#108 remove legacy 'dev' subdomain from Terraform

[jayhill]

No description provided.

[github-actions]

Terraform Dev Plan 🧪

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.main.aws_acm_certificate_validation.cloudfront_cert must be replaced
-/+ resource "aws_acm_certificate_validation" "cloudfront_cert" {
      ~ id                      = "0001-01-01 00:00:00 +0000 UTC" -> (known after apply)
      ~ validation_record_fqdns = [
          - "_92ab76aead9849ea4865bd0575a55af4.dev.zipcase.org",
          - "_be354e23f0a0918b8a91908d181ae35e.app-dev.zipcase.org",
        ] -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.main.aws_cloudfront_distribution.frontend will be updated in-place
  ~ resource "aws_cloudfront_distribution" "frontend" {
      ~ aliases                         = [
          - "app-dev.zipcase.org",
          - "dev.zipcase.org",
        ]
        id                              = "E1XGGL2RVXQ77N"
        tags                            = {
            "Environment" = "dev"
        }
        # (21 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # module.main.aws_route53_record.cloudfront_cert_validation["dev.zipcase.org"] will be created
  + resource "aws_route53_record" "cloudfront_cert_validation" {
      + allow_overwrite = (known after apply)
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = "_92ab76aead9849ea4865bd0575a55af4.dev.zipcase.org"
      + records         = [
          + "_b9b4c2c4f3ca9eac755571d5b2e4a375.xlfgrmvvlj.acm-validations.aws.",
        ]
      + ttl             = 60
      + type            = "CNAME"
      + zone_id         = "Z06541183E7BX11YADK3E"
    }

  # module.main.aws_s3_bucket_cors_configuration.frontend will be updated in-place
  ~ resource "aws_s3_bucket_cors_configuration" "frontend" {
        id                    = "zipcase-frontend-dev"
        # (2 unchanged attributes hidden)

      - cors_rule {
          - allowed_headers = [
              - "*",
            ] -> null
          - allowed_methods = [
              - "GET",
              - "HEAD",
            ] -> null
          - allowed_origins = [
              - "https://app-dev.zipcase.org",
              - "https://dev.zipcase.org",
            ] -> null
          - expose_headers  = [
              - "ETag",
            ] -> null
            id              = null
          - max_age_seconds = 3000 -> null
        }
      + cors_rule {
          + allowed_headers = [
              + "*",
            ]
          + allowed_methods = [
              + "GET",
              + "HEAD",
            ]
          + allowed_origins = [
              + "https://app-dev.zipcase.org",
            ]
          + expose_headers  = [
              + "ETag",
            ]
            id              = null
          + max_age_seconds = 3000
        }
    }

Plan: 2 to add, 2 to change, 1 to destroy.

Warning: Version constraints inside provider configuration blocks are deprecated

  on providers.tf line 3, in provider "aws":
   3:   version = "5.94.1"

Terraform 0.13 and earlier allowed provider version constraints inside the
provider configuration block, but that is now deprecated and will be removed
in a future version of Terraform. To silence this warning, move the provider
version constraint into the required_providers block.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

[github-actions]

Terraform Dev Plan 🧪

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.main.aws_acm_certificate_validation.cloudfront_cert must be replaced
-/+ resource "aws_acm_certificate_validation" "cloudfront_cert" {
      ~ id                      = "0001-01-01 00:00:00 +0000 UTC" -> (known after apply)
      ~ validation_record_fqdns = [
          - "_92ab76aead9849ea4865bd0575a55af4.dev.zipcase.org",
          - "_be354e23f0a0918b8a91908d181ae35e.app-dev.zipcase.org",
        ] -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.main.aws_cloudfront_distribution.frontend will be updated in-place
  ~ resource "aws_cloudfront_distribution" "frontend" {
      ~ aliases                         = [
          - "dev.zipcase.org",
            # (1 unchanged element hidden)
        ]
        id                              = "E1XGGL2RVXQ77N"
        tags                            = {
            "Environment" = "dev"
        }
        # (21 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # module.main.aws_route53_record.cloudfront_cert_validation["dev.zipcase.org"] will be created
  + resource "aws_route53_record" "cloudfront_cert_validation" {
      + allow_overwrite = (known after apply)
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = "_92ab76aead9849ea4865bd0575a55af4.dev.zipcase.org"
      + records         = [
          + "_b9b4c2c4f3ca9eac755571d5b2e4a375.xlfgrmvvlj.acm-validations.aws.",
        ]
      + ttl             = 60
      + type            = "CNAME"
      + zone_id         = "Z06541183E7BX11YADK3E"
    }

  # module.main.aws_s3_bucket_cors_configuration.frontend will be updated in-place
  ~ resource "aws_s3_bucket_cors_configuration" "frontend" {
        id                    = "zipcase-frontend-dev"
        # (2 unchanged attributes hidden)

      - cors_rule {
          - allowed_headers = [
              - "*",
            ] -> null
          - allowed_methods = [
              - "GET",
              - "HEAD",
            ] -> null
          - allowed_origins = [
              - "https://app-dev.zipcase.org",
              - "https://dev.zipcase.org",
            ] -> null
          - expose_headers  = [
              - "ETag",
            ] -> null
            id              = null
          - max_age_seconds = 3000 -> null
        }
      + cors_rule {
          + allowed_headers = [
              + "*",
            ]
          + allowed_methods = [
              + "GET",
              + "HEAD",
            ]
          + allowed_origins = [
              + "https://app-dev.zipcase.org",
            ]
          + expose_headers  = [
              + "ETag",
            ]
            id              = null
          + max_age_seconds = 3000
        }
    }

Plan: 2 to add, 2 to change, 1 to destroy.

Warning: Version constraints inside provider configuration blocks are deprecated

  on providers.tf line 3, in provider "aws":
   3:   version = "5.94.1"

Terraform 0.13 and earlier allowed provider version constraints inside the
provider configuration block, but that is now deprecated and will be removed
in a future version of Terraform. To silence this warning, move the provider
version constraint into the required_providers block.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

[github-actions]

Terraform Dev Plan 🧪

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.main.aws_acm_certificate_validation.cloudfront_cert must be replaced
-/+ resource "aws_acm_certificate_validation" "cloudfront_cert" {
      ~ id                      = "0001-01-01 00:00:00 +0000 UTC" -> (known after apply)
      ~ validation_record_fqdns = [
          - "_92ab76aead9849ea4865bd0575a55af4.dev.zipcase.org",
          - "_be354e23f0a0918b8a91908d181ae35e.app-dev.zipcase.org",
        ] -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.main.aws_cloudfront_distribution.frontend will be updated in-place
  ~ resource "aws_cloudfront_distribution" "frontend" {
      ~ aliases                         = [
          - "dev.zipcase.org",
            # (1 unchanged element hidden)
        ]
        id                              = "E1XGGL2RVXQ77N"
        tags                            = {
            "Environment" = "dev"
        }
        # (21 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # module.main.aws_route53_record.cloudfront_cert_validation["dev.zipcase.org"] will be created
  + resource "aws_route53_record" "cloudfront_cert_validation" {
      + allow_overwrite = (known after apply)
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = "_92ab76aead9849ea4865bd0575a55af4.dev.zipcase.org"
      + records         = [
          + "_b9b4c2c4f3ca9eac755571d5b2e4a375.xlfgrmvvlj.acm-validations.aws.",
        ]
      + ttl             = 60
      + type            = "CNAME"
      + zone_id         = "Z06541183E7BX11YADK3E"
    }

  # module.main.aws_s3_bucket_cors_configuration.frontend will be updated in-place
  ~ resource "aws_s3_bucket_cors_configuration" "frontend" {
        id                    = "zipcase-frontend-dev"
        # (2 unchanged attributes hidden)

      - cors_rule {
          - allowed_headers = [
              - "*",
            ] -> null
          - allowed_methods = [
              - "GET",
              - "HEAD",
            ] -> null
          - allowed_origins = [
              - "https://app-dev.zipcase.org",
              - "https://dev.zipcase.org",
            ] -> null
          - expose_headers  = [
              - "ETag",
            ] -> null
            id              = null
          - max_age_seconds = 3000 -> null
        }
      + cors_rule {
          + allowed_headers = [
              + "*",
            ]
          + allowed_methods = [
              + "GET",
              + "HEAD",
            ]
          + allowed_origins = [
              + "https://app-dev.zipcase.org",
            ]
          + expose_headers  = [
              + "ETag",
            ]
            id              = null
          + max_age_seconds = 3000
        }
    }

Plan: 2 to add, 2 to change, 1 to destroy.

Warning: Version constraints inside provider configuration blocks are deprecated

  on providers.tf line 3, in provider "aws":
   3:   version = "5.94.1"

Terraform 0.13 and earlier allowed provider version constraints inside the
provider configuration block, but that is now deprecated and will be removed
in a future version of Terraform. To silence this warning, move the provider
version constraint into the required_providers block.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

[github-actions]

Terraform Dev Plan 🧪

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement
+/- create replacement and then destroy

Terraform will perform the following actions:

  # module.main.aws_acm_certificate.cloudfront_cert must be replaced
+/- resource "aws_acm_certificate" "cloudfront_cert" {
      ~ arn                       = "arn:aws:acm:us-east-1:864981738327:certificate/a1b7e3f7-838b-42c5-b936-8646a7c15997" -> (known after apply)
      ~ domain_validation_options = [
          - {
              - domain_name           = "app-dev.zipcase.org"
              - resource_record_name  = "_be354e23f0a0918b8a91908d181ae35e.app-dev.zipcase.org."
              - resource_record_type  = "CNAME"
              - resource_record_value = "_255952759d62f1b4320f017cdfcdaa70.xlfgrmvvlj.acm-validations.aws."
            },
          - {
              - domain_name           = "dev.zipcase.org"
              - resource_record_name  = "_92ab76aead9849ea4865bd0575a55af4.dev.zipcase.org."
              - resource_record_type  = "CNAME"
              - resource_record_value = "_b9b4c2c4f3ca9eac755571d5b2e4a375.xlfgrmvvlj.acm-validations.aws."
            },
          + {
              + domain_name           = "app-dev.zipcase.org"
              + resource_record_name  = (known after apply)
              + resource_record_type  = (known after apply)
              + resource_record_value = (known after apply)
            },
        ]
      ~ id                        = "arn:aws:acm:us-east-1:864981738327:certificate/a1b7e3f7-838b-42c5-b936-8646a7c15997" -> (known after apply)
      ~ key_algorithm             = "RSA_2048" -> (known after apply)
      ~ not_after                 = "2026-05-02T23:59:59Z" -> (known after apply)
      ~ not_before                = "2025-04-03T00:00:00Z" -> (known after apply)
      ~ pending_renewal           = false -> (known after apply)
      ~ renewal_eligibility       = "ELIGIBLE" -> (known after apply)
      ~ renewal_summary           = [] -> (known after apply)
      ~ status                    = "ISSUED" -> (known after apply)
      ~ subject_alternative_names = [ # forces replacement
          - "dev.zipcase.org",
            # (1 unchanged element hidden)
        ]
      - tags                      = {} -> null
      ~ tags_all                  = {} -> (known after apply)
      ~ type                      = "AMAZON_ISSUED" -> (known after apply)
      ~ validation_emails         = [] -> (known after apply)
        # (4 unchanged attributes hidden)

      ~ options (known after apply)
      - options {
          - certificate_transparency_logging_preference = "ENABLED" -> null
        }
    }

  # module.main.aws_acm_certificate_validation.cloudfront_cert must be replaced
-/+ resource "aws_acm_certificate_validation" "cloudfront_cert" {
      ~ certificate_arn         = "arn:aws:acm:us-east-1:864981738327:certificate/a1b7e3f7-838b-42c5-b936-8646a7c15997" -> (known after apply) # forces replacement
      ~ id                      = "0001-01-01 00:00:00 +0000 UTC" -> (known after apply)
      ~ validation_record_fqdns = [
          - "_92ab76aead9849ea4865bd0575a55af4.dev.zipcase.org",
          - "_be354e23f0a0918b8a91908d181ae35e.app-dev.zipcase.org",
        ] -> (known after apply) # forces replacement
    }

  # module.main.aws_cloudfront_distribution.frontend will be updated in-place
  ~ resource "aws_cloudfront_distribution" "frontend" {
      ~ aliases                         = [
          - "dev.zipcase.org",
            # (1 unchanged element hidden)
        ]
        id                              = "E1XGGL2RVXQ77N"
        tags                            = {
            "Environment" = "dev"
        }
        # (21 unchanged attributes hidden)

      ~ viewer_certificate {
          ~ acm_certificate_arn            = "arn:aws:acm:us-east-1:864981738327:certificate/a1b7e3f7-838b-42c5-b936-8646a7c15997" -> (known after apply)
            # (4 unchanged attributes hidden)
        }

        # (5 unchanged blocks hidden)
    }

  # module.main.aws_route53_record.cloudfront_cert_validation["app-dev.zipcase.org"] must be replaced
-/+ resource "aws_route53_record" "cloudfront_cert_validation" {
      + allow_overwrite                  = (known after apply)
      ~ fqdn                             = "_be354e23f0a0918b8a91908d181ae35e.app-dev.zipcase.org" -> (known after apply)
      ~ id                               = "Z06541183E7BX11YADK3E__be354e23f0a0918b8a91908d181ae35e.app-dev.zipcase.org._CNAME" -> (known after apply)
      - multivalue_answer_routing_policy = false -> null
      ~ name                             = "_be354e23f0a0918b8a91908d181ae35e.app-dev.zipcase.org" -> (known after apply) # forces replacement
      ~ records                          = [
          - "_255952759d62f1b4320f017cdfcdaa70.xlfgrmvvlj.acm-validations.aws.",
        ] -> (known after apply)
      ~ type                             = "CNAME" -> (known after apply)
        # (4 unchanged attributes hidden)
    }

  # module.main.aws_s3_bucket_cors_configuration.frontend will be updated in-place
  ~ resource "aws_s3_bucket_cors_configuration" "frontend" {
        id                    = "zipcase-frontend-dev"
        # (2 unchanged attributes hidden)

      - cors_rule {
          - allowed_headers = [
              - "*",
            ] -> null
          - allowed_methods = [
              - "GET",
              - "HEAD",
            ] -> null
          - allowed_origins = [
              - "https://app-dev.zipcase.org",
              - "https://dev.zipcase.org",
            ] -> null
          - expose_headers  = [
              - "ETag",
            ] -> null
            id              = null
          - max_age_seconds = 3000 -> null
        }
      + cors_rule {
          + allowed_headers = [
              + "*",
            ]
          + allowed_methods = [
              + "GET",
              + "HEAD",
            ]
          + allowed_origins = [
              + "https://app-dev.zipcase.org",
            ]
          + expose_headers  = [
              + "ETag",
            ]
            id              = null
          + max_age_seconds = 3000
        }
    }

Plan: 3 to add, 2 to change, 3 to destroy.

Warning: Version constraints inside provider configuration blocks are deprecated

  on providers.tf line 3, in provider "aws":
   3:   version = "5.94.1"

Terraform 0.13 and earlier allowed provider version constraints inside the
provider configuration block, but that is now deprecated and will be removed
in a future version of Terraform. To silence this warning, move the provider
version constraint into the required_providers block.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.