You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We need a script that reports, from live AWS, which resources in the incubator account are managed by Terraform and which are not, because the only record of that gap (hackforla/incubator#155) was captured by hand on 2026-08-24 and has no way to stay current.
Action Items
The approach is a tag sweep, not a state diff. Both incubator and devops-security stamp a managed-by default tag — the latter via the dependency above — so absence of that tag is the signal. This is the reporting that hackforla/incubator#121 was written to enable.
Add the script to this repo under scripts/. It spans two other repos' Terraform and one shared AWS account, which is why it belongs in devops rather than in incubator. Write it as Bash using the aws CLI and jq: devops has no package.json or Node tooling, so the two existing .js files under github-actions/ are GitHub Actions helpers, not a precedent for a standalone script.
Query the Resource Groups Tagging API (aws resourcegroupstaggingapi get-resources) and split what it returns into three buckets by managed-by value: terraform-incubator, terraform-devops-security, and untagged/other.
Sweep both us-west-2 and us-east-1. The API is region-scoped. us-west-2 holds the workloads; us-east-1 is where IAM policies, CloudFront-facing ACM certificates and Route 53 surface. A single-region run silently under-reports. Counts as of 2026-08-27: us-west-2 returns 188 resources, 128 of them managed-by=terraform-incubator; us-east-1 returns 11.
Handle IAM separately — the tagging API does not cover most of it. Verified 2026-08-27: with --resource-type-filters iam in us-east-1 the API returns 10 ARNs, every one of them a policy. It returns no IAM users and no IAM roles, even though tagged ones demonstrably exist (alexe carries Project/Access Level, incubator-cicd-vrms carries managed-by). Live totals the sweep therefore misses: 25 users, 44 roles, 3 groups, 33 customer-managed policies. Enumerate these directly with iam list-users, list-roles, list-groups and list-policies --scope Local, then read tags per resource with list-user-tags / list-role-tags / list-policy-tags.
Report the three IAM groups as a known-untaggable category rather than as unmanaged. AWS has no group tagging API, so they can never carry the tag and would otherwise be permanent false positives.
Document the remaining blind spots, in the script's output or a README beside it, so nobody mistakes the report for a complete inventory:
resource types that support no tags at all are invisible to a tag sweep entirely;
default_tags only lands on a resource when Terraform next creates or updates it, so a resource that has been in state since before the tag was added can still read as unmanaged until some later apply touches it;
the sweep says nothing about the reverse direction — a resource in Terraform state that no longer exists in AWS.
Read-only AWS calls only (describe-*, list-*, get-*). This script describes the account; it must never create, modify or delete anything, and must not run terraform apply.
Scope this issue to running the script locally against an AWS profile with read access. Running it on a schedule in GitHub Actions would need an OIDC role for hackforla/devops, which does not exist — devops-security/terraform/aws-gha-oidc-providers.tf grants gha-incubator to repo:hackforla/incubator only. Out of scope here; open a follow-on issue if the report proves worth automating.
Resources/Instructions
AWS account 035866691871 (incubator), regions us-west-2 and us-east-1.
Add default tags to AWS resources incubator#121 (closed) — added managed-by = terraform-incubator for exactly this reporting purpose. The provider block is at incubator/terraform/backend.tf lines 24-31.
Dependency
Overview
We need a script that reports, from live AWS, which resources in the incubator account are managed by Terraform and which are not, because the only record of that gap (hackforla/incubator#155) was captured by hand on 2026-08-24 and has no way to stay current.
Action Items
The approach is a tag sweep, not a state diff. Both incubator and devops-security stamp a
managed-bydefault tag — the latter via the dependency above — so absence of that tag is the signal. This is the reporting that hackforla/incubator#121 was written to enable.scripts/. It spans two other repos' Terraform and one shared AWS account, which is why it belongs indevopsrather than inincubator. Write it as Bash using theawsCLI andjq:devopshas nopackage.jsonor Node tooling, so the two existing.jsfiles undergithub-actions/are GitHub Actions helpers, not a precedent for a standalone script.aws resourcegroupstaggingapi get-resources) and split what it returns into three buckets bymanaged-byvalue:terraform-incubator,terraform-devops-security, and untagged/other.us-west-2andus-east-1. The API is region-scoped. us-west-2 holds the workloads; us-east-1 is where IAM policies, CloudFront-facing ACM certificates and Route 53 surface. A single-region run silently under-reports. Counts as of 2026-08-27: us-west-2 returns 188 resources, 128 of themmanaged-by=terraform-incubator; us-east-1 returns 11.--resource-type-filters iamin us-east-1 the API returns 10 ARNs, every one of them apolicy. It returns no IAM users and no IAM roles, even though tagged ones demonstrably exist (alexecarriesProject/Access Level,incubator-cicd-vrmscarriesmanaged-by). Live totals the sweep therefore misses: 25 users, 44 roles, 3 groups, 33 customer-managed policies. Enumerate these directly withiam list-users,list-roles,list-groupsandlist-policies --scope Local, then read tags per resource withlist-user-tags/list-role-tags/list-policy-tags.default_tagsonly lands on a resource when Terraform next creates or updates it, so a resource that has been in state since before the tag was added can still read as unmanaged until some later apply touches it;incubator-prodECS cluster, the ASG, the ALB, the ACM certificates, the 8 Route 53 hosted zones and 2 of the 3 Cognito user pools should all come back unmanaged. Route 53 is the sharpest check: 8 zones exist and the tagging sweep returns zero, which is exactly what "no zone is tagged" looks like. Where the script and Change ops repository name to 'devops' #155 disagree, say so in a comment on Change ops repository name to 'devops' #155 rather than assuming the script is right.describe-*,list-*,get-*). This script describes the account; it must never create, modify or delete anything, and must not runterraform apply.hackforla/devops, which does not exist —devops-security/terraform/aws-gha-oidc-providers.tfgrantsgha-incubatortorepo:hackforla/incubatoronly. Out of scope here; open a follow-on issue if the report proves worth automating.Resources/Instructions
035866691871(incubator), regionsus-west-2andus-east-1.managed-by = terraform-incubatorfor exactly this reporting purpose. The provider block is atincubator/terraform/backend.tflines 24-31.