Tag the uploads bucket with its cost center

[myselfsiddharth]

Finance needs per-team S3 attribution, so the uploads bucket gets CostCenter and ManagedBy tags.

---

_{The counterpart to #1 in this demo. Same gate, an ordinary change: Flecto reports what moved and the check passes. A gate that fires on everything gets uninstalled in a week.}

[github-actions]

Flecto — config change report

✅ Check passing — 34 changes in 1 file — 0 changed, 34 added, 0 removed.

Policy: no findings.

Changes

Show all 34 changes

plan.json — 34 changes

Change	Path	Before	After
added	aws_iam_role.app.assume_role_policy	—	"{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ec2.amazonaws.com\"}}]…
added	aws_iam_role.app.force_detach_policies	—	false
added	aws_iam_role.app.max_session_duration	—	3600
added	aws_iam_role.app.name	—	"app"
added	aws_iam_role.app.path	—	"/"
added (terraform will create aws_iam_role.app)	aws_iam_role.app.#action	—	"create"
added	aws_iam_role_policy.app.name	—	"app-uploads"
added	aws_iam_role_policy.app.policy	—	"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"s3:GetObject\",\"s3:PutObject\"],\"Effect\":\"Allow\",\"Resou…
added (terraform will create aws_iam_role_policy.app)	aws_iam_role_policy.app.#action	—	"create"
added	aws_s3_bucket.uploads.bucket	—	"flecto-example-uploads"
added	aws_s3_bucket.uploads.force_destroy	—	false
added	aws_s3_bucket.uploads.tags.CostCenter	—	"platform"
added	aws_s3_bucket.uploads.tags.ManagedBy	—	"terraform"
added	aws_s3_bucket.uploads.tags_all.CostCenter	—	"platform"
added	aws_s3_bucket.uploads.tags_all.ManagedBy	—	"terraform"
added (terraform will create aws_s3_bucket.uploads)	aws_s3_bucket.uploads.#action	—	"create"
added	aws_s3_bucket_public_access_block.uploads.block_public_acls	—	true
added	aws_s3_bucket_public_access_block.uploads.block_public_policy	—	true
added	aws_s3_bucket_public_access_block.uploads.ignore_public_acls	—	true
added	aws_s3_bucket_public_access_block.uploads.restrict_public_buckets	—	true
added (terraform will create aws_s3_bucket_public_access_block.uploads)	aws_s3_bucket_public_access_block.uploads.#action	—	"create"
added	aws_security_group.web.description	—	"Public web tier"
added	aws_security_group.web.ingress[0].cidr_blocks[0]	—	"10.0.0.0/8"
added	aws_security_group.web.ingress[0].description	—	"HTTPS from the office VPN"
added	aws_security_group.web.ingress[0].from_port	—	443
added	aws_security_group.web.ingress[0].ipv6_cidr_blocks	—	[]
added	aws_security_group.web.ingress[0].prefix_list_ids	—	[]
added	aws_security_group.web.ingress[0].protocol	—	"tcp"
added	aws_security_group.web.ingress[0].security_groups	—	[]
added	aws_security_group.web.ingress[0].self	—	false
added	aws_security_group.web.ingress[0].to_port	—	443
added	aws_security_group.web.name	—	"web"
added	aws_security_group.web.revoke_rules_on_delete	—	false
added (terraform will create aws_security_group.web)	aws_security_group.web.#action	—	"create"

---

_{Posted by Flecto — this comment is updated in place on every run.}