[here]

Fixes #replace_this_text_with_the_issue_number

What changes did you make?

• terraform config to use s3 for state lockfiles deprcating dynamodb
• updating onboarding docs

Why did you make the changes (we will use this info to test)?

• From hackforla/devops #218

Expect exactly one terraform plan change: an in-place update of module.aws_custom_policies.aws_iam_policy.custom_policy["IncubatorTfPlanSecretsRead"], from the JSON edit. Anything else — any replacement, any second resource — is a stop-and-raise.

After the PR merges, confirm Apply Terraform changes on merge succeeds with no Deprecated Parameter warning, and that the policy's new default version no longer contains the DynamoDB statement.

After the merge, re-open /issues/new/choose and confirm the pre-work template renders without the DynamoDB step. GitHub renders issue templates from the default branch only, so this genuinely cannot be checked from the branch.

[github-actions]

Terraform plan in terraform
With backend config files: terraform/prod.backend.tfvars
With variables: iam_only = false

Plan: 0 to add, 1 to change, 0 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place

Terraform will perform the following actions:

  # module.aws_custom_policies.aws_iam_policy.custom_policy["IncubatorTfPlanSecretsRead"] will be updated in-place
!~  resource "aws_iam_policy" "custom_policy" {
        id               = "arn:aws:iam::035866691871:policy/IncubatorTfPlanSecretsRead"
        name             = "IncubatorTfPlanSecretsRead"
!~      policy           = jsonencode(
!~          {
!~              Statement = [
#                    (1 unchanged element hidden)
                    {
                        Action   = [
                            "s3:GetObject",
                            "s3:PutObject",
                            "s3:DeleteObject",
                            "s3:ListBucket",
                            "s3:GetBucketLocation",
                        ]
                        Effect   = "Allow"
                        Resource = [
                            "arn:aws:s3:::hfla-ops-terraform-state",
                            "arn:aws:s3:::hfla-ops-terraform-state/*",
                        ]
                        Sid      = "AllowS3BackendAccessForTerraformPlan"
                    },
-                   {
-                       Action   = [
-                           "dynamodb:PutItem",
-                           "dynamodb:DeleteItem",
-                           "dynamodb:GetItem",
-                           "dynamodb:UpdateItem",
-                           "dynamodb:DescribeTable",
                        ]
-                       Effect   = "Allow"
-                       Resource = [
-                           "arn:aws:dynamodb:us-west-2:035866691871:table/hfla_ops_terraform_table",
                        ]
-                       Sid      = "AllowDynamoDBLockTableAccessForTerraformPlan"
                    },
                ]
#                (1 unchanged attribute hidden)
            }
        )
        tags             = {}
#        (7 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

📝 Plan generated in Write Terraform Plan to Pull Request #124

[ale210]

@here this looks good, but can you please the issue-pr link in the pr description, for yours it should be "refs hackforla/devops#218" instead of "Fixes #replace_this_text_with_the_issue_number"

[ale210]

please update the first line of the PR that does the issue link