Updated Amazon ElastiCache for Redis cluster auth_token generation

[kunduso]

Instead of storing the auth_token as a GitHub Actions secret, this PR is creating a Random resource and updating the AWS Secrets Manager secret with the new value. This PR closes #24

[github-actions]

Infracost report

💰 Monthly cost will increase by $174 📈

Project	Cost change	New monthly cost
kunduso/amazon-elasticache-redis-tf/TFplan.JSON	+$174 (+334%)	$226

Cost details

──────────────────────────────────
Project: kunduso/amazon-elasticache-redis-tf/TFplan.JSON

~ aws_elasticache_replication_group.app4
  +$174 ($50 → $223)

    ~ ElastiCache (on-demand, cache.t2.small)
      +$174 ($50 → $223)

Monthly cost change for kunduso/amazon-elasticache-redis-tf/TFplan.JSON
Amount:  +$174 ($52 → $226)
Percent: +334%

──────────────────────────────────
Key: ~ changed, + added, - removed

25 cloud resources were detected:
∙ 4 were estimated, 2 of which include usage-based costs, see https://infracost.io/usage-file
∙ 21 were free:
  ∙ 4 x aws_route_table
  ∙ 4 x aws_route_table_association
  ∙ 4 x aws_subnet
  ∙ 2 x aws_iam_policy
  ∙ 2 x aws_ssm_parameter
  ∙ 1 x aws_default_security_group
  ∙ 1 x aws_elasticache_subnet_group
  ∙ 1 x aws_secretsmanager_secret_version
  ∙ 1 x aws_security_group
  ∙ 1 x aws_vpc

Infracost estimate: Monthly cost will increase by $174 ↑
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━┓
┃ Project                                            ┃ Cost change   ┃ New monthly cost ┃
┣━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╋━━━━━━━━━━━━━━━╋━━━━━━━━━━━━━━━━━━┫
┃ kunduso/amazon-elasticache-redis-tf/TFplan.JSON    ┃ +$174 (+334%) ┃ $226             ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┻━━━━━━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━┛

_{This comment will be updated when code changes.}

[github-actions]

Terraform Format and Style 🖌success

Terraform Initialization ⚙️success

Terraform Plan 📖success

Terraform Validation 🤖success

Show Plan

terraform
random_password.auth: Refreshing state... [id=none]
aws_kms_key.encrytion_secret: Refreshing state... [id=49c814dd-0c0f-4e8d-8dc1-4e4b5f688166]
data.aws_availability_zones.available: Reading...
aws_kms_key.encrytion_rest: Refreshing state... [id=d25d563f-9511-4831-9aee-0823f480e665]
aws_vpc.this: Refreshing state... [id=vpc-0aee610d9ee2f5056]
data.aws_availability_zones.available: Read complete after 0s [id=us-east-2]
aws_secretsmanager_secret.elasticache_auth: Refreshing state... [id=arn:aws:secretsmanager:us-east-2:743794601996:secret:app-4-elasticache-auth-mcI2Ab]
aws_secretsmanager_secret_version.auth: Refreshing state... [id=arn:aws:secretsmanager:us-east-2:743794601996:secret:app-4-elasticache-auth-mcI2Ab|030E77C7-5BBA-4D11-8E41-AA25BF3868BB]
aws_iam_policy.secret_manager_policy: Refreshing state... [id=arn:aws:iam::743794601996:policy/app-4-secret-read-policy]
aws_route_table.public: Refreshing state... [id=rtb-07a879baced138b59]
aws_default_security_group.default: Refreshing state... [id=sg-017656e5a4e187b27]
aws_subnet.private[1]: Refreshing state... [id=subnet-00445199ef90108e3]
aws_subnet.public[0]: Refreshing state... [id=subnet-01504aaf919b844a2]
aws_security_group.elasticache: Refreshing state... [id=sg-042c8552097212094]
aws_route_table.private[1]: Refreshing state... [id=rtb-09c463d4787f20931]
aws_route_table.private[2]: Refreshing state... [id=rtb-0be19402a8902cddc]
aws_route_table.private[0]: Refreshing state... [id=rtb-00fd94662b273fa5f]
aws_subnet.private[0]: Refreshing state... [id=subnet-0d793fee34548d46b]
aws_subnet.private[2]: Refreshing state... [id=subnet-052cb9788e3699e42]
aws_route_table_association.public[0]: Refreshing state... [id=rtbassoc-049a33ab4984be2a1]
aws_route_table_association.private[1]: Refreshing state... [id=rtbassoc-0a3cfb9c7b6d62162]
aws_elasticache_subnet_group.elasticache_subnet: Refreshing state... [id=app-4-cache-subnet]
aws_route_table_association.private[2]: Refreshing state... [id=rtbassoc-0ec28b2c44b0623b5]
aws_route_table_association.private[0]: Refreshing state... [id=rtbassoc-07474438f8d7717f5]
aws_elasticache_replication_group.app4: Refreshing state... [id=app-4-redis-cluster]
aws_ssm_parameter.elasticache_ep: Refreshing state... [id=/elasticache/app-4/app-4-redis-cluster/endpoint]
aws_ssm_parameter.elasticache_port: Refreshing state... [id=/elasticache/app-4/app-4-redis-cluster/port]
aws_iam_policy.ssm_parameter_policy: Refreshing state... [id=arn:aws:iam::743794601996:policy/app-4-ssm-parameter-read-policy]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_elasticache_replication_group.app4 will be updated in-place
  ~ resource "aws_elasticache_replication_group" "app4" {
      ~ auth_token                     = (sensitive value)
        id                             = "app-4-redis-cluster"
      ~ member_clusters                = [
          - "app-4-redis-cluster-0001-001",
          - "app-4-redis-cluster-0001-003",
        ] -> (known after apply)
      ~ num_node_groups                = 1 -> 3
      ~ replicas_per_node_group        = 1 -> 2
      - snapshot_retention_limit       = 1 -> null
        tags                           = {}
        # (27 unchanged attributes hidden)
    }

  # aws_iam_policy.secret_manager_policy will be updated in-place
  ~ resource "aws_iam_policy" "secret_manager_policy" {
        id          = "arn:aws:iam::743794601996:policy/app-4-secret-read-policy"
        name        = "app-4-secret-read-policy"
      ~ policy      = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "secretsmanager:GetSecretValue",
                        ]
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:secretsmanager:us-east-2:743794601996:secret:app-4-elasticache-auth-mcI2Ab",
                        ]
                    },
                  - {
                      - Action   = [
                          - "kms:Decrypt",
                        ]
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:kms:us-east-2:743794601996:key/49c814dd-0c0f-4e8d-8dc1-4e4b5f688166",
                        ]
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        tags        = {}
        # (5 unchanged attributes hidden)
    }

  # aws_secretsmanager_secret_version.auth must be replaced
-/+ resource "aws_secretsmanager_secret_version" "auth" {
      ~ arn            = "arn:aws:secretsmanager:us-east-2:743794601996:secret:app-4-elasticache-auth-mcI2Ab" -> (known after apply)
      ~ id             = "arn:aws:secretsmanager:us-east-2:743794601996:secret:app-4-elasticache-auth-mcI2Ab|030E77C7-5BBA-4D11-8E41-AA25BF3868BB" -> (known after apply)
      ~ secret_string  = (sensitive value) # forces replacement
      ~ version_id     = "030E77C7-5BBA-4D11-8E41-AA25BF3868BB" -> (known after apply)
      ~ version_stages = [
          - "AWSCURRENT",
        ] -> (known after apply)
        # (1 unchanged attribute hidden)
    }

Plan: 1 to add, 2 to change, 1 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: TFplan.JSON

To perform exactly these actions, run the following command to apply:
    terraform apply "TFplan.JSON"

Pushed by: @kunduso, Action: pull_request