data.archive_file.read_todos_zip: Reading...
data.archive_file.update_todo_zip: Reading...
data.archive_file.create_todo_zip: Reading...
data.archive_file.update_todo_zip: Read complete after 0s [id=797f074d7a878ff9eeac72ecabe5e7e5d768c338]
data.archive_file.read_todos_zip: Read complete after 0s [id=e07585e61c09bf3c3c53281c4b37641081a1e3d2]
data.archive_file.create_todo_zip: Read complete after 0s [id=0ff8f5c09501ab24bc53a64db164f85f8f839f58]
aws_iam_role.lambda_execution_role: Refreshing state... [id=development-lambda-execution-role]
aws_api_gateway_rest_api.todos_api: Refreshing state... [id=9na209p8b6]
aws_dynamodb_table.todos: Refreshing state... [id=development-todos]
aws_iam_role_policy_attachment.lambda_basic_execution: Refreshing state... [id=development-lambda-execution-role-20250812165742822600000001]
aws_api_gateway_resource.todos_resource: Refreshing state... [id=8zhvjb]
aws_api_gateway_method.create_todo_method: Refreshing state... [id=agm-9na209p8b6-8zhvjb-POST]
aws_api_gateway_method.todos_options: Refreshing state... [id=agm-9na209p8b6-8zhvjb-OPTIONS]
aws_api_gateway_resource.todo_id_resource: Refreshing state... [id=cjb1ld]
aws_api_gateway_method.read_todos_method: Refreshing state... [id=agm-9na209p8b6-8zhvjb-GET]
aws_api_gateway_resource.todo_complete_resource: Refreshing state... [id=0pnv57]
aws_api_gateway_method_response.todos_options_response: Refreshing state... [id=agmr-9na209p8b6-8zhvjb-OPTIONS-200]
aws_api_gateway_integration.todos_options_integration: Refreshing state... [id=agi-9na209p8b6-8zhvjb-OPTIONS]
aws_api_gateway_method.update_todo_method: Refreshing state... [id=agm-9na209p8b6-0pnv57-PUT]
aws_api_gateway_method.todo_complete_options: Refreshing state... [id=agm-9na209p8b6-0pnv57-OPTIONS]
aws_api_gateway_integration_response.todos_options_integration_response: Refreshing state... [id=agir-9na209p8b6-8zhvjb-OPTIONS-200]
aws_api_gateway_method_response.todo_complete_options_response: Refreshing state... [id=agmr-9na209p8b6-0pnv57-OPTIONS-200]
aws_api_gateway_integration.todo_complete_options_integration: Refreshing state... [id=agi-9na209p8b6-0pnv57-OPTIONS]
aws_api_gateway_integration_response.todo_complete_options_integration_response: Refreshing state... [id=agir-9na209p8b6-0pnv57-OPTIONS-200]
aws_iam_policy.lambda_dynamodb_policy: Refreshing state... [id=arn:aws:iam::018043257032:policy/development-lambda-dynamodb-policy]
aws_lambda_function.create_todo: Refreshing state... [id=development-create-todo]
aws_lambda_function.update_todo: Refreshing state... [id=development-update-todo]
aws_lambda_function.read_todos: Refreshing state... [id=development-read-todos]
aws_iam_role_policy_attachment.lambda_dynamodb_policy_attachment: Refreshing state... [id=development-lambda-execution-role-20250812165753221500000002]
aws_lambda_permission.create_todo_api_gateway: Refreshing state... [id=AllowExecutionFromAPIGateway]
aws_cloudwatch_log_group.create_todo_logs: Refreshing state... [id=/aws/lambda/development-create-todo]
aws_api_gateway_integration.create_todo_integration: Refreshing state... [id=agi-9na209p8b6-8zhvjb-POST]
aws_lambda_permission.update_todo_api_gateway: Refreshing state... [id=AllowExecutionFromAPIGateway]
aws_cloudwatch_log_group.update_todo_logs: Refreshing state... [id=/aws/lambda/development-update-todo]
aws_cloudwatch_log_group.read_todos_logs: Refreshing state... [id=/aws/lambda/development-read-todos]
aws_lambda_permission.read_todos_api_gateway: Refreshing state... [id=AllowExecutionFromAPIGateway]
aws_api_gateway_integration.read_todos_integration: Refreshing state... [id=agi-9na209p8b6-8zhvjb-GET]
aws_api_gateway_integration.update_todo_integration: Refreshing state... [id=agi-9na209p8b6-0pnv57-PUT]
aws_api_gateway_deployment.todos_api_deployment: Refreshing state... [id=fbddrc]
aws_api_gateway_stage.todos_api_stage: Refreshing state... [id=ags-9na209p8b6-development]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
+/- create replacement and then destroy

Terraform will perform the following actions:

  # aws_api_gateway_authorizer.cognito_authorizer will be created
  + resource "aws_api_gateway_authorizer" "cognito_authorizer" {
      + arn                              = (known after apply)
      + authorizer_result_ttl_in_seconds = 300
      + id                               = (known after apply)
      + identity_source                  = "method.request.header.Authorization"
      + name                             = "development-cognito-authorizer"
      + provider_arns                    = (known after apply)
      + rest_api_id                      = "9na209p8b6"
      + type                             = "COGNITO_USER_POOLS"
    }

  # aws_api_gateway_deployment.todos_api_deployment must be replaced
+/- resource "aws_api_gateway_deployment" "todos_api_deployment" {
      ~ created_date  = "2025-08-12T16:58:12Z" -> (known after apply)
      ~ execution_arn = "arn:aws:execute-api:eu-west-2:018043257032:9na209p8b6/" -> (known after apply)
      ~ id            = "fbddrc" -> (known after apply)
      ~ invoke_url    = "https://9na209p8b6.execute-api.eu-west-2.amazonaws.com/" -> (known after apply)
      ~ triggers      = { # forces replacement
          - "redeployment" = "86dcdaf97db61f4b4d9d8e7de6f735510c046e47"
        } -> (known after apply) # forces replacement
        # (1 unchanged attribute hidden)
    }

  # aws_api_gateway_method.create_todo_method will be updated in-place
  ~ resource "aws_api_gateway_method" "create_todo_method" {
      ~ authorization        = "NONE" -> "COGNITO_USER_POOLS"
      + authorizer_id        = (known after apply)
        id                   = "agm-9na209p8b6-8zhvjb-POST"
        # (7 unchanged attributes hidden)
    }

  # aws_api_gateway_method.read_todos_method will be updated in-place
  ~ resource "aws_api_gateway_method" "read_todos_method" {
      ~ authorization        = "NONE" -> "COGNITO_USER_POOLS"
      + authorizer_id        = (known after apply)
        id                   = "agm-9na209p8b6-8zhvjb-GET"
        # (7 unchanged attributes hidden)
    }

  # aws_api_gateway_method.update_todo_method will be updated in-place
  ~ resource "aws_api_gateway_method" "update_todo_method" {
      ~ authorization        = "NONE" -> "COGNITO_USER_POOLS"
      + authorizer_id        = (known after apply)
        id                   = "agm-9na209p8b6-0pnv57-PUT"
        # (7 unchanged attributes hidden)
    }

  # aws_api_gateway_stage.todos_api_stage will be updated in-place
  ~ resource "aws_api_gateway_stage" "todos_api_stage" {
      ~ deployment_id         = "fbddrc" -> (known after apply)
        id                    = "ags-9na209p8b6-development"
        tags                  = {
            "Application" = "lambda_boilerplate"
            "Environment" = "development"
            "ManagedBy"   = "terraform"
            "Name"        = "development-todos-api-stage"
            "Owner"       = "foad"
            "Repository"  = "https://github.com/foad/lambda_boilerplate"
            "Type"        = "API-Gateway-Stage"
        }
        # (9 unchanged attributes hidden)
    }

  # aws_cognito_user_pool.main will be created
  + resource "aws_cognito_user_pool" "main" {
      + alias_attributes           = [
          + "email",
        ]
      + arn                        = (known after apply)
      + auto_verified_attributes   = [
          + "email",
        ]
      + creation_date              = (known after apply)
      + custom_domain              = (known after apply)
      + deletion_protection        = "INACTIVE"
      + domain                     = (known after apply)
      + email_verification_message = (known after apply)
      + email_verification_subject = (known after apply)
      + endpoint                   = (known after apply)
      + estimated_number_of_users  = (known after apply)
      + id                         = (known after apply)
      + last_modified_date         = (known after apply)
      + mfa_configuration          = "OFF"
      + name                       = "development-todo-user-pool"
      + sms_verification_message   = (known after apply)
      + tags                       = {
          + "Application" = "lambda_boilerplate"
          + "Environment" = "development"
          + "ManagedBy"   = "terraform"
          + "Name"        = "development-todo-user-pool"
          + "Owner"       = "foad"
          + "Repository"  = "https://github.com/foad/lambda_boilerplate"
          + "Type"        = "Cognito-UserPool"
        }
      + tags_all                   = {
          + "Application" = "lambda_boilerplate"
          + "Environment" = "development"
          + "ManagedBy"   = "terraform"
          + "Name"        = "development-todo-user-pool"
          + "Owner"       = "foad"
          + "Repository"  = "https://github.com/foad/lambda_boilerplate"
          + "Type"        = "Cognito-UserPool"
        }
      + user_pool_tier             = (known after apply)

      + account_recovery_setting {
          + recovery_mechanism {
              + name     = "verified_email"
              + priority = 1
            }
        }

      + device_configuration {
          + challenge_required_on_new_device      = false
          + device_only_remembered_on_user_prompt = false
        }

      + email_configuration {
          + email_sending_account = "COGNITO_DEFAULT"
        }

      + password_policy {
          + minimum_length                   = 8
          + require_lowercase                = true
          + require_numbers                  = true
          + require_symbols                  = false
          + require_uppercase                = true
          + temporary_password_validity_days = (known after apply)
        }

      + user_pool_add_ons {
          + advanced_security_mode = "OFF"
        }

      + username_configuration {
          + case_sensitive = false
        }

      + verification_message_template {
          + default_email_option  = "CONFIRM_WITH_CODE"
          + email_message         = "Your verification code is {####}"
          + email_message_by_link = (known after apply)
          + email_subject         = "Your verification code"
          + email_subject_by_link = (known after apply)
          + sms_message           = (known after apply)
        }
    }

  # aws_cognito_user_pool_client.main will be created
  + resource "aws_cognito_user_pool_client" "main" {
      + access_token_validity                         = 60
      + allowed_oauth_flows                           = (known after apply)
      + allowed_oauth_flows_user_pool_client          = (known after apply)
      + allowed_oauth_scopes                          = (known after apply)
      + auth_session_validity                         = (known after apply)
      + callback_urls                                 = (known after apply)
      + client_secret                                 = (sensitive value)
      + default_redirect_uri                          = (known after apply)
      + enable_propagate_additional_user_context_data = (known after apply)
      + enable_token_revocation                       = (known after apply)
      + explicit_auth_flows                           = [
          + "ALLOW_REFRESH_TOKEN_AUTH",
          + "ALLOW_USER_PASSWORD_AUTH",
          + "ALLOW_USER_SRP_AUTH",
        ]
      + generate_secret                               = false
      + id                                            = (known after apply)
      + id_token_validity                             = 60
      + logout_urls                                   = (known after apply)
      + name                                          = "development-todo-app-client"
      + prevent_user_existence_errors                 = "ENABLED"
      + read_attributes                               = [
          + "email",
          + "email_verified",
        ]
      + refresh_token_validity                        = 30
      + supported_identity_providers                  = (known after apply)
      + user_pool_id                                  = (known after apply)
      + write_attributes                              = [
          + "email",
        ]

      + token_validity_units {
          + access_token  = "minutes"
          + id_token      = "minutes"
          + refresh_token = "days"
        }
    }

  # aws_iam_policy.lambda_cognito_policy will be created
  + resource "aws_iam_policy" "lambda_cognito_policy" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + description      = "IAM policy for Lambda functions to access Cognito for JWT verification"
      + id               = (known after apply)
      + name             = "development-lambda-cognito-policy"
      + name_prefix      = (known after apply)
      + path             = "/"
      + policy           = (known after apply)
      + policy_id        = (known after apply)
      + tags             = {
          + "Application" = "lambda_boilerplate"
          + "Environment" = "development"
          + "ManagedBy"   = "terraform"
          + "Name"        = "development-lambda-cognito-policy"
          + "Owner"       = "foad"
          + "Repository"  = "https://github.com/foad/lambda_boilerplate"
          + "Type"        = "IAM-Policy"
        }
      + tags_all         = {
          + "Application" = "lambda_boilerplate"
          + "Environment" = "development"
          + "ManagedBy"   = "terraform"
          + "Name"        = "development-lambda-cognito-policy"
          + "Owner"       = "foad"
          + "Repository"  = "https://github.com/foad/lambda_boilerplate"
          + "Type"        = "IAM-Policy"
        }
    }

  # aws_iam_role_policy_attachment.lambda_cognito_policy_attachment will be created
  + resource "aws_iam_role_policy_attachment" "lambda_cognito_policy_attachment" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "development-lambda-execution-role"
    }

  # aws_lambda_function.create_todo will be updated in-place
  ~ resource "aws_lambda_function" "create_todo" {
        id                             = "development-create-todo"
      ~ last_modified                  = "2025-08-14T15:25:53.000+0000" -> (known after apply)
      ~ source_code_hash               = "dmzMMKB+XLMjcyHdBgCwijgYdKqEm8CIpaqqfFYyzbo=" -> "Wnm8XRv0O34hzlBpqunXPRPRPKsLv3WYfcWiq9gQb/8="
        tags                           = {
            "Application" = "lambda_boilerplate"
            "Environment" = "development"
            "ManagedBy"   = "terraform"
            "Name"        = "development-create-todo"
            "Owner"       = "foad"
            "Repository"  = "https://github.com/foad/lambda_boilerplate"
            "Type"        = "Lambda-Function"
        }
        # (21 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              - "TODOS_TABLE_NAME" = "development-todos"
            } -> (known after apply)
        }

        # (3 unchanged blocks hidden)
    }

  # aws_lambda_function.read_todos will be updated in-place
  ~ resource "aws_lambda_function" "read_todos" {
        id                             = "development-read-todos"
      ~ last_modified                  = "2025-08-14T15:25:53.000+0000" -> (known after apply)
      ~ source_code_hash               = "hMmu8Dj4CWtxrRZ1JioUAQFC8XR8E4E49+THPEfeuUw=" -> "p4rYMDbo3OIUq1cvehPJEMPIVMRG6WudVd8NPbs7np8="
        tags                           = {
            "Application" = "lambda_boilerplate"
            "Environment" = "development"
            "ManagedBy"   = "terraform"
            "Name"        = "development-read-todos"
            "Owner"       = "foad"
            "Repository"  = "https://github.com/foad/lambda_boilerplate"
            "Type"        = "Lambda-Function"
        }
        # (21 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              - "TODOS_TABLE_NAME" = "development-todos"
            } -> (known after apply)
        }

        # (3 unchanged blocks hidden)
    }

  # aws_lambda_function.update_todo will be updated in-place
  ~ resource "aws_lambda_function" "update_todo" {
        id                             = "development-update-todo"
      ~ last_modified                  = "2025-08-14T15:25:53.000+0000" -> (known after apply)
      ~ source_code_hash               = "A0k9A06afVj2TD3QlYDMAjaArQgQbo28zvPHAisvLlE=" -> "dpQjEY4oFGmXNtJ30cbnHZRoNacApbhAWb5wKl7KADg="
        tags                           = {
            "Application" = "lambda_boilerplate"
            "Environment" = "development"
            "ManagedBy"   = "terraform"
            "Name"        = "development-update-todo"
            "Owner"       = "foad"
            "Repository"  = "https://github.com/foad/lambda_boilerplate"
            "Type"        = "Lambda-Function"
        }
        # (21 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              - "TODOS_TABLE_NAME" = "development-todos"
            } -> (known after apply)
        }

        # (3 unchanged blocks hidden)
    }

Plan: 6 to add, 7 to change, 1 to destroy.

Changes to Outputs:
  + api_gateway_authorizer_id   = (known after apply)
  + cognito_auth_enabled        = true
  + cognito_user_pool_arn       = (known after apply)
  + cognito_user_pool_client_id = (known after apply)
  + cognito_user_pool_endpoint  = (known after apply)
  + cognito_user_pool_id        = (known after apply)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.