Upgraded terraform providers

Author: BSick7

.nullstone/module.yml

@@ -11,3 +11,4 @@ subplatform: container
 type: ""
 appCategories: []
 is_public: true
+tool_name: "terraform"

.terraform.lock.hcl

@@ -1,3 +1,6 @@
+# 0.5.0 (Sep 22, 2025)
+* Upgraded Terraform providers.
+
 # 0.4.16 (Feb 27, 2025)
 * Fixed `topics` usage from `event_sources` in capabilities.
 

CHANGELOG.md

@@ -9,8 +9,8 @@ locals {
 }
 
 locals {
-  lambda_arn = "arn:aws:lambda:${data.aws_region.this.name}:${data.aws_caller_identity.this.account_id}:function:${local.resource_name}"
-  invoke_arn = "arn:aws:apigateway:${data.aws_region.this.name}:lambda:path/2015-03-31/functions/${local.lambda_arn}/invocations"
+  lambda_arn = "arn:aws:lambda:${data.aws_region.this.region}:${data.aws_caller_identity.this.account_id}:function:${local.resource_name}"
+  invoke_arn = "arn:aws:apigateway:${data.aws_region.this.region}:lambda:path/2015-03-31/functions/${local.lambda_arn}/invocations"
   app_metadata = tomap({
     // Inject app metadata into capabilities here (e.g. security_group_id, role_name)
     function_name = local.resource_name

app.tf

@@ -4,7 +4,7 @@ data "aws_ecr_authorization_token" "temporary" {
 
 provider "dockerless" {
   registry_auth = {
-    "${data.aws_caller_identity.this.account_id}.dkr.ecr.${data.aws_region.this.name}.amazonaws.com" = {
+    "${data.aws_caller_identity.this.account_id}.dkr.ecr.${data.aws_region.this.region}.amazonaws.com" = {
       username = data.aws_ecr_authorization_token.temporary.user_name
       password = data.aws_ecr_authorization_token.temporary.password
     }

bootstrap_image.tf

@@ -3,7 +3,8 @@
 locals {
   cap_modules = [
     {
-      id         = 0
+      name       = ""
+      tfId       = ""
       namespace  = ""
       env_prefix = ""
       outputs    = {}
@@ -50,7 +51,7 @@ locals {
       {
         logDriver = "awslogs"
         options = {
-          "awslogs-region"        = data.aws_region.this.name
+          "awslogs-region"        = data.aws_region.this.region
           "awslogs-group"         = module.logs.name
           "awslogs-stream-prefix" = local.block_name
         }

capabilities.tf

@@ -1,7 +1,7 @@
 {{ range . -}}
 provider "ns" {
-  capability_id = {{ .Id }}
-  alias         = "cap_{{ .Id }}"
+  capability_name = "{{ .Name }}"
+  alias           = "{{ .TfModuleName }}"
 }
 
 module "{{ .TfModuleName }}" {
@@ -11,13 +11,12 @@ module "{{ .TfModuleName }}" {
   {{- end }}
 
   app_metadata = local.app_metadata
-  {{ range $key, $value := .Variables -}}
-  {{ if $value.HasValue -}}
+  {{ range $key, $value := .Variables -}}{{- if $value.HasValue }}
   {{ $key }} = jsondecode({{ $value.Value | to_json_string }})
-  {{- end }}
-  {{ end }}
+  {{- end -}}{{- end }}
+
   providers = {
-    ns = ns.cap_{{ .Id}}
+    ns = ns.{{ .TfModuleName }}
   }
 }
 {{ end }}
@@ -37,7 +36,8 @@ locals {
   cap_modules = [
 {{- range $index, $element := .ExceptNeedsDestroyed }}
     {{ if $index }}, {{ end }}{
-      id         = {{ $element.Id }}
+      name       = "{{ $element.Name }}"
+      tfId       = "{{ $element.TfId }}"
       namespace  = "{{ $element.Namespace }}"
       env_prefix = "{{ $element.EnvPrefix }}"
       outputs    = {{ $element.TfModuleAddr }}
@@ -55,7 +55,7 @@ locals {
 
   cap_secrets = merge([
     for mod in local.cap_modules : {
-      for item in lookup(mod.outputs, "secrets", []) : "${mod.env_prefix}${item.name}" => item.value
+      for item in lookup(mod.outputs, "secrets", []) : "${mod.env_prefix}${item.name}" => sensitive(item.value)
     }
   ]...)
 }

capabilities.tf.tmpl

@@ -36,13 +36,13 @@ data "aws_iam_policy_document" "encryption_key" {
 
     principals {
       type        = "Service"
-      identifiers = ["logs.${data.aws_region.this.name}.amazonaws.com"]
+      identifiers = ["logs.${data.aws_region.this.region}.amazonaws.com"]
     }
 
     condition {
       test     = "ArnEquals"
       variable = "kms:EncryptionContext:aws:logs:arn"
-      values   = ["arn:aws:logs:${data.aws_region.this.name}:${data.aws_caller_identity.this.account_id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.this.region}:${data.aws_caller_identity.this.account_id}:*"]
     }
   }
 

encryption.tf

@@ -28,19 +28,25 @@ locals {
     NULLSTONE_PUBLIC_HOSTS  = join(",", local.public_hosts)
     NULLSTONE_PRIVATE_HOSTS = join(",", local.private_hosts)
   })
-
-  input_env_vars = merge(local.standard_env_vars, local.cap_env_vars, var.env_vars)
-  input_secrets  = merge(local.cap_secrets, var.secrets)
+  
+  input_env_vars    = merge(local.standard_env_vars, local.cap_env_vars, var.env_vars)
+  input_secrets     = merge(local.cap_secrets, var.secrets)
+  input_secret_keys = nonsensitive(concat(keys(local.cap_secrets), keys(var.secrets)))
 }
 
 data "ns_env_variables" "this" {
   input_env_variables = local.input_env_vars
   input_secrets       = local.input_secrets
 }
 
+// ns_secret_keys.this is used to calculate a set of secrets to add to aws secrets manager
+// The resulting "secret_keys" attribute must be known at plan time
+// This doesn't need to do a full interpolation because we only care about which inputs need to be added to aws secrets manager
+// ns_secret_keys.input_env_variables should contain only var.env_vars since they could contain interpolation that promotes them to sensitive
+// We exclude "local.cap_env_vars" because capabilities must use "cap_secrets" to create secrets
 data "ns_secret_keys" "this" {
   input_env_variables = var.env_vars
-  input_secret_keys   = nonsensitive(keys(local.input_secrets))
+  input_secret_keys   = local.input_secret_keys
 }
 
 locals {

env_vars.tf

@@ -1,6 +1,6 @@
 output "region" {
   description = "string ||| The region the lambda was created."
-  value       = data.aws_region.this.name
+  value       = data.aws_region.this.region
 }
 
 output "deployer" {
@@ -84,11 +84,11 @@ output "image_pusher" {
 }
 
 output "private_urls" {
-  description = "list(string) ||| A list of URLs only accessible inside the network."
   value       = local.private_urls
+  description = "list(string) ||| A list of URLs only accessible inside the network"
 }
 
 output "public_urls" {
-  description = "list(string) ||| A list of URLs accessible to the public"
   value       = local.public_urls
+  description = "list(string) ||| A list of URLs accessible to the public"
 }