Update TF plan/apply from PR 146 to use separate OIDC roles

[Benettonkkb]

Part 2 of Pull request 147

What changes did you make?

• Added incubator-tf-plan and incubator-tf-apply the role-to-assume in the ...plan.tf and apply.tf files

Why did you make the changes (we will use this info to test)?

• It was requested in the Issue.

[ale210]

This is approved but cannot be merged until the roles are created via devops-security PR 147

[github-actions]

Terraform plan in terraform
With backend config files: terraform/prod.backend.tfvars

No changes. Your infrastructure matches the configuration.

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

✅ Plan applied in Terraform apply (OIDC) #58

[ale210]

This can be applied once the issue with reading secrets in devops-security is fixed - @Benettonkkb please complete hackforla/devops-security#154 when you can

[Copilot]

Pull request overview

Updates GitHub Actions Terraform workflows to assume separate AWS OIDC roles for plan vs apply, aligning CI permissions with least-privilege separation goals. The PR also modifies the shared CI/CD IAM policy used by project pipelines.

Changes:

• Update Terraform plan workflow to assume incubator-tf-plan.
• Update Terraform apply workflow to assume incubator-tf-apply.
• Adjust terraform/cicd.tf IAM policy formatting and add Secrets Manager read access for home-unite-us-*.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
terraform/cicd.tf	Reformat IAM policy statements and add Secrets Manager GetSecretValue permission for home-unite-us-*.
.github/workflows/terraform-plan.yaml	Switch Terraform plan job to assume the incubator-tf-plan role.
.github/workflows/terraform-apply.yaml	Switch Terraform apply job to assume the incubator-tf-apply role.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Benettonkkb]

used git reset to get back to 592ec23 instead of git revert which was the confusion from the meeting.