Terraform plan diff: repo-secrets-mcp-server / vault-gov

repo-secrets-mcp-server__vault-gov.md

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # vault_jwt_auth_backend_role.gha_loadtest_pool_oidc_role will be created
  + resource "vault_jwt_auth_backend_role" "gha_loadtest_pool_oidc_role" {
      + backend                      = "ghav2"
      + bound_audiences              = [
          + "https://github.com/FirstResonance",
        ]
      + bound_claims                 = {
          + "job_workflow_ref" = "FirstResonance/mcp-server/.github/workflows/load-test.yaml@*"
        }
      + bound_claims_type            = "glob"
      + clock_skew_leeway            = 0
      + disable_bound_claims_parsing = false
      + expiration_leeway            = 0
      + id                           = (known after apply)
      + not_before_leeway            = 0
      + role_name                    = "mcp_server_loadtest_pool_role"
      + role_type                    = "jwt"
      + token_policies               = [
          + "mcp-server-loadtest-pool-policy",
        ]
      + token_ttl                    = 60
      + token_type                   = "default"
      + user_claim                   = "job_workflow_ref"
      + user_claim_json_pointer      = false
      + verbose_oidc_logging         = false
        # (1 unchanged attribute hidden)
    }

  # vault_policy.mcp_server_loadtest_pool_policy will be created
  + resource "vault_policy" "mcp_server_loadtest_pool_policy" {
      + id     = (known after apply)
      + name   = "mcp-server-loadtest-pool-policy"
      + policy = <<-EOT
            # Allow user to manage their own tokens
            path "auth/token/create" {
              capabilities = ["create", "read", "update", "list"]
            }
            
            # Shared Auth0 credentials for the load-test token pool
            path "cicd/data/shared/automated/loadtest-auth0-pool" {
              capabilities = ["read"]
            }
        EOT
    }

Plan: 2 to add, 0 to change, 0 to destroy.