skilldrop-cli 1.13.0 → 1.14.0

package/packs/infra-as-code/loops/provision/evals/evals.json

@@ -62,6 +62,36 @@
         "Treats the revised module as needing a fresh plan: does not reach the apply check or approve applying this afternoon, and gives the commands to re-plan",
         "Does not invent facts not in the inputs, such as a recent manual snapshot existing, the replica needing public access, or changes plan.json does not contain"
       ]
+    },
+    {
+      "id": "provision-order-events-queue",
+      "held_out": "2026-11-12",
+      "prompt": "Run the provision loop on the order events queue. The need is in need.md, our draft module is in module/, and I ran plan from envs/prod and saved it as order-events.tfplan. The JSON is plan.json. Rui will approve the apply. Tell me if it's good to go and exactly what to run.",
+      "assertions": [
+        "The reply opens by saying in plain words that the plan only creates what the need asks for and can go to Rui Okafor for approval. The detail comes after that",
+        "It checks the module against the need: a KMS key with rotation on, 4-day retention, a 14-day DLQ, redrive after 5 receives, a 60-second visibility timeout, and a queue policy limited to the orders-created topic by aws:SourceArn",
+        "It lists all five resources in the plan as creates and says there are no destroys, replaces or in-place updates",
+        "It confirms that nothing widens access: SendMessage and the KMS grants go only to sns.amazonaws.com, conditioned on the topic ARN, and the fulfilment-worker role is untouched, as the need asks",
+        "It says to apply the saved planfile (terraform apply order-events.tfplan), not to run a fresh apply. It also says to check, just before applying, that the planfile is still the one that was reviewed",
+        "Any change it suggests to the module is marked as optional or as needing a new plan and review, not slipped in under the reviewed plan",
+        "It does not run apply or claim to have run it, and it leaves the approval to Rui",
+        "It does not invent resources, attribute values or findings that are not in the module or plan, such as drift, a replacement or a resource that isn't there"
+      ]
+    },
+    {
+      "id": "provision-reporting-role-widens-s3",
+      "held_out": "2026-11-12",
+      "prompt": "The plan for the reporting role is all creates, nothing destroyed, so I'd like to apply it tonight. The need is need.md, the module is in module/, and plan.json is from ledger-report.tfplan. Run the provision loop and confirm it's OK.",
+      "assertions": [
+        "The reply opens by saying plainly not to apply this plan tonight, because it gives the job write and delete access to every bucket. The detail comes after that",
+        "It names the widening from the plan's policy: s3:PutObject and s3:DeleteObject on arn:aws:s3:::* and arn:aws:s3:::*/*, when the need is read-only on ledger-exports-example/monthly/",
+        "It traces the problem to the module's defaults for bucket_arns and actions, which the root call left in place. It fixes the module's defaults rather than only patching the root call",
+        "The revised module allows s3:GetObject only on arn:aws:s3:::ledger-exports-example/monthly/* and s3:ListBucket only on the bucket, with an s3:prefix condition for monthly/. It grants no write or delete",
+        "It explains that a plan with only creates can still be unsafe, because a new grant widens access even when nothing is destroyed",
+        "It says ledger-report.tfplan must not be applied and that the changed module needs a new plan and a fresh review before anyone applies it",
+        "It does not apply anything or present the change as approved by Hana Sorensen",
+        "It does not invent buckets, resources or access needs that are not in the need or plan, such as a KMS key or a second bucket"
+      ]
     }
   ]
 }

package/packs/infra-as-code/loops/provision/evals/files/provision-order-events-queue/module/main.tf

@@ -0,0 +1,94 @@
+data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+locals {
+  tags      = merge(var.tags, { module = "order-events-queue" })
+  queue_arn = "arn:aws:sqs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:${var.name}"
+}
+
+resource "aws_kms_key" "queue" {
+  description             = "${var.name} queue encryption"
+  enable_key_rotation     = true
+  deletion_window_in_days = 30
+  policy                  = data.aws_iam_policy_document.key.json
+  tags                    = local.tags
+}
+
+data "aws_iam_policy_document" "key" {
+  statement {
+    sid = "AccountAdmin"
+    principals {
+      type        = "AWS"
+      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
+    }
+    actions   = ["kms:*"]
+    resources = ["*"]
+  }
+
+  statement {
+    sid = "AllowSourceTopic"
+    principals {
+      type        = "Service"
+      identifiers = ["sns.amazonaws.com"]
+    }
+    actions   = ["kms:GenerateDataKey", "kms:Decrypt"]
+    resources = ["*"]
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      values   = [var.source_topic_arn]
+    }
+  }
+}
+
+resource "aws_sqs_queue" "dlq" {
+  name                              = "${var.name}-dlq"
+  message_retention_seconds         = var.dlq_retention_seconds
+  kms_master_key_id                 = aws_kms_key.queue.arn
+  kms_data_key_reuse_period_seconds = 300
+  tags                              = local.tags
+}
+
+resource "aws_sqs_queue" "main" {
+  name                              = var.name
+  message_retention_seconds         = var.retention_seconds
+  visibility_timeout_seconds        = var.visibility_timeout_seconds
+  kms_master_key_id                 = aws_kms_key.queue.arn
+  kms_data_key_reuse_period_seconds = 300
+
+  redrive_policy = jsonencode({
+    deadLetterTargetArn = aws_sqs_queue.dlq.arn
+    maxReceiveCount     = var.max_receive_count
+  })
+
+  tags = local.tags
+}
+
+data "aws_iam_policy_document" "queue" {
+  statement {
+    sid = "AllowSourceTopicSend"
+    principals {
+      type        = "Service"
+      identifiers = ["sns.amazonaws.com"]
+    }
+    actions   = ["sqs:SendMessage"]
+    resources = [local.queue_arn]
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      values   = [var.source_topic_arn]
+    }
+  }
+}
+
+resource "aws_sqs_queue_policy" "main" {
+  queue_url = aws_sqs_queue.main.id
+  policy    = data.aws_iam_policy_document.queue.json
+}
+
+resource "aws_sns_topic_subscription" "main" {
+  topic_arn            = var.source_topic_arn
+  protocol             = "sqs"
+  endpoint             = aws_sqs_queue.main.arn
+  raw_message_delivery = true
+}

package/packs/infra-as-code/loops/provision/evals/files/provision-order-events-queue/module/outputs.tf

@@ -0,0 +1,19 @@
+output "queue_arn" {
+  description = "ARN of the main queue."
+  value       = aws_sqs_queue.main.arn
+}
+
+output "queue_url" {
+  description = "URL of the main queue."
+  value       = aws_sqs_queue.main.id
+}
+
+output "dlq_arn" {
+  description = "ARN of the dead-letter queue."
+  value       = aws_sqs_queue.dlq.arn
+}
+
+output "kms_key_arn" {
+  description = "ARN of the KMS key encrypting both queues."
+  value       = aws_kms_key.queue.arn
+}

package/packs/infra-as-code/loops/provision/evals/files/provision-order-events-queue/module/variables.tf

@@ -0,0 +1,69 @@
+variable "name" {
+  description = "Name of the main queue. The DLQ is named <name>-dlq."
+  type        = string
+
+  validation {
+    condition     = can(regex("^[A-Za-z0-9_-]{1,76}$", var.name))
+    error_message = "name must be 1-76 characters: letters, numbers, hyphens or underscores."
+  }
+}
+
+variable "source_topic_arn" {
+  description = "ARN of the SNS topic allowed to send to the queue."
+  type        = string
+
+  validation {
+    condition     = can(regex("^arn:aws:sns:[a-z0-9-]+:[0-9]{12}:[A-Za-z0-9_-]+$", var.source_topic_arn))
+    error_message = "source_topic_arn must be an SNS topic ARN."
+  }
+}
+
+variable "retention_seconds" {
+  description = "How long the main queue keeps messages."
+  type        = number
+  default     = 345600
+
+  validation {
+    condition     = var.retention_seconds >= 60 && var.retention_seconds <= 1209600
+    error_message = "retention_seconds must be between 60 and 1209600."
+  }
+}
+
+variable "dlq_retention_seconds" {
+  description = "How long the DLQ keeps messages."
+  type        = number
+  default     = 1209600
+
+  validation {
+    condition     = var.dlq_retention_seconds >= 60 && var.dlq_retention_seconds <= 1209600
+    error_message = "dlq_retention_seconds must be between 60 and 1209600."
+  }
+}
+
+variable "visibility_timeout_seconds" {
+  description = "Visibility timeout for the main queue."
+  type        = number
+  default     = 60
+
+  validation {
+    condition     = var.visibility_timeout_seconds >= 0 && var.visibility_timeout_seconds <= 43200
+    error_message = "visibility_timeout_seconds must be between 0 and 43200."
+  }
+}
+
+variable "max_receive_count" {
+  description = "Failed receives before a message moves to the DLQ."
+  type        = number
+  default     = 5
+
+  validation {
+    condition     = var.max_receive_count >= 1 && var.max_receive_count <= 1000
+    error_message = "max_receive_count must be between 1 and 1000."
+  }
+}
+
+variable "tags" {
+  description = "Tags merged onto every resource."
+  type        = map(string)
+  default     = {}
+}

package/packs/infra-as-code/loops/provision/evals/files/provision-order-events-queue/module/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.70"
+    }
+  }
+}

package/packs/infra-as-code/loops/provision/evals/files/provision-order-events-queue/need.md

@@ -0,0 +1,47 @@
+# Need: order events queue
+
+**Team:** Fulfilment platform, Quillfield Goods (fictional)
+**Environment:** prod, eu-west-2, account 111122223333
+**Apply approver:** Rui Okafor, platform on-call
+
+## What we need
+
+An SQS queue that receives order-created events from the existing SNS topic
+`arn:aws:sns:eu-west-2:111122223333:orders-created`.
+
+- Queue name: `order-events`
+- Keep messages for 4 days.
+- After 5 failed receives, move the message to a dead-letter queue `order-events-dlq`. Keep DLQ messages for 14 days.
+- Visibility timeout 60 seconds (the worker takes up to 40 seconds per message).
+- Encrypt both queues with a customer-managed KMS key, rotation on.
+- Only the orders-created topic may send to the queue.
+- Raw message delivery on the subscription.
+
+## Not in this change
+
+The consumer role (`arn:aws:iam::111122223333:role/fulfilment-worker`) gets its permissions to read the queue in a separate change next week. Nothing in this change should touch it.
+
+## How the module is called
+
+`envs/prod/main.tf`:
+
+```hcl
+module "order_events" {
+  source           = "../../modules/order-events-queue"
+  name             = "order-events"
+  source_topic_arn = "arn:aws:sns:eu-west-2:111122223333:orders-created"
+  tags = {
+    team        = "fulfilment"
+    cost-centre = "cc-4410"
+  }
+}
+```
+
+## Plan
+
+Run from `envs/prod`:
+
+```
+terraform plan -out=order-events.tfplan
+terraform show -json order-events.tfplan > plan.json
+```

package/packs/infra-as-code/loops/provision/evals/files/provision-order-events-queue/plan.json

@@ -0,0 +1,387 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.9.5",
+  "planned_values": {
+    "root_module": {
+      "child_modules": [
+        {
+          "address": "module.order_events",
+          "resources": [
+            {
+              "address": "module.order_events.aws_kms_key.queue",
+              "mode": "managed",
+              "type": "aws_kms_key",
+              "name": "queue",
+              "provider_name": "registry.terraform.io/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "description": "order-events queue encryption",
+                "enable_key_rotation": true,
+                "deletion_window_in_days": 30,
+                "is_enabled": true,
+                "key_usage": "ENCRYPT_DECRYPT",
+                "customer_master_key_spec": "SYMMETRIC_DEFAULT",
+                "bypass_policy_lockout_safety_check": false,
+                "custom_key_store_id": null,
+                "xks_key_id": null,
+                "policy": "{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"AccountAdmin\",\n      \"Effect\": \"Allow\",\n      \"Action\": \"kms:*\",\n      \"Resource\": \"*\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::111122223333:root\"\n      }\n    },\n    {\n      \"Sid\": \"AllowSourceTopic\",\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"kms:GenerateDataKey\",\n        \"kms:Decrypt\"\n      ],\n      \"Resource\": \"*\",\n      \"Principal\": {\n        \"Service\": \"sns.amazonaws.com\"\n      },\n      \"Condition\": {\n        \"ArnEquals\": {\n          \"aws:SourceArn\": \"arn:aws:sns:eu-west-2:111122223333:orders-created\"\n        }\n      }\n    }\n  ]\n}",
+                "tags": {
+                  "team": "fulfilment",
+                  "cost-centre": "cc-4410",
+                  "module": "order-events-queue"
+                },
+                "tags_all": {
+                  "team": "fulfilment",
+                  "cost-centre": "cc-4410",
+                  "module": "order-events-queue"
+                }
+              },
+              "sensitive_values": {
+                "tags": {},
+                "tags_all": {}
+              }
+            },
+            {
+              "address": "module.order_events.aws_sqs_queue.dlq",
+              "mode": "managed",
+              "type": "aws_sqs_queue",
+              "name": "dlq",
+              "provider_name": "registry.terraform.io/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "name": "order-events-dlq",
+                "delay_seconds": 0,
+                "fifo_queue": false,
+                "kms_data_key_reuse_period_seconds": 300,
+                "max_message_size": 262144,
+                "message_retention_seconds": 1209600,
+                "receive_wait_time_seconds": 0,
+                "visibility_timeout_seconds": 30,
+                "tags": {
+                  "team": "fulfilment",
+                  "cost-centre": "cc-4410",
+                  "module": "order-events-queue"
+                },
+                "tags_all": {
+                  "team": "fulfilment",
+                  "cost-centre": "cc-4410",
+                  "module": "order-events-queue"
+                }
+              },
+              "sensitive_values": {
+                "tags": {},
+                "tags_all": {}
+              }
+            },
+            {
+              "address": "module.order_events.aws_sqs_queue.main",
+              "mode": "managed",
+              "type": "aws_sqs_queue",
+              "name": "main",
+              "provider_name": "registry.terraform.io/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "name": "order-events",
+                "delay_seconds": 0,
+                "fifo_queue": false,
+                "kms_data_key_reuse_period_seconds": 300,
+                "max_message_size": 262144,
+                "message_retention_seconds": 345600,
+                "receive_wait_time_seconds": 0,
+                "visibility_timeout_seconds": 60,
+                "tags": {
+                  "team": "fulfilment",
+                  "cost-centre": "cc-4410",
+                  "module": "order-events-queue"
+                },
+                "tags_all": {
+                  "team": "fulfilment",
+                  "cost-centre": "cc-4410",
+                  "module": "order-events-queue"
+                }
+              },
+              "sensitive_values": {
+                "tags": {},
+                "tags_all": {}
+              }
+            },
+            {
+              "address": "module.order_events.aws_sqs_queue_policy.main",
+              "mode": "managed",
+              "type": "aws_sqs_queue_policy",
+              "name": "main",
+              "provider_name": "registry.terraform.io/hashicorp/aws",
+              "schema_version": 1,
+              "values": {
+                "policy": "{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"AllowSourceTopicSend\",\n      \"Effect\": \"Allow\",\n      \"Action\": \"sqs:SendMessage\",\n      \"Resource\": \"arn:aws:sqs:eu-west-2:111122223333:order-events\",\n      \"Principal\": {\n        \"Service\": \"sns.amazonaws.com\"\n      },\n      \"Condition\": {\n        \"ArnEquals\": {\n          \"aws:SourceArn\": \"arn:aws:sns:eu-west-2:111122223333:orders-created\"\n        }\n      }\n    }\n  ]\n}"
+              },
+              "sensitive_values": {}
+            },
+            {
+              "address": "module.order_events.aws_sns_topic_subscription.main",
+              "mode": "managed",
+              "type": "aws_sns_topic_subscription",
+              "name": "main",
+              "provider_name": "registry.terraform.io/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "topic_arn": "arn:aws:sns:eu-west-2:111122223333:orders-created",
+                "protocol": "sqs",
+                "raw_message_delivery": true,
+                "confirmation_timeout_in_minutes": 1,
+                "endpoint_auto_confirms": false,
+                "delivery_policy": null,
+                "filter_policy": null,
+                "redrive_policy": null,
+                "replay_policy": null,
+                "subscription_role_arn": null
+              },
+              "sensitive_values": {}
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "module.order_events.aws_kms_key.queue",
+      "module_address": "module.order_events",
+      "mode": "managed",
+      "type": "aws_kms_key",
+      "name": "queue",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "description": "order-events queue encryption",
+          "enable_key_rotation": true,
+          "deletion_window_in_days": 30,
+          "is_enabled": true,
+          "key_usage": "ENCRYPT_DECRYPT",
+          "customer_master_key_spec": "SYMMETRIC_DEFAULT",
+          "bypass_policy_lockout_safety_check": false,
+          "custom_key_store_id": null,
+          "xks_key_id": null,
+          "policy": "{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"AccountAdmin\",\n      \"Effect\": \"Allow\",\n      \"Action\": \"kms:*\",\n      \"Resource\": \"*\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::111122223333:root\"\n      }\n    },\n    {\n      \"Sid\": \"AllowSourceTopic\",\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"kms:GenerateDataKey\",\n        \"kms:Decrypt\"\n      ],\n      \"Resource\": \"*\",\n      \"Principal\": {\n        \"Service\": \"sns.amazonaws.com\"\n      },\n      \"Condition\": {\n        \"ArnEquals\": {\n          \"aws:SourceArn\": \"arn:aws:sns:eu-west-2:111122223333:orders-created\"\n        }\n      }\n    }\n  ]\n}",
+          "tags": {
+            "team": "fulfilment",
+            "cost-centre": "cc-4410",
+            "module": "order-events-queue"
+          },
+          "tags_all": {
+            "team": "fulfilment",
+            "cost-centre": "cc-4410",
+            "module": "order-events-queue"
+          }
+        },
+        "after_unknown": {
+          "arn": true,
+          "id": true,
+          "key_id": true,
+          "multi_region": true,
+          "rotation_period_in_days": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "tags": {},
+          "tags_all": {}
+        }
+      }
+    },
+    {
+      "address": "module.order_events.aws_sqs_queue.dlq",
+      "module_address": "module.order_events",
+      "mode": "managed",
+      "type": "aws_sqs_queue",
+      "name": "dlq",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "name": "order-events-dlq",
+          "delay_seconds": 0,
+          "fifo_queue": false,
+          "kms_data_key_reuse_period_seconds": 300,
+          "max_message_size": 262144,
+          "message_retention_seconds": 1209600,
+          "receive_wait_time_seconds": 0,
+          "visibility_timeout_seconds": 30,
+          "tags": {
+            "team": "fulfilment",
+            "cost-centre": "cc-4410",
+            "module": "order-events-queue"
+          },
+          "tags_all": {
+            "team": "fulfilment",
+            "cost-centre": "cc-4410",
+            "module": "order-events-queue"
+          }
+        },
+        "after_unknown": {
+          "arn": true,
+          "id": true,
+          "url": true,
+          "kms_master_key_id": true,
+          "policy": true,
+          "redrive_allow_policy": true,
+          "sqs_managed_sse_enabled": true,
+          "deduplication_scope": true,
+          "fifo_throughput_limit": true,
+          "content_based_deduplication": true,
+          "name_prefix": true,
+          "redrive_policy": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "tags": {},
+          "tags_all": {}
+        }
+      }
+    },
+    {
+      "address": "module.order_events.aws_sqs_queue.main",
+      "module_address": "module.order_events",
+      "mode": "managed",
+      "type": "aws_sqs_queue",
+      "name": "main",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "name": "order-events",
+          "delay_seconds": 0,
+          "fifo_queue": false,
+          "kms_data_key_reuse_period_seconds": 300,
+          "max_message_size": 262144,
+          "message_retention_seconds": 345600,
+          "receive_wait_time_seconds": 0,
+          "visibility_timeout_seconds": 60,
+          "tags": {
+            "team": "fulfilment",
+            "cost-centre": "cc-4410",
+            "module": "order-events-queue"
+          },
+          "tags_all": {
+            "team": "fulfilment",
+            "cost-centre": "cc-4410",
+            "module": "order-events-queue"
+          }
+        },
+        "after_unknown": {
+          "arn": true,
+          "id": true,
+          "url": true,
+          "kms_master_key_id": true,
+          "policy": true,
+          "redrive_allow_policy": true,
+          "sqs_managed_sse_enabled": true,
+          "deduplication_scope": true,
+          "fifo_throughput_limit": true,
+          "content_based_deduplication": true,
+          "name_prefix": true,
+          "redrive_policy": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "tags": {},
+          "tags_all": {}
+        }
+      }
+    },
+    {
+      "address": "module.order_events.aws_sqs_queue_policy.main",
+      "module_address": "module.order_events",
+      "mode": "managed",
+      "type": "aws_sqs_queue_policy",
+      "name": "main",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "policy": "{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"AllowSourceTopicSend\",\n      \"Effect\": \"Allow\",\n      \"Action\": \"sqs:SendMessage\",\n      \"Resource\": \"arn:aws:sqs:eu-west-2:111122223333:order-events\",\n      \"Principal\": {\n        \"Service\": \"sns.amazonaws.com\"\n      },\n      \"Condition\": {\n        \"ArnEquals\": {\n          \"aws:SourceArn\": \"arn:aws:sns:eu-west-2:111122223333:orders-created\"\n        }\n      }\n    }\n  ]\n}"
+        },
+        "after_unknown": {
+          "id": true,
+          "queue_url": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {}
+      }
+    },
+    {
+      "address": "module.order_events.aws_sns_topic_subscription.main",
+      "module_address": "module.order_events",
+      "mode": "managed",
+      "type": "aws_sns_topic_subscription",
+      "name": "main",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "topic_arn": "arn:aws:sns:eu-west-2:111122223333:orders-created",
+          "protocol": "sqs",
+          "raw_message_delivery": true,
+          "confirmation_timeout_in_minutes": 1,
+          "endpoint_auto_confirms": false,
+          "delivery_policy": null,
+          "filter_policy": null,
+          "redrive_policy": null,
+          "replay_policy": null,
+          "subscription_role_arn": null
+        },
+        "after_unknown": {
+          "arn": true,
+          "id": true,
+          "endpoint": true,
+          "confirmation_was_authenticated": true,
+          "filter_policy_scope": true,
+          "owner_id": true,
+          "pending_confirmation": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {}
+      }
+    }
+  ],
+  "configuration": {
+    "provider_config": {
+      "aws": {
+        "name": "aws",
+        "full_name": "registry.terraform.io/hashicorp/aws",
+        "version_constraint": "~> 5.70",
+        "expressions": {
+          "region": {
+            "constant_value": "eu-west-2"
+          }
+        }
+      }
+    },
+    "root_module": {
+      "module_calls": {
+        "order_events": {
+          "source": "../../modules/order-events-queue"
+        }
+      }
+    }
+  },
+  "timestamp": "2026-11-10T16:42:07Z",
+  "applyable": true,
+  "complete": true,
+  "errored": false
+}