg-0bd86b2d1d4c494db" # forces replacement -> (known after apply) # forces replacement
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-3648003083" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-0ece1a17f0c8a91ba" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-1048699024" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-033e24265326cb0d2" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"] must be replaced
+/- resource "aws_security_group_rule" "node" {
      ~ id                       = "sgrule-2598257535" -> (known after apply)
      ~ security_group_id        = "sg-01e99d583cc16bbd6" # forces replacement -> (known after apply) # forces replacement
      ~ security_group_rule_id   = "sgr-095a9eedb908604cf" -> (known after apply)
      + source_security_group_id = (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.eks.time_sleep.this[0] must be replaced
+/- resource "time_sleep" "this" {
      ~ id              = "2024-11-24T15:26:39Z" -> (known after apply)
      ~ triggers        = { # forces replacement
          ~ "cluster_certificate_authority_data" = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJUkNaSXRwS1ZZb1l3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TkRFeE1qUXhOVEUxTVRaYUZ3MHpOREV4TWpJeE5USXdNVFphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURyd3hFZ2pJTERkK1BSVmR0cy9FVWU1WXVMZVV2TlBxV1U4VDg0aGRYUWVDajdRdmxKYk5GRGYxM3AKNk1MZnhDTzBycmEzb05rV0htaXN3R1ZFUEpWREJTcG90VGxacGhvRHpKa0N4akNDc0F3TUxyNVV1T0R4UzZkUwpZOGYzSDhRVlBIRWRMakR0VlFJWVpTdkE5ZDFSUFBvVWhvcHdJYWFNNG1MTE1VUmlwUnEyNndZeVRXemFQWW9XCkdZV3doNC9QVldVcktNRkVEeGEzMGl5aDRwQi8rUWF5ejdkV2xyeDY4U0VZMjJIckN2MzUvSTFzWHFDZ3NTL2UKaGZHTW1iZUs4UFMyaytGUWhJQXZTTnRTZGt1a1lra2Y4d1dIUTRkaDdOaWpVU3QrUlNBUWd1eENhSUNqUWtxRwo5ckk1Q3J4Z1djbE41QVR2UnpuUHlHak9SaUxsQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJRU01GVzBSR3IzQlJwNE5rM1JBVkN2dk44aDdUQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQTZCV0dLSkNUYgp4MnFscTc0Tm5JL0w3aEt6MUVkWGdESnF0b1pXbTdCNmMvY055T0xJQUNmd21tOWVvRGJqMnpHVHc5OFhTVm84CkFEQmxTWHVSb2dTUi9RY2IxeEpVWnFVcHRXM2dNYWRvMjhZNnZVY0s0aG9lL3pPaDZDczlIMEdoVkxaNU9RaXgKVHYrSHRBM0ZlTWNuUFV6SWJUNXd1ZVVoUG41bnVVTkVwejAvaGNQL2JrM00rVWxMK1RNMnkwM0lmWEZhL21mLwpiV1kzK0RCUUhVa0svSlJ1T2hjRDhrUkdZV0RRMTQ5K2kxdlpSTE9BL2tlblFidXc1ZThNOFNiTmFQcXVsd2JVCjdLZjZ6dm50ZlhDa0R1Vkw0NGFWdWlXa2pnQWQrckZyaHFDd3BSRnRhMmtqdlNtQTRmaFI5SHF5L0wrRHZ0S2kKRTJDdVByU2w4TEVOCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K" -> (known after apply)
          ~ "cluster_endpoint"                   = "https://085DFD0C5701406346D03AB1EA5B38F2.gr7.us-east-1.eks.amazonaws.com" -> (known after apply)
          ~ "cluster_name"                       = "zeno-production-cluster" -> "zeno-staging-cluster"
          ~ "cluster_service_cidr"               = "172.20.0.0/16" -> (known after apply)
            # (1 unchanged element hidden)
        }
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.vpc.aws_default_network_acl.this[0] will be updated in-place
  ~ resource "aws_default_network_acl" "this" {
        id                     = "acl-01d72c016ec1365bf"
      ~ tags                   = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
      ~ tags_all               = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
        # (5 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.resources.module.vpc.aws_default_route_table.default[0] will be updated in-place
  ~ resource "aws_default_route_table" "default" {
        id                     = "rtb-0dca056b5cb3f4bdc"
      ~ tags                   = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
      ~ tags_all               = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
        # (6 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.resources.module.vpc.aws_default_security_group.this[0] will be updated in-place
  ~ resource "aws_default_security_group" "this" {
        id                     = "sg-02f79d9422c79d174"
        name                   = "default"
      ~ tags                   = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
      ~ tags_all               = {
          ~ "Name" = "vpc-zeno-production-default" -> "vpc-zeno-staging-default"
        }
        # (7 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_eip.nat[0] will be updated in-place
  ~ resource "aws_eip" "nat" {
        id                   = "eipalloc-04e1927500c13e36f"
      ~ tags                 = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
      ~ tags_all             = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
        # (12 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_internet_gateway.this[0] will be updated in-place
  ~ resource "aws_internet_gateway" "this" {
        id       = "igw-0721a42d5f02f490a"
      ~ tags     = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
      ~ tags_all = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
        # (3 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_nat_gateway.this[0] will be updated in-place
  ~ resource "aws_nat_gateway" "this" {
        id                                 = "nat-0fe07f0eb9fb2161d"
      ~ tags                               = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
      ~ tags_all                           = {
          ~ "Name" = "vpc-zeno-production-us-east-1a" -> "vpc-zeno-staging-us-east-1a"
        }
        # (10 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_route_table.private[0] will be updated in-place
  ~ resource "aws_route_table" "private" {
        id               = "rtb-0e06cd84685011ff8"
      ~ tags             = {
          ~ "Name" = "vpc-zeno-production-private" -> "vpc-zeno-staging-private"
        }
      ~ tags_all         = {
          ~ "Name" = "vpc-zeno-production-private" -> "vpc-zeno-staging-private"
        }
        # (5 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_route_table.public[0] will be updated in-place
  ~ resource "aws_route_table" "public" {
        id               = "rtb-0f703710ef8983d5a"
      ~ tags             = {
          ~ "Name" = "vpc-zeno-production-public" -> "vpc-zeno-staging-public"
        }
      ~ tags_all         = {
          ~ "Name" = "vpc-zeno-production-public" -> "vpc-zeno-staging-public"
        }
        # (5 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.private[0] will be updated in-place
  ~ resource "aws_subnet" "private" {
        id                                             = "subnet-00564600fc0109d5f"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1a" -> "vpc-zeno-staging-private-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/internal-elb"               = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1a" -> "vpc-zeno-staging-private-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.private[1] will be updated in-place
  ~ resource "aws_subnet" "private" {
        id                                             = "subnet-0c9a24adf6985b148"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1b" -> "vpc-zeno-staging-private-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/internal-elb"               = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1b" -> "vpc-zeno-staging-private-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.private[2] will be updated in-place
  ~ resource "aws_subnet" "private" {
        id                                             = "subnet-0e9ba580b832e58ab"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1c" -> "vpc-zeno-staging-private-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/internal-elb"               = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-private-us-east-1c" -> "vpc-zeno-staging-private-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.public[0] will be updated in-place
  ~ resource "aws_subnet" "public" {
        id                                             = "subnet-0b2d1b545f702eceb"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1a" -> "vpc-zeno-staging-public-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/elb"                        = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1a" -> "vpc-zeno-staging-public-us-east-1a"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.public[1] will be updated in-place
  ~ resource "aws_subnet" "public" {
        id                                             = "subnet-060bb06a5c8393f81"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1b" -> "vpc-zeno-staging-public-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/elb"                        = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1b" -> "vpc-zeno-staging-public-us-east-1b"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_subnet.public[2] will be updated in-place
  ~ resource "aws_subnet" "public" {
        id                                             = "subnet-0aad369235ab19564"
      ~ tags                                           = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1c" -> "vpc-zeno-staging-public-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            "kubernetes.io/role/elb"                        = "1"
        }
      ~ tags_all                                       = {
          ~ "Name"                                          = "vpc-zeno-production-public-us-east-1c" -> "vpc-zeno-staging-public-us-east-1c"
          - "kubernetes.io/cluster/zeno-production-cluster" = "shared" -> null
          + "kubernetes.io/cluster/zeno-staging-cluster"    = "shared"
            # (1 unchanged element hidden)
        }
        # (15 unchanged attributes hidden)
    }

  # module.resources.module.vpc.aws_vpc.this[0] will be updated in-place
  ~ resource "aws_vpc" "this" {
        id                                   = "vpc-0f6151e1ec7ed4b96"
      ~ tags                                 = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
      ~ tags_all                             = {
          ~ "Name" = "vpc-zeno-production" -> "vpc-zeno-staging"
        }
        # (14 unchanged attributes hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0] must be replaced
+/- resource "aws_eks_node_group" "this" {
      ~ arn                    = "arn:aws:eks:us-east-1:084375562450:nodegroup/zeno-production-cluster/default-20241124152646072500000019/02c9af64-288d-0382-1221-3ef1d3e95d2c" -> (known after apply)
      ~ capacity_type          = "ON_DEMAND" -> (known after apply)
      ~ cluster_name           = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      ~ disk_size              = 0 -> (known after apply)
      ~ id                     = "zeno-production-cluster:default-20241124152646072500000019" -> (known after apply)
      - labels                 = {} -> null
      ~ node_group_name        = "default-20241124152646072500000019" -> (known after apply)
      ~ release_version        = "1.31.2-20241115" -> (known after apply)
      ~ resources              = [
          - {
              - autoscaling_groups              = [
                  - {
                      - name = "eks-default-20241124152646072500000019-02c9af64-288d-0382-1221-3ef1d3e95d2c"
                    },
                ]
              - remote_access_security_group_id = ""
            },
        ] -> (known after apply)
      ~ status                 = "ACTIVE" -> (known after apply)
        tags                   = {
            "Name" = "default"
        }
        # (7 unchanged attributes hidden)

      ~ launch_template {
            id      = "lt-0fdd12ec7c2965609"
          ~ name    = "default-20241124152643442800000015" -> (known after apply)
          ~ version = "2" -> (known after apply)
        }

      ~ update_config {
          - max_unavailable            = 0 -> null
            # (1 unchanged attribute hidden)
        }

        # (2 unchanged blocks hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0] will be updated in-place
  ~ resource "aws_launch_template" "this" {
      ~ default_version         = 2 -> (known after apply)
        id                      = "lt-0fdd12ec7c2965609"
      ~ latest_version          = 2 -> (known after apply)
        name                    = "default-20241124152643442800000015"
        tags                    = {}
      ~ vpc_security_group_ids  = [
          - "sg-01e99d583cc16bbd6",
        ] -> (known after apply)
        # (8 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0] must be replaced
+/- resource "aws_eks_node_group" "this" {
      ~ arn                    = "arn:aws:eks:us-east-1:084375562450:nodegroup/zeno-production-cluster/regular-2024112415264607270000001b/12c9af64-288c-45dc-a2cc-27f36a2c775c" -> (known after apply)
      ~ capacity_type          = "ON_DEMAND" -> (known after apply)
      ~ cluster_name           = "zeno-production-cluster" -> "zeno-staging-cluster" # forces replacement
      ~ disk_size              = 0 -> (known after apply)
      ~ id                     = "zeno-production-cluster:regular-2024112415264607270000001b" -> (known after apply)
      - labels                 = {} -> null
      ~ node_group_name        = "regular-2024112415264607270000001b" -> (known after apply)
      ~ release_version        = "1.31.2-20241115" -> (known after apply)
      ~ resources              = [
          - {
              - autoscaling_groups              = [
                  - {
                      - name = "eks-regular-2024112415264607270000001b-12c9af64-288c-45dc-a2cc-27f36a2c775c"
                    },
                ]
              - remote_access_security_group_id = ""
            },
        ] -> (known after apply)
      ~ status                 = "ACTIVE" -> (known after apply)
        tags                   = {
            "Name" = "regular"
        }
        # (7 unchanged attributes hidden)

      ~ launch_template {
            id      = "lt-099de2edeeea863c8"
          ~ name    = "regular-20241124152643442900000017" -> (known after apply)
          ~ version = "2" -> (known after apply)
        }

      - node_repair_config {
          - enabled = true -> null
        }

      ~ scaling_config {
          ~ desired_size = 2 -> 1
            # (2 unchanged attributes hidden)
        }

      ~ update_config {
          - max_unavailable            = 0 -> null
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0] will be updated in-place
  ~ resource "aws_launch_template" "this" {
      ~ default_version         = 2 -> (known after apply)
        id                      = "lt-099de2edeeea863c8"
      ~ latest_version          = 2 -> (known after apply)
        name                    = "regular-20241124152643442900000017"
        tags                    = {}
      ~ vpc_security_group_ids  = [
          - "sg-01e99d583cc16bbd6",
        ] -> (known after apply)
        # (8 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + minified_json             = (known after apply)
      + override_policy_documents = []
      + source_policy_documents   = []

      + statement {
          + actions   = [
              + "kms:*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "Default"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:root",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:CancelKeyDeletion",
              + "kms:Create*",
              + "kms:Delete*",
              + "kms:Describe*",
              + "kms:Disable*",
              + "kms:Enable*",
              + "kms:Get*",
              + "kms:ImportKeyMaterial",
              + "kms:List*",
              + "kms:Put*",
              + "kms:ReplicateKey",
              + "kms:Revoke*",
              + "kms:ScheduleKeyDeletion",
              + "kms:TagResource",
              + "kms:UntagResource",
              + "kms:Update*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyAdministration"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:user/tarashish@developmentseed.org",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:Decrypt",
              + "kms:DescribeKey",
              + "kms:Encrypt",
              + "kms:GenerateDataKey*",
              + "kms:ReEncrypt*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyUsage"

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"] must be replaced
-/+ resource "aws_kms_alias" "this" {
      ~ arn            = "arn:aws:kms:us-east-1:084375562450:alias/eks/zeno-production-cluster" -> (known after apply)
      ~ id             = "alias/eks/zeno-production-cluster" -> (known after apply)
      ~ name           = "alias/eks/zeno-production-cluster" -> "alias/eks/zeno-staging-cluster" # forces replacement
      + name_prefix    = (known after apply)
      ~ target_key_arn = "arn:aws:kms:us-east-1:084375562450:key/8cd9f3d5-f6e1-49ff-a032-da1528c9daa4" -> (known after apply)
        # (1 unchanged attribute hidden)
    }

  # module.resources.module.eks.module.kms.aws_kms_key.this[0] will be updated in-place
  ~ resource "aws_kms_key" "this" {
      ~ description                        = "zeno-production-cluster cluster encryption key" -> "zeno-staging-cluster cluster encryption key"
        id                                 = "8cd9f3d5-f6e1-49ff-a032-da1528c9daa4"
      ~ policy                             = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "kms:*"
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::084375562450:root"
                        }
                      - Resource  = "*"
                      - Sid       = "Default"
                    },
                  - {
                      - Action    = [
                          - "kms:Update*",
                          - "kms:UntagResource",
                          - "kms:TagResource",
                          - "kms:ScheduleKeyDeletion",
                          - "kms:Revoke*",
                          - "kms:ReplicateKey",
                          - "kms:Put*",
                          - "kms:List*",
                          - "kms:ImportKeyMaterial",
                          - "kms:Get*",
                          - "kms:Enable*",
                          - "kms:Disable*",
                          - "kms:Describe*",
                          - "kms:Delete*",
                          - "kms:Create*",
                          - "kms:CancelKeyDeletion",
                        ]
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::084375562450:user/tarashish@developmentseed.org"
                        }
                      - Resource  = "*"
                      - Sid       = "KeyAdministration"
                    },
                  - {
                      - Action    = [
                          - "kms:ReEncrypt*",
                          - "kms:GenerateDataKey*",
                          - "kms:Encrypt",
                          - "kms:DescribeKey",
                          - "kms:Decrypt",
                        ]
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::084375562450:role/zeno-production-cluster-cluster-20241124151456720400000002"
                        }
                      - Resource  = "*"
                      - Sid       = "KeyUsage"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        tags                               = {
            "terraform-aws-modules" = "eks"
        }
        # (10 unchanged attributes hidden)
    }

Plan: 26 to add, 18 to change, 26 to destroy.

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-14T09:25:42Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`success`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.data.aws_availability_zones.available: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]
module.resources.data.aws_db_instance.zeno-db: Read complete after 0s [id=zeno-db]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_eks_addon_version" "this" {
      + addon_name         = "aws-ebs-csi-driver"
      + id                 = (known after apply)
      + kubernetes_version = "1.31"
      + version            = (known after apply)
    }

  # module.resources.module.eks.data.tls_certificate.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "tls_certificate" "this" {
      + certificates = (known after apply)
      + id           = (known after apply)
      + url          = (known after apply)
    }

  # module.resources.module.eks.aws_cloudwatch_log_group.this[0] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "/aws/eks/zeno-staging-cluster/cluster"
      + name_prefix       = (known after apply)
      + retention_in_days = 90
      + skip_destroy      = false
      + tags              = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
      + tags_all          = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
    }

  # module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"] will be created
  + resource "aws_eks_addon" "this" {
      + addon_name                  = "aws-ebs-csi-driver"
      + addon_version               = "v1.40.1-eksbuild.1"
      + arn                         = (known after apply)
      + cluster_name                = "zeno-staging-cluster"
      + configuration_values        = (known after apply)
      + created_at                  = (known after apply)
      + id                          = (known after apply)
      + modified_at                 = (known after apply)
      + preserve                    = true
      + resolve_conflicts_on_create = "OVERWRITE"
      + resolve_conflicts_on_update = "OVERWRITE"
      + tags_all                    = (known after apply)

      + timeouts {}
    }

  # module.resources.module.eks.aws_eks_cluster.this[0] will be created
  + resource "aws_eks_cluster" "this" {
      + arn                           = (known after apply)
      + bootstrap_self_managed_addons = true
      + certificate_authority         = (known after apply)
      + cluster_id                    = (known after apply)
      + created_at                    = (known after apply)
      + enabled_cluster_log_types     = [
          + "api",
          + "audit",
          + "authenticator",
        ]
      + endpoint                      = (known after apply)
      + id                            = (known after apply)
      + identity                      = (known after apply)
      + name                          = "zeno-staging-cluster"
      + platform_version              = (known after apply)
      + role_arn                      = (known after apply)
      + status                        = (known after apply)
      + tags                          = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                      = {
          + "terraform-aws-modules" = "eks"
        }
      + version                       = "1.31"

      + access_config {
          + authentication_mode                         = "API_AND_CONFIG_MAP"
          + bootstrap_cluster_creator_admin_permissions = false
        }

      + encryption_config {
          + resources = [
              + "secrets",
            ]

          + provider {
              + key_arn = (known after apply)
            }
        }

      + kubernetes_network_config {
          + ip_family         = "ipv4"
          + service_ipv4_cidr = (known after apply)
          + service_ipv6_cidr = (known after apply)
        }

      + timeouts {}

      + vpc_config {
          + cluster_security_group_id = (known after apply)
          + endpoint_private_access   = true
          + endpoint_public_access    = true
          + public_access_cidrs       = [
              + "0.0.0.0/0",
            ]
          + security_group_ids        = (known after apply)
          + subnet_ids                = (known after apply)
          + vpc_id                    = (known after apply)
        }
    }

  # module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0] will be created
  + resource "aws_iam_openid_connect_provider" "oidc_provider" {
      + arn             = (known after apply)
      + client_id_list  = [
          + "sts.amazonaws.com",
        ]
      + id              = (known after apply)
      + tags            = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + tags_all        = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + thumbprint_list = (known after apply)
      + url             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_policy.cluster_encryption[0] will be created
  + resource "aws_iam_policy" "cluster_encryption" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + description      = "Cluster encryption policy to allow cluster role to utilize CMK provided"
      + id               = (known after apply)
      + name             = (known after apply)
      + name_prefix      = "zeno-staging-cluster-cluster-ClusterEncryption"
      + path             = "/"
      + policy           = (known after apply)
      + policy_id        = (known after apply)
      + tags_all         = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "eks.amazonaws.com"
                        }
                      + Sid       = "EKSClusterAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "zeno-staging-cluster-cluster-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0] will be created
  + resource "aws_iam_role_policy_attachment" "cluster_encryption" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.cluster[0] will be created
  + resource "aws_security_group" "cluster" {
      + arn                    = (known after apply)
      + description            = "EKS cluster security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-cluster-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + tags_all               = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.node[0] will be created
  + resource "aws_security_group" "node" {
      + arn                    = (known after apply)
      + description            = "EKS node shared security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-node-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + tags_all               = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"] will be created
  + resource "aws_security_group_rule" "cluster" {
      + description              = "Node groups to cluster API"
      + from_port                = 443
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["egress_all"] will be created
  + resource "aws_security_group_rule" "node" {
      + cidr_blocks              = [
          + "0.0.0.0/0",
        ]
      + description              = "Allow all egress"
      + from_port                = 0
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "egress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node groups"
      + from_port                = 443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 4443/tcp webhook"
      + from_port                = 4443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 4443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 6443/tcp webhook"
      + from_port                = 6443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 6443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 8443/tcp webhook"
      + from_port                = 8443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 8443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 9443/tcp webhook"
      + from_port                = 9443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 9443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node kubelets"
      + from_port                = 10250
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 10250
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node ingress on ephemeral ports"
      + from_port                = 1025
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 65535
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS UDP"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "udp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.time_sleep.this[0] will be created
  + resource "time_sleep" "this" {
      + create_duration = "30s"
      + id              = (known after apply)
      + triggers        = {
          + "cluster_certificate_authority_data" = (known after apply)
          + "cluster_endpoint"                   = (known after apply)
          + "cluster_name"                       = "zeno-staging-cluster"
          + "cluster_service_cidr"               = (known after apply)
          + "cluster_version"                    = "1.31"
        }
    }

  # module.resources.module.vpc.aws_default_network_acl.this[0] will be created
  + resource "aws_default_network_acl" "this" {
      + arn                    = (known after apply)
      + default_network_acl_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + egress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + egress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }

      + ingress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + ingress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }
    }

  # module.resources.module.vpc.aws_default_route_table.default[0] will be created
  + resource "aws_default_route_table" "default" {
      + arn                    = (known after apply)
      + default_route_table_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + route                  = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + timeouts {
          + create = "5m"
          + update = "5m"
        }
    }

  # module.resources.module.vpc.aws_default_security_group.this[0] will be created
  + resource "aws_default_security_group" "this" {
      + arn                    = (known after apply)
      + description            = (known after apply)
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.vpc.aws_eip.nat[0] will be created
  + resource "aws_eip" "nat" {
      + allocation_id        = (known after apply)
      + arn                  = (known after apply)
      + association_id       = (known after apply)
      + carrier_ip           = (known after apply)
      + customer_owned_ip    = (known after apply)
      + domain               = "vpc"
      + id                   = (known after apply)
      + instance             = (known after apply)
      + ipam_pool_id         = (known after apply)
      + network_border_group = (known after apply)
      + network_interface    = (known after apply)
      + private_dns          = (known after apply)
      + private_ip           = (known after apply)
      + ptr_record           = (known after apply)
      + public_dns           = (known after apply)
      + public_ip            = (known after apply)
      + public_ipv4_pool     = (known after apply)
      + tags                 = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all             = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + vpc                  = (known after apply)
    }

  # module.resources.module.vpc.aws_internet_gateway.this[0] will be created
  + resource "aws_internet_gateway" "this" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + owner_id = (known after apply)
      + tags     = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all = {
          + "Name" = "vpc-zeno-staging"
        }
      + vpc_id   = (known after apply)
    }

  # module.resources.module.vpc.aws_nat_gateway.this[0] will be created
  + resource "aws_nat_gateway" "this" {
      + allocation_id                      = (known after apply)
      + association_id                     = (known after apply)
      + connectivity_type                  = "public"
      + id                                 = (known after apply)
      + network_interface_id               = (known after apply)
      + private_ip                         = (known after apply)
      + public_ip                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ip_addresses     = (known after apply)
      + subnet_id                          = (known after apply)
      + tags                               = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all                           = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
    }

  # module.resources.module.vpc.aws_route.private_nat_gateway[0] will be created
  + resource "aws_route" "private_nat_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + nat_gateway_id         = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route.public_internet_gateway[0] will be created
  + resource "aws_route" "public_internet_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + gateway_id             = (known after apply)
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route_table.private[0] will be created
  + resource "aws_route_table" "private" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table.public[0] will be created
  + resource "aws_route_table" "public" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[0] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[1] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[2] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[0] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[1] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[2] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[0] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.1.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[1] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.2.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[2] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.3.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[0] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.4.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[1] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.5.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[2] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.6.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_vpc.this[0] will be created
  + resource "aws_vpc" "this" {
      + arn                                  = (known after apply)
      + cidr_block                           = "10.0.0.0/16"
      + default_network_acl_id               = (known after apply)
      + default_route_table_id               = (known after apply)
      + default_security_group_id            = (known after apply)
      + dhcp_options_id                      = (known after apply)
      + enable_dns_hostnames                 = true
      + enable_dns_support                   = true
      + enable_network_address_usage_metrics = (known after apply)
      + id                                   = (known after apply)
      + instance_tenancy                     = "default"
      + ipv6_association_id                  = (known after apply)
      + ipv6_cidr_block                      = (known after apply)
      + ipv6_cidr_block_network_border_group = (known after apply)
      + main_route_table_id                  = (known after apply)
      + owner_id                             = (known after apply)
      + tags                                 = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all                             = {
          + "Name" = "vpc-zeno-staging"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.small",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "default-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "default"
        }
      + tags_all               = {
          + "Name" = "default"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 0
          + max_size     = 1
          + min_size     = 0
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "default-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for default EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "default-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "default"
            }
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.large",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "regular-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "regular"
        }
      + tags_all               = {
          + "Name" = "regular"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 1
          + max_size     = 2
          + min_size     = 1
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "regular-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for regular EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "regular-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "regular"
            }
        }
    }

  # module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + minified_json             = (known after apply)
      + override_policy_documents = []
      + source_policy_documents   = []

      + statement {
          + actions   = [
              + "kms:*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "Default"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:root",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:CancelKeyDeletion",
              + "kms:Create*",
              + "kms:Delete*",
              + "kms:Describe*",
              + "kms:Disable*",
              + "kms:Enable*",
              + "kms:Get*",
              + "kms:ImportKeyMaterial",
              + "kms:List*",
              + "kms:Put*",
              + "kms:ReplicateKey",
              + "kms:Revoke*",
              + "kms:ScheduleKeyDeletion",
              + "kms:TagResource",
              + "kms:UntagResource",
              + "kms:Update*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyAdministration"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:user/tarashish@developmentseed.org",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:Decrypt",
              + "kms:DescribeKey",
              + "kms:Encrypt",
              + "kms:GenerateDataKey*",
              + "kms:ReEncrypt*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyUsage"

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"] will be created
  + resource "aws_kms_alias" "this" {
      + arn            = (known after apply)
      + id             = (known after apply)
      + name           = "alias/eks/zeno-staging-cluster"
      + name_prefix    = (known after apply)
      + target_key_arn = (known after apply)
      + target_key_id  = (known after apply)
    }

  # module.resources.module.eks.module.kms.aws_kms_key.this[0] will be created
  + resource "aws_kms_key" "this" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + description                        = "zeno-staging-cluster cluster encryption key"
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = false
      + policy                             = (known after apply)
      + rotation_period_in_days            = (known after apply)
      + tags                               = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                           = {
          + "terraform-aws-modules" = "eks"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

Plan: 64 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-14T09:31:04Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`success`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.data.aws_availability_zones.available: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.data.aws_caller_identity.current: Read complete after 1s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 1s [id=084375562450]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 1s [id=084375562450]
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 1s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.data.aws_availability_zones.available: Read complete after 1s [id=us-east-1]
module.resources.data.aws_db_instance.zeno-db: Read complete after 1s [id=zeno-db]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_eks_addon_version" "this" {
      + addon_name         = "aws-ebs-csi-driver"
      + id                 = (known after apply)
      + kubernetes_version = "1.31"
      + version            = (known after apply)
    }

  # module.resources.module.eks.data.tls_certificate.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "tls_certificate" "this" {
      + certificates = (known after apply)
      + id           = (known after apply)
      + url          = (known after apply)
    }

  # module.resources.module.eks.aws_cloudwatch_log_group.this[0] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "/aws/eks/zeno-staging-cluster/cluster"
      + name_prefix       = (known after apply)
      + retention_in_days = 90
      + skip_destroy      = false
      + tags              = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
      + tags_all          = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
    }

  # module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"] will be created
  + resource "aws_eks_addon" "this" {
      + addon_name                  = "aws-ebs-csi-driver"
      + addon_version               = "v1.40.1-eksbuild.1"
      + arn                         = (known after apply)
      + cluster_name                = "zeno-staging-cluster"
      + configuration_values        = (known after apply)
      + created_at                  = (known after apply)
      + id                          = (known after apply)
      + modified_at                 = (known after apply)
      + preserve                    = true
      + resolve_conflicts_on_create = "OVERWRITE"
      + resolve_conflicts_on_update = "OVERWRITE"
      + tags_all                    = (known after apply)

      + timeouts {}
    }

  # module.resources.module.eks.aws_eks_cluster.this[0] will be created
  + resource "aws_eks_cluster" "this" {
      + arn                           = (known after apply)
      + bootstrap_self_managed_addons = true
      + certificate_authority         = (known after apply)
      + cluster_id                    = (known after apply)
      + created_at                    = (known after apply)
      + enabled_cluster_log_types     = [
          + "api",
          + "audit",
          + "authenticator",
        ]
      + endpoint                      = (known after apply)
      + id                            = (known after apply)
      + identity                      = (known after apply)
      + name                          = "zeno-staging-cluster"
      + platform_version              = (known after apply)
      + role_arn                      = (known after apply)
      + status                        = (known after apply)
      + tags                          = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                      = {
          + "terraform-aws-modules" = "eks"
        }
      + version                       = "1.31"

      + access_config {
          + authentication_mode                         = "API_AND_CONFIG_MAP"
          + bootstrap_cluster_creator_admin_permissions = false
        }

      + encryption_config {
          + resources = [
              + "secrets",
            ]

          + provider {
              + key_arn = (known after apply)
            }
        }

      + kubernetes_network_config {
          + ip_family         = "ipv4"
          + service_ipv4_cidr = (known after apply)
          + service_ipv6_cidr = (known after apply)
        }

      + timeouts {}

      + vpc_config {
          + cluster_security_group_id = (known after apply)
          + endpoint_private_access   = true
          + endpoint_public_access    = true
          + public_access_cidrs       = [
              + "0.0.0.0/0",
            ]
          + security_group_ids        = (known after apply)
          + subnet_ids                = (known after apply)
          + vpc_id                    = (known after apply)
        }
    }

  # module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0] will be created
  + resource "aws_iam_openid_connect_provider" "oidc_provider" {
      + arn             = (known after apply)
      + client_id_list  = [
          + "sts.amazonaws.com",
        ]
      + id              = (known after apply)
      + tags            = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + tags_all        = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + thumbprint_list = (known after apply)
      + url             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_policy.cluster_encryption[0] will be created
  + resource "aws_iam_policy" "cluster_encryption" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + description      = "Cluster encryption policy to allow cluster role to utilize CMK provided"
      + id               = (known after apply)
      + name             = (known after apply)
      + name_prefix      = "zeno-staging-cluster-cluster-ClusterEncryption"
      + path             = "/"
      + policy           = (known after apply)
      + policy_id        = (known after apply)
      + tags_all         = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "eks.amazonaws.com"
                        }
                      + Sid       = "EKSClusterAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "zeno-staging-cluster-cluster-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0] will be created
  + resource "aws_iam_role_policy_attachment" "cluster_encryption" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.cluster[0] will be created
  + resource "aws_security_group" "cluster" {
      + arn                    = (known after apply)
      + description            = "EKS cluster security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-cluster-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + tags_all               = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.node[0] will be created
  + resource "aws_security_group" "node" {
      + arn                    = (known after apply)
      + description            = "EKS node shared security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-node-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + tags_all               = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"] will be created
  + resource "aws_security_group_rule" "cluster" {
      + description              = "Node groups to cluster API"
      + from_port                = 443
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["egress_all"] will be created
  + resource "aws_security_group_rule" "node" {
      + cidr_blocks              = [
          + "0.0.0.0/0",
        ]
      + description              = "Allow all egress"
      + from_port                = 0
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "egress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node groups"
      + from_port                = 443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 4443/tcp webhook"
      + from_port                = 4443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 4443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 6443/tcp webhook"
      + from_port                = 6443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 6443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 8443/tcp webhook"
      + from_port                = 8443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 8443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 9443/tcp webhook"
      + from_port                = 9443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 9443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node kubelets"
      + from_port                = 10250
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 10250
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node ingress on ephemeral ports"
      + from_port                = 1025
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 65535
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS UDP"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "udp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.time_sleep.this[0] will be created
  + resource "time_sleep" "this" {
      + create_duration = "30s"
      + id              = (known after apply)
      + triggers        = {
          + "cluster_certificate_authority_data" = (known after apply)
          + "cluster_endpoint"                   = (known after apply)
          + "cluster_name"                       = "zeno-staging-cluster"
          + "cluster_service_cidr"               = (known after apply)
          + "cluster_version"                    = "1.31"
        }
    }

  # module.resources.module.vpc.aws_default_network_acl.this[0] will be created
  + resource "aws_default_network_acl" "this" {
      + arn                    = (known after apply)
      + default_network_acl_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + egress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + egress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }

      + ingress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + ingress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }
    }

  # module.resources.module.vpc.aws_default_route_table.default[0] will be created
  + resource "aws_default_route_table" "default" {
      + arn                    = (known after apply)
      + default_route_table_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + route                  = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + timeouts {
          + create = "5m"
          + update = "5m"
        }
    }

  # module.resources.module.vpc.aws_default_security_group.this[0] will be created
  + resource "aws_default_security_group" "this" {
      + arn                    = (known after apply)
      + description            = (known after apply)
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.vpc.aws_eip.nat[0] will be created
  + resource "aws_eip" "nat" {
      + allocation_id        = (known after apply)
      + arn                  = (known after apply)
      + association_id       = (known after apply)
      + carrier_ip           = (known after apply)
      + customer_owned_ip    = (known after apply)
      + domain               = "vpc"
      + id                   = (known after apply)
      + instance             = (known after apply)
      + ipam_pool_id         = (known after apply)
      + network_border_group = (known after apply)
      + network_interface    = (known after apply)
      + private_dns          = (known after apply)
      + private_ip           = (known after apply)
      + ptr_record           = (known after apply)
      + public_dns           = (known after apply)
      + public_ip            = (known after apply)
      + public_ipv4_pool     = (known after apply)
      + tags                 = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all             = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + vpc                  = (known after apply)
    }

  # module.resources.module.vpc.aws_internet_gateway.this[0] will be created
  + resource "aws_internet_gateway" "this" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + owner_id = (known after apply)
      + tags     = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all = {
          + "Name" = "vpc-zeno-staging"
        }
      + vpc_id   = (known after apply)
    }

  # module.resources.module.vpc.aws_nat_gateway.this[0] will be created
  + resource "aws_nat_gateway" "this" {
      + allocation_id                      = (known after apply)
      + association_id                     = (known after apply)
      + connectivity_type                  = "public"
      + id                                 = (known after apply)
      + network_interface_id               = (known after apply)
      + private_ip                         = (known after apply)
      + public_ip                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ip_addresses     = (known after apply)
      + subnet_id                          = (known after apply)
      + tags                               = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all                           = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
    }

  # module.resources.module.vpc.aws_route.private_nat_gateway[0] will be created
  + resource "aws_route" "private_nat_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + nat_gateway_id         = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route.public_internet_gateway[0] will be created
  + resource "aws_route" "public_internet_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + gateway_id             = (known after apply)
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route_table.private[0] will be created
  + resource "aws_route_table" "private" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table.public[0] will be created
  + resource "aws_route_table" "public" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[0] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[1] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[2] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[0] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[1] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[2] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[0] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.1.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[1] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.2.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[2] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.3.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[0] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.4.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[1] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.5.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[2] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.6.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_vpc.this[0] will be created
  + resource "aws_vpc" "this" {
      + arn                                  = (known after apply)
      + cidr_block                           = "10.0.0.0/16"
      + default_network_acl_id               = (known after apply)
      + default_route_table_id               = (known after apply)
      + default_security_group_id            = (known after apply)
      + dhcp_options_id                      = (known after apply)
      + enable_dns_hostnames                 = true
      + enable_dns_support                   = true
      + enable_network_address_usage_metrics = (known after apply)
      + id                                   = (known after apply)
      + instance_tenancy                     = "default"
      + ipv6_association_id                  = (known after apply)
      + ipv6_cidr_block                      = (known after apply)
      + ipv6_cidr_block_network_border_group = (known after apply)
      + main_route_table_id                  = (known after apply)
      + owner_id                             = (known after apply)
      + tags                                 = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all                             = {
          + "Name" = "vpc-zeno-staging"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.small",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "default-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "default"
        }
      + tags_all               = {
          + "Name" = "default"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 0
          + max_size     = 1
          + min_size     = 0
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "default-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for default EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "default-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "default"
            }
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.large",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "regular-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "regular"
        }
      + tags_all               = {
          + "Name" = "regular"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 1
          + max_size     = 2
          + min_size     = 1
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "regular-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for regular EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "regular-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "regular"
            }
        }
    }

  # module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + minified_json             = (known after apply)
      + override_policy_documents = []
      + source_policy_documents   = []

      + statement {
          + actions   = [
              + "kms:*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "Default"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:root",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:CancelKeyDeletion",
              + "kms:Create*",
              + "kms:Delete*",
              + "kms:Describe*",
              + "kms:Disable*",
              + "kms:Enable*",
              + "kms:Get*",
              + "kms:ImportKeyMaterial",
              + "kms:List*",
              + "kms:Put*",
              + "kms:ReplicateKey",
              + "kms:Revoke*",
              + "kms:ScheduleKeyDeletion",
              + "kms:TagResource",
              + "kms:UntagResource",
              + "kms:Update*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyAdministration"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:user/tarashish@developmentseed.org",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:Decrypt",
              + "kms:DescribeKey",
              + "kms:Encrypt",
              + "kms:GenerateDataKey*",
              + "kms:ReEncrypt*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyUsage"

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"] will be created
  + resource "aws_kms_alias" "this" {
      + arn            = (known after apply)
      + id             = (known after apply)
      + name           = "alias/eks/zeno-staging-cluster"
      + name_prefix    = (known after apply)
      + target_key_arn = (known after apply)
      + target_key_id  = (known after apply)
    }

  # module.resources.module.eks.module.kms.aws_kms_key.this[0] will be created
  + resource "aws_kms_key" "this" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + description                        = "zeno-staging-cluster cluster encryption key"
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = false
      + policy                             = (known after apply)
      + rotation_period_in_days            = (known after apply)
      + tags                               = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                           = {
          + "terraform-aws-modules" = "eks"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

Plan: 64 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-14T09:41:03Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`success`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.data.aws_availability_zones.available: Reading...
module.resources.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]
module.resources.data.aws_db_instance.zeno-db: Read complete after 0s [id=zeno-db]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_eks_addon_version" "this" {
      + addon_name         = "aws-ebs-csi-driver"
      + id                 = (known after apply)
      + kubernetes_version = "1.31"
      + version            = (known after apply)
    }

  # module.resources.module.eks.data.tls_certificate.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "tls_certificate" "this" {
      + certificates = (known after apply)
      + id           = (known after apply)
      + url          = (known after apply)
    }

  # module.resources.module.eks.aws_cloudwatch_log_group.this[0] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "/aws/eks/zeno-staging-cluster/cluster"
      + name_prefix       = (known after apply)
      + retention_in_days = 90
      + skip_destroy      = false
      + tags              = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
      + tags_all          = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
    }

  # module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"] will be created
  + resource "aws_eks_addon" "this" {
      + addon_name                  = "aws-ebs-csi-driver"
      + addon_version               = "v1.40.1-eksbuild.1"
      + arn                         = (known after apply)
      + cluster_name                = "zeno-staging-cluster"
      + configuration_values        = (known after apply)
      + created_at                  = (known after apply)
      + id                          = (known after apply)
      + modified_at                 = (known after apply)
      + preserve                    = true
      + resolve_conflicts_on_create = "OVERWRITE"
      + resolve_conflicts_on_update = "OVERWRITE"
      + tags_all                    = (known after apply)

      + timeouts {}
    }

  # module.resources.module.eks.aws_eks_cluster.this[0] will be created
  + resource "aws_eks_cluster" "this" {
      + arn                           = (known after apply)
      + bootstrap_self_managed_addons = true
      + certificate_authority         = (known after apply)
      + cluster_id                    = (known after apply)
      + created_at                    = (known after apply)
      + enabled_cluster_log_types     = [
          + "api",
          + "audit",
          + "authenticator",
        ]
      + endpoint                      = (known after apply)
      + id                            = (known after apply)
      + identity                      = (known after apply)
      + name                          = "zeno-staging-cluster"
      + platform_version              = (known after apply)
      + role_arn                      = (known after apply)
      + status                        = (known after apply)
      + tags                          = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                      = {
          + "terraform-aws-modules" = "eks"
        }
      + version                       = "1.31"

      + access_config {
          + authentication_mode                         = "API_AND_CONFIG_MAP"
          + bootstrap_cluster_creator_admin_permissions = false
        }

      + encryption_config {
          + resources = [
              + "secrets",
            ]

          + provider {
              + key_arn = (known after apply)
            }
        }

      + kubernetes_network_config {
          + ip_family         = "ipv4"
          + service_ipv4_cidr = (known after apply)
          + service_ipv6_cidr = (known after apply)
        }

      + timeouts {}

      + vpc_config {
          + cluster_security_group_id = (known after apply)
          + endpoint_private_access   = true
          + endpoint_public_access    = true
          + public_access_cidrs       = [
              + "0.0.0.0/0",
            ]
          + security_group_ids        = (known after apply)
          + subnet_ids                = (known after apply)
          + vpc_id                    = (known after apply)
        }
    }

  # module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0] will be created
  + resource "aws_iam_openid_connect_provider" "oidc_provider" {
      + arn             = (known after apply)
      + client_id_list  = [
          + "sts.amazonaws.com",
        ]
      + id              = (known after apply)
      + tags            = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + tags_all        = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + thumbprint_list = (known after apply)
      + url             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_policy.cluster_encryption[0] will be created
  + resource "aws_iam_policy" "cluster_encryption" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + description      = "Cluster encryption policy to allow cluster role to utilize CMK provided"
      + id               = (known after apply)
      + name             = (known after apply)
      + name_prefix      = "zeno-staging-cluster-cluster-ClusterEncryption"
      + path             = "/"
      + policy           = (known after apply)
      + policy_id        = (known after apply)
      + tags_all         = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "eks.amazonaws.com"
                        }
                      + Sid       = "EKSClusterAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "zeno-staging-cluster-cluster-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0] will be created
  + resource "aws_iam_role_policy_attachment" "cluster_encryption" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.cluster[0] will be created
  + resource "aws_security_group" "cluster" {
      + arn                    = (known after apply)
      + description            = "EKS cluster security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-cluster-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + tags_all               = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.node[0] will be created
  + resource "aws_security_group" "node" {
      + arn                    = (known after apply)
      + description            = "EKS node shared security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-node-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + tags_all               = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"] will be created
  + resource "aws_security_group_rule" "cluster" {
      + description              = "Node groups to cluster API"
      + from_port                = 443
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["egress_all"] will be created
  + resource "aws_security_group_rule" "node" {
      + cidr_blocks              = [
          + "0.0.0.0/0",
        ]
      + description              = "Allow all egress"
      + from_port                = 0
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "egress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node groups"
      + from_port                = 443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 4443/tcp webhook"
      + from_port                = 4443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 4443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 6443/tcp webhook"
      + from_port                = 6443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 6443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 8443/tcp webhook"
      + from_port                = 8443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 8443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 9443/tcp webhook"
      + from_port                = 9443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 9443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node kubelets"
      + from_port                = 10250
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 10250
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node ingress on ephemeral ports"
      + from_port                = 1025
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 65535
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS UDP"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "udp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.time_sleep.this[0] will be created
  + resource "time_sleep" "this" {
      + create_duration = "30s"
      + id              = (known after apply)
      + triggers        = {
          + "cluster_certificate_authority_data" = (known after apply)
          + "cluster_endpoint"                   = (known after apply)
          + "cluster_name"                       = "zeno-staging-cluster"
          + "cluster_service_cidr"               = (known after apply)
          + "cluster_version"                    = "1.31"
        }
    }

  # module.resources.module.vpc.aws_default_network_acl.this[0] will be created
  + resource "aws_default_network_acl" "this" {
      + arn                    = (known after apply)
      + default_network_acl_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + egress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + egress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }

      + ingress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + ingress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }
    }

  # module.resources.module.vpc.aws_default_route_table.default[0] will be created
  + resource "aws_default_route_table" "default" {
      + arn                    = (known after apply)
      + default_route_table_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + route                  = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + timeouts {
          + create = "5m"
          + update = "5m"
        }
    }

  # module.resources.module.vpc.aws_default_security_group.this[0] will be created
  + resource "aws_default_security_group" "this" {
      + arn                    = (known after apply)
      + description            = (known after apply)
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.vpc.aws_eip.nat[0] will be created
  + resource "aws_eip" "nat" {
      + allocation_id        = (known after apply)
      + arn                  = (known after apply)
      + association_id       = (known after apply)
      + carrier_ip           = (known after apply)
      + customer_owned_ip    = (known after apply)
      + domain               = "vpc"
      + id                   = (known after apply)
      + instance             = (known after apply)
      + ipam_pool_id         = (known after apply)
      + network_border_group = (known after apply)
      + network_interface    = (known after apply)
      + private_dns          = (known after apply)
      + private_ip           = (known after apply)
      + ptr_record           = (known after apply)
      + public_dns           = (known after apply)
      + public_ip            = (known after apply)
      + public_ipv4_pool     = (known after apply)
      + tags                 = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all             = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + vpc                  = (known after apply)
    }

  # module.resources.module.vpc.aws_internet_gateway.this[0] will be created
  + resource "aws_internet_gateway" "this" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + owner_id = (known after apply)
      + tags     = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all = {
          + "Name" = "vpc-zeno-staging"
        }
      + vpc_id   = (known after apply)
    }

  # module.resources.module.vpc.aws_nat_gateway.this[0] will be created
  + resource "aws_nat_gateway" "this" {
      + allocation_id                      = (known after apply)
      + association_id                     = (known after apply)
      + connectivity_type                  = "public"
      + id                                 = (known after apply)
      + network_interface_id               = (known after apply)
      + private_ip                         = (known after apply)
      + public_ip                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ip_addresses     = (known after apply)
      + subnet_id                          = (known after apply)
      + tags                               = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all                           = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
    }

  # module.resources.module.vpc.aws_route.private_nat_gateway[0] will be created
  + resource "aws_route" "private_nat_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + nat_gateway_id         = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route.public_internet_gateway[0] will be created
  + resource "aws_route" "public_internet_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + gateway_id             = (known after apply)
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route_table.private[0] will be created
  + resource "aws_route_table" "private" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table.public[0] will be created
  + resource "aws_route_table" "public" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[0] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[1] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[2] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[0] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[1] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[2] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[0] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.1.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[1] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.2.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[2] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.3.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[0] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.4.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[1] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.5.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[2] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.6.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_vpc.this[0] will be created
  + resource "aws_vpc" "this" {
      + arn                                  = (known after apply)
      + cidr_block                           = "10.0.0.0/16"
      + default_network_acl_id               = (known after apply)
      + default_route_table_id               = (known after apply)
      + default_security_group_id            = (known after apply)
      + dhcp_options_id                      = (known after apply)
      + enable_dns_hostnames                 = true
      + enable_dns_support                   = true
      + enable_network_address_usage_metrics = (known after apply)
      + id                                   = (known after apply)
      + instance_tenancy                     = "default"
      + ipv6_association_id                  = (known after apply)
      + ipv6_cidr_block                      = (known after apply)
      + ipv6_cidr_block_network_border_group = (known after apply)
      + main_route_table_id                  = (known after apply)
      + owner_id                             = (known after apply)
      + tags                                 = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all                             = {
          + "Name" = "vpc-zeno-staging"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.small",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "default-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "default"
        }
      + tags_all               = {
          + "Name" = "default"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 0
          + max_size     = 1
          + min_size     = 0
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "default-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for default EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "default-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "default"
            }
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.large",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "regular-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "regular"
        }
      + tags_all               = {
          + "Name" = "regular"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 1
          + max_size     = 2
          + min_size     = 1
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "regular-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for regular EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "regular-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "regular"
            }
        }
    }

  # module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + minified_json             = (known after apply)
      + override_policy_documents = []
      + source_policy_documents   = []

      + statement {
          + actions   = [
              + "kms:*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "Default"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:root",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:CancelKeyDeletion",
              + "kms:Create*",
              + "kms:Delete*",
              + "kms:Describe*",
              + "kms:Disable*",
              + "kms:Enable*",
              + "kms:Get*",
              + "kms:ImportKeyMaterial",
              + "kms:List*",
              + "kms:Put*",
              + "kms:ReplicateKey",
              + "kms:Revoke*",
              + "kms:ScheduleKeyDeletion",
              + "kms:TagResource",
              + "kms:UntagResource",
              + "kms:Update*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyAdministration"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:user/tarashish@developmentseed.org",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:Decrypt",
              + "kms:DescribeKey",
              + "kms:Encrypt",
              + "kms:GenerateDataKey*",
              + "kms:ReEncrypt*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyUsage"

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"] will be created
  + resource "aws_kms_alias" "this" {
      + arn            = (known after apply)
      + id             = (known after apply)
      + name           = "alias/eks/zeno-staging-cluster"
      + name_prefix    = (known after apply)
      + target_key_arn = (known after apply)
      + target_key_id  = (known after apply)
    }

  # module.resources.module.eks.module.kms.aws_kms_key.this[0] will be created
  + resource "aws_kms_key" "this" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + description                        = "zeno-staging-cluster cluster encryption key"
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = false
      + policy                             = (known after apply)
      + rotation_period_in_days            = (known after apply)
      + tags                               = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                           = {
          + "terraform-aws-modules" = "eks"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

Plan: 64 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-14T09:43:18Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`success`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.data.aws_availability_zones.available: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]
module.resources.data.aws_db_instance.zeno-db: Read complete after 0s [id=zeno-db]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_eks_addon_version" "this" {
      + addon_name         = "aws-ebs-csi-driver"
      + id                 = (known after apply)
      + kubernetes_version = "1.31"
      + version            = (known after apply)
    }

  # module.resources.module.eks.data.tls_certificate.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "tls_certificate" "this" {
      + certificates = (known after apply)
      + id           = (known after apply)
      + url          = (known after apply)
    }

  # module.resources.module.eks.aws_cloudwatch_log_group.this[0] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "/aws/eks/zeno-staging-cluster/cluster"
      + name_prefix       = (known after apply)
      + retention_in_days = 90
      + skip_destroy      = false
      + tags              = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
      + tags_all          = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
    }

  # module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"] will be created
  + resource "aws_eks_addon" "this" {
      + addon_name                  = "aws-ebs-csi-driver"
      + addon_version               = "v1.40.1-eksbuild.1"
      + arn                         = (known after apply)
      + cluster_name                = "zeno-staging-cluster"
      + configuration_values        = (known after apply)
      + created_at                  = (known after apply)
      + id                          = (known after apply)
      + modified_at                 = (known after apply)
      + preserve                    = true
      + resolve_conflicts_on_create = "OVERWRITE"
      + resolve_conflicts_on_update = "OVERWRITE"
      + tags_all                    = (known after apply)

      + timeouts {}
    }

  # module.resources.module.eks.aws_eks_cluster.this[0] will be created
  + resource "aws_eks_cluster" "this" {
      + arn                           = (known after apply)
      + bootstrap_self_managed_addons = true
      + certificate_authority         = (known after apply)
      + cluster_id                    = (known after apply)
      + created_at                    = (known after apply)
      + enabled_cluster_log_types     = [
          + "api",
          + "audit",
          + "authenticator",
        ]
      + endpoint                      = (known after apply)
      + id                            = (known after apply)
      + identity                      = (known after apply)
      + name                          = "zeno-staging-cluster"
      + platform_version              = (known after apply)
      + role_arn                      = (known after apply)
      + status                        = (known after apply)
      + tags                          = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                      = {
          + "terraform-aws-modules" = "eks"
        }
      + version                       = "1.31"

      + access_config {
          + authentication_mode                         = "API_AND_CONFIG_MAP"
          + bootstrap_cluster_creator_admin_permissions = false
        }

      + encryption_config {
          + resources = [
              + "secrets",
            ]

          + provider {
              + key_arn = (known after apply)
            }
        }

      + kubernetes_network_config {
          + ip_family         = "ipv4"
          + service_ipv4_cidr = (known after apply)
          + service_ipv6_cidr = (known after apply)
        }

      + timeouts {}

      + vpc_config {
          + cluster_security_group_id = (known after apply)
          + endpoint_private_access   = true
          + endpoint_public_access    = true
          + public_access_cidrs       = [
              + "0.0.0.0/0",
            ]
          + security_group_ids        = (known after apply)
          + subnet_ids                = (known after apply)
          + vpc_id                    = (known after apply)
        }
    }

  # module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0] will be created
  + resource "aws_iam_openid_connect_provider" "oidc_provider" {
      + arn             = (known after apply)
      + client_id_list  = [
          + "sts.amazonaws.com",
        ]
      + id              = (known after apply)
      + tags            = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + tags_all        = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + thumbprint_list = (known after apply)
      + url             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_policy.cluster_encryption[0] will be created
  + resource "aws_iam_policy" "cluster_encryption" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + description      = "Cluster encryption policy to allow cluster role to utilize CMK provided"
      + id               = (known after apply)
      + name             = (known after apply)
      + name_prefix      = "zeno-staging-cluster-cluster-ClusterEncryption"
      + path             = "/"
      + policy           = (known after apply)
      + policy_id        = (known after apply)
      + tags_all         = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "eks.amazonaws.com"
                        }
                      + Sid       = "EKSClusterAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "zeno-staging-cluster-cluster-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0] will be created
  + resource "aws_iam_role_policy_attachment" "cluster_encryption" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.cluster[0] will be created
  + resource "aws_security_group" "cluster" {
      + arn                    = (known after apply)
      + description            = "EKS cluster security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-cluster-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + tags_all               = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.node[0] will be created
  + resource "aws_security_group" "node" {
      + arn                    = (known after apply)
      + description            = "EKS node shared security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-node-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + tags_all               = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"] will be created
  + resource "aws_security_group_rule" "cluster" {
      + description              = "Node groups to cluster API"
      + from_port                = 443
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["egress_all"] will be created
  + resource "aws_security_group_rule" "node" {
      + cidr_blocks              = [
          + "0.0.0.0/0",
        ]
      + description              = "Allow all egress"
      + from_port                = 0
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "egress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node groups"
      + from_port                = 443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 4443/tcp webhook"
      + from_port                = 4443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 4443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 6443/tcp webhook"
      + from_port                = 6443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 6443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 8443/tcp webhook"
      + from_port                = 8443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 8443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 9443/tcp webhook"
      + from_port                = 9443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 9443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node kubelets"
      + from_port                = 10250
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 10250
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node ingress on ephemeral ports"
      + from_port                = 1025
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 65535
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS UDP"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "udp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.time_sleep.this[0] will be created
  + resource "time_sleep" "this" {
      + create_duration = "30s"
      + id              = (known after apply)
      + triggers        = {
          + "cluster_certificate_authority_data" = (known after apply)
          + "cluster_endpoint"                   = (known after apply)
          + "cluster_name"                       = "zeno-staging-cluster"
          + "cluster_service_cidr"               = (known after apply)
          + "cluster_version"                    = "1.31"
        }
    }

  # module.resources.module.vpc.aws_default_network_acl.this[0] will be created
  + resource "aws_default_network_acl" "this" {
      + arn                    = (known after apply)
      + default_network_acl_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + egress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + egress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }

      + ingress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + ingress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }
    }

  # module.resources.module.vpc.aws_default_route_table.default[0] will be created
  + resource "aws_default_route_table" "default" {
      + arn                    = (known after apply)
      + default_route_table_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + route                  = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + timeouts {
          + create = "5m"
          + update = "5m"
        }
    }

  # module.resources.module.vpc.aws_default_security_group.this[0] will be created
  + resource "aws_default_security_group" "this" {
      + arn                    = (known after apply)
      + description            = (known after apply)
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.vpc.aws_eip.nat[0] will be created
  + resource "aws_eip" "nat" {
      + allocation_id        = (known after apply)
      + arn                  = (known after apply)
      + association_id       = (known after apply)
      + carrier_ip           = (known after apply)
      + customer_owned_ip    = (known after apply)
      + domain               = "vpc"
      + id                   = (known after apply)
      + instance             = (known after apply)
      + ipam_pool_id         = (known after apply)
      + network_border_group = (known after apply)
      + network_interface    = (known after apply)
      + private_dns          = (known after apply)
      + private_ip           = (known after apply)
      + ptr_record           = (known after apply)
      + public_dns           = (known after apply)
      + public_ip            = (known after apply)
      + public_ipv4_pool     = (known after apply)
      + tags                 = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all             = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + vpc                  = (known after apply)
    }

  # module.resources.module.vpc.aws_internet_gateway.this[0] will be created
  + resource "aws_internet_gateway" "this" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + owner_id = (known after apply)
      + tags     = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all = {
          + "Name" = "vpc-zeno-staging"
        }
      + vpc_id   = (known after apply)
    }

  # module.resources.module.vpc.aws_nat_gateway.this[0] will be created
  + resource "aws_nat_gateway" "this" {
      + allocation_id                      = (known after apply)
      + association_id                     = (known after apply)
      + connectivity_type                  = "public"
      + id                                 = (known after apply)
      + network_interface_id               = (known after apply)
      + private_ip                         = (known after apply)
      + public_ip                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ip_addresses     = (known after apply)
      + subnet_id                          = (known after apply)
      + tags                               = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all                           = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
    }

  # module.resources.module.vpc.aws_route.private_nat_gateway[0] will be created
  + resource "aws_route" "private_nat_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + nat_gateway_id         = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route.public_internet_gateway[0] will be created
  + resource "aws_route" "public_internet_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + gateway_id             = (known after apply)
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route_table.private[0] will be created
  + resource "aws_route_table" "private" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table.public[0] will be created
  + resource "aws_route_table" "public" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[0] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[1] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[2] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[0] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[1] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[2] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[0] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.1.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[1] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.2.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[2] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.3.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[0] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.4.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[1] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.5.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[2] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.6.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_vpc.this[0] will be created
  + resource "aws_vpc" "this" {
      + arn                                  = (known after apply)
      + cidr_block                           = "10.0.0.0/16"
      + default_network_acl_id               = (known after apply)
      + default_route_table_id               = (known after apply)
      + default_security_group_id            = (known after apply)
      + dhcp_options_id                      = (known after apply)
      + enable_dns_hostnames                 = true
      + enable_dns_support                   = true
      + enable_network_address_usage_metrics = (known after apply)
      + id                                   = (known after apply)
      + instance_tenancy                     = "default"
      + ipv6_association_id                  = (known after apply)
      + ipv6_cidr_block                      = (known after apply)
      + ipv6_cidr_block_network_border_group = (known after apply)
      + main_route_table_id                  = (known after apply)
      + owner_id                             = (known after apply)
      + tags                                 = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all                             = {
          + "Name" = "vpc-zeno-staging"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.small",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "default-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "default"
        }
      + tags_all               = {
          + "Name" = "default"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 0
          + max_size     = 1
          + min_size     = 0
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "default-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for default EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "default-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "default"
            }
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.large",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "regular-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "regular"
        }
      + tags_all               = {
          + "Name" = "regular"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 1
          + max_size     = 2
          + min_size     = 1
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "regular-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for regular EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "regular-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "regular"
            }
        }
    }

  # module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + minified_json             = (known after apply)
      + override_policy_documents = []
      + source_policy_documents   = []

      + statement {
          + actions   = [
              + "kms:*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "Default"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:root",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:CancelKeyDeletion",
              + "kms:Create*",
              + "kms:Delete*",
              + "kms:Describe*",
              + "kms:Disable*",
              + "kms:Enable*",
              + "kms:Get*",
              + "kms:ImportKeyMaterial",
              + "kms:List*",
              + "kms:Put*",
              + "kms:ReplicateKey",
              + "kms:Revoke*",
              + "kms:ScheduleKeyDeletion",
              + "kms:TagResource",
              + "kms:UntagResource",
              + "kms:Update*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyAdministration"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:user/tarashish@developmentseed.org",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:Decrypt",
              + "kms:DescribeKey",
              + "kms:Encrypt",
              + "kms:GenerateDataKey*",
              + "kms:ReEncrypt*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyUsage"

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"] will be created
  + resource "aws_kms_alias" "this" {
      + arn            = (known after apply)
      + id             = (known after apply)
      + name           = "alias/eks/zeno-staging-cluster"
      + name_prefix    = (known after apply)
      + target_key_arn = (known after apply)
      + target_key_id  = (known after apply)
    }

  # module.resources.module.eks.module.kms.aws_kms_key.this[0] will be created
  + resource "aws_kms_key" "this" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + description                        = "zeno-staging-cluster cluster encryption key"
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = false
      + policy                             = (known after apply)
      + rotation_period_in_days            = (known after apply)
      + tags                               = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                           = {
          + "terraform-aws-modules" = "eks"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

Plan: 64 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: batpad
created_at: 2025-04-14T09:54:51Z
body: I think this is close to ready to go, but because of the previous setup, we will have to do a little dance when deploying to production:

 - Move the `kubeconfig` step back up before the terraform steps
 - Comment back in the helm provider config in `providers.tf` and `helm.tf`
 - Do one merge / deploy to production so that the helm provider stuff is correctly read so that terraform is able to cleanup the existing helm resources that were managed by terraform.
 - Once one deploy to production is done, we can revert the changes to comment out the helm providers stuff and move the `kubeconfig` step to where it is now.
 
 @sunu would need your 👀 and sanity check on this, and I think I will wait for you to be around before attempting to merge / deploy these changes.

After we merge this, I think I can quite quickly work on consolidating everything into a single helm chart with dependencies, so we reduce the sprawl of `values` files, etc.


author_association: COLLABORATOR
user: login: github-actions[bot]
created_at: 2025-04-16T09:43:10Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`success`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.data.aws_availability_zones.available: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]
module.resources.data.aws_db_instance.zeno-db: Read complete after 0s [id=zeno-db]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_eks_addon_version" "this" {
      + addon_name         = "aws-ebs-csi-driver"
      + id                 = (known after apply)
      + kubernetes_version = "1.31"
      + version            = (known after apply)
    }

  # module.resources.module.eks.data.tls_certificate.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "tls_certificate" "this" {
      + certificates = (known after apply)
      + id           = (known after apply)
      + url          = (known after apply)
    }

  # module.resources.module.eks.aws_cloudwatch_log_group.this[0] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "/aws/eks/zeno-staging-cluster/cluster"
      + name_prefix       = (known after apply)
      + retention_in_days = 90
      + skip_destroy      = false
      + tags              = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
      + tags_all          = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
    }

  # module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"] will be created
  + resource "aws_eks_addon" "this" {
      + addon_name                  = "aws-ebs-csi-driver"
      + addon_version               = "v1.40.1-eksbuild.1"
      + arn                         = (known after apply)
      + cluster_name                = "zeno-staging-cluster"
      + configuration_values        = (known after apply)
      + created_at                  = (known after apply)
      + id                          = (known after apply)
      + modified_at                 = (known after apply)
      + preserve                    = true
      + resolve_conflicts_on_create = "OVERWRITE"
      + resolve_conflicts_on_update = "OVERWRITE"
      + tags_all                    = (known after apply)

      + timeouts {}
    }

  # module.resources.module.eks.aws_eks_cluster.this[0] will be created
  + resource "aws_eks_cluster" "this" {
      + arn                           = (known after apply)
      + bootstrap_self_managed_addons = true
      + certificate_authority         = (known after apply)
      + cluster_id                    = (known after apply)
      + created_at                    = (known after apply)
      + enabled_cluster_log_types     = [
          + "api",
          + "audit",
          + "authenticator",
        ]
      + endpoint                      = (known after apply)
      + id                            = (known after apply)
      + identity                      = (known after apply)
      + name                          = "zeno-staging-cluster"
      + platform_version              = (known after apply)
      + role_arn                      = (known after apply)
      + status                        = (known after apply)
      + tags                          = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                      = {
          + "terraform-aws-modules" = "eks"
        }
      + version                       = "1.31"

      + access_config {
          + authentication_mode                         = "API_AND_CONFIG_MAP"
          + bootstrap_cluster_creator_admin_permissions = false
        }

      + encryption_config {
          + resources = [
              + "secrets",
            ]

          + provider {
              + key_arn = (known after apply)
            }
        }

      + kubernetes_network_config {
          + ip_family         = "ipv4"
          + service_ipv4_cidr = (known after apply)
          + service_ipv6_cidr = (known after apply)
        }

      + timeouts {}

      + vpc_config {
          + cluster_security_group_id = (known after apply)
          + endpoint_private_access   = true
          + endpoint_public_access    = true
          + public_access_cidrs       = [
              + "0.0.0.0/0",
            ]
          + security_group_ids        = (known after apply)
          + subnet_ids                = (known after apply)
          + vpc_id                    = (known after apply)
        }
    }

  # module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0] will be created
  + resource "aws_iam_openid_connect_provider" "oidc_provider" {
      + arn             = (known after apply)
      + client_id_list  = [
          + "sts.amazonaws.com",
        ]
      + id              = (known after apply)
      + tags            = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + tags_all        = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + thumbprint_list = (known after apply)
      + url             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_policy.cluster_encryption[0] will be created
  + resource "aws_iam_policy" "cluster_encryption" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + description      = "Cluster encryption policy to allow cluster role to utilize CMK provided"
      + id               = (known after apply)
      + name             = (known after apply)
      + name_prefix      = "zeno-staging-cluster-cluster-ClusterEncryption"
      + path             = "/"
      + policy           = (known after apply)
      + policy_id        = (known after apply)
      + tags_all         = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "eks.amazonaws.com"
                        }
                      + Sid       = "EKSClusterAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "zeno-staging-cluster-cluster-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0] will be created
  + resource "aws_iam_role_policy_attachment" "cluster_encryption" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.cluster[0] will be created
  + resource "aws_security_group" "cluster" {
      + arn                    = (known after apply)
      + description            = "EKS cluster security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-cluster-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + tags_all               = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.node[0] will be created
  + resource "aws_security_group" "node" {
      + arn                    = (known after apply)
      + description            = "EKS node shared security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-node-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + tags_all               = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"] will be created
  + resource "aws_security_group_rule" "cluster" {
      + description              = "Node groups to cluster API"
      + from_port                = 443
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["egress_all"] will be created
  + resource "aws_security_group_rule" "node" {
      + cidr_blocks              = [
          + "0.0.0.0/0",
        ]
      + description              = "Allow all egress"
      + from_port                = 0
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "egress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node groups"
      + from_port                = 443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 4443/tcp webhook"
      + from_port                = 4443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 4443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 6443/tcp webhook"
      + from_port                = 6443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 6443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 8443/tcp webhook"
      + from_port                = 8443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 8443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 9443/tcp webhook"
      + from_port                = 9443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 9443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node kubelets"
      + from_port                = 10250
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 10250
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node ingress on ephemeral ports"
      + from_port                = 1025
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 65535
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS UDP"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "udp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.time_sleep.this[0] will be created
  + resource "time_sleep" "this" {
      + create_duration = "30s"
      + id              = (known after apply)
      + triggers        = {
          + "cluster_certificate_authority_data" = (known after apply)
          + "cluster_endpoint"                   = (known after apply)
          + "cluster_name"                       = "zeno-staging-cluster"
          + "cluster_service_cidr"               = (known after apply)
          + "cluster_version"                    = "1.31"
        }
    }

  # module.resources.module.vpc.aws_default_network_acl.this[0] will be created
  + resource "aws_default_network_acl" "this" {
      + arn                    = (known after apply)
      + default_network_acl_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + egress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + egress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }

      + ingress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + ingress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }
    }

  # module.resources.module.vpc.aws_default_route_table.default[0] will be created
  + resource "aws_default_route_table" "default" {
      + arn                    = (known after apply)
      + default_route_table_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + route                  = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + timeouts {
          + create = "5m"
          + update = "5m"
        }
    }

  # module.resources.module.vpc.aws_default_security_group.this[0] will be created
  + resource "aws_default_security_group" "this" {
      + arn                    = (known after apply)
      + description            = (known after apply)
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.vpc.aws_eip.nat[0] will be created
  + resource "aws_eip" "nat" {
      + allocation_id        = (known after apply)
      + arn                  = (known after apply)
      + association_id       = (known after apply)
      + carrier_ip           = (known after apply)
      + customer_owned_ip    = (known after apply)
      + domain               = "vpc"
      + id                   = (known after apply)
      + instance             = (known after apply)
      + ipam_pool_id         = (known after apply)
      + network_border_group = (known after apply)
      + network_interface    = (known after apply)
      + private_dns          = (known after apply)
      + private_ip           = (known after apply)
      + ptr_record           = (known after apply)
      + public_dns           = (known after apply)
      + public_ip            = (known after apply)
      + public_ipv4_pool     = (known after apply)
      + tags                 = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all             = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + vpc                  = (known after apply)
    }

  # module.resources.module.vpc.aws_internet_gateway.this[0] will be created
  + resource "aws_internet_gateway" "this" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + owner_id = (known after apply)
      + tags     = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all = {
          + "Name" = "vpc-zeno-staging"
        }
      + vpc_id   = (known after apply)
    }

  # module.resources.module.vpc.aws_nat_gateway.this[0] will be created
  + resource "aws_nat_gateway" "this" {
      + allocation_id                      = (known after apply)
      + association_id                     = (known after apply)
      + connectivity_type                  = "public"
      + id                                 = (known after apply)
      + network_interface_id               = (known after apply)
      + private_ip                         = (known after apply)
      + public_ip                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ip_addresses     = (known after apply)
      + subnet_id                          = (known after apply)
      + tags                               = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all                           = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
    }

  # module.resources.module.vpc.aws_route.private_nat_gateway[0] will be created
  + resource "aws_route" "private_nat_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + nat_gateway_id         = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route.public_internet_gateway[0] will be created
  + resource "aws_route" "public_internet_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + gateway_id             = (known after apply)
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route_table.private[0] will be created
  + resource "aws_route_table" "private" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table.public[0] will be created
  + resource "aws_route_table" "public" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[0] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[1] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[2] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[0] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[1] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[2] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[0] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.1.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[1] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.2.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[2] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.3.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[0] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.4.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[1] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.5.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[2] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.6.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_vpc.this[0] will be created
  + resource "aws_vpc" "this" {
      + arn                                  = (known after apply)
      + cidr_block                           = "10.0.0.0/16"
      + default_network_acl_id               = (known after apply)
      + default_route_table_id               = (known after apply)
      + default_security_group_id            = (known after apply)
      + dhcp_options_id                      = (known after apply)
      + enable_dns_hostnames                 = true
      + enable_dns_support                   = true
      + enable_network_address_usage_metrics = (known after apply)
      + id                                   = (known after apply)
      + instance_tenancy                     = "default"
      + ipv6_association_id                  = (known after apply)
      + ipv6_cidr_block                      = (known after apply)
      + ipv6_cidr_block_network_border_group = (known after apply)
      + main_route_table_id                  = (known after apply)
      + owner_id                             = (known after apply)
      + tags                                 = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all                             = {
          + "Name" = "vpc-zeno-staging"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.small",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "default-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "default"
        }
      + tags_all               = {
          + "Name" = "default"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 0
          + max_size     = 1
          + min_size     = 0
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "default-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for default EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "default-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "default"
            }
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.large",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "regular-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "regular"
        }
      + tags_all               = {
          + "Name" = "regular"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 1
          + max_size     = 2
          + min_size     = 1
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "regular-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for regular EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "regular-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "regular"
            }
        }
    }

  # module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + minified_json             = (known after apply)
      + override_policy_documents = []
      + source_policy_documents   = []

      + statement {
          + actions   = [
              + "kms:*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "Default"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:root",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:CancelKeyDeletion",
              + "kms:Create*",
              + "kms:Delete*",
              + "kms:Describe*",
              + "kms:Disable*",
              + "kms:Enable*",
              + "kms:Get*",
              + "kms:ImportKeyMaterial",
              + "kms:List*",
              + "kms:Put*",
              + "kms:ReplicateKey",
              + "kms:Revoke*",
              + "kms:ScheduleKeyDeletion",
              + "kms:TagResource",
              + "kms:UntagResource",
              + "kms:Update*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyAdministration"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:user/tarashish@developmentseed.org",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:Decrypt",
              + "kms:DescribeKey",
              + "kms:Encrypt",
              + "kms:GenerateDataKey*",
              + "kms:ReEncrypt*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyUsage"

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"] will be created
  + resource "aws_kms_alias" "this" {
      + arn            = (known after apply)
      + id             = (known after apply)
      + name           = "alias/eks/zeno-staging-cluster"
      + name_prefix    = (known after apply)
      + target_key_arn = (known after apply)
      + target_key_id  = (known after apply)
    }

  # module.resources.module.eks.module.kms.aws_kms_key.this[0] will be created
  + resource "aws_kms_key" "this" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + description                        = "zeno-staging-cluster cluster encryption key"
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = false
      + policy                             = (known after apply)
      + rotation_period_in_days            = (known after apply)
      + tags                               = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                           = {
          + "terraform-aws-modules" = "eks"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

Plan: 64 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

```

</details>

*Pusher: @leothomas, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-17T10:03:13Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`success`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.data.aws_availability_zones.available: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 0s [id=084375562450]
module.resources.data.aws_db_instance.zeno-db: Read complete after 0s [id=zeno-db]
module.resources.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_eks_addon_version" "this" {
      + addon_name         = "aws-ebs-csi-driver"
      + id                 = (known after apply)
      + kubernetes_version = "1.31"
      + version            = (known after apply)
    }

  # module.resources.module.eks.data.tls_certificate.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "tls_certificate" "this" {
      + certificates = (known after apply)
      + id           = (known after apply)
      + url          = (known after apply)
    }

  # module.resources.module.eks.aws_cloudwatch_log_group.this[0] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "/aws/eks/zeno-staging-cluster/cluster"
      + name_prefix       = (known after apply)
      + retention_in_days = 90
      + skip_destroy      = false
      + tags              = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
      + tags_all          = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
    }

  # module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"] will be created
  + resource "aws_eks_addon" "this" {
      + addon_name                  = "aws-ebs-csi-driver"
      + addon_version               = "v1.40.1-eksbuild.1"
      + arn                         = (known after apply)
      + cluster_name                = "zeno-staging-cluster"
      + configuration_values        = (known after apply)
      + created_at                  = (known after apply)
      + id                          = (known after apply)
      + modified_at                 = (known after apply)
      + preserve                    = true
      + resolve_conflicts_on_create = "OVERWRITE"
      + resolve_conflicts_on_update = "OVERWRITE"
      + tags_all                    = (known after apply)

      + timeouts {}
    }

  # module.resources.module.eks.aws_eks_cluster.this[0] will be created
  + resource "aws_eks_cluster" "this" {
      + arn                           = (known after apply)
      + bootstrap_self_managed_addons = true
      + certificate_authority         = (known after apply)
      + cluster_id                    = (known after apply)
      + created_at                    = (known after apply)
      + enabled_cluster_log_types     = [
          + "api",
          + "audit",
          + "authenticator",
        ]
      + endpoint                      = (known after apply)
      + id                            = (known after apply)
      + identity                      = (known after apply)
      + name                          = "zeno-staging-cluster"
      + platform_version              = (known after apply)
      + role_arn                      = (known after apply)
      + status                        = (known after apply)
      + tags                          = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                      = {
          + "terraform-aws-modules" = "eks"
        }
      + version                       = "1.31"

      + access_config {
          + authentication_mode                         = "API_AND_CONFIG_MAP"
          + bootstrap_cluster_creator_admin_permissions = false
        }

      + encryption_config {
          + resources = [
              + "secrets",
            ]

          + provider {
              + key_arn = (known after apply)
            }
        }

      + kubernetes_network_config {
          + ip_family         = "ipv4"
          + service_ipv4_cidr = (known after apply)
          + service_ipv6_cidr = (known after apply)
        }

      + timeouts {}

      + vpc_config {
          + cluster_security_group_id = (known after apply)
          + endpoint_private_access   = true
          + endpoint_public_access    = true
          + public_access_cidrs       = [
              + "0.0.0.0/0",
            ]
          + security_group_ids        = (known after apply)
          + subnet_ids                = (known after apply)
          + vpc_id                    = (known after apply)
        }
    }

  # module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0] will be created
  + resource "aws_iam_openid_connect_provider" "oidc_provider" {
      + arn             = (known after apply)
      + client_id_list  = [
          + "sts.amazonaws.com",
        ]
      + id              = (known after apply)
      + tags            = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + tags_all        = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + thumbprint_list = (known after apply)
      + url             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_policy.cluster_encryption[0] will be created
  + resource "aws_iam_policy" "cluster_encryption" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + description      = "Cluster encryption policy to allow cluster role to utilize CMK provided"
      + id               = (known after apply)
      + name             = (known after apply)
      + name_prefix      = "zeno-staging-cluster-cluster-ClusterEncryption"
      + path             = "/"
      + policy           = (known after apply)
      + policy_id        = (known after apply)
      + tags_all         = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "eks.amazonaws.com"
                        }
                      + Sid       = "EKSClusterAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "zeno-staging-cluster-cluster-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0] will be created
  + resource "aws_iam_role_policy_attachment" "cluster_encryption" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.cluster[0] will be created
  + resource "aws_security_group" "cluster" {
      + arn                    = (known after apply)
      + description            = "EKS cluster security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-cluster-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + tags_all               = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.node[0] will be created
  + resource "aws_security_group" "node" {
      + arn                    = (known after apply)
      + description            = "EKS node shared security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-node-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + tags_all               = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"] will be created
  + resource "aws_security_group_rule" "cluster" {
      + description              = "Node groups to cluster API"
      + from_port                = 443
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["egress_all"] will be created
  + resource "aws_security_group_rule" "node" {
      + cidr_blocks              = [
          + "0.0.0.0/0",
        ]
      + description              = "Allow all egress"
      + from_port                = 0
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "egress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node groups"
      + from_port                = 443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 4443/tcp webhook"
      + from_port                = 4443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 4443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 6443/tcp webhook"
      + from_port                = 6443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 6443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 8443/tcp webhook"
      + from_port                = 8443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 8443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 9443/tcp webhook"
      + from_port                = 9443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 9443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node kubelets"
      + from_port                = 10250
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 10250
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node ingress on ephemeral ports"
      + from_port                = 1025
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 65535
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS UDP"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "udp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.time_sleep.this[0] will be created
  + resource "time_sleep" "this" {
      + create_duration = "30s"
      + id              = (known after apply)
      + triggers        = {
          + "cluster_certificate_authority_data" = (known after apply)
          + "cluster_endpoint"                   = (known after apply)
          + "cluster_name"                       = "zeno-staging-cluster"
          + "cluster_service_cidr"               = (known after apply)
          + "cluster_version"                    = "1.31"
        }
    }

  # module.resources.module.vpc.aws_default_network_acl.this[0] will be created
  + resource "aws_default_network_acl" "this" {
      + arn                    = (known after apply)
      + default_network_acl_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + egress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + egress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }

      + ingress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + ingress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }
    }

  # module.resources.module.vpc.aws_default_route_table.default[0] will be created
  + resource "aws_default_route_table" "default" {
      + arn                    = (known after apply)
      + default_route_table_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + route                  = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + timeouts {
          + create = "5m"
          + update = "5m"
        }
    }

  # module.resources.module.vpc.aws_default_security_group.this[0] will be created
  + resource "aws_default_security_group" "this" {
      + arn                    = (known after apply)
      + description            = (known after apply)
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.vpc.aws_eip.nat[0] will be created
  + resource "aws_eip" "nat" {
      + allocation_id        = (known after apply)
      + arn                  = (known after apply)
      + association_id       = (known after apply)
      + carrier_ip           = (known after apply)
      + customer_owned_ip    = (known after apply)
      + domain               = "vpc"
      + id                   = (known after apply)
      + instance             = (known after apply)
      + ipam_pool_id         = (known after apply)
      + network_border_group = (known after apply)
      + network_interface    = (known after apply)
      + private_dns          = (known after apply)
      + private_ip           = (known after apply)
      + ptr_record           = (known after apply)
      + public_dns           = (known after apply)
      + public_ip            = (known after apply)
      + public_ipv4_pool     = (known after apply)
      + tags                 = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all             = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + vpc                  = (known after apply)
    }

  # module.resources.module.vpc.aws_internet_gateway.this[0] will be created
  + resource "aws_internet_gateway" "this" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + owner_id = (known after apply)
      + tags     = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all = {
          + "Name" = "vpc-zeno-staging"
        }
      + vpc_id   = (known after apply)
    }

  # module.resources.module.vpc.aws_nat_gateway.this[0] will be created
  + resource "aws_nat_gateway" "this" {
      + allocation_id                      = (known after apply)
      + association_id                     = (known after apply)
      + connectivity_type                  = "public"
      + id                                 = (known after apply)
      + network_interface_id               = (known after apply)
      + private_ip                         = (known after apply)
      + public_ip                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ip_addresses     = (known after apply)
      + subnet_id                          = (known after apply)
      + tags                               = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all                           = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
    }

  # module.resources.module.vpc.aws_route.private_nat_gateway[0] will be created
  + resource "aws_route" "private_nat_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + nat_gateway_id         = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route.public_internet_gateway[0] will be created
  + resource "aws_route" "public_internet_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + gateway_id             = (known after apply)
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route_table.private[0] will be created
  + resource "aws_route_table" "private" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table.public[0] will be created
  + resource "aws_route_table" "public" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[0] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[1] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[2] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[0] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[1] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[2] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[0] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.1.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[1] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.2.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[2] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.3.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[0] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.4.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[1] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.5.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[2] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.6.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_vpc.this[0] will be created
  + resource "aws_vpc" "this" {
      + arn                                  = (known after apply)
      + cidr_block                           = "10.0.0.0/16"
      + default_network_acl_id               = (known after apply)
      + default_route_table_id               = (known after apply)
      + default_security_group_id            = (known after apply)
      + dhcp_options_id                      = (known after apply)
      + enable_dns_hostnames                 = true
      + enable_dns_support                   = true
      + enable_network_address_usage_metrics = (known after apply)
      + id                                   = (known after apply)
      + instance_tenancy                     = "default"
      + ipv6_association_id                  = (known after apply)
      + ipv6_cidr_block                      = (known after apply)
      + ipv6_cidr_block_network_border_group = (known after apply)
      + main_route_table_id                  = (known after apply)
      + owner_id                             = (known after apply)
      + tags                                 = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all                             = {
          + "Name" = "vpc-zeno-staging"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.small",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "default-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "default"
        }
      + tags_all               = {
          + "Name" = "default"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 0
          + max_size     = 1
          + min_size     = 0
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "default-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for default EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "default-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "default"
            }
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.large",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "regular-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "regular"
        }
      + tags_all               = {
          + "Name" = "regular"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 1
          + max_size     = 2
          + min_size     = 1
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "regular-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for regular EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "regular-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "regular"
            }
        }
    }

  # module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + minified_json             = (known after apply)
      + override_policy_documents = []
      + source_policy_documents   = []

      + statement {
          + actions   = [
              + "kms:*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "Default"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:root",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:CancelKeyDeletion",
              + "kms:Create*",
              + "kms:Delete*",
              + "kms:Describe*",
              + "kms:Disable*",
              + "kms:Enable*",
              + "kms:Get*",
              + "kms:ImportKeyMaterial",
              + "kms:List*",
              + "kms:Put*",
              + "kms:ReplicateKey",
              + "kms:Revoke*",
              + "kms:ScheduleKeyDeletion",
              + "kms:TagResource",
              + "kms:UntagResource",
              + "kms:Update*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyAdministration"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:user/tarashish@developmentseed.org",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:Decrypt",
              + "kms:DescribeKey",
              + "kms:Encrypt",
              + "kms:GenerateDataKey*",
              + "kms:ReEncrypt*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyUsage"

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"] will be created
  + resource "aws_kms_alias" "this" {
      + arn            = (known after apply)
      + id             = (known after apply)
      + name           = "alias/eks/zeno-staging-cluster"
      + name_prefix    = (known after apply)
      + target_key_arn = (known after apply)
      + target_key_id  = (known after apply)
    }

  # module.resources.module.eks.module.kms.aws_kms_key.this[0] will be created
  + resource "aws_kms_key" "this" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + description                        = "zeno-staging-cluster cluster encryption key"
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = false
      + policy                             = (known after apply)
      + rotation_period_in_days            = (known after apply)
      + tags                               = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                           = {
          + "terraform-aws-modules" = "eks"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

Plan: 64 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-18T10:16:30Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`success`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.data.aws_availability_zones.available: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]
module.resources.data.aws_db_instance.zeno-db: Read complete after 0s [id=zeno-db]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_eks_addon_version" "this" {
      + addon_name         = "aws-ebs-csi-driver"
      + id                 = (known after apply)
      + kubernetes_version = "1.31"
      + version            = (known after apply)
    }

  # module.resources.module.eks.data.tls_certificate.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "tls_certificate" "this" {
      + certificates = (known after apply)
      + id           = (known after apply)
      + url          = (known after apply)
    }

  # module.resources.module.eks.aws_cloudwatch_log_group.this[0] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "/aws/eks/zeno-staging-cluster/cluster"
      + name_prefix       = (known after apply)
      + retention_in_days = 90
      + skip_destroy      = false
      + tags              = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
      + tags_all          = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
    }

  # module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"] will be created
  + resource "aws_eks_addon" "this" {
      + addon_name                  = "aws-ebs-csi-driver"
      + addon_version               = "v1.40.1-eksbuild.1"
      + arn                         = (known after apply)
      + cluster_name                = "zeno-staging-cluster"
      + configuration_values        = (known after apply)
      + created_at                  = (known after apply)
      + id                          = (known after apply)
      + modified_at                 = (known after apply)
      + preserve                    = true
      + resolve_conflicts_on_create = "OVERWRITE"
      + resolve_conflicts_on_update = "OVERWRITE"
      + tags_all                    = (known after apply)

      + timeouts {}
    }

  # module.resources.module.eks.aws_eks_cluster.this[0] will be created
  + resource "aws_eks_cluster" "this" {
      + arn                           = (known after apply)
      + bootstrap_self_managed_addons = true
      + certificate_authority         = (known after apply)
      + cluster_id                    = (known after apply)
      + created_at                    = (known after apply)
      + enabled_cluster_log_types     = [
          + "api",
          + "audit",
          + "authenticator",
        ]
      + endpoint                      = (known after apply)
      + id                            = (known after apply)
      + identity                      = (known after apply)
      + name                          = "zeno-staging-cluster"
      + platform_version              = (known after apply)
      + role_arn                      = (known after apply)
      + status                        = (known after apply)
      + tags                          = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                      = {
          + "terraform-aws-modules" = "eks"
        }
      + version                       = "1.31"

      + access_config {
          + authentication_mode                         = "API_AND_CONFIG_MAP"
          + bootstrap_cluster_creator_admin_permissions = false
        }

      + encryption_config {
          + resources = [
              + "secrets",
            ]

          + provider {
              + key_arn = (known after apply)
            }
        }

      + kubernetes_network_config {
          + ip_family         = "ipv4"
          + service_ipv4_cidr = (known after apply)
          + service_ipv6_cidr = (known after apply)
        }

      + timeouts {}

      + vpc_config {
          + cluster_security_group_id = (known after apply)
          + endpoint_private_access   = true
          + endpoint_public_access    = true
          + public_access_cidrs       = [
              + "0.0.0.0/0",
            ]
          + security_group_ids        = (known after apply)
          + subnet_ids                = (known after apply)
          + vpc_id                    = (known after apply)
        }
    }

  # module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0] will be created
  + resource "aws_iam_openid_connect_provider" "oidc_provider" {
      + arn             = (known after apply)
      + client_id_list  = [
          + "sts.amazonaws.com",
        ]
      + id              = (known after apply)
      + tags            = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + tags_all        = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + thumbprint_list = (known after apply)
      + url             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_policy.cluster_encryption[0] will be created
  + resource "aws_iam_policy" "cluster_encryption" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + description      = "Cluster encryption policy to allow cluster role to utilize CMK provided"
      + id               = (known after apply)
      + name             = (known after apply)
      + name_prefix      = "zeno-staging-cluster-cluster-ClusterEncryption"
      + path             = "/"
      + policy           = (known after apply)
      + policy_id        = (known after apply)
      + tags_all         = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "eks.amazonaws.com"
                        }
                      + Sid       = "EKSClusterAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "zeno-staging-cluster-cluster-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0] will be created
  + resource "aws_iam_role_policy_attachment" "cluster_encryption" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.cluster[0] will be created
  + resource "aws_security_group" "cluster" {
      + arn                    = (known after apply)
      + description            = "EKS cluster security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-cluster-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + tags_all               = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.node[0] will be created
  + resource "aws_security_group" "node" {
      + arn                    = (known after apply)
      + description            = "EKS node shared security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-node-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + tags_all               = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"] will be created
  + resource "aws_security_group_rule" "cluster" {
      + description              = "Node groups to cluster API"
      + from_port                = 443
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["egress_all"] will be created
  + resource "aws_security_group_rule" "node" {
      + cidr_blocks              = [
          + "0.0.0.0/0",
        ]
      + description              = "Allow all egress"
      + from_port                = 0
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "egress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node groups"
      + from_port                = 443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 4443/tcp webhook"
      + from_port                = 4443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 4443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 6443/tcp webhook"
      + from_port                = 6443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 6443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 8443/tcp webhook"
      + from_port                = 8443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 8443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 9443/tcp webhook"
      + from_port                = 9443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 9443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node kubelets"
      + from_port                = 10250
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 10250
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node ingress on ephemeral ports"
      + from_port                = 1025
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 65535
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS UDP"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "udp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.time_sleep.this[0] will be created
  + resource "time_sleep" "this" {
      + create_duration = "30s"
      + id              = (known after apply)
      + triggers        = {
          + "cluster_certificate_authority_data" = (known after apply)
          + "cluster_endpoint"                   = (known after apply)
          + "cluster_name"                       = "zeno-staging-cluster"
          + "cluster_service_cidr"               = (known after apply)
          + "cluster_version"                    = "1.31"
        }
    }

  # module.resources.module.vpc.aws_default_network_acl.this[0] will be created
  + resource "aws_default_network_acl" "this" {
      + arn                    = (known after apply)
      + default_network_acl_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + egress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + egress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }

      + ingress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + ingress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }
    }

  # module.resources.module.vpc.aws_default_route_table.default[0] will be created
  + resource "aws_default_route_table" "default" {
      + arn                    = (known after apply)
      + default_route_table_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + route                  = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + timeouts {
          + create = "5m"
          + update = "5m"
        }
    }

  # module.resources.module.vpc.aws_default_security_group.this[0] will be created
  + resource "aws_default_security_group" "this" {
      + arn                    = (known after apply)
      + description            = (known after apply)
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.vpc.aws_eip.nat[0] will be created
  + resource "aws_eip" "nat" {
      + allocation_id        = (known after apply)
      + arn                  = (known after apply)
      + association_id       = (known after apply)
      + carrier_ip           = (known after apply)
      + customer_owned_ip    = (known after apply)
      + domain               = "vpc"
      + id                   = (known after apply)
      + instance             = (known after apply)
      + ipam_pool_id         = (known after apply)
      + network_border_group = (known after apply)
      + network_interface    = (known after apply)
      + private_dns          = (known after apply)
      + private_ip           = (known after apply)
      + ptr_record           = (known after apply)
      + public_dns           = (known after apply)
      + public_ip            = (known after apply)
      + public_ipv4_pool     = (known after apply)
      + tags                 = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all             = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + vpc                  = (known after apply)
    }

  # module.resources.module.vpc.aws_internet_gateway.this[0] will be created
  + resource "aws_internet_gateway" "this" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + owner_id = (known after apply)
      + tags     = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all = {
          + "Name" = "vpc-zeno-staging"
        }
      + vpc_id   = (known after apply)
    }

  # module.resources.module.vpc.aws_nat_gateway.this[0] will be created
  + resource "aws_nat_gateway" "this" {
      + allocation_id                      = (known after apply)
      + association_id                     = (known after apply)
      + connectivity_type                  = "public"
      + id                                 = (known after apply)
      + network_interface_id               = (known after apply)
      + private_ip                         = (known after apply)
      + public_ip                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ip_addresses     = (known after apply)
      + subnet_id                          = (known after apply)
      + tags                               = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all                           = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
    }

  # module.resources.module.vpc.aws_route.private_nat_gateway[0] will be created
  + resource "aws_route" "private_nat_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + nat_gateway_id         = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route.public_internet_gateway[0] will be created
  + resource "aws_route" "public_internet_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + gateway_id             = (known after apply)
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route_table.private[0] will be created
  + resource "aws_route_table" "private" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table.public[0] will be created
  + resource "aws_route_table" "public" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[0] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[1] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[2] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[0] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[1] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[2] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[0] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.1.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[1] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.2.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[2] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.3.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[0] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.4.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[1] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.5.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[2] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.6.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_vpc.this[0] will be created
  + resource "aws_vpc" "this" {
      + arn                                  = (known after apply)
      + cidr_block                           = "10.0.0.0/16"
      + default_network_acl_id               = (known after apply)
      + default_route_table_id               = (known after apply)
      + default_security_group_id            = (known after apply)
      + dhcp_options_id                      = (known after apply)
      + enable_dns_hostnames                 = true
      + enable_dns_support                   = true
      + enable_network_address_usage_metrics = (known after apply)
      + id                                   = (known after apply)
      + instance_tenancy                     = "default"
      + ipv6_association_id                  = (known after apply)
      + ipv6_cidr_block                      = (known after apply)
      + ipv6_cidr_block_network_border_group = (known after apply)
      + main_route_table_id                  = (known after apply)
      + owner_id                             = (known after apply)
      + tags                                 = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all                             = {
          + "Name" = "vpc-zeno-staging"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.small",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "default-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "default"
        }
      + tags_all               = {
          + "Name" = "default"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 0
          + max_size     = 1
          + min_size     = 0
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "default-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for default EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "default-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "default"
            }
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.large",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "regular-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "regular"
        }
      + tags_all               = {
          + "Name" = "regular"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 1
          + max_size     = 2
          + min_size     = 1
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "regular-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for regular EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "regular-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "regular"
            }
        }
    }

  # module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + minified_json             = (known after apply)
      + override_policy_documents = []
      + source_policy_documents   = []

      + statement {
          + actions   = [
              + "kms:*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "Default"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:root",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:CancelKeyDeletion",
              + "kms:Create*",
              + "kms:Delete*",
              + "kms:Describe*",
              + "kms:Disable*",
              + "kms:Enable*",
              + "kms:Get*",
              + "kms:ImportKeyMaterial",
              + "kms:List*",
              + "kms:Put*",
              + "kms:ReplicateKey",
              + "kms:Revoke*",
              + "kms:ScheduleKeyDeletion",
              + "kms:TagResource",
              + "kms:UntagResource",
              + "kms:Update*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyAdministration"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:user/tarashish@developmentseed.org",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:Decrypt",
              + "kms:DescribeKey",
              + "kms:Encrypt",
              + "kms:GenerateDataKey*",
              + "kms:ReEncrypt*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyUsage"

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"] will be created
  + resource "aws_kms_alias" "this" {
      + arn            = (known after apply)
      + id             = (known after apply)
      + name           = "alias/eks/zeno-staging-cluster"
      + name_prefix    = (known after apply)
      + target_key_arn = (known after apply)
      + target_key_id  = (known after apply)
    }

  # module.resources.module.eks.module.kms.aws_kms_key.this[0] will be created
  + resource "aws_kms_key" "this" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + description                        = "zeno-staging-cluster cluster encryption key"
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = false
      + policy                             = (known after apply)
      + rotation_period_in_days            = (known after apply)
      + tags                               = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                           = {
          + "terraform-aws-modules" = "eks"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

Plan: 64 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

```

</details>

*Pusher: @sunu, Action: `pull_request`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-22T09:23:27Z
body: #### Terraform Format and Style 🖌`success`
#### Terraform Initialization ⚙️`success`
#### Terraform Plan 📖`success`
#### Terraform Validation 🤖`success`

<details><summary>Show Plan</summary>

```

terraform
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Reading...
module.resources.data.aws_caller_identity.current: Reading...
module.resources.data.aws_db_instance.zeno-db: Reading...
module.resources.data.aws_availability_zones.available: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Reading...
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2764486067]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Reading...
module.resources.module.eks.data.aws_partition.current: Reading...
module.resources.module.eks.data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_partition.current: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Reading...
module.resources.module.eks.data.aws_caller_identity.current: Reading...
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_iam_policy_document.assume_role_policy[0]: Read complete after 0s [id=2560088296]
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Reading...
module.resources.module.eks.module.kms.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.resources.module.eks.module.eks_managed_node_group["default"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.kms.data.aws_caller_identity.current[0]: Read complete after 0s [id=084375562450]
module.resources.module.eks.module.eks_managed_node_group["regular"].data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_caller_identity.current: Read complete after 0s [id=084375562450]
module.resources.module.eks.data.aws_iam_session_context.current: Reading...
module.resources.module.eks.data.aws_iam_session_context.current: Read complete after 0s [id=arn:aws:iam::084375562450:user/tarashish@developmentseed.org]
module.resources.data.aws_availability_zones.available: Read complete after 0s [id=us-east-1]
module.resources.data.aws_db_instance.zeno-db: Read complete after 0s [id=zeno-db]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # module.resources.module.eks.data.aws_eks_addon_version.this["aws-ebs-csi-driver"] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_eks_addon_version" "this" {
      + addon_name         = "aws-ebs-csi-driver"
      + id                 = (known after apply)
      + kubernetes_version = "1.31"
      + version            = (known after apply)
    }

  # module.resources.module.eks.data.tls_certificate.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "tls_certificate" "this" {
      + certificates = (known after apply)
      + id           = (known after apply)
      + url          = (known after apply)
    }

  # module.resources.module.eks.aws_cloudwatch_log_group.this[0] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "/aws/eks/zeno-staging-cluster/cluster"
      + name_prefix       = (known after apply)
      + retention_in_days = 90
      + skip_destroy      = false
      + tags              = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
      + tags_all          = {
          + "Name" = "/aws/eks/zeno-staging-cluster/cluster"
        }
    }

  # module.resources.module.eks.aws_eks_addon.this["aws-ebs-csi-driver"] will be created
  + resource "aws_eks_addon" "this" {
      + addon_name                  = "aws-ebs-csi-driver"
      + addon_version               = "v1.40.1-eksbuild.1"
      + arn                         = (known after apply)
      + cluster_name                = "zeno-staging-cluster"
      + configuration_values        = (known after apply)
      + created_at                  = (known after apply)
      + id                          = (known after apply)
      + modified_at                 = (known after apply)
      + preserve                    = true
      + resolve_conflicts_on_create = "OVERWRITE"
      + resolve_conflicts_on_update = "OVERWRITE"
      + tags_all                    = (known after apply)

      + timeouts {}
    }

  # module.resources.module.eks.aws_eks_cluster.this[0] will be created
  + resource "aws_eks_cluster" "this" {
      + arn                           = (known after apply)
      + bootstrap_self_managed_addons = true
      + certificate_authority         = (known after apply)
      + cluster_id                    = (known after apply)
      + created_at                    = (known after apply)
      + enabled_cluster_log_types     = [
          + "api",
          + "audit",
          + "authenticator",
        ]
      + endpoint                      = (known after apply)
      + id                            = (known after apply)
      + identity                      = (known after apply)
      + name                          = "zeno-staging-cluster"
      + platform_version              = (known after apply)
      + role_arn                      = (known after apply)
      + status                        = (known after apply)
      + tags                          = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                      = {
          + "terraform-aws-modules" = "eks"
        }
      + version                       = "1.31"

      + access_config {
          + authentication_mode                         = "API_AND_CONFIG_MAP"
          + bootstrap_cluster_creator_admin_permissions = false
        }

      + encryption_config {
          + resources = [
              + "secrets",
            ]

          + provider {
              + key_arn = (known after apply)
            }
        }

      + kubernetes_network_config {
          + ip_family         = "ipv4"
          + service_ipv4_cidr = (known after apply)
          + service_ipv6_cidr = (known after apply)
        }

      + timeouts {}

      + vpc_config {
          + cluster_security_group_id = (known after apply)
          + endpoint_private_access   = true
          + endpoint_public_access    = true
          + public_access_cidrs       = [
              + "0.0.0.0/0",
            ]
          + security_group_ids        = (known after apply)
          + subnet_ids                = (known after apply)
          + vpc_id                    = (known after apply)
        }
    }

  # module.resources.module.eks.aws_iam_openid_connect_provider.oidc_provider[0] will be created
  + resource "aws_iam_openid_connect_provider" "oidc_provider" {
      + arn             = (known after apply)
      + client_id_list  = [
          + "sts.amazonaws.com",
        ]
      + id              = (known after apply)
      + tags            = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + tags_all        = {
          + "Name" = "zeno-staging-cluster-eks-irsa"
        }
      + thumbprint_list = (known after apply)
      + url             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_policy.cluster_encryption[0] will be created
  + resource "aws_iam_policy" "cluster_encryption" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + description      = "Cluster encryption policy to allow cluster role to utilize CMK provided"
      + id               = (known after apply)
      + name             = (known after apply)
      + name_prefix      = "zeno-staging-cluster-cluster-ClusterEncryption"
      + path             = "/"
      + policy           = (known after apply)
      + policy_id        = (known after apply)
      + tags_all         = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "eks.amazonaws.com"
                        }
                      + Sid       = "EKSClusterAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "zeno-staging-cluster-cluster-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.cluster_encryption[0] will be created
  + resource "aws_iam_role_policy_attachment" "cluster_encryption" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController"
      + role       = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.cluster[0] will be created
  + resource "aws_security_group" "cluster" {
      + arn                    = (known after apply)
      + description            = "EKS cluster security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-cluster-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + tags_all               = {
          + "Name" = "zeno-staging-cluster-cluster"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group.node[0] will be created
  + resource "aws_security_group" "node" {
      + arn                    = (known after apply)
      + description            = "EKS node shared security group"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "zeno-staging-cluster-node-"
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + tags_all               = {
          + "Name"                                       = "zeno-staging-cluster-node"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "owned"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.eks.aws_security_group_rule.cluster["ingress_nodes_443"] will be created
  + resource "aws_security_group_rule" "cluster" {
      + description              = "Node groups to cluster API"
      + from_port                = 443
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["egress_all"] will be created
  + resource "aws_security_group_rule" "node" {
      + cidr_blocks              = [
          + "0.0.0.0/0",
        ]
      + description              = "Allow all egress"
      + from_port                = 0
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 0
      + type                     = "egress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_443"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node groups"
      + from_port                = 443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_4443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 4443/tcp webhook"
      + from_port                = 4443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 4443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_6443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 6443/tcp webhook"
      + from_port                = 6443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 6443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_8443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 8443/tcp webhook"
      + from_port                = 8443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 8443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_9443_webhook"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node 9443/tcp webhook"
      + from_port                = 9443
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 9443
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_cluster_kubelet"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Cluster API to node kubelets"
      + from_port                = 10250
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 10250
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_nodes_ephemeral"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node ingress on ephemeral ports"
      + from_port                = 1025
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 65535
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_tcp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.aws_security_group_rule.node["ingress_self_coredns_udp"] will be created
  + resource "aws_security_group_rule" "node" {
      + description              = "Node to node CoreDNS UDP"
      + from_port                = 53
      + id                       = (known after apply)
      + prefix_list_ids          = []
      + protocol                 = "udp"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = true
      + source_security_group_id = (known after apply)
      + to_port                  = 53
      + type                     = "ingress"
    }

  # module.resources.module.eks.time_sleep.this[0] will be created
  + resource "time_sleep" "this" {
      + create_duration = "30s"
      + id              = (known after apply)
      + triggers        = {
          + "cluster_certificate_authority_data" = (known after apply)
          + "cluster_endpoint"                   = (known after apply)
          + "cluster_name"                       = "zeno-staging-cluster"
          + "cluster_service_cidr"               = (known after apply)
          + "cluster_version"                    = "1.31"
        }
    }

  # module.resources.module.vpc.aws_default_network_acl.this[0] will be created
  + resource "aws_default_network_acl" "this" {
      + arn                    = (known after apply)
      + default_network_acl_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + egress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + egress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }

      + ingress {
          + action          = "allow"
          + from_port       = 0
          + ipv6_cidr_block = "::/0"
          + protocol        = "-1"
          + rule_no         = 101
          + to_port         = 0
        }
      + ingress {
          + action     = "allow"
          + cidr_block = "0.0.0.0/0"
          + from_port  = 0
          + protocol   = "-1"
          + rule_no    = 100
          + to_port    = 0
        }
    }

  # module.resources.module.vpc.aws_default_route_table.default[0] will be created
  + resource "aws_default_route_table" "default" {
      + arn                    = (known after apply)
      + default_route_table_id = (known after apply)
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + route                  = (known after apply)
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)

      + timeouts {
          + create = "5m"
          + update = "5m"
        }
    }

  # module.resources.module.vpc.aws_default_security_group.this[0] will be created
  + resource "aws_default_security_group" "this" {
      + arn                    = (known after apply)
      + description            = (known after apply)
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + tags_all               = {
          + "Name" = "vpc-zeno-staging-default"
        }
      + vpc_id                 = (known after apply)
    }

  # module.resources.module.vpc.aws_eip.nat[0] will be created
  + resource "aws_eip" "nat" {
      + allocation_id        = (known after apply)
      + arn                  = (known after apply)
      + association_id       = (known after apply)
      + carrier_ip           = (known after apply)
      + customer_owned_ip    = (known after apply)
      + domain               = "vpc"
      + id                   = (known after apply)
      + instance             = (known after apply)
      + ipam_pool_id         = (known after apply)
      + network_border_group = (known after apply)
      + network_interface    = (known after apply)
      + private_dns          = (known after apply)
      + private_ip           = (known after apply)
      + ptr_record           = (known after apply)
      + public_dns           = (known after apply)
      + public_ip            = (known after apply)
      + public_ipv4_pool     = (known after apply)
      + tags                 = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all             = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + vpc                  = (known after apply)
    }

  # module.resources.module.vpc.aws_internet_gateway.this[0] will be created
  + resource "aws_internet_gateway" "this" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + owner_id = (known after apply)
      + tags     = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all = {
          + "Name" = "vpc-zeno-staging"
        }
      + vpc_id   = (known after apply)
    }

  # module.resources.module.vpc.aws_nat_gateway.this[0] will be created
  + resource "aws_nat_gateway" "this" {
      + allocation_id                      = (known after apply)
      + association_id                     = (known after apply)
      + connectivity_type                  = "public"
      + id                                 = (known after apply)
      + network_interface_id               = (known after apply)
      + private_ip                         = (known after apply)
      + public_ip                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ip_addresses     = (known after apply)
      + subnet_id                          = (known after apply)
      + tags                               = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
      + tags_all                           = {
          + "Name" = "vpc-zeno-staging-us-east-1a"
        }
    }

  # module.resources.module.vpc.aws_route.private_nat_gateway[0] will be created
  + resource "aws_route" "private_nat_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + nat_gateway_id         = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route.public_internet_gateway[0] will be created
  + resource "aws_route" "public_internet_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + gateway_id             = (known after apply)
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.resources.module.vpc.aws_route_table.private[0] will be created
  + resource "aws_route_table" "private" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-private"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table.public[0] will be created
  + resource "aws_route_table" "public" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + tags_all         = {
          + "Name" = "vpc-zeno-staging-public"
        }
      + vpc_id           = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[0] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[1] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.private[2] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[0] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[1] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_route_table_association.public[2] will be created
  + resource "aws_route_table_association" "public" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[0] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.1.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[1] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.2.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.private[2] will be created
  + resource "aws_subnet" "private" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.3.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-private-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/internal-elb"            = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[0] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1a"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.4.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1a"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[1] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1b"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.5.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1b"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_subnet.public[2] will be created
  + resource "aws_subnet" "public" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = "us-east-1c"
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.0.6.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + tags_all                                       = {
          + "Name"                                       = "vpc-zeno-staging-public-us-east-1c"
          + "kubernetes.io/cluster/zeno-staging-cluster" = "shared"
          + "kubernetes.io/role/elb"                     = "1"
        }
      + vpc_id                                         = (known after apply)
    }

  # module.resources.module.vpc.aws_vpc.this[0] will be created
  + resource "aws_vpc" "this" {
      + arn                                  = (known after apply)
      + cidr_block                           = "10.0.0.0/16"
      + default_network_acl_id               = (known after apply)
      + default_route_table_id               = (known after apply)
      + default_security_group_id            = (known after apply)
      + dhcp_options_id                      = (known after apply)
      + enable_dns_hostnames                 = true
      + enable_dns_support                   = true
      + enable_network_address_usage_metrics = (known after apply)
      + id                                   = (known after apply)
      + instance_tenancy                     = "default"
      + ipv6_association_id                  = (known after apply)
      + ipv6_cidr_block                      = (known after apply)
      + ipv6_cidr_block_network_border_group = (known after apply)
      + main_route_table_id                  = (known after apply)
      + owner_id                             = (known after apply)
      + tags                                 = {
          + "Name" = "vpc-zeno-staging"
        }
      + tags_all                             = {
          + "Name" = "vpc-zeno-staging"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.small",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "default-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "default"
        }
      + tags_all               = {
          + "Name" = "default"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 0
          + max_size     = 1
          + min_size     = 0
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "default-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for default EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "default-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "default"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "default"
            }
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_eks_node_group.this[0] will be created
  + resource "aws_eks_node_group" "this" {
      + ami_type               = "AL2023_x86_64_STANDARD"
      + arn                    = (known after apply)
      + capacity_type          = (known after apply)
      + cluster_name           = "zeno-staging-cluster"
      + disk_size              = (known after apply)
      + id                     = (known after apply)
      + instance_types         = [
          + "t3.large",
        ]
      + node_group_name        = (known after apply)
      + node_group_name_prefix = "regular-"
      + node_role_arn          = (known after apply)
      + release_version        = (known after apply)
      + resources              = (known after apply)
      + status                 = (known after apply)
      + subnet_ids             = (known after apply)
      + tags                   = {
          + "Name" = "regular"
        }
      + tags_all               = {
          + "Name" = "regular"
        }
      + version                = "1.31"

      + launch_template {
          + id      = (known after apply)
          + name    = (known after apply)
          + version = (known after apply)
        }

      + scaling_config {
          + desired_size = 1
          + max_size     = 2
          + min_size     = 1
        }

      + timeouts {}

      + update_config {
          + max_unavailable_percentage = 33
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = "EKSNodeAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "EKS managed node group IAM role"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "regular-eks-node-group-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.additional["AmazonEBSCSIDriverPolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"] will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      + role       = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].aws_launch_template.this[0] will be created
  + resource "aws_launch_template" "this" {
      + arn                    = (known after apply)
      + default_version        = (known after apply)
      + description            = "Custom launch template for regular EKS managed node group"
      + id                     = (known after apply)
      + latest_version         = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "regular-"
      + tags_all               = (known after apply)
      + update_default_version = true
      + vpc_security_group_ids = (known after apply)

      + block_device_mappings {
          + device_name = "/dev/xvda"

          + ebs {
              + delete_on_termination = "true"
              + iops                  = (known after apply)
              + throughput            = (known after apply)
              + volume_size           = 100
              + volume_type           = "gp3"
            }
        }

      + metadata_options {
          + http_endpoint               = "enabled"
          + http_protocol_ipv6          = (known after apply)
          + http_put_response_hop_limit = 2
          + http_tokens                 = "required"
          + instance_metadata_tags      = (known after apply)
        }

      + monitoring {
          + enabled = true
        }

      + tag_specifications {
          + resource_type = "instance"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "network-interface"
          + tags          = {
              + "Name" = "regular"
            }
        }
      + tag_specifications {
          + resource_type = "volume"
          + tags          = {
              + "Name" = "regular"
            }
        }
    }

  # module.resources.module.eks.module.kms.data.aws_iam_policy_document.this[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "this" {
      + id                        = (known after apply)
      + json                      = (known after apply)
      + minified_json             = (known after apply)
      + override_policy_documents = []
      + source_policy_documents   = []

      + statement {
          + actions   = [
              + "kms:*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "Default"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:root",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:CancelKeyDeletion",
              + "kms:Create*",
              + "kms:Delete*",
              + "kms:Describe*",
              + "kms:Disable*",
              + "kms:Enable*",
              + "kms:Get*",
              + "kms:ImportKeyMaterial",
              + "kms:List*",
              + "kms:Put*",
              + "kms:ReplicateKey",
              + "kms:Revoke*",
              + "kms:ScheduleKeyDeletion",
              + "kms:TagResource",
              + "kms:UntagResource",
              + "kms:Update*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyAdministration"

          + principals {
              + identifiers = [
                  + "arn:aws:iam::084375562450:user/tarashish@developmentseed.org",
                ]
              + type        = "AWS"
            }
        }
      + statement {
          + actions   = [
              + "kms:Decrypt",
              + "kms:DescribeKey",
              + "kms:Encrypt",
              + "kms:GenerateDataKey*",
              + "kms:ReEncrypt*",
            ]
          + resources = [
              + "*",
            ]
          + sid       = "KeyUsage"

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.resources.module.eks.module.kms.aws_kms_alias.this["cluster"] will be created
  + resource "aws_kms_alias" "this" {
      + arn            = (known after apply)
      + id             = (known after apply)
      + name           = "alias/eks/zeno-staging-cluster"
      + name_prefix    = (known after apply)
      + target_key_arn = (known after apply)
      + target_key_id  = (known after apply)
    }

  # module.resources.module.eks.module.kms.aws_kms_key.this[0] will be created
  + resource "aws_kms_key" "this" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + description                        = "zeno-staging-cluster cluster encryption key"
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = false
      + policy                             = (known after apply)
      + rotation_period_in_days            = (known after apply)
      + tags                               = {
          + "terraform-aws-modules" = "eks"
        }
      + tags_all                           = {
          + "terraform-aws-modules" = "eks"
        }
    }

  # module.resources.module.eks.module.eks_managed_node_group["default"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

  # module.resources.module.eks.module.eks_managed_node_group["regular"].module.user_data.null_resource.validate_cluster_service_cidr will be created
  + resource "null_resource" "validate_cluster_service_cidr" {
      + id = (known after apply)
    }

Plan: 64 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

```

</details>

*Pusher: @batpad, Action: `pull_request`*
author_association: NONE
user: login: batpad
created_at: 2025-04-22T09:25:12Z
body: @sunu I added the hostname configs for staging, setting the staging hostnames to be `.zeno-staging.ds.io`

If this looks good to you, I think we can go ahead and merge and fix things that may not work.

Next steps:

 - Merge this PR
 - Hopefully, terraform stack creation, etc. runs successfully - if not, debug, rinse and repeat.
 - Once stack is deployed, get the IP address of the cluster and set a DNS record to point `*.zeno-staging.ds.io` to the cluster
 - Test services, SSL, etc. - debug what doesn't work, fix

Once everything works on staging, test merging this to `main` and verify nothing breaks on production.
author_association: COLLABORATOR
user: login: sunu
created_at: 2025-04-23T07:08:27Z
body: @batpad Thanks! The hostname config looks good to me. Let's go ahead and merge this. I'm happy to help debug if anything goes sideways.
author_association: COLLABORATOR