Add default tags to AWS resources created by devops-security Terraform

[ale210]

Closes #172

Adds a provider "aws" block to terraform/backend.tf setting default_tags to managed-by = "terraform-devops-security", mirroring the block in hackforla/incubator but with a distinct value so a coverage report can tell the two Terraform states apart in account 035866691871. No region or profile keys — those stay ambient, as in incubator.

Second commit regenerates terraform/README.md with terraform-docs. That file was already stale on main independently of this change: it was missing the ## Resources section entirely, and its module table listed 9 users who no longer exist while omitting one who does. The regeneration catches all of that up and adds the ## Providers row this change introduces.

Plan result

0 to add, 24 to change, 0 to destroy — every one an in-place tags_all update, no other attribute touched: 17 aws_iam_user, 3 aws_iam_policy, 3 aws_iam_role, 1 aws_iam_openid_connect_provider. Existing user_tags (Project, Access Level) are preserved and merged with, not replaced by, the new tag.

IAM groups cannot be tagged — needs a different mechanism

AWS exposes no tagging API for IAM groups: there is no iam tag-group and no iam list-group-tags. So ops-leads, project-leads and read-only-group will stay untagged no matter what this repo declares, and the plan confirms it — zero aws_iam_group resources appear in the 24 changes. The same is true of the attachment and membership resources (aws_iam_group_policy_attachment, aws_iam_role_policy_attachment, aws_iam_user_group_membership) and of aws_iam_user_login_profile, none of which accept tags either. Whoever writes the coverage report in hackforla/devops#199 needs a non-tag mechanism for the group axis.

Pre-existing finding: the committed lock file is not what CI uses

Running terraform plan locally against unmodified main fails with 44 failed to decode identity: unsupported attribute "account_id" errors. This is not caused by this PR — it reproduces identically on a clean main checkout, before any change here.

Cause, now confirmed from this PR's own CI run: dflook/terraform-plan@v1 does not honour terraform/.terraform.lock.hcl. The workflow log shows Installing hashicorp/aws v6.62.0, while the committed lock pins 6.8.0. CI has therefore been running — and applying — on a floating latest provider for some time, and the remote state now carries resource identities with an account_id attribute that the pinned 6.8.0 cannot decode. A contributor following the repo as written gets a hard failure; CI does not, because it ignores the pin.

So the lock file is currently decorative, and this PR's plan is reproducible in CI but not locally without terraform init -upgrade. The lock is deliberately left at 6.8.0 here — bumping it, or making CI respect it, is a separate change with its own blast radius and deserves its own ticket. Flagging it rather than fixing it in a tagging PR.

Post-merge verification

After merge and apply, aws iam list-role-tags --role-name gha-incubator should return managed-by=terraform-devops-security. It returns {"Tags": []} today, so this is a real before/after check and cannot be done from the branch.

[github-actions]

Terraform plan in terraform
With backend config files: terraform/prod.backend.tfvars

Plan: 0 to add, 24 to change, 0 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place

Terraform will perform the following actions:

  # aws_iam_role.incubator_tf_apply will be updated in-place
!~  resource "aws_iam_role" "incubator_tf_apply" {
        id                    = "incubator-tf-apply"
        name                  = "incubator-tf-apply"
        tags                  = {}
!~      tags_all              = {
+           "managed-by" = "terraform-devops-security"
        }
#        (11 unchanged attributes hidden)
    }

  # aws_iam_role.incubator_tf_plan will be updated in-place
!~  resource "aws_iam_role" "incubator_tf_plan" {
        id                    = "incubator-tf-plan"
        name                  = "incubator-tf-plan"
        tags                  = {}
!~      tags_all              = {
+           "managed-by" = "terraform-devops-security"
        }
#        (11 unchanged attributes hidden)
    }

  # module.aws_custom_policies.aws_iam_policy.custom_policy["EnforceMFAForUsers"] will be updated in-place
!~  resource "aws_iam_policy" "custom_policy" {
        id               = "arn:aws:iam::035866691871:policy/EnforceMFAForUsers"
        name             = "EnforceMFAForUsers"
        tags             = {}
!~      tags_all         = {
+           "managed-by" = "terraform-devops-security"
        }
#        (7 unchanged attributes hidden)
    }

  # module.aws_custom_policies.aws_iam_policy.custom_policy["IAMServicesSupervisor"] will be updated in-place
!~  resource "aws_iam_policy" "custom_policy" {
        id               = "arn:aws:iam::035866691871:policy/IAMServicesSupervisor"
        name             = "IAMServicesSupervisor"
        tags             = {}
!~      tags_all         = {
+           "managed-by" = "terraform-devops-security"
        }
#        (7 unchanged attributes hidden)
    }

  # module.aws_custom_policies.aws_iam_policy.custom_policy["IncubatorTfPlanSecretsRead"] will be updated in-place
!~  resource "aws_iam_policy" "custom_policy" {
        id               = "arn:aws:iam::035866691871:policy/IncubatorTfPlanSecretsRead"
        name             = "IncubatorTfPlanSecretsRead"
        tags             = {}
!~      tags_all         = {
+           "managed-by" = "terraform-devops-security"
        }
#        (7 unchanged attributes hidden)
    }

  # module.iam_oidc_gha_incubator.aws_iam_openid_connect_provider.github_actions will be updated in-place
!~  resource "aws_iam_openid_connect_provider" "github_actions" {
        id              = "arn:aws:iam::035866691871:oidc-provider/token.actions.githubusercontent.com"
        tags            = {}
!~      tags_all        = {
+           "managed-by" = "terraform-devops-security"
        }
#        (4 unchanged attributes hidden)
    }

  # module.iam_oidc_gha_incubator.aws_iam_role.github_actions_oidc will be updated in-place
!~  resource "aws_iam_role" "github_actions_oidc" {
        id                    = "gha-incubator"
        name                  = "gha-incubator"
        tags                  = {}
!~      tags_all              = {
+           "managed-by" = "terraform-devops-security"
        }
#        (11 unchanged attributes hidden)
    }

  # module.iam_user_Bwoltz.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "Bwoltz"
        name                 = "Bwoltz"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_Ganeshswaminathan1912.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "Ganeshswaminathan1912"
        name                 = "Ganeshswaminathan1912"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "vrms"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_alexe.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "alexe"
        name                 = "alexe"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_benettonkkb.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "benettonkkb"
        name                 = "benettonkkb"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_bltomlin.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "bltomlin"
        name                 = "bltomlin"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_chelseyb.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "chelseyb"
        name                 = "chelseyb"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_drakeredwind01.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "drakeredwind01"
        name                 = "drakeredwind01"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_ezesalvatore4.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "ezesalvatore"
        name                 = "ezesalvatore"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_gmgonzal.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "gmgonzal"
        name                 = "gmgonzal"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_here.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "here"
        name                 = "here"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_myronchen-git.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "myronchen-git"
        name                 = "myronchen-git"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_npang4.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "npang4"
        name                 = "npang4"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_raibarra.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "raibarra04"
        name                 = "raibarra04"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_rsakuma.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "rsakuma"
        name                 = "rsakuma"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_srinipandiyan.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "srinipandiyan"
        name                 = "srinipandiyan"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_testiamuser.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "testiamuser"
        name                 = "testiamuser"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

  # module.iam_user_tylerthome.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id                   = "tyler.thome"
        name                 = "tyler.thome"
        tags                 = {
            "Access Level" = "1"
            "Project"      = "home-unite-us"
        }
!~      tags_all             = {
+           "managed-by"   = "terraform-devops-security"
#            (2 unchanged elements hidden)
        }
#        (5 unchanged attributes hidden)
    }

Plan: 0 to add, 24 to change, 0 to destroy.

❌ Error applying plan in Apply Terraform changes on merge #39