chore: cleanup and adding SLAI

krishsax commented

2026-09-26 04:19:04 +00:00

Member

thanks :D

krishsax added 1 commit

2026-09-26 04:19:04 +00:00

chore: cleanup and adding SLAI Repo

CI / build (pull_request) Has been skipped

Details

atlantis/pre_workflow_hook: Install local-only OpenTofu providers succeeded.

Details

kennel/build skipped: no services or static sites defined

Details

Validate / Governance (pull_request_target) Successful in 3m3s

Details

CI / check (pull_request) Has been cancelled

Details

CI / check-1 (pull_request) Has been cancelled

Details

22f21f6941

krishsax requested reviews from thesuperRL, anish

2026-09-26 04:19:04 +00:00

scottylabs-bot added 1 commit

2026-09-26 04:21:33 +00:00

chore: regenerate tofu, schemas, CODEOWNERS [skip ci]

atlantis/pre_workflow_hook: Install local-only OpenTofu providers succeeded.

Details

atlantis/plan: keycloak Plan failed.

Details

atlantis/plan: git Plan failed.

Details

atlantis/plan: openbao Plan: 6 to add, 50 to change, 0 to destroy.

Details

atlantis/plan 2/3 projects failed to plan.

kennel/build skipped: no services or static sites defined

Details

8e90e2fd20

scottylabs-bot commented

2026-09-26 04:21:46 +00:00

Owner

Ran Plan for 3 projects:

project: keycloak dir: tofu/keycloak workspace: default
project: git dir: tofu/git workspace: default
project: openbao dir: tofu/openbao workspace: default

1. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

Plan Failed: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

2. project: `git` dir: `tofu/git` workspace: `default`

Plan Failed: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

3. project: `openbao` dir: `tofu/openbao` workspace: `default`

Show Output

Compiling governance-schema v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/376/default/crates/governance-schema)
   Compiling governance-core v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/376/default/crates/governance-core)
   Compiling governance-tfgen v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/376/default/crates/governance-tfgen)
   Compiling governance v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/376/default/crates/governance-cli)
    Finished `release` profile [optimized] target(s) in 8.76s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
! update in-place (current -> planned)

OpenTofu will perform the following actions:

  # vault_identity_group.slai-repo_admins will be created
+ resource "vault_identity_group" "slai-repo_admins" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "slai-repo-admins"
+       policies                   = [
+           "slai-repo-prod",
        ]
+       type                       = "external"
    }

  # vault_identity_group.slai-repo_members will be created
+ resource "vault_identity_group" "slai-repo_members" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "slai-repo-members"
+       policies                   = [
+           "slai-repo-dev",
        ]
+       type                       = "external"
    }

  # vault_identity_group_alias.slai-repo_admins will be created
+ resource "vault_identity_group_alias" "slai-repo_admins" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/slai-repo/admins"
    }

  # vault_identity_group_alias.slai-repo_members will be created
+ resource "vault_identity_group_alias" "slai-repo_members" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/slai-repo"
    }

  # vault_policy.bus-sign_dev will be updated in-place
! resource "vault_policy" "bus-sign_dev" {
        id     = "bus-sign-dev"
        name   = "bus-sign-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/bus-sign/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.bus-sign_prod will be updated in-place
! resource "vault_policy" "bus-sign_prod" {
        id     = "bus-sign-prod"
        name   = "bus-sign-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/bus-sign/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_dev will be updated in-place
! resource "vault_policy" "cal_dev" {
        id     = "cal-dev"
        name   = "cal-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cal/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_prod will be updated in-place
! resource "vault_policy" "cal_prod" {
        id     = "cal-prod"
        name   = "cal-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cal/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_dev will be updated in-place
! resource "vault_policy" "changelog_dev" {
        id     = "changelog-dev"
        name   = "changelog-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/changelog/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_prod will be updated in-place
! resource "vault_policy" "changelog_prod" {
        id     = "changelog-prod"
        name   = "changelog-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/changelog/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_dev will be updated in-place
! resource "vault_policy" "cmugpt-agent_dev" {
        id     = "cmugpt-agent-dev"
        name   = "cmugpt-agent-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-agent/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_prod will be updated in-place
! resource "vault_policy" "cmugpt-agent_prod" {
        id     = "cmugpt-agent-prod"
        name   = "cmugpt-agent-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-agent/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_dev will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_dev" {
        id     = "cmugpt-mcp-server-dev"
        name   = "cmugpt-mcp-server-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-mcp-server/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_prod will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_prod" {
        id     = "cmugpt-mcp-server-prod"
        name   = "cmugpt-mcp-server-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-mcp-server/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_dev" {
        id     = "cmugpt-sms-surface-dev"
        name   = "cmugpt-sms-surface-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-sms-surface/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_prod" {
        id     = "cmugpt-sms-surface-prod"
        name   = "cmugpt-sms-surface-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-sms-surface/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-surface_dev" {
        id     = "cmugpt-surface-dev"
        name   = "cmugpt-surface-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-surface/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-surface_prod" {
        id     = "cmugpt-surface-prod"
        name   = "cmugpt-surface-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-surface/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_dev will be updated in-place
! resource "vault_policy" "components_dev" {
        id     = "components-dev"
        name   = "components-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/components/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_prod will be updated in-place
! resource "vault_policy" "components_prod" {
        id     = "components-prod"
        name   = "components-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/components/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_dev will be updated in-place
! resource "vault_policy" "courses_dev" {
        id     = "courses-dev"
        name   = "courses-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/courses/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_prod will be updated in-place
! resource "vault_policy" "courses_prod" {
        id     = "courses-prod"
        name   = "courses-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/courses/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_dev will be updated in-place
! resource "vault_policy" "dalmatian_dev" {
        id     = "dalmatian-dev"
        name   = "dalmatian-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/dalmatian/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_prod will be updated in-place
! resource "vault_policy" "dalmatian_prod" {
        id     = "dalmatian-prod"
        name   = "dalmatian-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/dalmatian/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_dev will be updated in-place
! resource "vault_policy" "discord-verify_dev" {
        id     = "discord-verify-dev"
        name   = "discord-verify-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/discord-verify/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_prod will be updated in-place
! resource "vault_policy" "discord-verify_prod" {
        id     = "discord-verify-prod"
        name   = "discord-verify-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/discord-verify/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_dev will be updated in-place
! resource "vault_policy" "documentation_dev" {
        id     = "documentation-dev"
        name   = "documentation-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/documentation/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_prod will be updated in-place
! resource "vault_policy" "documentation_prod" {
        id     = "documentation-prod"
        name   = "documentation-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/documentation/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_dev will be updated in-place
! resource "vault_policy" "eats_dev" {
        id     = "eats-dev"
        name   = "eats-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/eats/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_prod will be updated in-place
! resource "vault_policy" "eats_prod" {
        id     = "eats-prod"
        name   = "eats-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/eats/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_dev will be updated in-place
! resource "vault_policy" "groupme-mirror_dev" {
        id     = "groupme-mirror-dev"
        name   = "groupme-mirror-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/groupme-mirror/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_prod will be updated in-place
! resource "vault_policy" "groupme-mirror_prod" {
        id     = "groupme-mirror-prod"
        name   = "groupme-mirror-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/groupme-mirror/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_dev will be updated in-place
! resource "vault_policy" "housing_dev" {
        id     = "housing-dev"
        name   = "housing-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/housing/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_prod will be updated in-place
! resource "vault_policy" "housing_prod" {
        id     = "housing-prod"
        name   = "housing-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/housing/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_dev will be updated in-place
! resource "vault_policy" "insta_dev" {
        id     = "insta-dev"
        name   = "insta-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/insta/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_prod will be updated in-place
! resource "vault_policy" "insta_prod" {
        id     = "insta-prod"
        name   = "insta-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/insta/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_dev will be updated in-place
! resource "vault_policy" "link-shortener_dev" {
        id     = "link-shortener-dev"
        name   = "link-shortener-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/link-shortener/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_prod will be updated in-place
! resource "vault_policy" "link-shortener_prod" {
        id     = "link-shortener-prod"
        name   = "link-shortener-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/link-shortener/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_dev will be updated in-place
! resource "vault_policy" "lost-and-found_dev" {
        id     = "lost-and-found-dev"
        name   = "lost-and-found-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/lost-and-found/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_prod will be updated in-place
! resource "vault_policy" "lost-and-found_prod" {
        id     = "lost-and-found-prod"
        name   = "lost-and-found-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/lost-and-found/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_dev will be updated in-place
! resource "vault_policy" "maps_dev" {
        id     = "maps-dev"
        name   = "maps-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/maps/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_prod will be updated in-place
! resource "vault_policy" "maps_prod" {
        id     = "maps-prod"
        name   = "maps-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/maps/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_dev will be updated in-place
! resource "vault_policy" "occ-main_dev" {
        id     = "occ-main-dev"
        name   = "occ-main-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/occ-main/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_prod will be updated in-place
! resource "vault_policy" "occ-main_prod" {
        id     = "occ-main-prod"
        name   = "occ-main-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/occ-main/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_dev will be updated in-place
! resource "vault_policy" "quest_dev" {
        id     = "quest-dev"
        name   = "quest-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/quest/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_prod will be updated in-place
! resource "vault_policy" "quest_prod" {
        id     = "quest-prod"
        name   = "quest-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/quest/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_dev will be updated in-place
! resource "vault_policy" "scottylabs-org_dev" {
        id     = "scottylabs-org-dev"
        name   = "scottylabs-org-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/scottylabs-org/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_prod will be updated in-place
! resource "vault_policy" "scottylabs-org_prod" {
        id     = "scottylabs-org-prod"
        name   = "scottylabs-org-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/scottylabs-org/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-repo_dev will be created
+ resource "vault_policy" "slai-repo_dev" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "slai-repo-dev"
+       policy          = <<-EOT
            path "secret/data/secretspec/slai-repo/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-repo/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-repo_prod will be created
+ resource "vault_policy" "slai-repo_prod" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "slai-repo-prod"
+       policy          = <<-EOT
            path "secret/data/secretspec/slai-repo/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-repo/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-repo/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_dev will be updated in-place
! resource "vault_policy" "study_dev" {
        id     = "study-dev"
        name   = "study-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/study/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_prod will be updated in-place
! resource "vault_policy" "study_prod" {
        id     = "study-prod"
        name   = "study-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/study/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_dev will be updated in-place
! resource "vault_policy" "tartan-vote_dev" {
        id     = "tartan-vote-dev"
        name   = "tartan-vote-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/tartan-vote/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_prod will be updated in-place
! resource "vault_policy" "tartan-vote_prod" {
        id     = "tartan-vote-prod"
        name   = "tartan-vote-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/tartan-vote/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_dev will be updated in-place
! resource "vault_policy" "terrier_dev" {
        id     = "terrier-dev"
        name   = "terrier-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/terrier/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_prod will be updated in-place
! resource "vault_policy" "terrier_prod" {
        id     = "terrier-prod"
        name   = "terrier-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/terrier/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

Plan: 6 to add, 50 to change, 0 to destroy.

▶️ To apply this plan, comment:
```
atlantis apply -p openbao
```
🚮 To delete this plan and lock, click here
🔁 To plan this project again, comment:
```
atlantis plan -p openbao
```

Plan: 6 to add, 50 to change, 0 to destroy.

Plan Summary

3 projects, 1 with changes, 0 with no changes, 2 failed

⏩ To apply all unapplied plans from this Pull Request, comment:
```
atlantis apply
```
🚮 To delete all plans and locks from this Pull Request, comment:
```
atlantis unlock
```

Ran Plan for 3 projects: 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` 1. project: `git` dir: `tofu/git` workspace: `default` 1. project: `openbao` dir: `tofu/openbao` workspace: `default` --- ### 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 2. project: `git` dir: `tofu/git` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 3. project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Compiling governance-schema v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/376/default/crates/governance-schema) Compiling governance-core v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/376/default/crates/governance-core) Compiling governance-tfgen v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/376/default/crates/governance-tfgen) Compiling governance v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/376/default/crates/governance-cli) Finished `release` profile [optimized] target(s) in 8.76s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create ! update in-place (current -> planned) OpenTofu will perform the following actions: # vault_identity_group.slai-repo_admins will be created + resource "vault_identity_group" "slai-repo_admins" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "slai-repo-admins" + policies = [ + "slai-repo-prod", ] + type = "external" } # vault_identity_group.slai-repo_members will be created + resource "vault_identity_group" "slai-repo_members" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "slai-repo-members" + policies = [ + "slai-repo-dev", ] + type = "external" } # vault_identity_group_alias.slai-repo_admins will be created + resource "vault_identity_group_alias" "slai-repo_admins" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/slai-repo/admins" } # vault_identity_group_alias.slai-repo_members will be created + resource "vault_identity_group_alias" "slai-repo_members" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/slai-repo" } # vault_policy.bus-sign_dev will be updated in-place ! resource "vault_policy" "bus-sign_dev" { id = "bus-sign-dev" name = "bus-sign-dev" ! policy = <<-EOT path "secret/data/secretspec/bus-sign/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.bus-sign_prod will be updated in-place ! resource "vault_policy" "bus-sign_prod" { id = "bus-sign-prod" name = "bus-sign-prod" ! policy = <<-EOT path "secret/data/secretspec/bus-sign/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_dev will be updated in-place ! resource "vault_policy" "cal_dev" { id = "cal-dev" name = "cal-dev" ! policy = <<-EOT path "secret/data/secretspec/cal/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_prod will be updated in-place ! resource "vault_policy" "cal_prod" { id = "cal-prod" name = "cal-prod" ! policy = <<-EOT path "secret/data/secretspec/cal/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_dev will be updated in-place ! resource "vault_policy" "changelog_dev" { id = "changelog-dev" name = "changelog-dev" ! policy = <<-EOT path "secret/data/secretspec/changelog/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_prod will be updated in-place ! resource "vault_policy" "changelog_prod" { id = "changelog-prod" name = "changelog-prod" ! policy = <<-EOT path "secret/data/secretspec/changelog/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_dev will be updated in-place ! resource "vault_policy" "cmugpt-agent_dev" { id = "cmugpt-agent-dev" name = "cmugpt-agent-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-agent/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_prod will be updated in-place ! resource "vault_policy" "cmugpt-agent_prod" { id = "cmugpt-agent-prod" name = "cmugpt-agent-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-agent/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_dev will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_dev" { id = "cmugpt-mcp-server-dev" name = "cmugpt-mcp-server-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-mcp-server/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_prod will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_prod" { id = "cmugpt-mcp-server-prod" name = "cmugpt-mcp-server-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-mcp-server/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_dev" { id = "cmugpt-sms-surface-dev" name = "cmugpt-sms-surface-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-sms-surface/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_prod" { id = "cmugpt-sms-surface-prod" name = "cmugpt-sms-surface-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-sms-surface/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-surface_dev" { id = "cmugpt-surface-dev" name = "cmugpt-surface-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-surface/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-surface_prod" { id = "cmugpt-surface-prod" name = "cmugpt-surface-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-surface/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_dev will be updated in-place ! resource "vault_policy" "components_dev" { id = "components-dev" name = "components-dev" ! policy = <<-EOT path "secret/data/secretspec/components/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_prod will be updated in-place ! resource "vault_policy" "components_prod" { id = "components-prod" name = "components-prod" ! policy = <<-EOT path "secret/data/secretspec/components/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_dev will be updated in-place ! resource "vault_policy" "courses_dev" { id = "courses-dev" name = "courses-dev" ! policy = <<-EOT path "secret/data/secretspec/courses/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_prod will be updated in-place ! resource "vault_policy" "courses_prod" { id = "courses-prod" name = "courses-prod" ! policy = <<-EOT path "secret/data/secretspec/courses/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_dev will be updated in-place ! resource "vault_policy" "dalmatian_dev" { id = "dalmatian-dev" name = "dalmatian-dev" ! policy = <<-EOT path "secret/data/secretspec/dalmatian/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_prod will be updated in-place ! resource "vault_policy" "dalmatian_prod" { id = "dalmatian-prod" name = "dalmatian-prod" ! policy = <<-EOT path "secret/data/secretspec/dalmatian/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_dev will be updated in-place ! resource "vault_policy" "discord-verify_dev" { id = "discord-verify-dev" name = "discord-verify-dev" ! policy = <<-EOT path "secret/data/secretspec/discord-verify/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_prod will be updated in-place ! resource "vault_policy" "discord-verify_prod" { id = "discord-verify-prod" name = "discord-verify-prod" ! policy = <<-EOT path "secret/data/secretspec/discord-verify/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_dev will be updated in-place ! resource "vault_policy" "documentation_dev" { id = "documentation-dev" name = "documentation-dev" ! policy = <<-EOT path "secret/data/secretspec/documentation/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_prod will be updated in-place ! resource "vault_policy" "documentation_prod" { id = "documentation-prod" name = "documentation-prod" ! policy = <<-EOT path "secret/data/secretspec/documentation/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_dev will be updated in-place ! resource "vault_policy" "eats_dev" { id = "eats-dev" name = "eats-dev" ! policy = <<-EOT path "secret/data/secretspec/eats/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_prod will be updated in-place ! resource "vault_policy" "eats_prod" { id = "eats-prod" name = "eats-prod" ! policy = <<-EOT path "secret/data/secretspec/eats/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_dev will be updated in-place ! resource "vault_policy" "groupme-mirror_dev" { id = "groupme-mirror-dev" name = "groupme-mirror-dev" ! policy = <<-EOT path "secret/data/secretspec/groupme-mirror/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_prod will be updated in-place ! resource "vault_policy" "groupme-mirror_prod" { id = "groupme-mirror-prod" name = "groupme-mirror-prod" ! policy = <<-EOT path "secret/data/secretspec/groupme-mirror/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_dev will be updated in-place ! resource "vault_policy" "housing_dev" { id = "housing-dev" name = "housing-dev" ! policy = <<-EOT path "secret/data/secretspec/housing/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_prod will be updated in-place ! resource "vault_policy" "housing_prod" { id = "housing-prod" name = "housing-prod" ! policy = <<-EOT path "secret/data/secretspec/housing/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_dev will be updated in-place ! resource "vault_policy" "insta_dev" { id = "insta-dev" name = "insta-dev" ! policy = <<-EOT path "secret/data/secretspec/insta/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_prod will be updated in-place ! resource "vault_policy" "insta_prod" { id = "insta-prod" name = "insta-prod" ! policy = <<-EOT path "secret/data/secretspec/insta/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_dev will be updated in-place ! resource "vault_policy" "link-shortener_dev" { id = "link-shortener-dev" name = "link-shortener-dev" ! policy = <<-EOT path "secret/data/secretspec/link-shortener/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_prod will be updated in-place ! resource "vault_policy" "link-shortener_prod" { id = "link-shortener-prod" name = "link-shortener-prod" ! policy = <<-EOT path "secret/data/secretspec/link-shortener/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_dev will be updated in-place ! resource "vault_policy" "lost-and-found_dev" { id = "lost-and-found-dev" name = "lost-and-found-dev" ! policy = <<-EOT path "secret/data/secretspec/lost-and-found/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_prod will be updated in-place ! resource "vault_policy" "lost-and-found_prod" { id = "lost-and-found-prod" name = "lost-and-found-prod" ! policy = <<-EOT path "secret/data/secretspec/lost-and-found/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_dev will be updated in-place ! resource "vault_policy" "maps_dev" { id = "maps-dev" name = "maps-dev" ! policy = <<-EOT path "secret/data/secretspec/maps/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_prod will be updated in-place ! resource "vault_policy" "maps_prod" { id = "maps-prod" name = "maps-prod" ! policy = <<-EOT path "secret/data/secretspec/maps/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_dev will be updated in-place ! resource "vault_policy" "occ-main_dev" { id = "occ-main-dev" name = "occ-main-dev" ! policy = <<-EOT path "secret/data/secretspec/occ-main/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_prod will be updated in-place ! resource "vault_policy" "occ-main_prod" { id = "occ-main-prod" name = "occ-main-prod" ! policy = <<-EOT path "secret/data/secretspec/occ-main/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_dev will be updated in-place ! resource "vault_policy" "quest_dev" { id = "quest-dev" name = "quest-dev" ! policy = <<-EOT path "secret/data/secretspec/quest/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_prod will be updated in-place ! resource "vault_policy" "quest_prod" { id = "quest-prod" name = "quest-prod" ! policy = <<-EOT path "secret/data/secretspec/quest/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_dev will be updated in-place ! resource "vault_policy" "scottylabs-org_dev" { id = "scottylabs-org-dev" name = "scottylabs-org-dev" ! policy = <<-EOT path "secret/data/secretspec/scottylabs-org/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_prod will be updated in-place ! resource "vault_policy" "scottylabs-org_prod" { id = "scottylabs-org-prod" name = "scottylabs-org-prod" ! policy = <<-EOT path "secret/data/secretspec/scottylabs-org/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-repo_dev will be created + resource "vault_policy" "slai-repo_dev" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "slai-repo-dev" + policy = <<-EOT path "secret/data/secretspec/slai-repo/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-repo/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-repo_prod will be created + resource "vault_policy" "slai-repo_prod" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "slai-repo-prod" + policy = <<-EOT path "secret/data/secretspec/slai-repo/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-repo/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-repo/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_dev will be updated in-place ! resource "vault_policy" "study_dev" { id = "study-dev" name = "study-dev" ! policy = <<-EOT path "secret/data/secretspec/study/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_prod will be updated in-place ! resource "vault_policy" "study_prod" { id = "study-prod" name = "study-prod" ! policy = <<-EOT path "secret/data/secretspec/study/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_dev will be updated in-place ! resource "vault_policy" "tartan-vote_dev" { id = "tartan-vote-dev" name = "tartan-vote-dev" ! policy = <<-EOT path "secret/data/secretspec/tartan-vote/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_prod will be updated in-place ! resource "vault_policy" "tartan-vote_prod" { id = "tartan-vote-prod" name = "tartan-vote-prod" ! policy = <<-EOT path "secret/data/secretspec/tartan-vote/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_dev will be updated in-place ! resource "vault_policy" "terrier_dev" { id = "terrier-dev" name = "terrier-dev" ! policy = <<-EOT path "secret/data/secretspec/terrier/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_prod will be updated in-place ! resource "vault_policy" "terrier_prod" { id = "terrier-prod" name = "terrier-prod" ! policy = <<-EOT path "secret/data/secretspec/terrier/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/ci/*" { capabilities = ["list", "read", "delete"] } EOT } Plan: 6 to add, 50 to change, 0 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p openbao ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fopenbao%252Fdefault%252Fopenbao) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p openbao ``` Plan: 6 to add, 50 to change, 0 to destroy. --- ### Plan Summary 3 projects, 1 with changes, 0 with no changes, 2 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```

krishsax added 1 commit

2026-09-26 04:24:22 +00:00

chore: rename to RFCs

CI / build (pull_request) Has been skipped

Details

atlantis/pre_workflow_hook: Install local-only OpenTofu providers succeeded.

Details

atlantis/plan: keycloak Plan failed.

Details

atlantis/plan: git Plan failed.

Details

atlantis/plan: openbao Plan: 6 to add, 50 to change, 0 to destroy.

Details

atlantis/plan 2/3 projects failed to plan.

kennel/build skipped: no services or static sites defined

Details

Validate / Governance (pull_request_target) Successful in 2m54s

Details

CI / check-1 (pull_request) Successful in 4m9s

Details

CI / check (pull_request) Successful in 0s

Details

174f77868e

scottylabs-bot commented

2026-09-26 04:24:27 +00:00

Owner

Ran Plan for 3 projects:

project: keycloak dir: tofu/keycloak workspace: default
project: git dir: tofu/git workspace: default
project: openbao dir: tofu/openbao workspace: default

1. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

Plan Failed: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

2. project: `git` dir: `tofu/git` workspace: `default`

Plan Failed: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

3. project: `openbao` dir: `tofu/openbao` workspace: `default`

Show Output

Finished `release` profile [optimized] target(s) in 0.08s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
! update in-place (current -> planned)

OpenTofu will perform the following actions:

  # vault_identity_group.slai-repo_admins will be created
+ resource "vault_identity_group" "slai-repo_admins" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "slai-repo-admins"
+       policies                   = [
+           "slai-repo-prod",
        ]
+       type                       = "external"
    }

  # vault_identity_group.slai-repo_members will be created
+ resource "vault_identity_group" "slai-repo_members" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "slai-repo-members"
+       policies                   = [
+           "slai-repo-dev",
        ]
+       type                       = "external"
    }

  # vault_identity_group_alias.slai-repo_admins will be created
+ resource "vault_identity_group_alias" "slai-repo_admins" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/slai-repo/admins"
    }

  # vault_identity_group_alias.slai-repo_members will be created
+ resource "vault_identity_group_alias" "slai-repo_members" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/slai-repo"
    }

  # vault_policy.bus-sign_dev will be updated in-place
! resource "vault_policy" "bus-sign_dev" {
        id     = "bus-sign-dev"
        name   = "bus-sign-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/bus-sign/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.bus-sign_prod will be updated in-place
! resource "vault_policy" "bus-sign_prod" {
        id     = "bus-sign-prod"
        name   = "bus-sign-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/bus-sign/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_dev will be updated in-place
! resource "vault_policy" "cal_dev" {
        id     = "cal-dev"
        name   = "cal-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cal/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_prod will be updated in-place
! resource "vault_policy" "cal_prod" {
        id     = "cal-prod"
        name   = "cal-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cal/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_dev will be updated in-place
! resource "vault_policy" "changelog_dev" {
        id     = "changelog-dev"
        name   = "changelog-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/changelog/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_prod will be updated in-place
! resource "vault_policy" "changelog_prod" {
        id     = "changelog-prod"
        name   = "changelog-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/changelog/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_dev will be updated in-place
! resource "vault_policy" "cmugpt-agent_dev" {
        id     = "cmugpt-agent-dev"
        name   = "cmugpt-agent-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-agent/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_prod will be updated in-place
! resource "vault_policy" "cmugpt-agent_prod" {
        id     = "cmugpt-agent-prod"
        name   = "cmugpt-agent-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-agent/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_dev will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_dev" {
        id     = "cmugpt-mcp-server-dev"
        name   = "cmugpt-mcp-server-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-mcp-server/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_prod will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_prod" {
        id     = "cmugpt-mcp-server-prod"
        name   = "cmugpt-mcp-server-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-mcp-server/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_dev" {
        id     = "cmugpt-sms-surface-dev"
        name   = "cmugpt-sms-surface-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-sms-surface/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_prod" {
        id     = "cmugpt-sms-surface-prod"
        name   = "cmugpt-sms-surface-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-sms-surface/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-surface_dev" {
        id     = "cmugpt-surface-dev"
        name   = "cmugpt-surface-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-surface/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-surface_prod" {
        id     = "cmugpt-surface-prod"
        name   = "cmugpt-surface-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-surface/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_dev will be updated in-place
! resource "vault_policy" "components_dev" {
        id     = "components-dev"
        name   = "components-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/components/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_prod will be updated in-place
! resource "vault_policy" "components_prod" {
        id     = "components-prod"
        name   = "components-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/components/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_dev will be updated in-place
! resource "vault_policy" "courses_dev" {
        id     = "courses-dev"
        name   = "courses-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/courses/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_prod will be updated in-place
! resource "vault_policy" "courses_prod" {
        id     = "courses-prod"
        name   = "courses-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/courses/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_dev will be updated in-place
! resource "vault_policy" "dalmatian_dev" {
        id     = "dalmatian-dev"
        name   = "dalmatian-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/dalmatian/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_prod will be updated in-place
! resource "vault_policy" "dalmatian_prod" {
        id     = "dalmatian-prod"
        name   = "dalmatian-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/dalmatian/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_dev will be updated in-place
! resource "vault_policy" "discord-verify_dev" {
        id     = "discord-verify-dev"
        name   = "discord-verify-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/discord-verify/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_prod will be updated in-place
! resource "vault_policy" "discord-verify_prod" {
        id     = "discord-verify-prod"
        name   = "discord-verify-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/discord-verify/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_dev will be updated in-place
! resource "vault_policy" "documentation_dev" {
        id     = "documentation-dev"
        name   = "documentation-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/documentation/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_prod will be updated in-place
! resource "vault_policy" "documentation_prod" {
        id     = "documentation-prod"
        name   = "documentation-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/documentation/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_dev will be updated in-place
! resource "vault_policy" "eats_dev" {
        id     = "eats-dev"
        name   = "eats-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/eats/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_prod will be updated in-place
! resource "vault_policy" "eats_prod" {
        id     = "eats-prod"
        name   = "eats-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/eats/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_dev will be updated in-place
! resource "vault_policy" "groupme-mirror_dev" {
        id     = "groupme-mirror-dev"
        name   = "groupme-mirror-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/groupme-mirror/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_prod will be updated in-place
! resource "vault_policy" "groupme-mirror_prod" {
        id     = "groupme-mirror-prod"
        name   = "groupme-mirror-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/groupme-mirror/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_dev will be updated in-place
! resource "vault_policy" "housing_dev" {
        id     = "housing-dev"
        name   = "housing-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/housing/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_prod will be updated in-place
! resource "vault_policy" "housing_prod" {
        id     = "housing-prod"
        name   = "housing-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/housing/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_dev will be updated in-place
! resource "vault_policy" "insta_dev" {
        id     = "insta-dev"
        name   = "insta-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/insta/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_prod will be updated in-place
! resource "vault_policy" "insta_prod" {
        id     = "insta-prod"
        name   = "insta-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/insta/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_dev will be updated in-place
! resource "vault_policy" "link-shortener_dev" {
        id     = "link-shortener-dev"
        name   = "link-shortener-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/link-shortener/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_prod will be updated in-place
! resource "vault_policy" "link-shortener_prod" {
        id     = "link-shortener-prod"
        name   = "link-shortener-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/link-shortener/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_dev will be updated in-place
! resource "vault_policy" "lost-and-found_dev" {
        id     = "lost-and-found-dev"
        name   = "lost-and-found-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/lost-and-found/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_prod will be updated in-place
! resource "vault_policy" "lost-and-found_prod" {
        id     = "lost-and-found-prod"
        name   = "lost-and-found-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/lost-and-found/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_dev will be updated in-place
! resource "vault_policy" "maps_dev" {
        id     = "maps-dev"
        name   = "maps-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/maps/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_prod will be updated in-place
! resource "vault_policy" "maps_prod" {
        id     = "maps-prod"
        name   = "maps-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/maps/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_dev will be updated in-place
! resource "vault_policy" "occ-main_dev" {
        id     = "occ-main-dev"
        name   = "occ-main-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/occ-main/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_prod will be updated in-place
! resource "vault_policy" "occ-main_prod" {
        id     = "occ-main-prod"
        name   = "occ-main-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/occ-main/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_dev will be updated in-place
! resource "vault_policy" "quest_dev" {
        id     = "quest-dev"
        name   = "quest-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/quest/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_prod will be updated in-place
! resource "vault_policy" "quest_prod" {
        id     = "quest-prod"
        name   = "quest-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/quest/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_dev will be updated in-place
! resource "vault_policy" "scottylabs-org_dev" {
        id     = "scottylabs-org-dev"
        name   = "scottylabs-org-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/scottylabs-org/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_prod will be updated in-place
! resource "vault_policy" "scottylabs-org_prod" {
        id     = "scottylabs-org-prod"
        name   = "scottylabs-org-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/scottylabs-org/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-repo_dev will be created
+ resource "vault_policy" "slai-repo_dev" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "slai-repo-dev"
+       policy          = <<-EOT
            path "secret/data/secretspec/slai-repo/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-repo/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-repo_prod will be created
+ resource "vault_policy" "slai-repo_prod" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "slai-repo-prod"
+       policy          = <<-EOT
            path "secret/data/secretspec/slai-repo/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-repo/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-repo/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_dev will be updated in-place
! resource "vault_policy" "study_dev" {
        id     = "study-dev"
        name   = "study-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/study/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_prod will be updated in-place
! resource "vault_policy" "study_prod" {
        id     = "study-prod"
        name   = "study-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/study/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_dev will be updated in-place
! resource "vault_policy" "tartan-vote_dev" {
        id     = "tartan-vote-dev"
        name   = "tartan-vote-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/tartan-vote/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_prod will be updated in-place
! resource "vault_policy" "tartan-vote_prod" {
        id     = "tartan-vote-prod"
        name   = "tartan-vote-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/tartan-vote/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_dev will be updated in-place
! resource "vault_policy" "terrier_dev" {
        id     = "terrier-dev"
        name   = "terrier-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/terrier/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_prod will be updated in-place
! resource "vault_policy" "terrier_prod" {
        id     = "terrier-prod"
        name   = "terrier-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/terrier/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

Plan: 6 to add, 50 to change, 0 to destroy.

▶️ To apply this plan, comment:
```
atlantis apply -p openbao
```
🚮 To delete this plan and lock, click here
🔁 To plan this project again, comment:
```
atlantis plan -p openbao
```

Plan: 6 to add, 50 to change, 0 to destroy.

Plan Summary

3 projects, 1 with changes, 0 with no changes, 2 failed

⏩ To apply all unapplied plans from this Pull Request, comment:
```
atlantis apply
```
🚮 To delete all plans and locks from this Pull Request, comment:
```
atlantis unlock
```

Ran Plan for 3 projects: 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` 1. project: `git` dir: `tofu/git` workspace: `default` 1. project: `openbao` dir: `tofu/openbao` workspace: `default` --- ### 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 2. project: `git` dir: `tofu/git` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 3. project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Finished `release` profile [optimized] target(s) in 0.08s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create ! update in-place (current -> planned) OpenTofu will perform the following actions: # vault_identity_group.slai-repo_admins will be created + resource "vault_identity_group" "slai-repo_admins" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "slai-repo-admins" + policies = [ + "slai-repo-prod", ] + type = "external" } # vault_identity_group.slai-repo_members will be created + resource "vault_identity_group" "slai-repo_members" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "slai-repo-members" + policies = [ + "slai-repo-dev", ] + type = "external" } # vault_identity_group_alias.slai-repo_admins will be created + resource "vault_identity_group_alias" "slai-repo_admins" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/slai-repo/admins" } # vault_identity_group_alias.slai-repo_members will be created + resource "vault_identity_group_alias" "slai-repo_members" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/slai-repo" } # vault_policy.bus-sign_dev will be updated in-place ! resource "vault_policy" "bus-sign_dev" { id = "bus-sign-dev" name = "bus-sign-dev" ! policy = <<-EOT path "secret/data/secretspec/bus-sign/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.bus-sign_prod will be updated in-place ! resource "vault_policy" "bus-sign_prod" { id = "bus-sign-prod" name = "bus-sign-prod" ! policy = <<-EOT path "secret/data/secretspec/bus-sign/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_dev will be updated in-place ! resource "vault_policy" "cal_dev" { id = "cal-dev" name = "cal-dev" ! policy = <<-EOT path "secret/data/secretspec/cal/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_prod will be updated in-place ! resource "vault_policy" "cal_prod" { id = "cal-prod" name = "cal-prod" ! policy = <<-EOT path "secret/data/secretspec/cal/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_dev will be updated in-place ! resource "vault_policy" "changelog_dev" { id = "changelog-dev" name = "changelog-dev" ! policy = <<-EOT path "secret/data/secretspec/changelog/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_prod will be updated in-place ! resource "vault_policy" "changelog_prod" { id = "changelog-prod" name = "changelog-prod" ! policy = <<-EOT path "secret/data/secretspec/changelog/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_dev will be updated in-place ! resource "vault_policy" "cmugpt-agent_dev" { id = "cmugpt-agent-dev" name = "cmugpt-agent-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-agent/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_prod will be updated in-place ! resource "vault_policy" "cmugpt-agent_prod" { id = "cmugpt-agent-prod" name = "cmugpt-agent-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-agent/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_dev will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_dev" { id = "cmugpt-mcp-server-dev" name = "cmugpt-mcp-server-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-mcp-server/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_prod will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_prod" { id = "cmugpt-mcp-server-prod" name = "cmugpt-mcp-server-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-mcp-server/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_dev" { id = "cmugpt-sms-surface-dev" name = "cmugpt-sms-surface-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-sms-surface/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_prod" { id = "cmugpt-sms-surface-prod" name = "cmugpt-sms-surface-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-sms-surface/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-surface_dev" { id = "cmugpt-surface-dev" name = "cmugpt-surface-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-surface/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-surface_prod" { id = "cmugpt-surface-prod" name = "cmugpt-surface-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-surface/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_dev will be updated in-place ! resource "vault_policy" "components_dev" { id = "components-dev" name = "components-dev" ! policy = <<-EOT path "secret/data/secretspec/components/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_prod will be updated in-place ! resource "vault_policy" "components_prod" { id = "components-prod" name = "components-prod" ! policy = <<-EOT path "secret/data/secretspec/components/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_dev will be updated in-place ! resource "vault_policy" "courses_dev" { id = "courses-dev" name = "courses-dev" ! policy = <<-EOT path "secret/data/secretspec/courses/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_prod will be updated in-place ! resource "vault_policy" "courses_prod" { id = "courses-prod" name = "courses-prod" ! policy = <<-EOT path "secret/data/secretspec/courses/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_dev will be updated in-place ! resource "vault_policy" "dalmatian_dev" { id = "dalmatian-dev" name = "dalmatian-dev" ! policy = <<-EOT path "secret/data/secretspec/dalmatian/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_prod will be updated in-place ! resource "vault_policy" "dalmatian_prod" { id = "dalmatian-prod" name = "dalmatian-prod" ! policy = <<-EOT path "secret/data/secretspec/dalmatian/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_dev will be updated in-place ! resource "vault_policy" "discord-verify_dev" { id = "discord-verify-dev" name = "discord-verify-dev" ! policy = <<-EOT path "secret/data/secretspec/discord-verify/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_prod will be updated in-place ! resource "vault_policy" "discord-verify_prod" { id = "discord-verify-prod" name = "discord-verify-prod" ! policy = <<-EOT path "secret/data/secretspec/discord-verify/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_dev will be updated in-place ! resource "vault_policy" "documentation_dev" { id = "documentation-dev" name = "documentation-dev" ! policy = <<-EOT path "secret/data/secretspec/documentation/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_prod will be updated in-place ! resource "vault_policy" "documentation_prod" { id = "documentation-prod" name = "documentation-prod" ! policy = <<-EOT path "secret/data/secretspec/documentation/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_dev will be updated in-place ! resource "vault_policy" "eats_dev" { id = "eats-dev" name = "eats-dev" ! policy = <<-EOT path "secret/data/secretspec/eats/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_prod will be updated in-place ! resource "vault_policy" "eats_prod" { id = "eats-prod" name = "eats-prod" ! policy = <<-EOT path "secret/data/secretspec/eats/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_dev will be updated in-place ! resource "vault_policy" "groupme-mirror_dev" { id = "groupme-mirror-dev" name = "groupme-mirror-dev" ! policy = <<-EOT path "secret/data/secretspec/groupme-mirror/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_prod will be updated in-place ! resource "vault_policy" "groupme-mirror_prod" { id = "groupme-mirror-prod" name = "groupme-mirror-prod" ! policy = <<-EOT path "secret/data/secretspec/groupme-mirror/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_dev will be updated in-place ! resource "vault_policy" "housing_dev" { id = "housing-dev" name = "housing-dev" ! policy = <<-EOT path "secret/data/secretspec/housing/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_prod will be updated in-place ! resource "vault_policy" "housing_prod" { id = "housing-prod" name = "housing-prod" ! policy = <<-EOT path "secret/data/secretspec/housing/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_dev will be updated in-place ! resource "vault_policy" "insta_dev" { id = "insta-dev" name = "insta-dev" ! policy = <<-EOT path "secret/data/secretspec/insta/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_prod will be updated in-place ! resource "vault_policy" "insta_prod" { id = "insta-prod" name = "insta-prod" ! policy = <<-EOT path "secret/data/secretspec/insta/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_dev will be updated in-place ! resource "vault_policy" "link-shortener_dev" { id = "link-shortener-dev" name = "link-shortener-dev" ! policy = <<-EOT path "secret/data/secretspec/link-shortener/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_prod will be updated in-place ! resource "vault_policy" "link-shortener_prod" { id = "link-shortener-prod" name = "link-shortener-prod" ! policy = <<-EOT path "secret/data/secretspec/link-shortener/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_dev will be updated in-place ! resource "vault_policy" "lost-and-found_dev" { id = "lost-and-found-dev" name = "lost-and-found-dev" ! policy = <<-EOT path "secret/data/secretspec/lost-and-found/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_prod will be updated in-place ! resource "vault_policy" "lost-and-found_prod" { id = "lost-and-found-prod" name = "lost-and-found-prod" ! policy = <<-EOT path "secret/data/secretspec/lost-and-found/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_dev will be updated in-place ! resource "vault_policy" "maps_dev" { id = "maps-dev" name = "maps-dev" ! policy = <<-EOT path "secret/data/secretspec/maps/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_prod will be updated in-place ! resource "vault_policy" "maps_prod" { id = "maps-prod" name = "maps-prod" ! policy = <<-EOT path "secret/data/secretspec/maps/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_dev will be updated in-place ! resource "vault_policy" "occ-main_dev" { id = "occ-main-dev" name = "occ-main-dev" ! policy = <<-EOT path "secret/data/secretspec/occ-main/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_prod will be updated in-place ! resource "vault_policy" "occ-main_prod" { id = "occ-main-prod" name = "occ-main-prod" ! policy = <<-EOT path "secret/data/secretspec/occ-main/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_dev will be updated in-place ! resource "vault_policy" "quest_dev" { id = "quest-dev" name = "quest-dev" ! policy = <<-EOT path "secret/data/secretspec/quest/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_prod will be updated in-place ! resource "vault_policy" "quest_prod" { id = "quest-prod" name = "quest-prod" ! policy = <<-EOT path "secret/data/secretspec/quest/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_dev will be updated in-place ! resource "vault_policy" "scottylabs-org_dev" { id = "scottylabs-org-dev" name = "scottylabs-org-dev" ! policy = <<-EOT path "secret/data/secretspec/scottylabs-org/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_prod will be updated in-place ! resource "vault_policy" "scottylabs-org_prod" { id = "scottylabs-org-prod" name = "scottylabs-org-prod" ! policy = <<-EOT path "secret/data/secretspec/scottylabs-org/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-repo_dev will be created + resource "vault_policy" "slai-repo_dev" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "slai-repo-dev" + policy = <<-EOT path "secret/data/secretspec/slai-repo/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-repo/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-repo_prod will be created + resource "vault_policy" "slai-repo_prod" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "slai-repo-prod" + policy = <<-EOT path "secret/data/secretspec/slai-repo/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-repo/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-repo/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_dev will be updated in-place ! resource "vault_policy" "study_dev" { id = "study-dev" name = "study-dev" ! policy = <<-EOT path "secret/data/secretspec/study/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_prod will be updated in-place ! resource "vault_policy" "study_prod" { id = "study-prod" name = "study-prod" ! policy = <<-EOT path "secret/data/secretspec/study/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_dev will be updated in-place ! resource "vault_policy" "tartan-vote_dev" { id = "tartan-vote-dev" name = "tartan-vote-dev" ! policy = <<-EOT path "secret/data/secretspec/tartan-vote/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_prod will be updated in-place ! resource "vault_policy" "tartan-vote_prod" { id = "tartan-vote-prod" name = "tartan-vote-prod" ! policy = <<-EOT path "secret/data/secretspec/tartan-vote/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_dev will be updated in-place ! resource "vault_policy" "terrier_dev" { id = "terrier-dev" name = "terrier-dev" ! policy = <<-EOT path "secret/data/secretspec/terrier/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_prod will be updated in-place ! resource "vault_policy" "terrier_prod" { id = "terrier-prod" name = "terrier-prod" ! policy = <<-EOT path "secret/data/secretspec/terrier/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/ci/*" { capabilities = ["list", "read", "delete"] } EOT } Plan: 6 to add, 50 to change, 0 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p openbao ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fopenbao%252Fdefault%252Fopenbao) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p openbao ``` Plan: 6 to add, 50 to change, 0 to destroy. --- ### Plan Summary 3 projects, 1 with changes, 0 with no changes, 2 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```

krishsax changed title from ~~chore: cleanup and adding SLAI Repo~~ to chore: cleanup and adding SLAI RFC repo

2026-09-26 04:24:34 +00:00

scottylabs-bot commented

2026-09-26 04:24:38 +00:00

Owner

Ran Plan for 3 projects:

project: git dir: tofu/git workspace: default
project: keycloak dir: tofu/keycloak workspace: default
project: openbao dir: tofu/openbao workspace: default

1. project: `git` dir: `tofu/git` workspace: `default`

Plan Failed: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

2. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

Plan Failed: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

3. project: `openbao` dir: `tofu/openbao` workspace: `default`

Show Output

Finished `release` profile [optimized] target(s) in 0.07s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
! update in-place (current -> planned)

OpenTofu will perform the following actions:

  # vault_identity_group.slai-repo_admins will be created
+ resource "vault_identity_group" "slai-repo_admins" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "slai-repo-admins"
+       policies                   = [
+           "slai-repo-prod",
        ]
+       type                       = "external"
    }

  # vault_identity_group.slai-repo_members will be created
+ resource "vault_identity_group" "slai-repo_members" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "slai-repo-members"
+       policies                   = [
+           "slai-repo-dev",
        ]
+       type                       = "external"
    }

  # vault_identity_group_alias.slai-repo_admins will be created
+ resource "vault_identity_group_alias" "slai-repo_admins" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/slai-repo/admins"
    }

  # vault_identity_group_alias.slai-repo_members will be created
+ resource "vault_identity_group_alias" "slai-repo_members" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/slai-repo"
    }

  # vault_policy.bus-sign_dev will be updated in-place
! resource "vault_policy" "bus-sign_dev" {
        id     = "bus-sign-dev"
        name   = "bus-sign-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/bus-sign/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.bus-sign_prod will be updated in-place
! resource "vault_policy" "bus-sign_prod" {
        id     = "bus-sign-prod"
        name   = "bus-sign-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/bus-sign/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_dev will be updated in-place
! resource "vault_policy" "cal_dev" {
        id     = "cal-dev"
        name   = "cal-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cal/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_prod will be updated in-place
! resource "vault_policy" "cal_prod" {
        id     = "cal-prod"
        name   = "cal-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cal/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_dev will be updated in-place
! resource "vault_policy" "changelog_dev" {
        id     = "changelog-dev"
        name   = "changelog-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/changelog/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_prod will be updated in-place
! resource "vault_policy" "changelog_prod" {
        id     = "changelog-prod"
        name   = "changelog-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/changelog/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_dev will be updated in-place
! resource "vault_policy" "cmugpt-agent_dev" {
        id     = "cmugpt-agent-dev"
        name   = "cmugpt-agent-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-agent/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_prod will be updated in-place
! resource "vault_policy" "cmugpt-agent_prod" {
        id     = "cmugpt-agent-prod"
        name   = "cmugpt-agent-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-agent/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_dev will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_dev" {
        id     = "cmugpt-mcp-server-dev"
        name   = "cmugpt-mcp-server-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-mcp-server/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_prod will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_prod" {
        id     = "cmugpt-mcp-server-prod"
        name   = "cmugpt-mcp-server-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-mcp-server/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_dev" {
        id     = "cmugpt-sms-surface-dev"
        name   = "cmugpt-sms-surface-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-sms-surface/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_prod" {
        id     = "cmugpt-sms-surface-prod"
        name   = "cmugpt-sms-surface-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-sms-surface/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-surface_dev" {
        id     = "cmugpt-surface-dev"
        name   = "cmugpt-surface-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-surface/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-surface_prod" {
        id     = "cmugpt-surface-prod"
        name   = "cmugpt-surface-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-surface/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_dev will be updated in-place
! resource "vault_policy" "components_dev" {
        id     = "components-dev"
        name   = "components-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/components/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_prod will be updated in-place
! resource "vault_policy" "components_prod" {
        id     = "components-prod"
        name   = "components-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/components/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_dev will be updated in-place
! resource "vault_policy" "courses_dev" {
        id     = "courses-dev"
        name   = "courses-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/courses/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_prod will be updated in-place
! resource "vault_policy" "courses_prod" {
        id     = "courses-prod"
        name   = "courses-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/courses/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_dev will be updated in-place
! resource "vault_policy" "dalmatian_dev" {
        id     = "dalmatian-dev"
        name   = "dalmatian-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/dalmatian/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_prod will be updated in-place
! resource "vault_policy" "dalmatian_prod" {
        id     = "dalmatian-prod"
        name   = "dalmatian-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/dalmatian/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_dev will be updated in-place
! resource "vault_policy" "discord-verify_dev" {
        id     = "discord-verify-dev"
        name   = "discord-verify-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/discord-verify/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_prod will be updated in-place
! resource "vault_policy" "discord-verify_prod" {
        id     = "discord-verify-prod"
        name   = "discord-verify-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/discord-verify/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_dev will be updated in-place
! resource "vault_policy" "documentation_dev" {
        id     = "documentation-dev"
        name   = "documentation-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/documentation/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_prod will be updated in-place
! resource "vault_policy" "documentation_prod" {
        id     = "documentation-prod"
        name   = "documentation-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/documentation/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_dev will be updated in-place
! resource "vault_policy" "eats_dev" {
        id     = "eats-dev"
        name   = "eats-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/eats/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_prod will be updated in-place
! resource "vault_policy" "eats_prod" {
        id     = "eats-prod"
        name   = "eats-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/eats/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_dev will be updated in-place
! resource "vault_policy" "groupme-mirror_dev" {
        id     = "groupme-mirror-dev"
        name   = "groupme-mirror-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/groupme-mirror/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_prod will be updated in-place
! resource "vault_policy" "groupme-mirror_prod" {
        id     = "groupme-mirror-prod"
        name   = "groupme-mirror-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/groupme-mirror/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_dev will be updated in-place
! resource "vault_policy" "housing_dev" {
        id     = "housing-dev"
        name   = "housing-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/housing/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_prod will be updated in-place
! resource "vault_policy" "housing_prod" {
        id     = "housing-prod"
        name   = "housing-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/housing/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_dev will be updated in-place
! resource "vault_policy" "insta_dev" {
        id     = "insta-dev"
        name   = "insta-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/insta/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_prod will be updated in-place
! resource "vault_policy" "insta_prod" {
        id     = "insta-prod"
        name   = "insta-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/insta/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_dev will be updated in-place
! resource "vault_policy" "link-shortener_dev" {
        id     = "link-shortener-dev"
        name   = "link-shortener-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/link-shortener/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_prod will be updated in-place
! resource "vault_policy" "link-shortener_prod" {
        id     = "link-shortener-prod"
        name   = "link-shortener-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/link-shortener/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_dev will be updated in-place
! resource "vault_policy" "lost-and-found_dev" {
        id     = "lost-and-found-dev"
        name   = "lost-and-found-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/lost-and-found/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_prod will be updated in-place
! resource "vault_policy" "lost-and-found_prod" {
        id     = "lost-and-found-prod"
        name   = "lost-and-found-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/lost-and-found/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_dev will be updated in-place
! resource "vault_policy" "maps_dev" {
        id     = "maps-dev"
        name   = "maps-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/maps/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_prod will be updated in-place
! resource "vault_policy" "maps_prod" {
        id     = "maps-prod"
        name   = "maps-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/maps/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_dev will be updated in-place
! resource "vault_policy" "occ-main_dev" {
        id     = "occ-main-dev"
        name   = "occ-main-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/occ-main/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_prod will be updated in-place
! resource "vault_policy" "occ-main_prod" {
        id     = "occ-main-prod"
        name   = "occ-main-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/occ-main/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_dev will be updated in-place
! resource "vault_policy" "quest_dev" {
        id     = "quest-dev"
        name   = "quest-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/quest/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_prod will be updated in-place
! resource "vault_policy" "quest_prod" {
        id     = "quest-prod"
        name   = "quest-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/quest/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_dev will be updated in-place
! resource "vault_policy" "scottylabs-org_dev" {
        id     = "scottylabs-org-dev"
        name   = "scottylabs-org-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/scottylabs-org/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_prod will be updated in-place
! resource "vault_policy" "scottylabs-org_prod" {
        id     = "scottylabs-org-prod"
        name   = "scottylabs-org-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/scottylabs-org/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-repo_dev will be created
+ resource "vault_policy" "slai-repo_dev" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "slai-repo-dev"
+       policy          = <<-EOT
            path "secret/data/secretspec/slai-repo/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-repo/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-repo_prod will be created
+ resource "vault_policy" "slai-repo_prod" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "slai-repo-prod"
+       policy          = <<-EOT
            path "secret/data/secretspec/slai-repo/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-repo/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-repo/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_dev will be updated in-place
! resource "vault_policy" "study_dev" {
        id     = "study-dev"
        name   = "study-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/study/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_prod will be updated in-place
! resource "vault_policy" "study_prod" {
        id     = "study-prod"
        name   = "study-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/study/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_dev will be updated in-place
! resource "vault_policy" "tartan-vote_dev" {
        id     = "tartan-vote-dev"
        name   = "tartan-vote-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/tartan-vote/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_prod will be updated in-place
! resource "vault_policy" "tartan-vote_prod" {
        id     = "tartan-vote-prod"
        name   = "tartan-vote-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/tartan-vote/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_dev will be updated in-place
! resource "vault_policy" "terrier_dev" {
        id     = "terrier-dev"
        name   = "terrier-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/terrier/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_prod will be updated in-place
! resource "vault_policy" "terrier_prod" {
        id     = "terrier-prod"
        name   = "terrier-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/terrier/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

Plan: 6 to add, 50 to change, 0 to destroy.

▶️ To apply this plan, comment:
```
atlantis apply -p openbao
```
🚮 To delete this plan and lock, click here
🔁 To plan this project again, comment:
```
atlantis plan -p openbao
```

Plan: 6 to add, 50 to change, 0 to destroy.

Plan Summary

3 projects, 1 with changes, 0 with no changes, 2 failed

⏩ To apply all unapplied plans from this Pull Request, comment:
```
atlantis apply
```
🚮 To delete all plans and locks from this Pull Request, comment:
```
atlantis unlock
```

Ran Plan for 3 projects: 1. project: `git` dir: `tofu/git` workspace: `default` 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` 1. project: `openbao` dir: `tofu/openbao` workspace: `default` --- ### 1. project: `git` dir: `tofu/git` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 2. project: `keycloak` dir: `tofu/keycloak` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 3. project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Finished `release` profile [optimized] target(s) in 0.07s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create ! update in-place (current -> planned) OpenTofu will perform the following actions: # vault_identity_group.slai-repo_admins will be created + resource "vault_identity_group" "slai-repo_admins" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "slai-repo-admins" + policies = [ + "slai-repo-prod", ] + type = "external" } # vault_identity_group.slai-repo_members will be created + resource "vault_identity_group" "slai-repo_members" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "slai-repo-members" + policies = [ + "slai-repo-dev", ] + type = "external" } # vault_identity_group_alias.slai-repo_admins will be created + resource "vault_identity_group_alias" "slai-repo_admins" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/slai-repo/admins" } # vault_identity_group_alias.slai-repo_members will be created + resource "vault_identity_group_alias" "slai-repo_members" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/slai-repo" } # vault_policy.bus-sign_dev will be updated in-place ! resource "vault_policy" "bus-sign_dev" { id = "bus-sign-dev" name = "bus-sign-dev" ! policy = <<-EOT path "secret/data/secretspec/bus-sign/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.bus-sign_prod will be updated in-place ! resource "vault_policy" "bus-sign_prod" { id = "bus-sign-prod" name = "bus-sign-prod" ! policy = <<-EOT path "secret/data/secretspec/bus-sign/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_dev will be updated in-place ! resource "vault_policy" "cal_dev" { id = "cal-dev" name = "cal-dev" ! policy = <<-EOT path "secret/data/secretspec/cal/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_prod will be updated in-place ! resource "vault_policy" "cal_prod" { id = "cal-prod" name = "cal-prod" ! policy = <<-EOT path "secret/data/secretspec/cal/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_dev will be updated in-place ! resource "vault_policy" "changelog_dev" { id = "changelog-dev" name = "changelog-dev" ! policy = <<-EOT path "secret/data/secretspec/changelog/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_prod will be updated in-place ! resource "vault_policy" "changelog_prod" { id = "changelog-prod" name = "changelog-prod" ! policy = <<-EOT path "secret/data/secretspec/changelog/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_dev will be updated in-place ! resource "vault_policy" "cmugpt-agent_dev" { id = "cmugpt-agent-dev" name = "cmugpt-agent-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-agent/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_prod will be updated in-place ! resource "vault_policy" "cmugpt-agent_prod" { id = "cmugpt-agent-prod" name = "cmugpt-agent-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-agent/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_dev will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_dev" { id = "cmugpt-mcp-server-dev" name = "cmugpt-mcp-server-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-mcp-server/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_prod will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_prod" { id = "cmugpt-mcp-server-prod" name = "cmugpt-mcp-server-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-mcp-server/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_dev" { id = "cmugpt-sms-surface-dev" name = "cmugpt-sms-surface-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-sms-surface/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_prod" { id = "cmugpt-sms-surface-prod" name = "cmugpt-sms-surface-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-sms-surface/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-surface_dev" { id = "cmugpt-surface-dev" name = "cmugpt-surface-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-surface/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-surface_prod" { id = "cmugpt-surface-prod" name = "cmugpt-surface-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-surface/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_dev will be updated in-place ! resource "vault_policy" "components_dev" { id = "components-dev" name = "components-dev" ! policy = <<-EOT path "secret/data/secretspec/components/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_prod will be updated in-place ! resource "vault_policy" "components_prod" { id = "components-prod" name = "components-prod" ! policy = <<-EOT path "secret/data/secretspec/components/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_dev will be updated in-place ! resource "vault_policy" "courses_dev" { id = "courses-dev" name = "courses-dev" ! policy = <<-EOT path "secret/data/secretspec/courses/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_prod will be updated in-place ! resource "vault_policy" "courses_prod" { id = "courses-prod" name = "courses-prod" ! policy = <<-EOT path "secret/data/secretspec/courses/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_dev will be updated in-place ! resource "vault_policy" "dalmatian_dev" { id = "dalmatian-dev" name = "dalmatian-dev" ! policy = <<-EOT path "secret/data/secretspec/dalmatian/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_prod will be updated in-place ! resource "vault_policy" "dalmatian_prod" { id = "dalmatian-prod" name = "dalmatian-prod" ! policy = <<-EOT path "secret/data/secretspec/dalmatian/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_dev will be updated in-place ! resource "vault_policy" "discord-verify_dev" { id = "discord-verify-dev" name = "discord-verify-dev" ! policy = <<-EOT path "secret/data/secretspec/discord-verify/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_prod will be updated in-place ! resource "vault_policy" "discord-verify_prod" { id = "discord-verify-prod" name = "discord-verify-prod" ! policy = <<-EOT path "secret/data/secretspec/discord-verify/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_dev will be updated in-place ! resource "vault_policy" "documentation_dev" { id = "documentation-dev" name = "documentation-dev" ! policy = <<-EOT path "secret/data/secretspec/documentation/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_prod will be updated in-place ! resource "vault_policy" "documentation_prod" { id = "documentation-prod" name = "documentation-prod" ! policy = <<-EOT path "secret/data/secretspec/documentation/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_dev will be updated in-place ! resource "vault_policy" "eats_dev" { id = "eats-dev" name = "eats-dev" ! policy = <<-EOT path "secret/data/secretspec/eats/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_prod will be updated in-place ! resource "vault_policy" "eats_prod" { id = "eats-prod" name = "eats-prod" ! policy = <<-EOT path "secret/data/secretspec/eats/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_dev will be updated in-place ! resource "vault_policy" "groupme-mirror_dev" { id = "groupme-mirror-dev" name = "groupme-mirror-dev" ! policy = <<-EOT path "secret/data/secretspec/groupme-mirror/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_prod will be updated in-place ! resource "vault_policy" "groupme-mirror_prod" { id = "groupme-mirror-prod" name = "groupme-mirror-prod" ! policy = <<-EOT path "secret/data/secretspec/groupme-mirror/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_dev will be updated in-place ! resource "vault_policy" "housing_dev" { id = "housing-dev" name = "housing-dev" ! policy = <<-EOT path "secret/data/secretspec/housing/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_prod will be updated in-place ! resource "vault_policy" "housing_prod" { id = "housing-prod" name = "housing-prod" ! policy = <<-EOT path "secret/data/secretspec/housing/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_dev will be updated in-place ! resource "vault_policy" "insta_dev" { id = "insta-dev" name = "insta-dev" ! policy = <<-EOT path "secret/data/secretspec/insta/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_prod will be updated in-place ! resource "vault_policy" "insta_prod" { id = "insta-prod" name = "insta-prod" ! policy = <<-EOT path "secret/data/secretspec/insta/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_dev will be updated in-place ! resource "vault_policy" "link-shortener_dev" { id = "link-shortener-dev" name = "link-shortener-dev" ! policy = <<-EOT path "secret/data/secretspec/link-shortener/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_prod will be updated in-place ! resource "vault_policy" "link-shortener_prod" { id = "link-shortener-prod" name = "link-shortener-prod" ! policy = <<-EOT path "secret/data/secretspec/link-shortener/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_dev will be updated in-place ! resource "vault_policy" "lost-and-found_dev" { id = "lost-and-found-dev" name = "lost-and-found-dev" ! policy = <<-EOT path "secret/data/secretspec/lost-and-found/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_prod will be updated in-place ! resource "vault_policy" "lost-and-found_prod" { id = "lost-and-found-prod" name = "lost-and-found-prod" ! policy = <<-EOT path "secret/data/secretspec/lost-and-found/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_dev will be updated in-place ! resource "vault_policy" "maps_dev" { id = "maps-dev" name = "maps-dev" ! policy = <<-EOT path "secret/data/secretspec/maps/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_prod will be updated in-place ! resource "vault_policy" "maps_prod" { id = "maps-prod" name = "maps-prod" ! policy = <<-EOT path "secret/data/secretspec/maps/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_dev will be updated in-place ! resource "vault_policy" "occ-main_dev" { id = "occ-main-dev" name = "occ-main-dev" ! policy = <<-EOT path "secret/data/secretspec/occ-main/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_prod will be updated in-place ! resource "vault_policy" "occ-main_prod" { id = "occ-main-prod" name = "occ-main-prod" ! policy = <<-EOT path "secret/data/secretspec/occ-main/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_dev will be updated in-place ! resource "vault_policy" "quest_dev" { id = "quest-dev" name = "quest-dev" ! policy = <<-EOT path "secret/data/secretspec/quest/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_prod will be updated in-place ! resource "vault_policy" "quest_prod" { id = "quest-prod" name = "quest-prod" ! policy = <<-EOT path "secret/data/secretspec/quest/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_dev will be updated in-place ! resource "vault_policy" "scottylabs-org_dev" { id = "scottylabs-org-dev" name = "scottylabs-org-dev" ! policy = <<-EOT path "secret/data/secretspec/scottylabs-org/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_prod will be updated in-place ! resource "vault_policy" "scottylabs-org_prod" { id = "scottylabs-org-prod" name = "scottylabs-org-prod" ! policy = <<-EOT path "secret/data/secretspec/scottylabs-org/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-repo_dev will be created + resource "vault_policy" "slai-repo_dev" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "slai-repo-dev" + policy = <<-EOT path "secret/data/secretspec/slai-repo/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-repo/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-repo_prod will be created + resource "vault_policy" "slai-repo_prod" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "slai-repo-prod" + policy = <<-EOT path "secret/data/secretspec/slai-repo/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-repo/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-repo/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_dev will be updated in-place ! resource "vault_policy" "study_dev" { id = "study-dev" name = "study-dev" ! policy = <<-EOT path "secret/data/secretspec/study/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_prod will be updated in-place ! resource "vault_policy" "study_prod" { id = "study-prod" name = "study-prod" ! policy = <<-EOT path "secret/data/secretspec/study/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_dev will be updated in-place ! resource "vault_policy" "tartan-vote_dev" { id = "tartan-vote-dev" name = "tartan-vote-dev" ! policy = <<-EOT path "secret/data/secretspec/tartan-vote/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_prod will be updated in-place ! resource "vault_policy" "tartan-vote_prod" { id = "tartan-vote-prod" name = "tartan-vote-prod" ! policy = <<-EOT path "secret/data/secretspec/tartan-vote/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_dev will be updated in-place ! resource "vault_policy" "terrier_dev" { id = "terrier-dev" name = "terrier-dev" ! policy = <<-EOT path "secret/data/secretspec/terrier/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_prod will be updated in-place ! resource "vault_policy" "terrier_prod" { id = "terrier-prod" name = "terrier-prod" ! policy = <<-EOT path "secret/data/secretspec/terrier/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/ci/*" { capabilities = ["list", "read", "delete"] } EOT } Plan: 6 to add, 50 to change, 0 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p openbao ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fopenbao%252Fdefault%252Fopenbao) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p openbao ``` Plan: 6 to add, 50 to change, 0 to destroy. --- ### Plan Summary 3 projects, 1 with changes, 0 with no changes, 2 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```

xboxbedrock changed title from ~~chore: cleanup and adding SLAI RFC repo~~ to chore: cleanup and adding SLAI

2026-09-26 04:24:39 +00:00

scottylabs-bot commented

2026-09-26 04:24:43 +00:00

Owner

Ran Plan for 3 projects:

project: git dir: tofu/git workspace: default
project: keycloak dir: tofu/keycloak workspace: default
project: openbao dir: tofu/openbao workspace: default

1. project: `git` dir: `tofu/git` workspace: `default`

Plan Failed: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

2. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

Plan Failed: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

3. project: `openbao` dir: `tofu/openbao` workspace: `default`

Show Output

Finished `release` profile [optimized] target(s) in 0.06s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
! update in-place (current -> planned)

OpenTofu will perform the following actions:

  # vault_identity_group.slai-repo_admins will be created
+ resource "vault_identity_group" "slai-repo_admins" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "slai-repo-admins"
+       policies                   = [
+           "slai-repo-prod",
        ]
+       type                       = "external"
    }

  # vault_identity_group.slai-repo_members will be created
+ resource "vault_identity_group" "slai-repo_members" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "slai-repo-members"
+       policies                   = [
+           "slai-repo-dev",
        ]
+       type                       = "external"
    }

  # vault_identity_group_alias.slai-repo_admins will be created
+ resource "vault_identity_group_alias" "slai-repo_admins" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/slai-repo/admins"
    }

  # vault_identity_group_alias.slai-repo_members will be created
+ resource "vault_identity_group_alias" "slai-repo_members" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/slai-repo"
    }

  # vault_policy.bus-sign_dev will be updated in-place
! resource "vault_policy" "bus-sign_dev" {
        id     = "bus-sign-dev"
        name   = "bus-sign-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/bus-sign/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.bus-sign_prod will be updated in-place
! resource "vault_policy" "bus-sign_prod" {
        id     = "bus-sign-prod"
        name   = "bus-sign-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/bus-sign/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_dev will be updated in-place
! resource "vault_policy" "cal_dev" {
        id     = "cal-dev"
        name   = "cal-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cal/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_prod will be updated in-place
! resource "vault_policy" "cal_prod" {
        id     = "cal-prod"
        name   = "cal-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cal/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_dev will be updated in-place
! resource "vault_policy" "changelog_dev" {
        id     = "changelog-dev"
        name   = "changelog-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/changelog/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_prod will be updated in-place
! resource "vault_policy" "changelog_prod" {
        id     = "changelog-prod"
        name   = "changelog-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/changelog/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_dev will be updated in-place
! resource "vault_policy" "cmugpt-agent_dev" {
        id     = "cmugpt-agent-dev"
        name   = "cmugpt-agent-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-agent/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_prod will be updated in-place
! resource "vault_policy" "cmugpt-agent_prod" {
        id     = "cmugpt-agent-prod"
        name   = "cmugpt-agent-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-agent/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_dev will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_dev" {
        id     = "cmugpt-mcp-server-dev"
        name   = "cmugpt-mcp-server-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-mcp-server/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_prod will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_prod" {
        id     = "cmugpt-mcp-server-prod"
        name   = "cmugpt-mcp-server-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-mcp-server/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_dev" {
        id     = "cmugpt-sms-surface-dev"
        name   = "cmugpt-sms-surface-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-sms-surface/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_prod" {
        id     = "cmugpt-sms-surface-prod"
        name   = "cmugpt-sms-surface-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-sms-surface/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-surface_dev" {
        id     = "cmugpt-surface-dev"
        name   = "cmugpt-surface-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-surface/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-surface_prod" {
        id     = "cmugpt-surface-prod"
        name   = "cmugpt-surface-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-surface/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_dev will be updated in-place
! resource "vault_policy" "components_dev" {
        id     = "components-dev"
        name   = "components-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/components/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_prod will be updated in-place
! resource "vault_policy" "components_prod" {
        id     = "components-prod"
        name   = "components-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/components/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_dev will be updated in-place
! resource "vault_policy" "courses_dev" {
        id     = "courses-dev"
        name   = "courses-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/courses/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_prod will be updated in-place
! resource "vault_policy" "courses_prod" {
        id     = "courses-prod"
        name   = "courses-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/courses/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_dev will be updated in-place
! resource "vault_policy" "dalmatian_dev" {
        id     = "dalmatian-dev"
        name   = "dalmatian-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/dalmatian/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_prod will be updated in-place
! resource "vault_policy" "dalmatian_prod" {
        id     = "dalmatian-prod"
        name   = "dalmatian-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/dalmatian/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_dev will be updated in-place
! resource "vault_policy" "discord-verify_dev" {
        id     = "discord-verify-dev"
        name   = "discord-verify-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/discord-verify/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_prod will be updated in-place
! resource "vault_policy" "discord-verify_prod" {
        id     = "discord-verify-prod"
        name   = "discord-verify-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/discord-verify/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_dev will be updated in-place
! resource "vault_policy" "documentation_dev" {
        id     = "documentation-dev"
        name   = "documentation-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/documentation/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_prod will be updated in-place
! resource "vault_policy" "documentation_prod" {
        id     = "documentation-prod"
        name   = "documentation-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/documentation/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_dev will be updated in-place
! resource "vault_policy" "eats_dev" {
        id     = "eats-dev"
        name   = "eats-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/eats/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_prod will be updated in-place
! resource "vault_policy" "eats_prod" {
        id     = "eats-prod"
        name   = "eats-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/eats/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_dev will be updated in-place
! resource "vault_policy" "groupme-mirror_dev" {
        id     = "groupme-mirror-dev"
        name   = "groupme-mirror-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/groupme-mirror/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_prod will be updated in-place
! resource "vault_policy" "groupme-mirror_prod" {
        id     = "groupme-mirror-prod"
        name   = "groupme-mirror-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/groupme-mirror/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_dev will be updated in-place
! resource "vault_policy" "housing_dev" {
        id     = "housing-dev"
        name   = "housing-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/housing/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_prod will be updated in-place
! resource "vault_policy" "housing_prod" {
        id     = "housing-prod"
        name   = "housing-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/housing/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_dev will be updated in-place
! resource "vault_policy" "insta_dev" {
        id     = "insta-dev"
        name   = "insta-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/insta/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_prod will be updated in-place
! resource "vault_policy" "insta_prod" {
        id     = "insta-prod"
        name   = "insta-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/insta/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_dev will be updated in-place
! resource "vault_policy" "link-shortener_dev" {
        id     = "link-shortener-dev"
        name   = "link-shortener-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/link-shortener/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_prod will be updated in-place
! resource "vault_policy" "link-shortener_prod" {
        id     = "link-shortener-prod"
        name   = "link-shortener-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/link-shortener/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_dev will be updated in-place
! resource "vault_policy" "lost-and-found_dev" {
        id     = "lost-and-found-dev"
        name   = "lost-and-found-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/lost-and-found/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_prod will be updated in-place
! resource "vault_policy" "lost-and-found_prod" {
        id     = "lost-and-found-prod"
        name   = "lost-and-found-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/lost-and-found/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_dev will be updated in-place
! resource "vault_policy" "maps_dev" {
        id     = "maps-dev"
        name   = "maps-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/maps/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_prod will be updated in-place
! resource "vault_policy" "maps_prod" {
        id     = "maps-prod"
        name   = "maps-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/maps/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_dev will be updated in-place
! resource "vault_policy" "occ-main_dev" {
        id     = "occ-main-dev"
        name   = "occ-main-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/occ-main/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_prod will be updated in-place
! resource "vault_policy" "occ-main_prod" {
        id     = "occ-main-prod"
        name   = "occ-main-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/occ-main/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_dev will be updated in-place
! resource "vault_policy" "quest_dev" {
        id     = "quest-dev"
        name   = "quest-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/quest/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_prod will be updated in-place
! resource "vault_policy" "quest_prod" {
        id     = "quest-prod"
        name   = "quest-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/quest/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_dev will be updated in-place
! resource "vault_policy" "scottylabs-org_dev" {
        id     = "scottylabs-org-dev"
        name   = "scottylabs-org-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/scottylabs-org/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_prod will be updated in-place
! resource "vault_policy" "scottylabs-org_prod" {
        id     = "scottylabs-org-prod"
        name   = "scottylabs-org-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/scottylabs-org/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-repo_dev will be created
+ resource "vault_policy" "slai-repo_dev" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "slai-repo-dev"
+       policy          = <<-EOT
            path "secret/data/secretspec/slai-repo/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-repo/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-repo_prod will be created
+ resource "vault_policy" "slai-repo_prod" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "slai-repo-prod"
+       policy          = <<-EOT
            path "secret/data/secretspec/slai-repo/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-repo/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-repo/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-repo/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_dev will be updated in-place
! resource "vault_policy" "study_dev" {
        id     = "study-dev"
        name   = "study-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/study/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_prod will be updated in-place
! resource "vault_policy" "study_prod" {
        id     = "study-prod"
        name   = "study-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/study/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_dev will be updated in-place
! resource "vault_policy" "tartan-vote_dev" {
        id     = "tartan-vote-dev"
        name   = "tartan-vote-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/tartan-vote/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_prod will be updated in-place
! resource "vault_policy" "tartan-vote_prod" {
        id     = "tartan-vote-prod"
        name   = "tartan-vote-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/tartan-vote/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_dev will be updated in-place
! resource "vault_policy" "terrier_dev" {
        id     = "terrier-dev"
        name   = "terrier-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/terrier/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_prod will be updated in-place
! resource "vault_policy" "terrier_prod" {
        id     = "terrier-prod"
        name   = "terrier-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/terrier/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

Plan: 6 to add, 50 to change, 0 to destroy.

▶️ To apply this plan, comment:
```
atlantis apply -p openbao
```
🚮 To delete this plan and lock, click here
🔁 To plan this project again, comment:
```
atlantis plan -p openbao
```

Plan: 6 to add, 50 to change, 0 to destroy.

Plan Summary

3 projects, 1 with changes, 0 with no changes, 2 failed

⏩ To apply all unapplied plans from this Pull Request, comment:
```
atlantis apply
```
🚮 To delete all plans and locks from this Pull Request, comment:
```
atlantis unlock
```

Ran Plan for 3 projects: 1. project: `git` dir: `tofu/git` workspace: `default` 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` 1. project: `openbao` dir: `tofu/openbao` workspace: `default` --- ### 1. project: `git` dir: `tofu/git` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 2. project: `keycloak` dir: `tofu/keycloak` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 3. project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Finished `release` profile [optimized] target(s) in 0.06s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create ! update in-place (current -> planned) OpenTofu will perform the following actions: # vault_identity_group.slai-repo_admins will be created + resource "vault_identity_group" "slai-repo_admins" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "slai-repo-admins" + policies = [ + "slai-repo-prod", ] + type = "external" } # vault_identity_group.slai-repo_members will be created + resource "vault_identity_group" "slai-repo_members" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "slai-repo-members" + policies = [ + "slai-repo-dev", ] + type = "external" } # vault_identity_group_alias.slai-repo_admins will be created + resource "vault_identity_group_alias" "slai-repo_admins" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/slai-repo/admins" } # vault_identity_group_alias.slai-repo_members will be created + resource "vault_identity_group_alias" "slai-repo_members" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/slai-repo" } # vault_policy.bus-sign_dev will be updated in-place ! resource "vault_policy" "bus-sign_dev" { id = "bus-sign-dev" name = "bus-sign-dev" ! policy = <<-EOT path "secret/data/secretspec/bus-sign/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.bus-sign_prod will be updated in-place ! resource "vault_policy" "bus-sign_prod" { id = "bus-sign-prod" name = "bus-sign-prod" ! policy = <<-EOT path "secret/data/secretspec/bus-sign/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_dev will be updated in-place ! resource "vault_policy" "cal_dev" { id = "cal-dev" name = "cal-dev" ! policy = <<-EOT path "secret/data/secretspec/cal/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_prod will be updated in-place ! resource "vault_policy" "cal_prod" { id = "cal-prod" name = "cal-prod" ! policy = <<-EOT path "secret/data/secretspec/cal/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_dev will be updated in-place ! resource "vault_policy" "changelog_dev" { id = "changelog-dev" name = "changelog-dev" ! policy = <<-EOT path "secret/data/secretspec/changelog/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_prod will be updated in-place ! resource "vault_policy" "changelog_prod" { id = "changelog-prod" name = "changelog-prod" ! policy = <<-EOT path "secret/data/secretspec/changelog/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_dev will be updated in-place ! resource "vault_policy" "cmugpt-agent_dev" { id = "cmugpt-agent-dev" name = "cmugpt-agent-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-agent/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_prod will be updated in-place ! resource "vault_policy" "cmugpt-agent_prod" { id = "cmugpt-agent-prod" name = "cmugpt-agent-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-agent/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_dev will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_dev" { id = "cmugpt-mcp-server-dev" name = "cmugpt-mcp-server-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-mcp-server/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_prod will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_prod" { id = "cmugpt-mcp-server-prod" name = "cmugpt-mcp-server-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-mcp-server/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_dev" { id = "cmugpt-sms-surface-dev" name = "cmugpt-sms-surface-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-sms-surface/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_prod" { id = "cmugpt-sms-surface-prod" name = "cmugpt-sms-surface-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-sms-surface/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-surface_dev" { id = "cmugpt-surface-dev" name = "cmugpt-surface-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-surface/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-surface_prod" { id = "cmugpt-surface-prod" name = "cmugpt-surface-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-surface/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_dev will be updated in-place ! resource "vault_policy" "components_dev" { id = "components-dev" name = "components-dev" ! policy = <<-EOT path "secret/data/secretspec/components/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_prod will be updated in-place ! resource "vault_policy" "components_prod" { id = "components-prod" name = "components-prod" ! policy = <<-EOT path "secret/data/secretspec/components/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_dev will be updated in-place ! resource "vault_policy" "courses_dev" { id = "courses-dev" name = "courses-dev" ! policy = <<-EOT path "secret/data/secretspec/courses/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_prod will be updated in-place ! resource "vault_policy" "courses_prod" { id = "courses-prod" name = "courses-prod" ! policy = <<-EOT path "secret/data/secretspec/courses/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_dev will be updated in-place ! resource "vault_policy" "dalmatian_dev" { id = "dalmatian-dev" name = "dalmatian-dev" ! policy = <<-EOT path "secret/data/secretspec/dalmatian/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_prod will be updated in-place ! resource "vault_policy" "dalmatian_prod" { id = "dalmatian-prod" name = "dalmatian-prod" ! policy = <<-EOT path "secret/data/secretspec/dalmatian/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_dev will be updated in-place ! resource "vault_policy" "discord-verify_dev" { id = "discord-verify-dev" name = "discord-verify-dev" ! policy = <<-EOT path "secret/data/secretspec/discord-verify/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_prod will be updated in-place ! resource "vault_policy" "discord-verify_prod" { id = "discord-verify-prod" name = "discord-verify-prod" ! policy = <<-EOT path "secret/data/secretspec/discord-verify/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_dev will be updated in-place ! resource "vault_policy" "documentation_dev" { id = "documentation-dev" name = "documentation-dev" ! policy = <<-EOT path "secret/data/secretspec/documentation/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_prod will be updated in-place ! resource "vault_policy" "documentation_prod" { id = "documentation-prod" name = "documentation-prod" ! policy = <<-EOT path "secret/data/secretspec/documentation/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_dev will be updated in-place ! resource "vault_policy" "eats_dev" { id = "eats-dev" name = "eats-dev" ! policy = <<-EOT path "secret/data/secretspec/eats/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_prod will be updated in-place ! resource "vault_policy" "eats_prod" { id = "eats-prod" name = "eats-prod" ! policy = <<-EOT path "secret/data/secretspec/eats/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_dev will be updated in-place ! resource "vault_policy" "groupme-mirror_dev" { id = "groupme-mirror-dev" name = "groupme-mirror-dev" ! policy = <<-EOT path "secret/data/secretspec/groupme-mirror/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_prod will be updated in-place ! resource "vault_policy" "groupme-mirror_prod" { id = "groupme-mirror-prod" name = "groupme-mirror-prod" ! policy = <<-EOT path "secret/data/secretspec/groupme-mirror/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_dev will be updated in-place ! resource "vault_policy" "housing_dev" { id = "housing-dev" name = "housing-dev" ! policy = <<-EOT path "secret/data/secretspec/housing/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_prod will be updated in-place ! resource "vault_policy" "housing_prod" { id = "housing-prod" name = "housing-prod" ! policy = <<-EOT path "secret/data/secretspec/housing/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_dev will be updated in-place ! resource "vault_policy" "insta_dev" { id = "insta-dev" name = "insta-dev" ! policy = <<-EOT path "secret/data/secretspec/insta/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_prod will be updated in-place ! resource "vault_policy" "insta_prod" { id = "insta-prod" name = "insta-prod" ! policy = <<-EOT path "secret/data/secretspec/insta/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_dev will be updated in-place ! resource "vault_policy" "link-shortener_dev" { id = "link-shortener-dev" name = "link-shortener-dev" ! policy = <<-EOT path "secret/data/secretspec/link-shortener/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_prod will be updated in-place ! resource "vault_policy" "link-shortener_prod" { id = "link-shortener-prod" name = "link-shortener-prod" ! policy = <<-EOT path "secret/data/secretspec/link-shortener/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_dev will be updated in-place ! resource "vault_policy" "lost-and-found_dev" { id = "lost-and-found-dev" name = "lost-and-found-dev" ! policy = <<-EOT path "secret/data/secretspec/lost-and-found/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_prod will be updated in-place ! resource "vault_policy" "lost-and-found_prod" { id = "lost-and-found-prod" name = "lost-and-found-prod" ! policy = <<-EOT path "secret/data/secretspec/lost-and-found/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_dev will be updated in-place ! resource "vault_policy" "maps_dev" { id = "maps-dev" name = "maps-dev" ! policy = <<-EOT path "secret/data/secretspec/maps/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_prod will be updated in-place ! resource "vault_policy" "maps_prod" { id = "maps-prod" name = "maps-prod" ! policy = <<-EOT path "secret/data/secretspec/maps/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_dev will be updated in-place ! resource "vault_policy" "occ-main_dev" { id = "occ-main-dev" name = "occ-main-dev" ! policy = <<-EOT path "secret/data/secretspec/occ-main/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_prod will be updated in-place ! resource "vault_policy" "occ-main_prod" { id = "occ-main-prod" name = "occ-main-prod" ! policy = <<-EOT path "secret/data/secretspec/occ-main/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_dev will be updated in-place ! resource "vault_policy" "quest_dev" { id = "quest-dev" name = "quest-dev" ! policy = <<-EOT path "secret/data/secretspec/quest/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_prod will be updated in-place ! resource "vault_policy" "quest_prod" { id = "quest-prod" name = "quest-prod" ! policy = <<-EOT path "secret/data/secretspec/quest/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_dev will be updated in-place ! resource "vault_policy" "scottylabs-org_dev" { id = "scottylabs-org-dev" name = "scottylabs-org-dev" ! policy = <<-EOT path "secret/data/secretspec/scottylabs-org/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_prod will be updated in-place ! resource "vault_policy" "scottylabs-org_prod" { id = "scottylabs-org-prod" name = "scottylabs-org-prod" ! policy = <<-EOT path "secret/data/secretspec/scottylabs-org/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-repo_dev will be created + resource "vault_policy" "slai-repo_dev" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "slai-repo-dev" + policy = <<-EOT path "secret/data/secretspec/slai-repo/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-repo/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-repo_prod will be created + resource "vault_policy" "slai-repo_prod" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "slai-repo-prod" + policy = <<-EOT path "secret/data/secretspec/slai-repo/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-repo/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-repo/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-repo/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_dev will be updated in-place ! resource "vault_policy" "study_dev" { id = "study-dev" name = "study-dev" ! policy = <<-EOT path "secret/data/secretspec/study/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_prod will be updated in-place ! resource "vault_policy" "study_prod" { id = "study-prod" name = "study-prod" ! policy = <<-EOT path "secret/data/secretspec/study/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_dev will be updated in-place ! resource "vault_policy" "tartan-vote_dev" { id = "tartan-vote-dev" name = "tartan-vote-dev" ! policy = <<-EOT path "secret/data/secretspec/tartan-vote/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_prod will be updated in-place ! resource "vault_policy" "tartan-vote_prod" { id = "tartan-vote-prod" name = "tartan-vote-prod" ! policy = <<-EOT path "secret/data/secretspec/tartan-vote/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_dev will be updated in-place ! resource "vault_policy" "terrier_dev" { id = "terrier-dev" name = "terrier-dev" ! policy = <<-EOT path "secret/data/secretspec/terrier/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_prod will be updated in-place ! resource "vault_policy" "terrier_prod" { id = "terrier-prod" name = "terrier-prod" ! policy = <<-EOT path "secret/data/secretspec/terrier/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/ci/*" { capabilities = ["list", "read", "delete"] } EOT } Plan: 6 to add, 50 to change, 0 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p openbao ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fopenbao%252Fdefault%252Fopenbao) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p openbao ``` Plan: 6 to add, 50 to change, 0 to destroy. --- ### Plan Summary 3 projects, 1 with changes, 0 with no changes, 2 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```

scottylabs-bot added 1 commit

2026-09-26 04:27:24 +00:00

chore: regenerate tofu, schemas, CODEOWNERS [skip ci]

kennel/build skipped: no services or static sites defined

Details

atlantis/plan: openbao Plan: 6 to add, 50 to change, 0 to destroy.

Details

atlantis/plan: keycloak Plan: 4 to add, 0 to change, 0 to destroy.

Details

atlantis/plan: git Plan: 13 to add, 1 to change, 0 to destroy.

Details

atlantis/plan 3/3 projects planned successfully.

atlantis/policy_check 0/0 projects had policies checked successfully.

atlantis/pre_workflow_hook: Install local-only OpenTofu providers succeeded.

Details

atlantis/apply: openbao Apply succeeded.

Details

atlantis/apply: git Apply succeeded.

Details

atlantis/apply: keycloak Apply succeeded.

Details

atlantis/apply 3/3 projects applied successfully.

5862f94fed

scottylabs-bot commented

2026-09-26 04:27:29 +00:00

Owner

Ran Plan for 3 projects:

project: keycloak dir: tofu/keycloak workspace: default
project: git dir: tofu/git workspace: default
project: openbao dir: tofu/openbao workspace: default

1. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

Plan Failed: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

2. project: `git` dir: `tofu/git` workspace: `default`

Plan Failed: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

3. project: `openbao` dir: `tofu/openbao` workspace: `default`

Show Output

Finished `release` profile [optimized] target(s) in 0.06s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
! update in-place (current -> planned)

OpenTofu will perform the following actions:

  # vault_identity_group.slai-rfcs_admins will be created
+ resource "vault_identity_group" "slai-rfcs_admins" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "slai-rfcs-admins"
+       policies                   = [
+           "slai-rfcs-prod",
        ]
+       type                       = "external"
    }

  # vault_identity_group.slai-rfcs_members will be created
+ resource "vault_identity_group" "slai-rfcs_members" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "slai-rfcs-members"
+       policies                   = [
+           "slai-rfcs-dev",
        ]
+       type                       = "external"
    }

  # vault_identity_group_alias.slai-rfcs_admins will be created
+ resource "vault_identity_group_alias" "slai-rfcs_admins" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/slai-rfcs/admins"
    }

  # vault_identity_group_alias.slai-rfcs_members will be created
+ resource "vault_identity_group_alias" "slai-rfcs_members" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/slai-rfcs"
    }

  # vault_policy.bus-sign_dev will be updated in-place
! resource "vault_policy" "bus-sign_dev" {
        id     = "bus-sign-dev"
        name   = "bus-sign-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/bus-sign/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.bus-sign_prod will be updated in-place
! resource "vault_policy" "bus-sign_prod" {
        id     = "bus-sign-prod"
        name   = "bus-sign-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/bus-sign/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_dev will be updated in-place
! resource "vault_policy" "cal_dev" {
        id     = "cal-dev"
        name   = "cal-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cal/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_prod will be updated in-place
! resource "vault_policy" "cal_prod" {
        id     = "cal-prod"
        name   = "cal-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cal/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_dev will be updated in-place
! resource "vault_policy" "changelog_dev" {
        id     = "changelog-dev"
        name   = "changelog-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/changelog/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_prod will be updated in-place
! resource "vault_policy" "changelog_prod" {
        id     = "changelog-prod"
        name   = "changelog-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/changelog/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_dev will be updated in-place
! resource "vault_policy" "cmugpt-agent_dev" {
        id     = "cmugpt-agent-dev"
        name   = "cmugpt-agent-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-agent/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_prod will be updated in-place
! resource "vault_policy" "cmugpt-agent_prod" {
        id     = "cmugpt-agent-prod"
        name   = "cmugpt-agent-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-agent/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_dev will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_dev" {
        id     = "cmugpt-mcp-server-dev"
        name   = "cmugpt-mcp-server-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-mcp-server/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_prod will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_prod" {
        id     = "cmugpt-mcp-server-prod"
        name   = "cmugpt-mcp-server-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-mcp-server/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_dev" {
        id     = "cmugpt-sms-surface-dev"
        name   = "cmugpt-sms-surface-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-sms-surface/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_prod" {
        id     = "cmugpt-sms-surface-prod"
        name   = "cmugpt-sms-surface-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-sms-surface/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-surface_dev" {
        id     = "cmugpt-surface-dev"
        name   = "cmugpt-surface-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-surface/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-surface_prod" {
        id     = "cmugpt-surface-prod"
        name   = "cmugpt-surface-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-surface/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_dev will be updated in-place
! resource "vault_policy" "components_dev" {
        id     = "components-dev"
        name   = "components-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/components/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_prod will be updated in-place
! resource "vault_policy" "components_prod" {
        id     = "components-prod"
        name   = "components-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/components/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_dev will be updated in-place
! resource "vault_policy" "courses_dev" {
        id     = "courses-dev"
        name   = "courses-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/courses/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_prod will be updated in-place
! resource "vault_policy" "courses_prod" {
        id     = "courses-prod"
        name   = "courses-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/courses/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_dev will be updated in-place
! resource "vault_policy" "dalmatian_dev" {
        id     = "dalmatian-dev"
        name   = "dalmatian-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/dalmatian/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_prod will be updated in-place
! resource "vault_policy" "dalmatian_prod" {
        id     = "dalmatian-prod"
        name   = "dalmatian-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/dalmatian/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_dev will be updated in-place
! resource "vault_policy" "discord-verify_dev" {
        id     = "discord-verify-dev"
        name   = "discord-verify-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/discord-verify/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_prod will be updated in-place
! resource "vault_policy" "discord-verify_prod" {
        id     = "discord-verify-prod"
        name   = "discord-verify-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/discord-verify/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_dev will be updated in-place
! resource "vault_policy" "documentation_dev" {
        id     = "documentation-dev"
        name   = "documentation-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/documentation/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_prod will be updated in-place
! resource "vault_policy" "documentation_prod" {
        id     = "documentation-prod"
        name   = "documentation-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/documentation/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_dev will be updated in-place
! resource "vault_policy" "eats_dev" {
        id     = "eats-dev"
        name   = "eats-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/eats/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_prod will be updated in-place
! resource "vault_policy" "eats_prod" {
        id     = "eats-prod"
        name   = "eats-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/eats/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_dev will be updated in-place
! resource "vault_policy" "groupme-mirror_dev" {
        id     = "groupme-mirror-dev"
        name   = "groupme-mirror-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/groupme-mirror/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_prod will be updated in-place
! resource "vault_policy" "groupme-mirror_prod" {
        id     = "groupme-mirror-prod"
        name   = "groupme-mirror-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/groupme-mirror/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_dev will be updated in-place
! resource "vault_policy" "housing_dev" {
        id     = "housing-dev"
        name   = "housing-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/housing/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_prod will be updated in-place
! resource "vault_policy" "housing_prod" {
        id     = "housing-prod"
        name   = "housing-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/housing/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_dev will be updated in-place
! resource "vault_policy" "insta_dev" {
        id     = "insta-dev"
        name   = "insta-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/insta/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_prod will be updated in-place
! resource "vault_policy" "insta_prod" {
        id     = "insta-prod"
        name   = "insta-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/insta/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_dev will be updated in-place
! resource "vault_policy" "link-shortener_dev" {
        id     = "link-shortener-dev"
        name   = "link-shortener-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/link-shortener/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_prod will be updated in-place
! resource "vault_policy" "link-shortener_prod" {
        id     = "link-shortener-prod"
        name   = "link-shortener-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/link-shortener/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_dev will be updated in-place
! resource "vault_policy" "lost-and-found_dev" {
        id     = "lost-and-found-dev"
        name   = "lost-and-found-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/lost-and-found/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_prod will be updated in-place
! resource "vault_policy" "lost-and-found_prod" {
        id     = "lost-and-found-prod"
        name   = "lost-and-found-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/lost-and-found/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_dev will be updated in-place
! resource "vault_policy" "maps_dev" {
        id     = "maps-dev"
        name   = "maps-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/maps/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_prod will be updated in-place
! resource "vault_policy" "maps_prod" {
        id     = "maps-prod"
        name   = "maps-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/maps/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_dev will be updated in-place
! resource "vault_policy" "occ-main_dev" {
        id     = "occ-main-dev"
        name   = "occ-main-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/occ-main/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_prod will be updated in-place
! resource "vault_policy" "occ-main_prod" {
        id     = "occ-main-prod"
        name   = "occ-main-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/occ-main/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_dev will be updated in-place
! resource "vault_policy" "quest_dev" {
        id     = "quest-dev"
        name   = "quest-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/quest/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_prod will be updated in-place
! resource "vault_policy" "quest_prod" {
        id     = "quest-prod"
        name   = "quest-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/quest/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_dev will be updated in-place
! resource "vault_policy" "scottylabs-org_dev" {
        id     = "scottylabs-org-dev"
        name   = "scottylabs-org-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/scottylabs-org/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_prod will be updated in-place
! resource "vault_policy" "scottylabs-org_prod" {
        id     = "scottylabs-org-prod"
        name   = "scottylabs-org-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/scottylabs-org/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-rfcs_dev will be created
+ resource "vault_policy" "slai-rfcs_dev" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "slai-rfcs-dev"
+       policy          = <<-EOT
            path "secret/data/secretspec/slai-rfcs/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-rfcs/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-rfcs_prod will be created
+ resource "vault_policy" "slai-rfcs_prod" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "slai-rfcs-prod"
+       policy          = <<-EOT
            path "secret/data/secretspec/slai-rfcs/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-rfcs/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-rfcs/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_dev will be updated in-place
! resource "vault_policy" "study_dev" {
        id     = "study-dev"
        name   = "study-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/study/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_prod will be updated in-place
! resource "vault_policy" "study_prod" {
        id     = "study-prod"
        name   = "study-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/study/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_dev will be updated in-place
! resource "vault_policy" "tartan-vote_dev" {
        id     = "tartan-vote-dev"
        name   = "tartan-vote-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/tartan-vote/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_prod will be updated in-place
! resource "vault_policy" "tartan-vote_prod" {
        id     = "tartan-vote-prod"
        name   = "tartan-vote-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/tartan-vote/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_dev will be updated in-place
! resource "vault_policy" "terrier_dev" {
        id     = "terrier-dev"
        name   = "terrier-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/terrier/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_prod will be updated in-place
! resource "vault_policy" "terrier_prod" {
        id     = "terrier-prod"
        name   = "terrier-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/terrier/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

Plan: 6 to add, 50 to change, 0 to destroy.

▶️ To apply this plan, comment:
```
atlantis apply -p openbao
```
🚮 To delete this plan and lock, click here
🔁 To plan this project again, comment:
```
atlantis plan -p openbao
```

Plan: 6 to add, 50 to change, 0 to destroy.

Plan Summary

3 projects, 1 with changes, 0 with no changes, 2 failed

⏩ To apply all unapplied plans from this Pull Request, comment:
```
atlantis apply
```
🚮 To delete all plans and locks from this Pull Request, comment:
```
atlantis unlock
```

Ran Plan for 3 projects: 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` 1. project: `git` dir: `tofu/git` workspace: `default` 1. project: `openbao` dir: `tofu/openbao` workspace: `default` --- ### 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 2. project: `git` dir: `tofu/git` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #373. To continue, delete the lock from #373 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 3. project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Finished `release` profile [optimized] target(s) in 0.06s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create ! update in-place (current -> planned) OpenTofu will perform the following actions: # vault_identity_group.slai-rfcs_admins will be created + resource "vault_identity_group" "slai-rfcs_admins" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "slai-rfcs-admins" + policies = [ + "slai-rfcs-prod", ] + type = "external" } # vault_identity_group.slai-rfcs_members will be created + resource "vault_identity_group" "slai-rfcs_members" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "slai-rfcs-members" + policies = [ + "slai-rfcs-dev", ] + type = "external" } # vault_identity_group_alias.slai-rfcs_admins will be created + resource "vault_identity_group_alias" "slai-rfcs_admins" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/slai-rfcs/admins" } # vault_identity_group_alias.slai-rfcs_members will be created + resource "vault_identity_group_alias" "slai-rfcs_members" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/slai-rfcs" } # vault_policy.bus-sign_dev will be updated in-place ! resource "vault_policy" "bus-sign_dev" { id = "bus-sign-dev" name = "bus-sign-dev" ! policy = <<-EOT path "secret/data/secretspec/bus-sign/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.bus-sign_prod will be updated in-place ! resource "vault_policy" "bus-sign_prod" { id = "bus-sign-prod" name = "bus-sign-prod" ! policy = <<-EOT path "secret/data/secretspec/bus-sign/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_dev will be updated in-place ! resource "vault_policy" "cal_dev" { id = "cal-dev" name = "cal-dev" ! policy = <<-EOT path "secret/data/secretspec/cal/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_prod will be updated in-place ! resource "vault_policy" "cal_prod" { id = "cal-prod" name = "cal-prod" ! policy = <<-EOT path "secret/data/secretspec/cal/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_dev will be updated in-place ! resource "vault_policy" "changelog_dev" { id = "changelog-dev" name = "changelog-dev" ! policy = <<-EOT path "secret/data/secretspec/changelog/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_prod will be updated in-place ! resource "vault_policy" "changelog_prod" { id = "changelog-prod" name = "changelog-prod" ! policy = <<-EOT path "secret/data/secretspec/changelog/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_dev will be updated in-place ! resource "vault_policy" "cmugpt-agent_dev" { id = "cmugpt-agent-dev" name = "cmugpt-agent-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-agent/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_prod will be updated in-place ! resource "vault_policy" "cmugpt-agent_prod" { id = "cmugpt-agent-prod" name = "cmugpt-agent-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-agent/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_dev will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_dev" { id = "cmugpt-mcp-server-dev" name = "cmugpt-mcp-server-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-mcp-server/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_prod will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_prod" { id = "cmugpt-mcp-server-prod" name = "cmugpt-mcp-server-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-mcp-server/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_dev" { id = "cmugpt-sms-surface-dev" name = "cmugpt-sms-surface-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-sms-surface/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_prod" { id = "cmugpt-sms-surface-prod" name = "cmugpt-sms-surface-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-sms-surface/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-surface_dev" { id = "cmugpt-surface-dev" name = "cmugpt-surface-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-surface/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-surface_prod" { id = "cmugpt-surface-prod" name = "cmugpt-surface-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-surface/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_dev will be updated in-place ! resource "vault_policy" "components_dev" { id = "components-dev" name = "components-dev" ! policy = <<-EOT path "secret/data/secretspec/components/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_prod will be updated in-place ! resource "vault_policy" "components_prod" { id = "components-prod" name = "components-prod" ! policy = <<-EOT path "secret/data/secretspec/components/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_dev will be updated in-place ! resource "vault_policy" "courses_dev" { id = "courses-dev" name = "courses-dev" ! policy = <<-EOT path "secret/data/secretspec/courses/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_prod will be updated in-place ! resource "vault_policy" "courses_prod" { id = "courses-prod" name = "courses-prod" ! policy = <<-EOT path "secret/data/secretspec/courses/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_dev will be updated in-place ! resource "vault_policy" "dalmatian_dev" { id = "dalmatian-dev" name = "dalmatian-dev" ! policy = <<-EOT path "secret/data/secretspec/dalmatian/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_prod will be updated in-place ! resource "vault_policy" "dalmatian_prod" { id = "dalmatian-prod" name = "dalmatian-prod" ! policy = <<-EOT path "secret/data/secretspec/dalmatian/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_dev will be updated in-place ! resource "vault_policy" "discord-verify_dev" { id = "discord-verify-dev" name = "discord-verify-dev" ! policy = <<-EOT path "secret/data/secretspec/discord-verify/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_prod will be updated in-place ! resource "vault_policy" "discord-verify_prod" { id = "discord-verify-prod" name = "discord-verify-prod" ! policy = <<-EOT path "secret/data/secretspec/discord-verify/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_dev will be updated in-place ! resource "vault_policy" "documentation_dev" { id = "documentation-dev" name = "documentation-dev" ! policy = <<-EOT path "secret/data/secretspec/documentation/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_prod will be updated in-place ! resource "vault_policy" "documentation_prod" { id = "documentation-prod" name = "documentation-prod" ! policy = <<-EOT path "secret/data/secretspec/documentation/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_dev will be updated in-place ! resource "vault_policy" "eats_dev" { id = "eats-dev" name = "eats-dev" ! policy = <<-EOT path "secret/data/secretspec/eats/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_prod will be updated in-place ! resource "vault_policy" "eats_prod" { id = "eats-prod" name = "eats-prod" ! policy = <<-EOT path "secret/data/secretspec/eats/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_dev will be updated in-place ! resource "vault_policy" "groupme-mirror_dev" { id = "groupme-mirror-dev" name = "groupme-mirror-dev" ! policy = <<-EOT path "secret/data/secretspec/groupme-mirror/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_prod will be updated in-place ! resource "vault_policy" "groupme-mirror_prod" { id = "groupme-mirror-prod" name = "groupme-mirror-prod" ! policy = <<-EOT path "secret/data/secretspec/groupme-mirror/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_dev will be updated in-place ! resource "vault_policy" "housing_dev" { id = "housing-dev" name = "housing-dev" ! policy = <<-EOT path "secret/data/secretspec/housing/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_prod will be updated in-place ! resource "vault_policy" "housing_prod" { id = "housing-prod" name = "housing-prod" ! policy = <<-EOT path "secret/data/secretspec/housing/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_dev will be updated in-place ! resource "vault_policy" "insta_dev" { id = "insta-dev" name = "insta-dev" ! policy = <<-EOT path "secret/data/secretspec/insta/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_prod will be updated in-place ! resource "vault_policy" "insta_prod" { id = "insta-prod" name = "insta-prod" ! policy = <<-EOT path "secret/data/secretspec/insta/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_dev will be updated in-place ! resource "vault_policy" "link-shortener_dev" { id = "link-shortener-dev" name = "link-shortener-dev" ! policy = <<-EOT path "secret/data/secretspec/link-shortener/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_prod will be updated in-place ! resource "vault_policy" "link-shortener_prod" { id = "link-shortener-prod" name = "link-shortener-prod" ! policy = <<-EOT path "secret/data/secretspec/link-shortener/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_dev will be updated in-place ! resource "vault_policy" "lost-and-found_dev" { id = "lost-and-found-dev" name = "lost-and-found-dev" ! policy = <<-EOT path "secret/data/secretspec/lost-and-found/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_prod will be updated in-place ! resource "vault_policy" "lost-and-found_prod" { id = "lost-and-found-prod" name = "lost-and-found-prod" ! policy = <<-EOT path "secret/data/secretspec/lost-and-found/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_dev will be updated in-place ! resource "vault_policy" "maps_dev" { id = "maps-dev" name = "maps-dev" ! policy = <<-EOT path "secret/data/secretspec/maps/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_prod will be updated in-place ! resource "vault_policy" "maps_prod" { id = "maps-prod" name = "maps-prod" ! policy = <<-EOT path "secret/data/secretspec/maps/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_dev will be updated in-place ! resource "vault_policy" "occ-main_dev" { id = "occ-main-dev" name = "occ-main-dev" ! policy = <<-EOT path "secret/data/secretspec/occ-main/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_prod will be updated in-place ! resource "vault_policy" "occ-main_prod" { id = "occ-main-prod" name = "occ-main-prod" ! policy = <<-EOT path "secret/data/secretspec/occ-main/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_dev will be updated in-place ! resource "vault_policy" "quest_dev" { id = "quest-dev" name = "quest-dev" ! policy = <<-EOT path "secret/data/secretspec/quest/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_prod will be updated in-place ! resource "vault_policy" "quest_prod" { id = "quest-prod" name = "quest-prod" ! policy = <<-EOT path "secret/data/secretspec/quest/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_dev will be updated in-place ! resource "vault_policy" "scottylabs-org_dev" { id = "scottylabs-org-dev" name = "scottylabs-org-dev" ! policy = <<-EOT path "secret/data/secretspec/scottylabs-org/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_prod will be updated in-place ! resource "vault_policy" "scottylabs-org_prod" { id = "scottylabs-org-prod" name = "scottylabs-org-prod" ! policy = <<-EOT path "secret/data/secretspec/scottylabs-org/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-rfcs_dev will be created + resource "vault_policy" "slai-rfcs_dev" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "slai-rfcs-dev" + policy = <<-EOT path "secret/data/secretspec/slai-rfcs/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-rfcs/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-rfcs_prod will be created + resource "vault_policy" "slai-rfcs_prod" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "slai-rfcs-prod" + policy = <<-EOT path "secret/data/secretspec/slai-rfcs/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-rfcs/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-rfcs/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_dev will be updated in-place ! resource "vault_policy" "study_dev" { id = "study-dev" name = "study-dev" ! policy = <<-EOT path "secret/data/secretspec/study/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_prod will be updated in-place ! resource "vault_policy" "study_prod" { id = "study-prod" name = "study-prod" ! policy = <<-EOT path "secret/data/secretspec/study/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_dev will be updated in-place ! resource "vault_policy" "tartan-vote_dev" { id = "tartan-vote-dev" name = "tartan-vote-dev" ! policy = <<-EOT path "secret/data/secretspec/tartan-vote/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_prod will be updated in-place ! resource "vault_policy" "tartan-vote_prod" { id = "tartan-vote-prod" name = "tartan-vote-prod" ! policy = <<-EOT path "secret/data/secretspec/tartan-vote/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_dev will be updated in-place ! resource "vault_policy" "terrier_dev" { id = "terrier-dev" name = "terrier-dev" ! policy = <<-EOT path "secret/data/secretspec/terrier/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_prod will be updated in-place ! resource "vault_policy" "terrier_prod" { id = "terrier-prod" name = "terrier-prod" ! policy = <<-EOT path "secret/data/secretspec/terrier/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/ci/*" { capabilities = ["list", "read", "delete"] } EOT } Plan: 6 to add, 50 to change, 0 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p openbao ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fopenbao%252Fdefault%252Fopenbao) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p openbao ``` Plan: 6 to add, 50 to change, 0 to destroy. --- ### Plan Summary 3 projects, 1 with changes, 0 with no changes, 2 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```

thesuperRL commented

2026-09-26 17:50:35 +00:00

Owner

atlantis plan

scottylabs-bot commented

2026-09-26 17:51:09 +00:00

Owner

Ran Plan for 3 projects:

project: openbao dir: tofu/openbao workspace: default
project: keycloak dir: tofu/keycloak workspace: default
project: git dir: tofu/git workspace: default

1. project: `openbao` dir: `tofu/openbao` workspace: `default`

Show Output

Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on shared package cache
    Blocking waiting for file lock on build directory
    Finished `release` profile [optimized] target(s) in 0.14s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
! update in-place (current -> planned)

OpenTofu will perform the following actions:

  # vault_identity_group.slai-rfcs_admins will be created
+ resource "vault_identity_group" "slai-rfcs_admins" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "slai-rfcs-admins"
+       policies                   = [
+           "slai-rfcs-prod",
        ]
+       type                       = "external"
    }

  # vault_identity_group.slai-rfcs_members will be created
+ resource "vault_identity_group" "slai-rfcs_members" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "slai-rfcs-members"
+       policies                   = [
+           "slai-rfcs-dev",
        ]
+       type                       = "external"
    }

  # vault_identity_group_alias.slai-rfcs_admins will be created
+ resource "vault_identity_group_alias" "slai-rfcs_admins" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/slai-rfcs/admins"
    }

  # vault_identity_group_alias.slai-rfcs_members will be created
+ resource "vault_identity_group_alias" "slai-rfcs_members" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/slai-rfcs"
    }

  # vault_policy.bus-sign_dev will be updated in-place
! resource "vault_policy" "bus-sign_dev" {
        id     = "bus-sign-dev"
        name   = "bus-sign-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/bus-sign/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.bus-sign_prod will be updated in-place
! resource "vault_policy" "bus-sign_prod" {
        id     = "bus-sign-prod"
        name   = "bus-sign-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/bus-sign/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_dev will be updated in-place
! resource "vault_policy" "cal_dev" {
        id     = "cal-dev"
        name   = "cal-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cal/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_prod will be updated in-place
! resource "vault_policy" "cal_prod" {
        id     = "cal-prod"
        name   = "cal-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cal/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_dev will be updated in-place
! resource "vault_policy" "changelog_dev" {
        id     = "changelog-dev"
        name   = "changelog-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/changelog/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_prod will be updated in-place
! resource "vault_policy" "changelog_prod" {
        id     = "changelog-prod"
        name   = "changelog-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/changelog/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_dev will be updated in-place
! resource "vault_policy" "cmugpt-agent_dev" {
        id     = "cmugpt-agent-dev"
        name   = "cmugpt-agent-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-agent/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_prod will be updated in-place
! resource "vault_policy" "cmugpt-agent_prod" {
        id     = "cmugpt-agent-prod"
        name   = "cmugpt-agent-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-agent/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_dev will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_dev" {
        id     = "cmugpt-mcp-server-dev"
        name   = "cmugpt-mcp-server-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-mcp-server/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_prod will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_prod" {
        id     = "cmugpt-mcp-server-prod"
        name   = "cmugpt-mcp-server-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-mcp-server/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_dev" {
        id     = "cmugpt-sms-surface-dev"
        name   = "cmugpt-sms-surface-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-sms-surface/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_prod" {
        id     = "cmugpt-sms-surface-prod"
        name   = "cmugpt-sms-surface-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-sms-surface/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-surface_dev" {
        id     = "cmugpt-surface-dev"
        name   = "cmugpt-surface-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-surface/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-surface_prod" {
        id     = "cmugpt-surface-prod"
        name   = "cmugpt-surface-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/cmugpt-surface/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_dev will be updated in-place
! resource "vault_policy" "components_dev" {
        id     = "components-dev"
        name   = "components-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/components/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_prod will be updated in-place
! resource "vault_policy" "components_prod" {
        id     = "components-prod"
        name   = "components-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/components/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_dev will be updated in-place
! resource "vault_policy" "courses_dev" {
        id     = "courses-dev"
        name   = "courses-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/courses/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_prod will be updated in-place
! resource "vault_policy" "courses_prod" {
        id     = "courses-prod"
        name   = "courses-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/courses/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_dev will be updated in-place
! resource "vault_policy" "dalmatian_dev" {
        id     = "dalmatian-dev"
        name   = "dalmatian-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/dalmatian/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_prod will be updated in-place
! resource "vault_policy" "dalmatian_prod" {
        id     = "dalmatian-prod"
        name   = "dalmatian-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/dalmatian/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_dev will be updated in-place
! resource "vault_policy" "discord-verify_dev" {
        id     = "discord-verify-dev"
        name   = "discord-verify-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/discord-verify/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_prod will be updated in-place
! resource "vault_policy" "discord-verify_prod" {
        id     = "discord-verify-prod"
        name   = "discord-verify-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/discord-verify/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_dev will be updated in-place
! resource "vault_policy" "documentation_dev" {
        id     = "documentation-dev"
        name   = "documentation-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/documentation/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_prod will be updated in-place
! resource "vault_policy" "documentation_prod" {
        id     = "documentation-prod"
        name   = "documentation-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/documentation/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_dev will be updated in-place
! resource "vault_policy" "eats_dev" {
        id     = "eats-dev"
        name   = "eats-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/eats/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_prod will be updated in-place
! resource "vault_policy" "eats_prod" {
        id     = "eats-prod"
        name   = "eats-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/eats/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_dev will be updated in-place
! resource "vault_policy" "groupme-mirror_dev" {
        id     = "groupme-mirror-dev"
        name   = "groupme-mirror-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/groupme-mirror/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_prod will be updated in-place
! resource "vault_policy" "groupme-mirror_prod" {
        id     = "groupme-mirror-prod"
        name   = "groupme-mirror-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/groupme-mirror/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_dev will be updated in-place
! resource "vault_policy" "housing_dev" {
        id     = "housing-dev"
        name   = "housing-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/housing/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_prod will be updated in-place
! resource "vault_policy" "housing_prod" {
        id     = "housing-prod"
        name   = "housing-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/housing/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_dev will be updated in-place
! resource "vault_policy" "insta_dev" {
        id     = "insta-dev"
        name   = "insta-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/insta/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_prod will be updated in-place
! resource "vault_policy" "insta_prod" {
        id     = "insta-prod"
        name   = "insta-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/insta/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_dev will be updated in-place
! resource "vault_policy" "link-shortener_dev" {
        id     = "link-shortener-dev"
        name   = "link-shortener-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/link-shortener/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_prod will be updated in-place
! resource "vault_policy" "link-shortener_prod" {
        id     = "link-shortener-prod"
        name   = "link-shortener-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/link-shortener/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_dev will be updated in-place
! resource "vault_policy" "lost-and-found_dev" {
        id     = "lost-and-found-dev"
        name   = "lost-and-found-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/lost-and-found/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_prod will be updated in-place
! resource "vault_policy" "lost-and-found_prod" {
        id     = "lost-and-found-prod"
        name   = "lost-and-found-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/lost-and-found/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_dev will be updated in-place
! resource "vault_policy" "maps_dev" {
        id     = "maps-dev"
        name   = "maps-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/maps/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_prod will be updated in-place
! resource "vault_policy" "maps_prod" {
        id     = "maps-prod"
        name   = "maps-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/maps/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_dev will be updated in-place
! resource "vault_policy" "occ-main_dev" {
        id     = "occ-main-dev"
        name   = "occ-main-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/occ-main/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_prod will be updated in-place
! resource "vault_policy" "occ-main_prod" {
        id     = "occ-main-prod"
        name   = "occ-main-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/occ-main/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_dev will be updated in-place
! resource "vault_policy" "quest_dev" {
        id     = "quest-dev"
        name   = "quest-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/quest/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_prod will be updated in-place
! resource "vault_policy" "quest_prod" {
        id     = "quest-prod"
        name   = "quest-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/quest/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_dev will be updated in-place
! resource "vault_policy" "scottylabs-org_dev" {
        id     = "scottylabs-org-dev"
        name   = "scottylabs-org-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/scottylabs-org/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_prod will be updated in-place
! resource "vault_policy" "scottylabs-org_prod" {
        id     = "scottylabs-org-prod"
        name   = "scottylabs-org-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/scottylabs-org/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-rfcs_dev will be created
+ resource "vault_policy" "slai-rfcs_dev" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "slai-rfcs-dev"
+       policy          = <<-EOT
            path "secret/data/secretspec/slai-rfcs/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-rfcs/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-rfcs_prod will be created
+ resource "vault_policy" "slai-rfcs_prod" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "slai-rfcs-prod"
+       policy          = <<-EOT
            path "secret/data/secretspec/slai-rfcs/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-rfcs/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-rfcs/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_dev will be updated in-place
! resource "vault_policy" "study_dev" {
        id     = "study-dev"
        name   = "study-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/study/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_prod will be updated in-place
! resource "vault_policy" "study_prod" {
        id     = "study-prod"
        name   = "study-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/study/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_dev will be updated in-place
! resource "vault_policy" "tartan-vote_dev" {
        id     = "tartan-vote-dev"
        name   = "tartan-vote-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/tartan-vote/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_prod will be updated in-place
! resource "vault_policy" "tartan-vote_prod" {
        id     = "tartan-vote-prod"
        name   = "tartan-vote-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/tartan-vote/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_dev will be updated in-place
! resource "vault_policy" "terrier_dev" {
        id     = "terrier-dev"
        name   = "terrier-dev"
!       policy = <<-EOT
            path "secret/data/secretspec/terrier/dev/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/preview/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_prod will be updated in-place
! resource "vault_policy" "terrier_prod" {
        id     = "terrier-prod"
        name   = "terrier-prod"
!       policy = <<-EOT
            path "secret/data/secretspec/terrier/prod/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/staging/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/ci/*" {
-             capabilities = ["create", "read", "update", "delete", "list"]
+             capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

Plan: 6 to add, 50 to change, 0 to destroy.

▶️ To apply this plan, comment:
```
atlantis apply -p openbao
```
🚮 To delete this plan and lock, click here
🔁 To plan this project again, comment:
```
atlantis plan -p openbao
```

Plan: 6 to add, 50 to change, 0 to destroy.

2. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

Show Output

Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on build directory
    Finished `release` profile [optimized] target(s) in 0.18s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create

OpenTofu will perform the following actions:

  # keycloak_group.project_slai_slai-rfcs will be created
+ resource "keycloak_group" "project_slai_slai-rfcs" {
+       id        = (known after apply)
+       name      = "slai-rfcs"
+       parent_id = "9e6890c8-50a0-4b82-86b9-91791fffac25"
+       path      = (known after apply)
+       realm_id  = "scottylabs"
    }

  # keycloak_group.project_slai_slai-rfcs_admins will be created
+ resource "keycloak_group" "project_slai_slai-rfcs_admins" {
+       id        = (known after apply)
+       name      = "admins"
+       parent_id = (known after apply)
+       path      = (known after apply)
+       realm_id  = "scottylabs"
    }

  # keycloak_group_memberships.project_slai_slai-rfcs will be created
+ resource "keycloak_group_memberships" "project_slai_slai-rfcs" {
+       group_id = (known after apply)
+       id       = (known after apply)
+       members  = [
+           "akhanal2",
+           "apallati",
+           "jcz2",
+           "jessec2",
+           "jiyas",
+           "jliao2",
+           "krishsax",
+           "qge",
+           "rzhu3",
+           "spola2",
+           "yuxizhen",
        ]
+       realm_id = "scottylabs"
    }

  # keycloak_group_memberships.project_slai_slai-rfcs_admins will be created
+ resource "keycloak_group_memberships" "project_slai_slai-rfcs_admins" {
+       group_id = (known after apply)
+       id       = (known after apply)
+       members  = [
+           "apallati",
+           "jessec2",
+           "jiyas",
+           "krishsax",
        ]
+       realm_id = "scottylabs"
    }

Plan: 4 to add, 0 to change, 0 to destroy.

▶️ To apply this plan, comment:
```
atlantis apply -p keycloak
```
🚮 To delete this plan and lock, click here
🔁 To plan this project again, comment:
```
atlantis plan -p keycloak
```

Plan: 4 to add, 0 to change, 0 to destroy.

3. project: `git` dir: `tofu/git` workspace: `default`

Show Output

Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on shared package cache
    Finished `release` profile [optimized] target(s) in 0.14s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
! update in-place (current -> planned)

OpenTofu will perform the following actions:

  # forgejo_repository.slai_slai_rfcs will be created
+ resource "forgejo_repository" "slai_slai_rfcs" {
+       allow_manual_merge          = false
+       allow_merge_commits         = true
+       allow_rebase                = true
+       allow_rebase_explicit       = true
+       allow_squash_merge          = true
+       archive_on_destroy          = false
+       archived                    = false
+       auto_init                   = true
+       autodetect_manual_merge     = false
+       avatar_url                  = (known after apply)
+       clone_url                   = (known after apply)
+       created_at                  = (known after apply)
+       default_branch              = "main"
+       default_merge_style         = "merge"
+       description                 = "RFCs for SLAI"
+       empty                       = (known after apply)
+       external_tracker            = (known after apply)
+       external_wiki               = (known after apply)
+       fork                        = (known after apply)
+       forks_count                 = (known after apply)
+       full_name                   = (known after apply)
+       has_actions                 = true
+       has_issues                  = true
+       has_packages                = true
+       has_projects                = true
+       has_pull_requests           = true
+       has_releases                = true
+       has_wiki                    = true
+       html_url                    = (known after apply)
+       id                          = (known after apply)
+       ignore_whitespace_conflicts = false
+       internal                    = (known after apply)
+       internal_tracker            = (known after apply)
+       labels                      = false
+       lfs                         = false
+       milestones                  = false
+       mirror                      = false
+       mirror_interval             = (known after apply)
+       mirror_updated              = (known after apply)
+       name                        = "slai-rfcs"
+       open_issues_count           = (known after apply)
+       open_pr_counter             = (known after apply)
+       owner                       = "ScottyLabs"
+       parent_id                   = (known after apply)
+       permissions                 = (known after apply)
+       private                     = false
+       release_counter             = (known after apply)
+       size                        = (known after apply)
+       ssh_url                     = (known after apply)
+       stars_count                 = (known after apply)
+       template                    = false
+       trust_model                 = "default"
+       updated_at                  = (known after apply)
+       watchers_count              = (known after apply)
    }

  # forgejo_team.slai-rfcs_leads will be created
+ resource "forgejo_team" "slai-rfcs_leads" {
+       can_create_org_repo       = false
+       description               = "SLAI RFCs leads"
+       id                        = (known after apply)
+       includes_all_repositories = false
+       name                      = "slai-rfcs-leads"
+       organization              = (known after apply)
+       organization_id           = 3
+       permission                = "admin"
+       units_map                 = {
          + "repo.actions"    = "admin"
          + "repo.code"       = "admin"
          + "repo.ext_issues" = "admin"
          + "repo.ext_wiki"   = "admin"
          + "repo.issues"     = "admin"
          + "repo.packages"   = "admin"
          + "repo.projects"   = "admin"
          + "repo.pulls"      = "admin"
          + "repo.releases"   = "admin"
          + "repo.wiki"       = "admin"
        }
    }

  # forgejo_team_member.slai-rfcs_leads_anish will be created
+ resource "forgejo_team_member" "slai-rfcs_leads_anish" {
+       team_id = (known after apply)
+       user    = "anish"
    }

  # forgejo_team_member.slai-rfcs_leads_jc_965 will be created
+ resource "forgejo_team_member" "slai-rfcs_leads_jc_965" {
+       team_id = (known after apply)
+       user    = "jessec2"
    }

  # forgejo_team_member.slai-rfcs_leads_jiyas will be created
+ resource "forgejo_team_member" "slai-rfcs_leads_jiyas" {
+       team_id = (known after apply)
+       user    = "jiyas"
    }

  # forgejo_team_member.slai-rfcs_leads_krishsax will be created
+ resource "forgejo_team_member" "slai-rfcs_leads_krishsax" {
+       team_id = (known after apply)
+       user    = "krishsax"
    }

  # forgejo_team_repository.slai-rfcs_leads_slai_rfcs will be created
+ resource "forgejo_team_repository" "slai-rfcs_leads_slai_rfcs" {
+       owner      = "ScottyLabs"
+       repository = "slai-rfcs"
+       team_id    = (known after apply)
    }

  # forgejo_team_repository.slai_slai_rfcs will be created
+ resource "forgejo_team_repository" "slai_slai_rfcs" {
+       owner      = "ScottyLabs"
+       repository = "slai-rfcs"
+       team_id    = 8
    }

  # github_actions_repository_permissions.slai_slai_rfcs_actions will be created
+ resource "github_actions_repository_permissions" "slai_slai_rfcs_actions" {
+       enabled              = false
+       id                   = (known after apply)
+       repository           = "slai-rfcs"
+       sha_pinning_required = (known after apply)
    }

  # github_repository.slai_cmugpt_agent will be updated in-place
! resource "github_repository" "slai_cmugpt_agent" {
        id                                      = "cmugpt-agent"
        name                                    = "cmugpt-agent"
        # (39 unchanged attributes hidden)

-       template {
-           include_all_branches = false -> null
-           owner                = "ScottyLabs" -> null
-           repository           = "python-template" -> null
        }

        # (1 unchanged block hidden)
    }

  # github_repository.slai_slai_rfcs will be created
+ resource "github_repository" "slai_slai_rfcs" {
+       allow_auto_merge                        = false
+       allow_forking                           = (known after apply)
+       allow_merge_commit                      = true
+       allow_rebase_merge                      = true
+       allow_squash_merge                      = true
+       archived                                = false
+       default_branch                          = (known after apply)
+       delete_branch_on_merge                  = false
+       description                             = "READ-ONLY MIRROR"
+       etag                                    = (known after apply)
+       fork                                    = (known after apply)
+       full_name                               = (known after apply)
+       git_clone_url                           = (known after apply)
+       has_discussions                         = false
+       has_issues                              = false
+       has_projects                            = false
+       has_wiki                                = false
+       homepage_url                            = "https://git.cmu.dev/ScottyLabs/slai-rfcs"
+       html_url                                = (known after apply)
+       http_clone_url                          = (known after apply)
+       id                                      = (known after apply)
+       ignore_vulnerability_alerts_during_read = false
+       merge_commit_message                    = "PR_TITLE"
+       merge_commit_title                      = "MERGE_MESSAGE"
+       name                                    = "slai-rfcs"
+       node_id                                 = (known after apply)
+       primary_language                        = (known after apply)
+       private                                 = (known after apply)
+       repo_id                                 = (known after apply)
+       source_owner                            = (known after apply)
+       source_repo                             = (known after apply)
+       squash_merge_commit_message             = "COMMIT_MESSAGES"
+       squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
+       ssh_clone_url                           = (known after apply)
+       svn_url                                 = (known after apply)
+       topics                                  = (known after apply)
+       visibility                              = "public"
+       vulnerability_alerts                    = (known after apply)
+       web_commit_signoff_required             = (known after apply)

+       security_and_analysis (known after apply)
    }

  # github_repository_deploy_key.slai_slai_rfcs_mirror_deploy_key will be created
+ resource "github_repository_deploy_key" "slai_slai_rfcs_mirror_deploy_key" {
+       etag       = (known after apply)
+       id         = (known after apply)
+       key        = (known after apply)
+       read_only  = false
+       repository = "slai-rfcs"
+       title      = "Forgejo mirror"
    }

  # github_repository_ruleset.slai_slai_rfcs_ruleset will be created
+ resource "github_repository_ruleset" "slai_slai_rfcs_ruleset" {
+       enforcement = "active"
+       etag        = (known after apply)
+       id          = (known after apply)
+       name        = "Default"
+       node_id     = (known after apply)
+       repository  = "slai-rfcs"
+       ruleset_id  = (known after apply)
+       target      = "branch"

+       bypass_actors {
+           actor_id    = (known after apply)
+           actor_type  = "DeployKey"
+           bypass_mode = "always"
        }

+       conditions {
+           ref_name {
+               exclude = []
+               include = [
+                   "~ALL",
                ]
            }
        }

+       rules {
+           creation                      = true
+           deletion                      = true
+           non_fast_forward              = true
+           update                        = true
+           update_allows_fetch_and_merge = false

+           pull_request {
+               allowed_merge_methods             = (known after apply)
+               dismiss_stale_reviews_on_push     = false
+               require_code_owner_review         = false
+               require_last_push_approval        = false
+               required_approving_review_count   = 1
+               required_review_thread_resolution = false
            }
        }
    }

  # restapi_object.slai_slai_rfcs_push_mirror will be created
+ resource "restapi_object" "slai_slai_rfcs_push_mirror" {
+       api_data        = (known after apply)
+       api_response    = (known after apply)
+       create_response = (known after apply)
+       data            = jsonencode(
            {
+               interval       = "8h0m0s"
+               remote_address = "git@github.com:ScottyLabs/slai-rfcs.git"
+               sync_on_commit = true
+               use_ssh        = true
            }
        )
+       id              = (known after apply)
+       id_attribute    = "remote_name"
+       path            = "/api/v1/repos/ScottyLabs/slai-rfcs/push_mirrors"
    }

Plan: 13 to add, 1 to change, 0 to destroy.

▶️ To apply this plan, comment:
```
atlantis apply -p git
```
🚮 To delete this plan and lock, click here
🔁 To plan this project again, comment:
```
atlantis plan -p git
```

Plan: 13 to add, 1 to change, 0 to destroy.

Plan Summary

3 projects, 3 with changes, 0 with no changes, 0 failed

⏩ To apply all unapplied plans from this Pull Request, comment:
```
atlantis apply
```
🚮 To delete all plans and locks from this Pull Request, comment:
```
atlantis unlock
```

Ran Plan for 3 projects: 1. project: `openbao` dir: `tofu/openbao` workspace: `default` 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` 1. project: `git` dir: `tofu/git` workspace: `default` --- ### 1. project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on shared package cache Blocking waiting for file lock on build directory Finished `release` profile [optimized] target(s) in 0.14s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create ! update in-place (current -> planned) OpenTofu will perform the following actions: # vault_identity_group.slai-rfcs_admins will be created + resource "vault_identity_group" "slai-rfcs_admins" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "slai-rfcs-admins" + policies = [ + "slai-rfcs-prod", ] + type = "external" } # vault_identity_group.slai-rfcs_members will be created + resource "vault_identity_group" "slai-rfcs_members" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "slai-rfcs-members" + policies = [ + "slai-rfcs-dev", ] + type = "external" } # vault_identity_group_alias.slai-rfcs_admins will be created + resource "vault_identity_group_alias" "slai-rfcs_admins" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/slai-rfcs/admins" } # vault_identity_group_alias.slai-rfcs_members will be created + resource "vault_identity_group_alias" "slai-rfcs_members" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/slai-rfcs" } # vault_policy.bus-sign_dev will be updated in-place ! resource "vault_policy" "bus-sign_dev" { id = "bus-sign-dev" name = "bus-sign-dev" ! policy = <<-EOT path "secret/data/secretspec/bus-sign/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.bus-sign_prod will be updated in-place ! resource "vault_policy" "bus-sign_prod" { id = "bus-sign-prod" name = "bus-sign-prod" ! policy = <<-EOT path "secret/data/secretspec/bus-sign/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_dev will be updated in-place ! resource "vault_policy" "cal_dev" { id = "cal-dev" name = "cal-dev" ! policy = <<-EOT path "secret/data/secretspec/cal/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_prod will be updated in-place ! resource "vault_policy" "cal_prod" { id = "cal-prod" name = "cal-prod" ! policy = <<-EOT path "secret/data/secretspec/cal/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_dev will be updated in-place ! resource "vault_policy" "changelog_dev" { id = "changelog-dev" name = "changelog-dev" ! policy = <<-EOT path "secret/data/secretspec/changelog/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_prod will be updated in-place ! resource "vault_policy" "changelog_prod" { id = "changelog-prod" name = "changelog-prod" ! policy = <<-EOT path "secret/data/secretspec/changelog/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_dev will be updated in-place ! resource "vault_policy" "cmugpt-agent_dev" { id = "cmugpt-agent-dev" name = "cmugpt-agent-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-agent/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_prod will be updated in-place ! resource "vault_policy" "cmugpt-agent_prod" { id = "cmugpt-agent-prod" name = "cmugpt-agent-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-agent/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_dev will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_dev" { id = "cmugpt-mcp-server-dev" name = "cmugpt-mcp-server-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-mcp-server/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_prod will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_prod" { id = "cmugpt-mcp-server-prod" name = "cmugpt-mcp-server-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-mcp-server/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_dev" { id = "cmugpt-sms-surface-dev" name = "cmugpt-sms-surface-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-sms-surface/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_prod" { id = "cmugpt-sms-surface-prod" name = "cmugpt-sms-surface-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-sms-surface/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-surface_dev" { id = "cmugpt-surface-dev" name = "cmugpt-surface-dev" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-surface/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-surface_prod" { id = "cmugpt-surface-prod" name = "cmugpt-surface-prod" ! policy = <<-EOT path "secret/data/secretspec/cmugpt-surface/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_dev will be updated in-place ! resource "vault_policy" "components_dev" { id = "components-dev" name = "components-dev" ! policy = <<-EOT path "secret/data/secretspec/components/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_prod will be updated in-place ! resource "vault_policy" "components_prod" { id = "components-prod" name = "components-prod" ! policy = <<-EOT path "secret/data/secretspec/components/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_dev will be updated in-place ! resource "vault_policy" "courses_dev" { id = "courses-dev" name = "courses-dev" ! policy = <<-EOT path "secret/data/secretspec/courses/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_prod will be updated in-place ! resource "vault_policy" "courses_prod" { id = "courses-prod" name = "courses-prod" ! policy = <<-EOT path "secret/data/secretspec/courses/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_dev will be updated in-place ! resource "vault_policy" "dalmatian_dev" { id = "dalmatian-dev" name = "dalmatian-dev" ! policy = <<-EOT path "secret/data/secretspec/dalmatian/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_prod will be updated in-place ! resource "vault_policy" "dalmatian_prod" { id = "dalmatian-prod" name = "dalmatian-prod" ! policy = <<-EOT path "secret/data/secretspec/dalmatian/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_dev will be updated in-place ! resource "vault_policy" "discord-verify_dev" { id = "discord-verify-dev" name = "discord-verify-dev" ! policy = <<-EOT path "secret/data/secretspec/discord-verify/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_prod will be updated in-place ! resource "vault_policy" "discord-verify_prod" { id = "discord-verify-prod" name = "discord-verify-prod" ! policy = <<-EOT path "secret/data/secretspec/discord-verify/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_dev will be updated in-place ! resource "vault_policy" "documentation_dev" { id = "documentation-dev" name = "documentation-dev" ! policy = <<-EOT path "secret/data/secretspec/documentation/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_prod will be updated in-place ! resource "vault_policy" "documentation_prod" { id = "documentation-prod" name = "documentation-prod" ! policy = <<-EOT path "secret/data/secretspec/documentation/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_dev will be updated in-place ! resource "vault_policy" "eats_dev" { id = "eats-dev" name = "eats-dev" ! policy = <<-EOT path "secret/data/secretspec/eats/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_prod will be updated in-place ! resource "vault_policy" "eats_prod" { id = "eats-prod" name = "eats-prod" ! policy = <<-EOT path "secret/data/secretspec/eats/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_dev will be updated in-place ! resource "vault_policy" "groupme-mirror_dev" { id = "groupme-mirror-dev" name = "groupme-mirror-dev" ! policy = <<-EOT path "secret/data/secretspec/groupme-mirror/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_prod will be updated in-place ! resource "vault_policy" "groupme-mirror_prod" { id = "groupme-mirror-prod" name = "groupme-mirror-prod" ! policy = <<-EOT path "secret/data/secretspec/groupme-mirror/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_dev will be updated in-place ! resource "vault_policy" "housing_dev" { id = "housing-dev" name = "housing-dev" ! policy = <<-EOT path "secret/data/secretspec/housing/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_prod will be updated in-place ! resource "vault_policy" "housing_prod" { id = "housing-prod" name = "housing-prod" ! policy = <<-EOT path "secret/data/secretspec/housing/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_dev will be updated in-place ! resource "vault_policy" "insta_dev" { id = "insta-dev" name = "insta-dev" ! policy = <<-EOT path "secret/data/secretspec/insta/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_prod will be updated in-place ! resource "vault_policy" "insta_prod" { id = "insta-prod" name = "insta-prod" ! policy = <<-EOT path "secret/data/secretspec/insta/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_dev will be updated in-place ! resource "vault_policy" "link-shortener_dev" { id = "link-shortener-dev" name = "link-shortener-dev" ! policy = <<-EOT path "secret/data/secretspec/link-shortener/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_prod will be updated in-place ! resource "vault_policy" "link-shortener_prod" { id = "link-shortener-prod" name = "link-shortener-prod" ! policy = <<-EOT path "secret/data/secretspec/link-shortener/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_dev will be updated in-place ! resource "vault_policy" "lost-and-found_dev" { id = "lost-and-found-dev" name = "lost-and-found-dev" ! policy = <<-EOT path "secret/data/secretspec/lost-and-found/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_prod will be updated in-place ! resource "vault_policy" "lost-and-found_prod" { id = "lost-and-found-prod" name = "lost-and-found-prod" ! policy = <<-EOT path "secret/data/secretspec/lost-and-found/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_dev will be updated in-place ! resource "vault_policy" "maps_dev" { id = "maps-dev" name = "maps-dev" ! policy = <<-EOT path "secret/data/secretspec/maps/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_prod will be updated in-place ! resource "vault_policy" "maps_prod" { id = "maps-prod" name = "maps-prod" ! policy = <<-EOT path "secret/data/secretspec/maps/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_dev will be updated in-place ! resource "vault_policy" "occ-main_dev" { id = "occ-main-dev" name = "occ-main-dev" ! policy = <<-EOT path "secret/data/secretspec/occ-main/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_prod will be updated in-place ! resource "vault_policy" "occ-main_prod" { id = "occ-main-prod" name = "occ-main-prod" ! policy = <<-EOT path "secret/data/secretspec/occ-main/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_dev will be updated in-place ! resource "vault_policy" "quest_dev" { id = "quest-dev" name = "quest-dev" ! policy = <<-EOT path "secret/data/secretspec/quest/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_prod will be updated in-place ! resource "vault_policy" "quest_prod" { id = "quest-prod" name = "quest-prod" ! policy = <<-EOT path "secret/data/secretspec/quest/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_dev will be updated in-place ! resource "vault_policy" "scottylabs-org_dev" { id = "scottylabs-org-dev" name = "scottylabs-org-dev" ! policy = <<-EOT path "secret/data/secretspec/scottylabs-org/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_prod will be updated in-place ! resource "vault_policy" "scottylabs-org_prod" { id = "scottylabs-org-prod" name = "scottylabs-org-prod" ! policy = <<-EOT path "secret/data/secretspec/scottylabs-org/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-rfcs_dev will be created + resource "vault_policy" "slai-rfcs_dev" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "slai-rfcs-dev" + policy = <<-EOT path "secret/data/secretspec/slai-rfcs/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-rfcs/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-rfcs_prod will be created + resource "vault_policy" "slai-rfcs_prod" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "slai-rfcs-prod" + policy = <<-EOT path "secret/data/secretspec/slai-rfcs/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-rfcs/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-rfcs/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_dev will be updated in-place ! resource "vault_policy" "study_dev" { id = "study-dev" name = "study-dev" ! policy = <<-EOT path "secret/data/secretspec/study/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_prod will be updated in-place ! resource "vault_policy" "study_prod" { id = "study-prod" name = "study-prod" ! policy = <<-EOT path "secret/data/secretspec/study/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_dev will be updated in-place ! resource "vault_policy" "tartan-vote_dev" { id = "tartan-vote-dev" name = "tartan-vote-dev" ! policy = <<-EOT path "secret/data/secretspec/tartan-vote/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_prod will be updated in-place ! resource "vault_policy" "tartan-vote_prod" { id = "tartan-vote-prod" name = "tartan-vote-prod" ! policy = <<-EOT path "secret/data/secretspec/tartan-vote/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_dev will be updated in-place ! resource "vault_policy" "terrier_dev" { id = "terrier-dev" name = "terrier-dev" ! policy = <<-EOT path "secret/data/secretspec/terrier/dev/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/preview/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_prod will be updated in-place ! resource "vault_policy" "terrier_prod" { id = "terrier-prod" name = "terrier-prod" ! policy = <<-EOT path "secret/data/secretspec/terrier/prod/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/staging/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/ci/*" { - capabilities = ["create", "read", "update", "delete", "list"] + capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/ci/*" { capabilities = ["list", "read", "delete"] } EOT } Plan: 6 to add, 50 to change, 0 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p openbao ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fopenbao%252Fdefault%252Fopenbao) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p openbao ``` Plan: 6 to add, 50 to change, 0 to destroy. --- ### 2. project: `keycloak` dir: `tofu/keycloak` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on build directory Finished `release` profile [optimized] target(s) in 0.18s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create OpenTofu will perform the following actions: # keycloak_group.project_slai_slai-rfcs will be created + resource "keycloak_group" "project_slai_slai-rfcs" { + id = (known after apply) + name = "slai-rfcs" + parent_id = "9e6890c8-50a0-4b82-86b9-91791fffac25" + path = (known after apply) + realm_id = "scottylabs" } # keycloak_group.project_slai_slai-rfcs_admins will be created + resource "keycloak_group" "project_slai_slai-rfcs_admins" { + id = (known after apply) + name = "admins" + parent_id = (known after apply) + path = (known after apply) + realm_id = "scottylabs" } # keycloak_group_memberships.project_slai_slai-rfcs will be created + resource "keycloak_group_memberships" "project_slai_slai-rfcs" { + group_id = (known after apply) + id = (known after apply) + members = [ + "akhanal2", + "apallati", + "jcz2", + "jessec2", + "jiyas", + "jliao2", + "krishsax", + "qge", + "rzhu3", + "spola2", + "yuxizhen", ] + realm_id = "scottylabs" } # keycloak_group_memberships.project_slai_slai-rfcs_admins will be created + resource "keycloak_group_memberships" "project_slai_slai-rfcs_admins" { + group_id = (known after apply) + id = (known after apply) + members = [ + "apallati", + "jessec2", + "jiyas", + "krishsax", ] + realm_id = "scottylabs" } Plan: 4 to add, 0 to change, 0 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p keycloak ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fkeycloak%252Fdefault%252Fkeycloak) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p keycloak ``` Plan: 4 to add, 0 to change, 0 to destroy. --- ### 3. project: `git` dir: `tofu/git` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on shared package cache Finished `release` profile [optimized] target(s) in 0.14s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create ! update in-place (current -> planned) OpenTofu will perform the following actions: # forgejo_repository.slai_slai_rfcs will be created + resource "forgejo_repository" "slai_slai_rfcs" { + allow_manual_merge = false + allow_merge_commits = true + allow_rebase = true + allow_rebase_explicit = true + allow_squash_merge = true + archive_on_destroy = false + archived = false + auto_init = true + autodetect_manual_merge = false + avatar_url = (known after apply) + clone_url = (known after apply) + created_at = (known after apply) + default_branch = "main" + default_merge_style = "merge" + description = "RFCs for SLAI" + empty = (known after apply) + external_tracker = (known after apply) + external_wiki = (known after apply) + fork = (known after apply) + forks_count = (known after apply) + full_name = (known after apply) + has_actions = true + has_issues = true + has_packages = true + has_projects = true + has_pull_requests = true + has_releases = true + has_wiki = true + html_url = (known after apply) + id = (known after apply) + ignore_whitespace_conflicts = false + internal = (known after apply) + internal_tracker = (known after apply) + labels = false + lfs = false + milestones = false + mirror = false + mirror_interval = (known after apply) + mirror_updated = (known after apply) + name = "slai-rfcs" + open_issues_count = (known after apply) + open_pr_counter = (known after apply) + owner = "ScottyLabs" + parent_id = (known after apply) + permissions = (known after apply) + private = false + release_counter = (known after apply) + size = (known after apply) + ssh_url = (known after apply) + stars_count = (known after apply) + template = false + trust_model = "default" + updated_at = (known after apply) + watchers_count = (known after apply) } # forgejo_team.slai-rfcs_leads will be created + resource "forgejo_team" "slai-rfcs_leads" { + can_create_org_repo = false + description = "SLAI RFCs leads" + id = (known after apply) + includes_all_repositories = false + name = "slai-rfcs-leads" + organization = (known after apply) + organization_id = 3 + permission = "admin" + units_map = { + "repo.actions" = "admin" + "repo.code" = "admin" + "repo.ext_issues" = "admin" + "repo.ext_wiki" = "admin" + "repo.issues" = "admin" + "repo.packages" = "admin" + "repo.projects" = "admin" + "repo.pulls" = "admin" + "repo.releases" = "admin" + "repo.wiki" = "admin" } } # forgejo_team_member.slai-rfcs_leads_anish will be created + resource "forgejo_team_member" "slai-rfcs_leads_anish" { + team_id = (known after apply) + user = "anish" } # forgejo_team_member.slai-rfcs_leads_jc_965 will be created + resource "forgejo_team_member" "slai-rfcs_leads_jc_965" { + team_id = (known after apply) + user = "jessec2" } # forgejo_team_member.slai-rfcs_leads_jiyas will be created + resource "forgejo_team_member" "slai-rfcs_leads_jiyas" { + team_id = (known after apply) + user = "jiyas" } # forgejo_team_member.slai-rfcs_leads_krishsax will be created + resource "forgejo_team_member" "slai-rfcs_leads_krishsax" { + team_id = (known after apply) + user = "krishsax" } # forgejo_team_repository.slai-rfcs_leads_slai_rfcs will be created + resource "forgejo_team_repository" "slai-rfcs_leads_slai_rfcs" { + owner = "ScottyLabs" + repository = "slai-rfcs" + team_id = (known after apply) } # forgejo_team_repository.slai_slai_rfcs will be created + resource "forgejo_team_repository" "slai_slai_rfcs" { + owner = "ScottyLabs" + repository = "slai-rfcs" + team_id = 8 } # github_actions_repository_permissions.slai_slai_rfcs_actions will be created + resource "github_actions_repository_permissions" "slai_slai_rfcs_actions" { + enabled = false + id = (known after apply) + repository = "slai-rfcs" + sha_pinning_required = (known after apply) } # github_repository.slai_cmugpt_agent will be updated in-place ! resource "github_repository" "slai_cmugpt_agent" { id = "cmugpt-agent" name = "cmugpt-agent" # (39 unchanged attributes hidden) - template { - include_all_branches = false -> null - owner = "ScottyLabs" -> null - repository = "python-template" -> null } # (1 unchanged block hidden) } # github_repository.slai_slai_rfcs will be created + resource "github_repository" "slai_slai_rfcs" { + allow_auto_merge = false + allow_forking = (known after apply) + allow_merge_commit = true + allow_rebase_merge = true + allow_squash_merge = true + archived = false + default_branch = (known after apply) + delete_branch_on_merge = false + description = "READ-ONLY MIRROR" + etag = (known after apply) + fork = (known after apply) + full_name = (known after apply) + git_clone_url = (known after apply) + has_discussions = false + has_issues = false + has_projects = false + has_wiki = false + homepage_url = "https://git.cmu.dev/ScottyLabs/slai-rfcs" + html_url = (known after apply) + http_clone_url = (known after apply) + id = (known after apply) + ignore_vulnerability_alerts_during_read = false + merge_commit_message = "PR_TITLE" + merge_commit_title = "MERGE_MESSAGE" + name = "slai-rfcs" + node_id = (known after apply) + primary_language = (known after apply) + private = (known after apply) + repo_id = (known after apply) + source_owner = (known after apply) + source_repo = (known after apply) + squash_merge_commit_message = "COMMIT_MESSAGES" + squash_merge_commit_title = "COMMIT_OR_PR_TITLE" + ssh_clone_url = (known after apply) + svn_url = (known after apply) + topics = (known after apply) + visibility = "public" + vulnerability_alerts = (known after apply) + web_commit_signoff_required = (known after apply) + security_and_analysis (known after apply) } # github_repository_deploy_key.slai_slai_rfcs_mirror_deploy_key will be created + resource "github_repository_deploy_key" "slai_slai_rfcs_mirror_deploy_key" { + etag = (known after apply) + id = (known after apply) + key = (known after apply) + read_only = false + repository = "slai-rfcs" + title = "Forgejo mirror" } # github_repository_ruleset.slai_slai_rfcs_ruleset will be created + resource "github_repository_ruleset" "slai_slai_rfcs_ruleset" { + enforcement = "active" + etag = (known after apply) + id = (known after apply) + name = "Default" + node_id = (known after apply) + repository = "slai-rfcs" + ruleset_id = (known after apply) + target = "branch" + bypass_actors { + actor_id = (known after apply) + actor_type = "DeployKey" + bypass_mode = "always" } + conditions { + ref_name { + exclude = [] + include = [ + "~ALL", ] } } + rules { + creation = true + deletion = true + non_fast_forward = true + update = true + update_allows_fetch_and_merge = false + pull_request { + allowed_merge_methods = (known after apply) + dismiss_stale_reviews_on_push = false + require_code_owner_review = false + require_last_push_approval = false + required_approving_review_count = 1 + required_review_thread_resolution = false } } } # restapi_object.slai_slai_rfcs_push_mirror will be created + resource "restapi_object" "slai_slai_rfcs_push_mirror" { + api_data = (known after apply) + api_response = (known after apply) + create_response = (known after apply) + data = jsonencode( { + interval = "8h0m0s" + remote_address = "git@github.com:ScottyLabs/slai-rfcs.git" + sync_on_commit = true + use_ssh = true } ) + id = (known after apply) + id_attribute = "remote_name" + path = "/api/v1/repos/ScottyLabs/slai-rfcs/push_mirrors" } Plan: 13 to add, 1 to change, 0 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p git ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fgit%252Fdefault%252Fgit) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p git ``` Plan: 13 to add, 1 to change, 0 to destroy. --- ### Plan Summary 3 projects, 3 with changes, 0 with no changes, 0 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```

thesuperRL commented

2026-09-26 17:51:49 +00:00

Owner

atlantis apply

scottylabs-bot commented

2026-09-26 17:52:11 +00:00

Owner

Ran Apply for 3 projects:

project: openbao dir: tofu/openbao workspace: default
project: git dir: tofu/git workspace: default
project: keycloak dir: tofu/keycloak workspace: default

1. project: `openbao` dir: `tofu/openbao` workspace: `default`

Show Output

Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on build directory
    Finished `release` profile [optimized] target(s) in 0.15s

╷
│ Warning: Provider development overrides are in effect
│ 
│ The following provider development overrides are set in the CLI
│ configuration:
│  - svalabs/forgejo in /tmp/forgejo-provider
│ 
│ The behavior may therefore not match any released version of the provider
│ and applying changes may cause the state to become incompatible with
│ published releases.
╵
vault_policy.courses_prod: Modifying... [id=courses-prod]
vault_policy.housing_dev: Modifying... [id=housing-dev]
vault_policy.cmugpt-surface_prod: Modifying... [id=cmugpt-surface-prod]
vault_policy.link-shortener_prod: Modifying... [id=link-shortener-prod]
vault_policy.occ-main_prod: Modifying... [id=occ-main-prod]
vault_policy.insta_prod: Modifying... [id=insta-prod]
vault_policy.lost-and-found_prod: Modifying... [id=lost-and-found-prod]
vault_policy.bus-sign_dev: Modifying... [id=bus-sign-dev]
vault_policy.documentation_prod: Modifying... [id=documentation-prod]
vault_policy.scottylabs-org_prod: Modifying... [id=scottylabs-org-prod]
vault_policy.courses_prod: Modifications complete after 0s [id=courses-prod]
vault_policy.occ-main_prod: Modifications complete after 0s [id=occ-main-prod]
vault_policy.housing_dev: Modifications complete after 0s [id=housing-dev]
vault_policy.cmugpt-surface_prod: Modifications complete after 0s [id=cmugpt-surface-prod]
vault_policy.lost-and-found_dev: Modifying... [id=lost-and-found-dev]
vault_policy.link-shortener_prod: Modifications complete after 0s [id=link-shortener-prod]
vault_policy.slai-rfcs_prod: Creating...
vault_policy.bus-sign_dev: Modifications complete after 0s [id=bus-sign-dev]
vault_policy.lost-and-found_prod: Modifications complete after 0s [id=lost-and-found-prod]
vault_policy.documentation_prod: Modifications complete after 0s [id=documentation-prod]
vault_policy.cmugpt-mcp-server_dev: Modifying... [id=cmugpt-mcp-server-dev]
vault_policy.changelog_dev: Modifying... [id=changelog-dev]
vault_policy.insta_prod: Modifications complete after 0s [id=insta-prod]
vault_policy.scottylabs-org_prod: Modifications complete after 0s [id=scottylabs-org-prod]
vault_policy.insta_dev: Modifying... [id=insta-dev]
vault_policy.discord-verify_dev: Modifying... [id=discord-verify-dev]
vault_policy.cmugpt-sms-surface_dev: Modifying... [id=cmugpt-sms-surface-dev]
vault_policy.tartan-vote_dev: Modifying... [id=tartan-vote-dev]
vault_policy.components_prod: Modifying... [id=components-prod]
vault_policy.cmugpt-mcp-server_prod: Modifying... [id=cmugpt-mcp-server-prod]
vault_policy.lost-and-found_dev: Modifications complete after 0s [id=lost-and-found-dev]
vault_policy.cmugpt-mcp-server_dev: Modifications complete after 0s [id=cmugpt-mcp-server-dev]
vault_policy.changelog_dev: Modifications complete after 0s [id=changelog-dev]
vault_policy.tartan-vote_prod: Modifying... [id=tartan-vote-prod]
vault_policy.scottylabs-org_dev: Modifying... [id=scottylabs-org-dev]
vault_policy.insta_dev: Modifications complete after 0s [id=insta-dev]
vault_policy.discord-verify_dev: Modifications complete after 0s [id=discord-verify-dev]
vault_policy.changelog_prod: Modifying... [id=changelog-prod]
vault_policy.bus-sign_prod: Modifying... [id=bus-sign-prod]
vault_policy.cmugpt-sms-surface_dev: Modifications complete after 0s [id=cmugpt-sms-surface-dev]
vault_policy.cmugpt-mcp-server_prod: Modifications complete after 0s [id=cmugpt-mcp-server-prod]
vault_policy.tartan-vote_dev: Modifications complete after 0s [id=tartan-vote-dev]
vault_policy.components_prod: Modifications complete after 0s [id=components-prod]
vault_policy.occ-main_dev: Modifying... [id=occ-main-dev]
vault_policy.link-shortener_dev: Modifying... [id=link-shortener-dev]
vault_policy.cmugpt-agent_dev: Modifying... [id=cmugpt-agent-dev]
vault_policy.housing_prod: Modifying... [id=housing-prod]
vault_policy.quest_dev: Modifying... [id=quest-dev]
vault_policy.slai-rfcs_prod: Creation complete after 0s [id=slai-rfcs-prod]
vault_policy.cal_dev: Modifying... [id=cal-dev]
vault_policy.bus-sign_prod: Modifications complete after 1s [id=bus-sign-prod]
vault_policy.scottylabs-org_dev: Modifications complete after 1s [id=scottylabs-org-dev]
vault_policy.tartan-vote_prod: Modifications complete after 1s [id=tartan-vote-prod]
vault_policy.link-shortener_dev: Modifications complete after 1s [id=link-shortener-dev]
vault_policy.changelog_prod: Modifications complete after 1s [id=changelog-prod]
vault_policy.eats_dev: Modifying... [id=eats-dev]
vault_policy.dalmatian_prod: Modifying... [id=dalmatian-prod]
vault_policy.cmugpt-agent_dev: Modifications complete after 1s [id=cmugpt-agent-dev]
vault_policy.occ-main_dev: Modifications complete after 1s [id=occ-main-dev]
vault_policy.maps_dev: Modifying... [id=maps-dev]
vault_policy.cal_prod: Modifying... [id=cal-prod]
vault_policy.quest_dev: Modifications complete after 1s [id=quest-dev]
vault_policy.groupme-mirror_dev: Modifying... [id=groupme-mirror-dev]
vault_policy.housing_prod: Modifications complete after 1s [id=housing-prod]
vault_policy.discord-verify_prod: Modifying... [id=discord-verify-prod]
vault_policy.groupme-mirror_prod: Modifying... [id=groupme-mirror-prod]
vault_policy.slai-rfcs_dev: Creating...
vault_policy.terrier_dev: Modifying... [id=terrier-dev]
vault_policy.cal_dev: Modifications complete after 1s [id=cal-dev]
vault_policy.courses_dev: Modifying... [id=courses-dev]
vault_policy.maps_dev: Modifications complete after 0s [id=maps-dev]
vault_policy.eats_dev: Modifications complete after 0s [id=eats-dev]
vault_policy.groupme-mirror_dev: Modifications complete after 0s [id=groupme-mirror-dev]
vault_policy.dalmatian_prod: Modifications complete after 0s [id=dalmatian-prod]
vault_policy.study_dev: Modifying... [id=study-dev]
vault_identity_group.slai-rfcs_admins: Creating...
vault_policy.cal_prod: Modifications complete after 0s [id=cal-prod]
vault_policy.cmugpt-sms-surface_prod: Modifying... [id=cmugpt-sms-surface-prod]
vault_policy.discord-verify_prod: Modifications complete after 0s [id=discord-verify-prod]
vault_policy.groupme-mirror_prod: Modifications complete after 0s [id=groupme-mirror-prod]
vault_policy.courses_dev: Modifications complete after 0s [id=courses-dev]
vault_policy.maps_prod: Modifying... [id=maps-prod]
vault_policy.study_prod: Modifying... [id=study-prod]
vault_policy.terrier_dev: Modifications complete after 0s [id=terrier-dev]
vault_policy.eats_prod: Modifying... [id=eats-prod]
vault_policy.terrier_prod: Modifying... [id=terrier-prod]
vault_policy.slai-rfcs_dev: Creation complete after 0s [id=slai-rfcs-dev]
vault_policy.dalmatian_dev: Modifying... [id=dalmatian-dev]
vault_policy.components_dev: Modifying... [id=components-dev]
vault_policy.quest_prod: Modifying... [id=quest-prod]
vault_policy.cmugpt-sms-surface_prod: Modifications complete after 0s [id=cmugpt-sms-surface-prod]
vault_policy.documentation_dev: Modifying... [id=documentation-dev]
vault_identity_group.slai-rfcs_admins: Creation complete after 0s [id=f26f9aec-ceb4-3592-13ad-3bcc8fea72a4]
vault_identity_group.slai-rfcs_members: Creating...
vault_policy.eats_prod: Modifications complete after 0s [id=eats-prod]
vault_policy.terrier_prod: Modifications complete after 0s [id=terrier-prod]
vault_policy.study_prod: Modifications complete after 0s [id=study-prod]
vault_policy.study_dev: Modifications complete after 0s [id=study-dev]
vault_policy.maps_prod: Modifications complete after 0s [id=maps-prod]
vault_policy.cmugpt-surface_dev: Modifying... [id=cmugpt-surface-dev]
vault_identity_group_alias.slai-rfcs_admins: Creating...
vault_policy.cmugpt-agent_prod: Modifying... [id=cmugpt-agent-prod]
vault_policy.dalmatian_dev: Modifications complete after 0s [id=dalmatian-dev]
vault_policy.components_dev: Modifications complete after 0s [id=components-dev]
vault_policy.quest_prod: Modifications complete after 0s [id=quest-prod]
vault_policy.documentation_dev: Modifications complete after 0s [id=documentation-dev]
vault_identity_group.slai-rfcs_members: Creation complete after 0s [id=a46590d2-3103-eb92-a7e6-ad429651ff5b]
vault_identity_group_alias.slai-rfcs_members: Creating...
vault_policy.cmugpt-surface_dev: Modifications complete after 0s [id=cmugpt-surface-dev]
vault_policy.cmugpt-agent_prod: Modifications complete after 0s [id=cmugpt-agent-prod]
vault_identity_group_alias.slai-rfcs_admins: Creation complete after 0s [id=61c6f819-ebc9-6b19-b8ba-2afae82f2e69]
vault_identity_group_alias.slai-rfcs_members: Creation complete after 0s [id=2bfbf5a7-2a11-256b-1b4a-9eaf286250b7]

Apply complete! Resources: 6 added, 50 changed, 0 destroyed.

2. project: `git` dir: `tofu/git` workspace: `default`

Show Output

Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on build directory
    Finished `release` profile [optimized] target(s) in 0.16s

╷
│ Warning: Provider development overrides are in effect
│ 
│ The following provider development overrides are set in the CLI
│ configuration:
│  - svalabs/forgejo in /tmp/forgejo-provider
│ 
│ The behavior may therefore not match any released version of the provider
│ and applying changes may cause the state to become incompatible with
│ published releases.
╵
github_repository.slai_slai_rfcs: Creating...
github_repository.slai_cmugpt_agent: Modifying... [id=cmugpt-agent]
forgejo_team.slai-rfcs_leads: Creating...
forgejo_repository.slai_slai_rfcs: Creating...
forgejo_team.slai-rfcs_leads: Creation complete after 0s [name=slai-rfcs-leads]
forgejo_team_member.slai-rfcs_leads_krishsax: Creating...
forgejo_team_member.slai-rfcs_leads_jc_965: Creating...
forgejo_team_member.slai-rfcs_leads_jiyas: Creating...
forgejo_team_member.slai-rfcs_leads_anish: Creating...
forgejo_team_member.slai-rfcs_leads_jiyas: Creation complete after 0s
forgejo_team_member.slai-rfcs_leads_krishsax: Creation complete after 0s
forgejo_team_member.slai-rfcs_leads_anish: Creation complete after 0s
forgejo_team_member.slai-rfcs_leads_jc_965: Creation complete after 0s
forgejo_repository.slai_slai_rfcs: Creation complete after 0s [name=slai-rfcs]
forgejo_team_repository.slai_slai_rfcs: Creating...
restapi_object.slai_slai_rfcs_push_mirror: Creating...
forgejo_team_repository.slai_slai_rfcs: Creation complete after 0s
forgejo_team_repository.slai-rfcs_leads_slai_rfcs: Creating...
restapi_object.slai_slai_rfcs_push_mirror: Creation complete after 0s [id=remote_mirror_TX4eldNzJ_6]
forgejo_team_repository.slai-rfcs_leads_slai_rfcs: Creation complete after 0s
github_repository.slai_cmugpt_agent: Modifications complete after 8s [id=cmugpt-agent]
github_repository.slai_slai_rfcs: Creation complete after 8s [id=slai-rfcs]
github_repository_deploy_key.slai_slai_rfcs_mirror_deploy_key: Creating...
github_actions_repository_permissions.slai_slai_rfcs_actions: Creating...
github_repository_deploy_key.slai_slai_rfcs_mirror_deploy_key: Creation complete after 3s [id=slai-rfcs:164535864]
github_repository_ruleset.slai_slai_rfcs_ruleset: Creating...
github_actions_repository_permissions.slai_slai_rfcs_actions: Creation complete after 4s [id=slai-rfcs]
github_repository_ruleset.slai_slai_rfcs_ruleset: Creation complete after 2s [id=24046626]

Apply complete! Resources: 13 added, 1 changed, 0 destroyed.

3. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

Show Output

Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on shared package cache
    Finished `release` profile [optimized] target(s) in 0.14s

╷
│ Warning: Provider development overrides are in effect
│ 
│ The following provider development overrides are set in the CLI
│ configuration:
│  - svalabs/forgejo in /tmp/forgejo-provider
│ 
│ The behavior may therefore not match any released version of the provider
│ and applying changes may cause the state to become incompatible with
│ published releases.
╵
keycloak_group.project_slai_slai-rfcs: Creating...
keycloak_group.project_slai_slai-rfcs: Creation complete after 0s [id=f142f88f-bae2-4480-a343-f170cccbb497]
keycloak_group.project_slai_slai-rfcs_admins: Creating...
keycloak_group_memberships.project_slai_slai-rfcs: Creating...
keycloak_group.project_slai_slai-rfcs_admins: Creation complete after 0s [id=da273a01-8805-485f-a2d1-c2925a98b4c2]
keycloak_group_memberships.project_slai_slai-rfcs_admins: Creating...
keycloak_group_memberships.project_slai_slai-rfcs_admins: Creation complete after 7s [id=scottylabs/group-memberships/da273a01-8805-485f-a2d1-c2925a98b4c2]
keycloak_group_memberships.project_slai_slai-rfcs: Still creating... [10s elapsed]
keycloak_group_memberships.project_slai_slai-rfcs: Creation complete after 18s [id=scottylabs/group-memberships/f142f88f-bae2-4480-a343-f170cccbb497]

Apply complete! Resources: 4 added, 0 changed, 0 destroyed.

Apply Summary

3 projects, 3 successful, 0 failed, 0 errored

Ran Apply for 3 projects: 1. project: `openbao` dir: `tofu/openbao` workspace: `default` 1. project: `git` dir: `tofu/git` workspace: `default` 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` --- ### 1. project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on build directory Finished `release` profile [optimized] target(s) in 0.15s ╷ │ Warning: Provider development overrides are in effect │ │ The following provider development overrides are set in the CLI │ configuration: │ - svalabs/forgejo in /tmp/forgejo-provider │ │ The behavior may therefore not match any released version of the provider │ and applying changes may cause the state to become incompatible with │ published releases. ╵ vault_policy.courses_prod: Modifying... [id=courses-prod] vault_policy.housing_dev: Modifying... [id=housing-dev] vault_policy.cmugpt-surface_prod: Modifying... [id=cmugpt-surface-prod] vault_policy.link-shortener_prod: Modifying... [id=link-shortener-prod] vault_policy.occ-main_prod: Modifying... [id=occ-main-prod] vault_policy.insta_prod: Modifying... [id=insta-prod] vault_policy.lost-and-found_prod: Modifying... [id=lost-and-found-prod] vault_policy.bus-sign_dev: Modifying... [id=bus-sign-dev] vault_policy.documentation_prod: Modifying... [id=documentation-prod] vault_policy.scottylabs-org_prod: Modifying... [id=scottylabs-org-prod] vault_policy.courses_prod: Modifications complete after 0s [id=courses-prod] vault_policy.occ-main_prod: Modifications complete after 0s [id=occ-main-prod] vault_policy.housing_dev: Modifications complete after 0s [id=housing-dev] vault_policy.cmugpt-surface_prod: Modifications complete after 0s [id=cmugpt-surface-prod] vault_policy.lost-and-found_dev: Modifying... [id=lost-and-found-dev] vault_policy.link-shortener_prod: Modifications complete after 0s [id=link-shortener-prod] vault_policy.slai-rfcs_prod: Creating... vault_policy.bus-sign_dev: Modifications complete after 0s [id=bus-sign-dev] vault_policy.lost-and-found_prod: Modifications complete after 0s [id=lost-and-found-prod] vault_policy.documentation_prod: Modifications complete after 0s [id=documentation-prod] vault_policy.cmugpt-mcp-server_dev: Modifying... [id=cmugpt-mcp-server-dev] vault_policy.changelog_dev: Modifying... [id=changelog-dev] vault_policy.insta_prod: Modifications complete after 0s [id=insta-prod] vault_policy.scottylabs-org_prod: Modifications complete after 0s [id=scottylabs-org-prod] vault_policy.insta_dev: Modifying... [id=insta-dev] vault_policy.discord-verify_dev: Modifying... [id=discord-verify-dev] vault_policy.cmugpt-sms-surface_dev: Modifying... [id=cmugpt-sms-surface-dev] vault_policy.tartan-vote_dev: Modifying... [id=tartan-vote-dev] vault_policy.components_prod: Modifying... [id=components-prod] vault_policy.cmugpt-mcp-server_prod: Modifying... [id=cmugpt-mcp-server-prod] vault_policy.lost-and-found_dev: Modifications complete after 0s [id=lost-and-found-dev] vault_policy.cmugpt-mcp-server_dev: Modifications complete after 0s [id=cmugpt-mcp-server-dev] vault_policy.changelog_dev: Modifications complete after 0s [id=changelog-dev] vault_policy.tartan-vote_prod: Modifying... [id=tartan-vote-prod] vault_policy.scottylabs-org_dev: Modifying... [id=scottylabs-org-dev] vault_policy.insta_dev: Modifications complete after 0s [id=insta-dev] vault_policy.discord-verify_dev: Modifications complete after 0s [id=discord-verify-dev] vault_policy.changelog_prod: Modifying... [id=changelog-prod] vault_policy.bus-sign_prod: Modifying... [id=bus-sign-prod] vault_policy.cmugpt-sms-surface_dev: Modifications complete after 0s [id=cmugpt-sms-surface-dev] vault_policy.cmugpt-mcp-server_prod: Modifications complete after 0s [id=cmugpt-mcp-server-prod] vault_policy.tartan-vote_dev: Modifications complete after 0s [id=tartan-vote-dev] vault_policy.components_prod: Modifications complete after 0s [id=components-prod] vault_policy.occ-main_dev: Modifying... [id=occ-main-dev] vault_policy.link-shortener_dev: Modifying... [id=link-shortener-dev] vault_policy.cmugpt-agent_dev: Modifying... [id=cmugpt-agent-dev] vault_policy.housing_prod: Modifying... [id=housing-prod] vault_policy.quest_dev: Modifying... [id=quest-dev] vault_policy.slai-rfcs_prod: Creation complete after 0s [id=slai-rfcs-prod] vault_policy.cal_dev: Modifying... [id=cal-dev] vault_policy.bus-sign_prod: Modifications complete after 1s [id=bus-sign-prod] vault_policy.scottylabs-org_dev: Modifications complete after 1s [id=scottylabs-org-dev] vault_policy.tartan-vote_prod: Modifications complete after 1s [id=tartan-vote-prod] vault_policy.link-shortener_dev: Modifications complete after 1s [id=link-shortener-dev] vault_policy.changelog_prod: Modifications complete after 1s [id=changelog-prod] vault_policy.eats_dev: Modifying... [id=eats-dev] vault_policy.dalmatian_prod: Modifying... [id=dalmatian-prod] vault_policy.cmugpt-agent_dev: Modifications complete after 1s [id=cmugpt-agent-dev] vault_policy.occ-main_dev: Modifications complete after 1s [id=occ-main-dev] vault_policy.maps_dev: Modifying... [id=maps-dev] vault_policy.cal_prod: Modifying... [id=cal-prod] vault_policy.quest_dev: Modifications complete after 1s [id=quest-dev] vault_policy.groupme-mirror_dev: Modifying... [id=groupme-mirror-dev] vault_policy.housing_prod: Modifications complete after 1s [id=housing-prod] vault_policy.discord-verify_prod: Modifying... [id=discord-verify-prod] vault_policy.groupme-mirror_prod: Modifying... [id=groupme-mirror-prod] vault_policy.slai-rfcs_dev: Creating... vault_policy.terrier_dev: Modifying... [id=terrier-dev] vault_policy.cal_dev: Modifications complete after 1s [id=cal-dev] vault_policy.courses_dev: Modifying... [id=courses-dev] vault_policy.maps_dev: Modifications complete after 0s [id=maps-dev] vault_policy.eats_dev: Modifications complete after 0s [id=eats-dev] vault_policy.groupme-mirror_dev: Modifications complete after 0s [id=groupme-mirror-dev] vault_policy.dalmatian_prod: Modifications complete after 0s [id=dalmatian-prod] vault_policy.study_dev: Modifying... [id=study-dev] vault_identity_group.slai-rfcs_admins: Creating... vault_policy.cal_prod: Modifications complete after 0s [id=cal-prod] vault_policy.cmugpt-sms-surface_prod: Modifying... [id=cmugpt-sms-surface-prod] vault_policy.discord-verify_prod: Modifications complete after 0s [id=discord-verify-prod] vault_policy.groupme-mirror_prod: Modifications complete after 0s [id=groupme-mirror-prod] vault_policy.courses_dev: Modifications complete after 0s [id=courses-dev] vault_policy.maps_prod: Modifying... [id=maps-prod] vault_policy.study_prod: Modifying... [id=study-prod] vault_policy.terrier_dev: Modifications complete after 0s [id=terrier-dev] vault_policy.eats_prod: Modifying... [id=eats-prod] vault_policy.terrier_prod: Modifying... [id=terrier-prod] vault_policy.slai-rfcs_dev: Creation complete after 0s [id=slai-rfcs-dev] vault_policy.dalmatian_dev: Modifying... [id=dalmatian-dev] vault_policy.components_dev: Modifying... [id=components-dev] vault_policy.quest_prod: Modifying... [id=quest-prod] vault_policy.cmugpt-sms-surface_prod: Modifications complete after 0s [id=cmugpt-sms-surface-prod] vault_policy.documentation_dev: Modifying... [id=documentation-dev] vault_identity_group.slai-rfcs_admins: Creation complete after 0s [id=f26f9aec-ceb4-3592-13ad-3bcc8fea72a4] vault_identity_group.slai-rfcs_members: Creating... vault_policy.eats_prod: Modifications complete after 0s [id=eats-prod] vault_policy.terrier_prod: Modifications complete after 0s [id=terrier-prod] vault_policy.study_prod: Modifications complete after 0s [id=study-prod] vault_policy.study_dev: Modifications complete after 0s [id=study-dev] vault_policy.maps_prod: Modifications complete after 0s [id=maps-prod] vault_policy.cmugpt-surface_dev: Modifying... [id=cmugpt-surface-dev] vault_identity_group_alias.slai-rfcs_admins: Creating... vault_policy.cmugpt-agent_prod: Modifying... [id=cmugpt-agent-prod] vault_policy.dalmatian_dev: Modifications complete after 0s [id=dalmatian-dev] vault_policy.components_dev: Modifications complete after 0s [id=components-dev] vault_policy.quest_prod: Modifications complete after 0s [id=quest-prod] vault_policy.documentation_dev: Modifications complete after 0s [id=documentation-dev] vault_identity_group.slai-rfcs_members: Creation complete after 0s [id=a46590d2-3103-eb92-a7e6-ad429651ff5b] vault_identity_group_alias.slai-rfcs_members: Creating... vault_policy.cmugpt-surface_dev: Modifications complete after 0s [id=cmugpt-surface-dev] vault_policy.cmugpt-agent_prod: Modifications complete after 0s [id=cmugpt-agent-prod] vault_identity_group_alias.slai-rfcs_admins: Creation complete after 0s [id=61c6f819-ebc9-6b19-b8ba-2afae82f2e69] vault_identity_group_alias.slai-rfcs_members: Creation complete after 0s [id=2bfbf5a7-2a11-256b-1b4a-9eaf286250b7] Apply complete! Resources: 6 added, 50 changed, 0 destroyed. ``` </details> --- ### 2. project: `git` dir: `tofu/git` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on build directory Finished `release` profile [optimized] target(s) in 0.16s ╷ │ Warning: Provider development overrides are in effect │ │ The following provider development overrides are set in the CLI │ configuration: │ - svalabs/forgejo in /tmp/forgejo-provider │ │ The behavior may therefore not match any released version of the provider │ and applying changes may cause the state to become incompatible with │ published releases. ╵ github_repository.slai_slai_rfcs: Creating... github_repository.slai_cmugpt_agent: Modifying... [id=cmugpt-agent] forgejo_team.slai-rfcs_leads: Creating... forgejo_repository.slai_slai_rfcs: Creating... forgejo_team.slai-rfcs_leads: Creation complete after 0s [name=slai-rfcs-leads] forgejo_team_member.slai-rfcs_leads_krishsax: Creating... forgejo_team_member.slai-rfcs_leads_jc_965: Creating... forgejo_team_member.slai-rfcs_leads_jiyas: Creating... forgejo_team_member.slai-rfcs_leads_anish: Creating... forgejo_team_member.slai-rfcs_leads_jiyas: Creation complete after 0s forgejo_team_member.slai-rfcs_leads_krishsax: Creation complete after 0s forgejo_team_member.slai-rfcs_leads_anish: Creation complete after 0s forgejo_team_member.slai-rfcs_leads_jc_965: Creation complete after 0s forgejo_repository.slai_slai_rfcs: Creation complete after 0s [name=slai-rfcs] forgejo_team_repository.slai_slai_rfcs: Creating... restapi_object.slai_slai_rfcs_push_mirror: Creating... forgejo_team_repository.slai_slai_rfcs: Creation complete after 0s forgejo_team_repository.slai-rfcs_leads_slai_rfcs: Creating... restapi_object.slai_slai_rfcs_push_mirror: Creation complete after 0s [id=remote_mirror_TX4eldNzJ_6] forgejo_team_repository.slai-rfcs_leads_slai_rfcs: Creation complete after 0s github_repository.slai_cmugpt_agent: Modifications complete after 8s [id=cmugpt-agent] github_repository.slai_slai_rfcs: Creation complete after 8s [id=slai-rfcs] github_repository_deploy_key.slai_slai_rfcs_mirror_deploy_key: Creating... github_actions_repository_permissions.slai_slai_rfcs_actions: Creating... github_repository_deploy_key.slai_slai_rfcs_mirror_deploy_key: Creation complete after 3s [id=slai-rfcs:164535864] github_repository_ruleset.slai_slai_rfcs_ruleset: Creating... github_actions_repository_permissions.slai_slai_rfcs_actions: Creation complete after 4s [id=slai-rfcs] github_repository_ruleset.slai_slai_rfcs_ruleset: Creation complete after 2s [id=24046626] Apply complete! Resources: 13 added, 1 changed, 0 destroyed. ``` </details> --- ### 3. project: `keycloak` dir: `tofu/keycloak` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on shared package cache Finished `release` profile [optimized] target(s) in 0.14s ╷ │ Warning: Provider development overrides are in effect │ │ The following provider development overrides are set in the CLI │ configuration: │ - svalabs/forgejo in /tmp/forgejo-provider │ │ The behavior may therefore not match any released version of the provider │ and applying changes may cause the state to become incompatible with │ published releases. ╵ keycloak_group.project_slai_slai-rfcs: Creating... keycloak_group.project_slai_slai-rfcs: Creation complete after 0s [id=f142f88f-bae2-4480-a343-f170cccbb497] keycloak_group.project_slai_slai-rfcs_admins: Creating... keycloak_group_memberships.project_slai_slai-rfcs: Creating... keycloak_group.project_slai_slai-rfcs_admins: Creation complete after 0s [id=da273a01-8805-485f-a2d1-c2925a98b4c2] keycloak_group_memberships.project_slai_slai-rfcs_admins: Creating... keycloak_group_memberships.project_slai_slai-rfcs_admins: Creation complete after 7s [id=scottylabs/group-memberships/da273a01-8805-485f-a2d1-c2925a98b4c2] keycloak_group_memberships.project_slai_slai-rfcs: Still creating... [10s elapsed] keycloak_group_memberships.project_slai_slai-rfcs: Creation complete after 18s [id=scottylabs/group-memberships/f142f88f-bae2-4480-a343-f170cccbb497] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. ``` </details> --- ### Apply Summary 3 projects, 3 successful, 0 failed, 0 errored

thesuperRL merged commit 3df4243008 into main

2026-09-26 17:52:23 +00:00

scottylabs-bot commented

2026-09-26 17:52:24 +00:00

Owner

Locks and plans deleted for the projects and workspaces modified in this pull request:

dir: tofu/git workspace: default
dir: tofu/keycloak workspace: default
dir: tofu/openbao workspace: default

Locks and plans deleted for the projects and workspaces modified in this pull request: - dir: `tofu/git` workspace: `default` - dir: `tofu/keycloak` workspace: `default` - dir: `tofu/openbao` workspace: `default`

thesuperRL referenced this pull request from a commit

2026-09-26 17:52:25 +00:00

chore: cleanup and adding SLAI (#376)

brightz referenced this pull request from a commit

2026-09-26 22:03:28 +00:00

chore: cleanup and adding SLAI (#376)

Rows
Columns

chore: cleanup and adding SLAI #376

1. project: keycloak dir: tofu/keycloak workspace: default

2. project: git dir: tofu/git workspace: default

3. project: openbao dir: tofu/openbao workspace: default

Plan Summary

1. project: keycloak dir: tofu/keycloak workspace: default

2. project: git dir: tofu/git workspace: default

3. project: openbao dir: tofu/openbao workspace: default

Plan Summary

1. project: git dir: tofu/git workspace: default

2. project: keycloak dir: tofu/keycloak workspace: default

3. project: openbao dir: tofu/openbao workspace: default

Plan Summary

1. project: git dir: tofu/git workspace: default

2. project: keycloak dir: tofu/keycloak workspace: default

3. project: openbao dir: tofu/openbao workspace: default

Plan Summary

1. project: keycloak dir: tofu/keycloak workspace: default

2. project: git dir: tofu/git workspace: default

3. project: openbao dir: tofu/openbao workspace: default

Plan Summary

1. project: openbao dir: tofu/openbao workspace: default

2. project: keycloak dir: tofu/keycloak workspace: default

3. project: git dir: tofu/git workspace: default

Plan Summary

1. project: openbao dir: tofu/openbao workspace: default

2. project: git dir: tofu/git workspace: default

3. project: keycloak dir: tofu/keycloak workspace: default

Apply Summary

1. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

2. project: `git` dir: `tofu/git` workspace: `default`

3. project: `openbao` dir: `tofu/openbao` workspace: `default`

1. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

2. project: `git` dir: `tofu/git` workspace: `default`

3. project: `openbao` dir: `tofu/openbao` workspace: `default`

1. project: `git` dir: `tofu/git` workspace: `default`

2. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

3. project: `openbao` dir: `tofu/openbao` workspace: `default`

1. project: `git` dir: `tofu/git` workspace: `default`

2. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

3. project: `openbao` dir: `tofu/openbao` workspace: `default`

1. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

2. project: `git` dir: `tofu/git` workspace: `default`

3. project: `openbao` dir: `tofu/openbao` workspace: `default`

1. project: `openbao` dir: `tofu/openbao` workspace: `default`

2. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

3. project: `git` dir: `tofu/git` workspace: `default`

1. project: `openbao` dir: `tofu/openbao` workspace: `default`

2. project: `git` dir: `tofu/git` workspace: `default`

3. project: `keycloak` dir: `tofu/keycloak` workspace: `default`