feat(apis): key the search query digest and sweep export claims every five minutes by jm-rivera · Pull Request #130 · DevelopmentFinanceObservatory/infra

jm-rivera · 2026-10-31T09:16:50Z

Two additive changes to the apis stack, for DevelopmentFinanceObservatory/apis#14 and DevelopmentFinanceObservatory/apis#201, both merged to apis dev and main.

search_query_hmac_key.tf adds a generated secret, mounted on the apis service as SEARCH_QUERY_HMAC_KEY. It keys the query_hmac field of the search resolve log line (apis#14). With no key the field is null.

datasets_maintenance_schedules gains sweep-export-claims every five minutes, because allowance counts are per UTC day and a daily sweep misses most crashed prepares (apis#201). The task must exist in the image the maintenance job runs, or the scheduled job fails every five minutes; apis#201 is in the image released to main.

The maintenance job's graph, SDMX, UN and origin catalogue settings arrived separately in #137.

No environment's tfvars change.

Testing: terraform fmt -check and terraform validate pass with -backend=false. No plan has run against real state.

…e maintenance graph access

…nd-claim-sweep # Conflicts: # infra/dfo-dev/apis/README.md # infra/stacks/apis/datasets_maintenance_job.tf

github-actions · 2026-11-01T09:44:00Z

Terraform Apply — `apis`

Apply complete! Resources: 4 added, 1 changed, 0 destroyed.

Init	Validate	Apply
pass	pass	pass

Show apply output

ephemeral.random_password.datasets_pin_principal: Opening...
ephemeral.random_password.share_import_principal: Opening...
ephemeral.random_password.live_refresh_principal: Opening...
ephemeral.random_password.datasets_first_party_principal: Opening...
ephemeral.random_password.caller_principal: Opening...
ephemeral.random_password.search_query_hmac_key: Opening...
ephemeral.random_password.caller_hmac_key: Opening...
ephemeral.random_password.datasets_pin_principal: Opening complete after 1s
ephemeral.random_password.share_import_principal: Opening complete after 1s
ephemeral.random_password.datasets_first_party_principal: Opening complete after 1s
ephemeral.random_password.live_refresh_principal: Opening complete after 1s
ephemeral.random_password.caller_hmac_key: Opening complete after 1s
ephemeral.random_password.caller_principal: Opening complete after 1s
ephemeral.random_password.search_query_hmac_key: Opening complete after 1s
google_secret_manager_secret.search_query_hmac_key: Creating...
google_secret_manager_secret.search_query_hmac_key: Creation complete after 1s [id=projects/dev-fin-observatory/secrets/dfo-dev-search-query-hmac-key]
google_secret_manager_secret_version.search_query_hmac_key: Creating...
google_secret_manager_secret_version.search_query_hmac_key: Creation complete after 1s [id=projects/41292283861/secrets/dfo-dev-search-query-hmac-key/versions/1]
module.apis_service.google_secret_manager_secret_iam_member.runtime_secret_access["dfo-dev-search-query-hmac-key"]: Creating...
module.apis_service.google_secret_manager_secret_iam_member.runtime_secret_access["dfo-dev-search-query-hmac-key"]: Creation complete after 4s [id=projects/dev-fin-observatory/secrets/dfo-dev-search-query-hmac-key/roles/secretmanager.secretAccessor/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
module.apis_service.google_cloud_run_v2_service.this: Modifying... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-apis]
module.apis_service.google_cloud_run_v2_service.this: Still modifying... [id=projects/dev-fin-observatory/locations/...erica-northeast1/services/dfo-dev-apis, 00m10s elapsed]
module.apis_service.google_cloud_run_v2_service.this: Still modifying... [id=projects/dev-fin-observatory/locations/...erica-northeast1/services/dfo-dev-apis, 00m20s elapsed]
module.apis_service.google_cloud_run_v2_service.this: Still modifying... [id=projects/dev-fin-observatory/locations/...erica-northeast1/services/dfo-dev-apis, 00m30s elapsed]
module.apis_service.google_cloud_run_v2_service.this: Still modifying... [id=projects/dev-fin-observatory/locations/...erica-northeast1/services/dfo-dev-apis, 00m40s elapsed]
module.apis_service.google_cloud_run_v2_service.this: Still modifying... [id=projects/dev-fin-observatory/locations/...erica-northeast1/services/dfo-dev-apis, 00m50s elapsed]
module.apis_service.google_cloud_run_v2_service.this: Still modifying... [id=projects/dev-fin-observatory/locations/...erica-northeast1/services/dfo-dev-apis, 01m00s elapsed]
module.apis_service.google_cloud_run_v2_service.this: Still modifying... [id=projects/dev-fin-observatory/locations/...erica-northeast1/services/dfo-dev-apis, 01m10s elapsed]
module.apis_service.google_cloud_run_v2_service.this: Modifications complete after 1m11s [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-apis]
google_cloud_scheduler_job.datasets_maintenance["sweep-export-claims"]: Creating...
google_cloud_scheduler_job.datasets_maintenance["sweep-export-claims"]: Creation complete after 2s [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-datasets-sweep-export-claims]
ephemeral.random_password.caller_hmac_key: Closing...
ephemeral.random_password.search_query_hmac_key: Closing...
ephemeral.random_password.live_refresh_principal: Closing...
ephemeral.random_password.caller_principal: Closing...
ephemeral.random_password.share_import_principal: Closing...
ephemeral.random_password.datasets_pin_principal: Closing...
ephemeral.random_password.datasets_first_party_principal: Closing...
ephemeral.random_password.caller_principal: Closing complete after 0s
ephemeral.random_password.caller_hmac_key: Closing complete after 0s
ephemeral.random_password.share_import_principal: Closing complete after 0s
ephemeral.random_password.search_query_hmac_key: Closing complete after 0s
ephemeral.random_password.datasets_pin_principal: Closing complete after 0s
ephemeral.random_password.live_refresh_principal: Closing complete after 0s
ephemeral.random_password.datasets_first_party_principal: Closing complete after 0s

Apply complete! Resources: 4 added, 1 changed, 0 destroyed.

Outputs:

datasets_maintenance_job_name = "dfo-dev-datasets-maintenance"
datasets_migrate_job_name = "dfo-dev-datasets-migrate"
datasets_migration_runner_service_account_email = "dfo-dev-migration-runner@dev-fin-observatory.iam.gserviceaccount.com"
datasets_runtime_db_user = "dfo-dev-apis-run@dev-fin-observatory.iam"
datasets_worker_invoker_service_account_email = "dfo-dev-worker-invoker@dev-fin-observatory.iam.gserviceaccount.com"
datasets_worker_queue_name = "projects/dev-fin-observatory/locations/northamerica-northeast1/queues/dfo-dev-datasets-worker"
datasets_worker_runtime_service_account_email = "dfo-dev-datasets-worker-run@dev-fin-observatory.iam.gserviceaccount.com"
datasets_worker_service_name = "dfo-dev-datasets-worker"
datasets_worker_service_url = "https://dfo-dev-datasets-worker-zms5lj4zhq-nn.a.run.app"
eval_reader_service_account_email = "dfo-dev-apis-eval-reader@dev-fin-observatory.iam.gserviceaccount.com"
graph_release_bucket_name = "dfo-dev-graph-release-dev-fin-observatory"
graph_release_job_name = "dfo-dev-graph-release"
origin_catalogue_bucket_name = "dfo-dev-origin-catalogue-dev-fin-observatory"
origin_catalogue_job_name = "dfo-dev-origin-catalogue"
presentation_migrate_job_name = "dfo-dev-presentation-migrate"
psc_network_endpoint_ip_address = "10.100.3.2"
psc_network_subnetwork_id = "projects/dev-fin-observatory/regions/northamerica-northeast1/subnetworks/dfo-dev-apis-psc-subnet"
runtime_service_account_email = "dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com"
search_catalogue_bucket_name = "dfo-dev-search-catalogue-dev-fin-observatory"
search_catalogue_job_name = "dfo-dev-search-catalogue"
service_name = "dfo-dev-apis"
service_url = "https://dfo-dev-apis-zms5lj4zhq-nn.a.run.app"

_{Stack apis · 74da90b · @jm-rivera · run}

github-actions · 2026-11-01T18:37:00Z

Terraform Plan — `apis`

Plan: 4 to add, 1 to change, 0 to destroy.

Init	Validate	Plan
pass	pass	pass

Show plan

ephemeral.random_password.datasets_pin_principal: Opening...
ephemeral.random_password.caller_principal: Opening...
ephemeral.random_password.live_refresh_principal: Opening...
ephemeral.random_password.share_import_principal: Opening...
ephemeral.random_password.datasets_first_party_principal: Opening...
ephemeral.random_password.search_query_hmac_key: Opening...
ephemeral.random_password.caller_hmac_key: Opening...
ephemeral.random_password.share_import_principal: Opening complete after 1s
ephemeral.random_password.caller_principal: Opening complete after 1s
ephemeral.random_password.datasets_pin_principal: Opening complete after 1s
ephemeral.random_password.search_query_hmac_key: Opening complete after 1s
ephemeral.random_password.live_refresh_principal: Opening complete after 1s
ephemeral.random_password.caller_hmac_key: Opening complete after 1s
ephemeral.random_password.datasets_first_party_principal: Opening complete after 1s
data.google_secret_manager_secret.search_catalogue_gemini: Reading...
data.google_project.current: Reading...
google_service_account.datasets_maintenance_scheduler: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-dsmaint-scheduler@dev-fin-observatory.iam.gserviceaccount.com]
google_service_account.sdk_e2e: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-sdk-e2e@dev-fin-observatory.iam.gserviceaccount.com]
google_secret_manager_secret.datasets_first_party_principal: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-datasets-first-party-principal]
google_service_account.datasets_worker: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-datasets-worker-run@dev-fin-observatory.iam.gserviceaccount.com]
google_service_account.origin_catalogue_scheduler: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-origin-cat-scheduler@dev-fin-observatory.iam.gserviceaccount.com]
data.google_service_account.apis_deployer: Reading...
google_project_service.cloudtasks: Refreshing state... [id=dev-fin-observatory/cloudtasks.googleapis.com]
google_secret_manager_secret.datasets_pin_principal: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-datasets-pin-principal]
data.google_secret_manager_secret.search_catalogue_gemini: Read complete after 0s [id=projects/dev-fin-observatory/secrets/dfo-dev-gemini-api-key]
data.google_secret_manager_secret.typesafe[0]: Reading...
google_secret_manager_secret.live_refresh_principal: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-live-refresh-principal]
google_service_account.origin_catalogue_job: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-origin-catalogue-job@dev-fin-observatory.iam.gserviceaccount.com]
data.google_secret_manager_secret.typesafe[0]: Read complete after 0s [id=projects/dev-fin-observatory/secrets/dfo-dev-typesafe-api-key]
google_storage_bucket.origin_catalogue: Refreshing state... [id=dfo-dev-origin-catalogue-dev-fin-observatory]
google_project_iam_custom_role.cloudsql_login_only: Refreshing state... [id=projects/dev-fin-observatory/roles/dfoDevApisCloudsqlLoginOnly]
module.apis_service.google_service_account.runtime: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
google_project_service.cloudscheduler: Refreshing state... [id=dev-fin-observatory/cloudscheduler.googleapis.com]
google_service_account.graph_release_job: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-graph-release-job@dev-fin-observatory.iam.gserviceaccount.com]
google_secret_manager_secret.caller_hmac_key: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-caller-hmac-key]
data.google_secret_manager_secret.gemini: Reading...
data.google_service_account.apis_deployer: Read complete after 1s [id=projects/dev-fin-observatory/serviceAccounts/dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com]
google_secret_manager_secret.share_import_principal: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-share-import-principal]
google_service_account.datasets_worker_invoker: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-worker-invoker@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket.search_catalogue: Refreshing state... [id=dfo-dev-search-catalogue-dev-fin-observatory]
google_project_service.dns: Refreshing state... [id=dev-fin-observatory/dns.googleapis.com]
data.google_secret_manager_secret.gemini: Read complete after 0s [id=projects/dev-fin-observatory/secrets/dfo-dev-gemini-api-key]
google_service_account.graph_release_scheduler: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-graph-rel-scheduler@dev-fin-observatory.iam.gserviceaccount.com]
google_service_account.search_catalogue_job: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-search-catalogue-job@dev-fin-observatory.iam.gserviceaccount.com]
google_service_account.datasets_migration_runner: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-migration-runner@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket.graph_release: Refreshing state... [id=dfo-dev-graph-release-dev-fin-observatory]
google_secret_manager_secret.caller_principal: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-caller-principal]
google_service_account.eval_reader: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-apis-eval-reader@dev-fin-observatory.iam.gserviceaccount.com]
google_secret_manager_secret_version.datasets_pin_principal: Refreshing state... [id=projects/41292283861/secrets/dfo-dev-datasets-pin-principal/versions/1]
google_secret_manager_secret_version.datasets_first_party_principal: Refreshing state... [id=projects/41292283861/secrets/dfo-dev-datasets-first-party-principal/versions/1]
data.google_project.current: Read complete after 1s [id=projects/dev-fin-observatory]
google_secret_manager_secret_version.live_refresh_principal: Refreshing state... [id=projects/41292283861/secrets/dfo-dev-live-refresh-principal/versions/1]
google_storage_bucket_iam_member.datasets_worker_working_viewer: Refreshing state... [id=b/dev-fin-observatory-datasets-working/roles/storage.objectViewer/serviceAccount:dfo-dev-datasets-worker-run@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.datasets_worker_pinned_viewer: Refreshing state... [id=b/dev-fin-observatory-datasets-pinned/roles/storage.objectViewer/serviceAccount:dfo-dev-datasets-worker-run@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_run_v2_service_iam_member.graph_generation_dc_viewer_worker: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-dc-datacommons-service/roles/run.viewer/serviceAccount:dfo-dev-datasets-worker-run@dev-fin-observatory.iam.gserviceaccount.com]
google_service_account_iam_member.datasets_worker_token_creator: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-datasets-worker-run@dev-fin-observatory.iam.gserviceaccount.com/roles/iam.serviceAccountTokenCreator/serviceAccount:dfo-dev-datasets-worker-run@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.datasets_worker_pinned_creator: Refreshing state... [id=b/dev-fin-observatory-datasets-pinned/roles/storage.objectCreator/serviceAccount:dfo-dev-datasets-worker-run@dev-fin-observatory.iam.gserviceaccount.com]
google_sql_user.datasets_worker_runtime: Refreshing state... [id=dfo-dev-datasets-worker-run@dev-fin-observatory.iam//dfo-dev-platform-postgres]
google_cloud_run_v2_service_iam_member.dc_invoker_datasets_worker: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-dc-datacommons-service/roles/run.invoker/serviceAccount:dfo-dev-datasets-worker-run@dev-fin-observatory.iam.gserviceaccount.com]
google_project_iam_member.datasets_worker_cloudsql_client: Refreshing state... [id=dev-fin-observatory/roles/cloudsql.client/serviceAccount:dfo-dev-datasets-worker-run@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.datasets_worker_working_creator: Refreshing state... [id=b/dev-fin-observatory-datasets-working/roles/storage.objectCreator/serviceAccount:dfo-dev-datasets-worker-run@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_run_v2_service_iam_member.dc_invoker_origin_catalogue_job: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-dc-datacommons-service/roles/run.invoker/serviceAccount:dfo-dev-origin-catalogue-job@dev-fin-observatory.iam.gserviceaccount.com]
google_project_iam_member.origin_catalogue_job_bigquery_job_user: Refreshing state... [id=dev-fin-observatory/roles/bigquery.jobUser/serviceAccount:dfo-dev-origin-catalogue-job@dev-fin-observatory.iam.gserviceaccount.com]
google_bigquery_connection_iam_member.origin_catalogue_job_connection_user: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/connections/dfo_dev_dc_spanner_connection/roles/bigquery.connectionUser/serviceAccount:dfo-dev-origin-catalogue-job@dev-fin-observatory.iam.gserviceaccount.com]
google_spanner_instance_iam_member.origin_catalogue_job_spanner_instance_viewer: Refreshing state... [id=dev-fin-observatory/dfo-dev-dc-instance/roles/spanner.viewer/serviceAccount:dfo-dev-origin-catalogue-job@dev-fin-observatory.iam.gserviceaccount.com]
google_spanner_database_iam_member.origin_catalogue_job_spanner_reader: Refreshing state... [id=dev-fin-observatory/dfo-dev-dc-instance/dfo-dev-dc-db/roles/spanner.databaseReader/serviceAccount:dfo-dev-origin-catalogue-job@dev-fin-observatory.iam.gserviceaccount.com]
google_service_account_iam_member.sdk_e2e_self_id_token: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-sdk-e2e@dev-fin-observatory.iam.gserviceaccount.com/roles/iam.serviceAccountOpenIdTokenCreator/serviceAccount:dfo-dev-sdk-e2e@dev-fin-observatory.iam.gserviceaccount.com]
google_service_account_iam_member.origin_catalogue_job_deployer_act_as: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-origin-catalogue-job@dev-fin-observatory.iam.gserviceaccount.com/roles/iam.serviceAccountUser/serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com]
google_service_account_iam_member.datasets_worker_deployer_act_as: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-datasets-worker-run@dev-fin-observatory.iam.gserviceaccount.com/roles/iam.serviceAccountUser/serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_run_v2_service_iam_member.graph_release_job_dc_viewer: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-dc-datacommons-service/roles/run.viewer/serviceAccount:dfo-dev-graph-release-job@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_run_v2_service_iam_member.dc_invoker_graph_release_job: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-dc-datacommons-service/roles/run.invoker/serviceAccount:dfo-dev-graph-release-job@dev-fin-observatory.iam.gserviceaccount.com]
google_spanner_database_iam_member.graph_release_job_spanner_reader: Refreshing state... [id=dev-fin-observatory/dfo-dev-dc-instance/dfo-dev-dc-db/roles/spanner.databaseReader/serviceAccount:dfo-dev-graph-release-job@dev-fin-observatory.iam.gserviceaccount.com]
google_service_account_iam_member.graph_release_job_deployer_act_as: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-graph-release-job@dev-fin-observatory.iam.gserviceaccount.com/roles/iam.serviceAccountUser/serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com]
google_secret_manager_secret_version.share_import_principal: Refreshing state... [id=projects/41292283861/secrets/dfo-dev-share-import-principal/versions/1]
google_project_iam_member.datasets_worker_cloudsql_instance_user: Refreshing state... [id=dev-fin-observatory/projects/dev-fin-observatory/roles/dfoDevApisCloudsqlLoginOnly/serviceAccount:dfo-dev-datasets-worker-run@dev-fin-observatory.iam.gserviceaccount.com]
google_secret_manager_secret_version.caller_hmac_key: Refreshing state... [id=projects/41292283861/secrets/dfo-dev-caller-hmac-key/versions/1]
google_service_account_iam_member.datasets_migration_runner_deployer_act_as: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-migration-runner@dev-fin-observatory.iam.gserviceaccount.com/roles/iam.serviceAccountUser/serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com]
google_secret_manager_secret_iam_member.presentation_migrator_secret_reader: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-presentation-migrator-password/roles/secretmanager.secretAccessor/serviceAccount:dfo-dev-migration-runner@dev-fin-observatory.iam.gserviceaccount.com]
google_secret_manager_secret_iam_member.datasets_migrator_secret_reader: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-datasets-migrator-password/roles/secretmanager.secretAccessor/serviceAccount:dfo-dev-migration-runner@dev-fin-observatory.iam.gserviceaccount.com]
google_service_account_iam_member.search_catalogue_job_deployer_act_as: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-search-catalogue-job@dev-fin-observatory.iam.gserviceaccount.com/roles/iam.serviceAccountUser/serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_run_v2_service_iam_member.dc_invoker_search_catalogue_job: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-dc-datacommons-service/roles/run.invoker/serviceAccount:dfo-dev-search-catalogue-job@dev-fin-observatory.iam.gserviceaccount.com]
google_secret_manager_secret_iam_member.search_catalogue_job_gemini_accessor: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-gemini-api-key/roles/secretmanager.secretAccessor/serviceAccount:dfo-dev-search-catalogue-job@dev-fin-observatory.iam.gserviceaccount.com]
google_secret_manager_secret_version.caller_principal: Refreshing state... [id=projects/41292283861/secrets/dfo-dev-caller-principal/versions/1]
google_service_account_iam_member.sdk_e2e_wif: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-sdk-e2e@dev-fin-observatory.iam.gserviceaccount.com/roles/iam.workloadIdentityUser/principalSet://iam.googleapis.com/projects/41292283861/locations/global/workloadIdentityPools/github-pool/attribute.repo_ref/1428553790:refs/heads/main]
google_service_account_iam_member.eval_reader_self_id_token: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-apis-eval-reader@dev-fin-observatory.iam.gserviceaccount.com/roles/iam.serviceAccountOpenIdTokenCreator/serviceAccount:dfo-dev-apis-eval-reader@dev-fin-observatory.iam.gserviceaccount.com]
google_service_account_iam_member.eval_reader_wif: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-apis-eval-reader@dev-fin-observatory.iam.gserviceaccount.com/roles/iam.workloadIdentityUser/principalSet://iam.googleapis.com/projects/41292283861/locations/global/workloadIdentityPools/github-pool/attribute.repository_id/1401633649]
google_cloud_run_v2_service_iam_member.eval_reader_dc_invoker: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-dc-datacommons-service/roles/run.invoker/serviceAccount:dfo-dev-apis-eval-reader@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.eval_reader_origin_catalogue_viewer: Refreshing state... [id=b/dfo-dev-origin-catalogue-dev-fin-observatory/roles/storage.objectViewer/serviceAccount:dfo-dev-apis-eval-reader@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.origin_catalogue_job_object_user: Refreshing state... [id=b/dfo-dev-origin-catalogue-dev-fin-observatory/roles/storage.objectUser/serviceAccount:dfo-dev-origin-catalogue-job@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.search_catalogue_job_origin_catalogue_viewer: Refreshing state... [id=b/dfo-dev-origin-catalogue-dev-fin-observatory/roles/storage.objectViewer/serviceAccount:dfo-dev-search-catalogue-job@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.origin_catalogue_datasets_worker_viewer: Refreshing state... [id=b/dfo-dev-origin-catalogue-dev-fin-observatory/roles/storage.objectViewer/serviceAccount:dfo-dev-datasets-worker-run@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.search_catalogue_job_object_user: Refreshing state... [id=b/dfo-dev-search-catalogue-dev-fin-observatory/roles/storage.objectUser/serviceAccount:dfo-dev-search-catalogue-job@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.graph_release_datasets_worker_viewer: Refreshing state... [id=b/dfo-dev-graph-release-dev-fin-observatory/roles/storage.objectViewer/serviceAccount:dfo-dev-datasets-worker-run@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.graph_release_search_catalogue_viewer[0]: Refreshing state... [id=b/dfo-dev-graph-release-dev-fin-observatory/roles/storage.objectViewer/serviceAccount:dfo-dev-search-catalogue-job@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.eval_reader_graph_release_viewer: Refreshing state... [id=b/dfo-dev-graph-release-dev-fin-observatory/roles/storage.objectViewer/serviceAccount:dfo-dev-apis-eval-reader@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.graph_release_job_object_user: Refreshing state... [id=b/dfo-dev-graph-release-dev-fin-observatory/roles/storage.objectUser/serviceAccount:dfo-dev-graph-release-job@dev-fin-observatory.iam.gserviceaccount.com]
module.apis_service.google_service_account_iam_member.deployer_act_as["serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com"]: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com/roles/iam.serviceAccountUser/serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_run_v2_service_iam_member.graph_generation_dc_viewer: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-dc-datacommons-service/roles/run.viewer/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.datasets_pinned_viewer: Refreshing state... [id=b/dev-fin-observatory-datasets-pinned/roles/storage.objectViewer/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_run_v2_service_iam_member.dc_invoker_apis: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-dc-datacommons-service/roles/run.invoker/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
google_sql_user.datasets_runtime: Refreshing state... [id=dfo-dev-apis-run@dev-fin-observatory.iam//dfo-dev-platform-postgres]
google_storage_bucket_iam_member.search_catalogue_apis_runtime_viewer: Refreshing state... [id=b/dfo-dev-search-catalogue-dev-fin-observatory/roles/storage.objectViewer/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
google_service_account_iam_member.datasets_token_creator: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com/roles/iam.serviceAccountTokenCreator/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.graph_release_apis_runtime_viewer: Refreshing state... [id=b/dfo-dev-graph-release-dev-fin-observatory/roles/storage.objectViewer/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.datasets_pinned_creator: Refreshing state... [id=b/dev-fin-observatory-datasets-pinned/roles/storage.objectCreator/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
google_service_account_iam_member.datasets_worker_invoker_act_as: Refreshing state... [id=projects/dev-fin-observatory/serviceAccounts/dfo-dev-worker-invoker@dev-fin-observatory.iam.gserviceaccount.com/roles/iam.serviceAccountUser/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.datasets_working_creator: Refreshing state... [id=b/dev-fin-observatory-datasets-working/roles/storage.objectCreator/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
google_project_iam_member.datasets_cloudsql_instance_user: Refreshing state... [id=dev-fin-observatory/projects/dev-fin-observatory/roles/dfoDevApisCloudsqlLoginOnly/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
google_project_iam_member.datasets_cloudsql_client: Refreshing state... [id=dev-fin-observatory/roles/cloudsql.client/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.datasets_working_viewer: Refreshing state... [id=b/dev-fin-observatory-datasets-working/roles/storage.objectViewer/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
google_storage_bucket_iam_member.origin_catalogue_apis_runtime_viewer: Refreshing state... [id=b/dfo-dev-origin-catalogue-dev-fin-observatory/roles/storage.objectViewer/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_tasks_queue.datasets_worker: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/queues/dfo-dev-datasets-worker]
google_sql_provision_script.runtime_connect: Refreshing state... [id=dev-fin-observatory/dfo-dev-platform-postgres]
module.apis_service.google_secret_manager_secret_iam_member.runtime_secret_access["dfo-dev-gemini-api-key"]: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-gemini-api-key/roles/secretmanager.secretAccessor/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
module.apis_service.google_secret_manager_secret_iam_member.runtime_secret_access["dfo-dev-datasets-first-party-principal"]: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-datasets-first-party-principal/roles/secretmanager.secretAccessor/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
module.apis_service.google_secret_manager_secret_iam_member.runtime_secret_access["dfo-dev-live-refresh-principal"]: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-live-refresh-principal/roles/secretmanager.secretAccessor/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
module.apis_service.google_secret_manager_secret_iam_member.runtime_secret_access["dfo-dev-caller-hmac-key"]: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-caller-hmac-key/roles/secretmanager.secretAccessor/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
module.apis_service.google_secret_manager_secret_iam_member.runtime_secret_access["dfo-dev-datasets-pin-principal"]: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-datasets-pin-principal/roles/secretmanager.secretAccessor/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
module.apis_service.google_secret_manager_secret_iam_member.runtime_secret_access["dfo-dev-caller-principal"]: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-caller-principal/roles/secretmanager.secretAccessor/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
module.apis_service.google_secret_manager_secret_iam_member.runtime_secret_access["dfo-dev-share-import-principal"]: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-share-import-principal/roles/secretmanager.secretAccessor/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
module.apis_service.google_secret_manager_secret_iam_member.runtime_secret_access["dfo-dev-typesafe-api-key"]: Refreshing state... [id=projects/dev-fin-observatory/secrets/dfo-dev-typesafe-api-key/roles/secretmanager.secretAccessor/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
module.psc_network.google_compute_network.this: Refreshing state... [id=projects/dev-fin-observatory/global/networks/dfo-dev-apis-psc]
module.psc_network.google_compute_subnetwork.this: Refreshing state... [id=projects/dev-fin-observatory/regions/northamerica-northeast1/subnetworks/dfo-dev-apis-psc-subnet]
module.psc_network.google_dns_managed_zone.psc: Refreshing state... [id=projects/dev-fin-observatory/managedZones/dfo-dev-apis-psc-sql]
module.psc_network.google_compute_address.psc_endpoint: Refreshing state... [id=projects/dev-fin-observatory/regions/northamerica-northeast1/addresses/dfo-dev-apis-psc-endpoint]
google_cloud_run_v2_service.datasets_worker: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-datasets-worker]
google_cloud_tasks_queue_iam_member.datasets_worker_queue_enqueuer: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/queues/dfo-dev-datasets-worker/roles/cloudtasks.enqueuer/serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com]
module.apis_service.google_cloud_run_v2_service.this: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-apis]
google_cloud_run_v2_service_iam_member.datasets_worker_invoker: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-datasets-worker/roles/run.invoker/serviceAccount:dfo-dev-worker-invoker@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_run_v2_service_iam_member.datasets_worker_deployer_run_developer: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-datasets-worker/roles/run.developer/serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_run_v2_service_iam_member.sdk_e2e_apis_invoker: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-apis/roles/run.invoker/serviceAccount:dfo-dev-sdk-e2e@dev-fin-observatory.iam.gserviceaccount.com]
module.apis_service.google_cloud_run_v2_service_iam_member.deployer_run_developer["serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com"]: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-apis/roles/run.developer/serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_run_v2_service_iam_member.eval_reader_apis_invoker: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-apis/roles/run.invoker/serviceAccount:dfo-dev-apis-eval-reader@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_run_v2_job.origin_catalogue: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-origin-catalogue]
google_logging_metric.client_calls: Refreshing state... [id=dfo-dev-client-calls]
google_cloud_run_v2_job.search_catalogue: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-search-catalogue]
google_logging_metric.graph_release_refused: Refreshing state... [id=dfo-dev-graph-release-refused]
google_logging_metric.search_engine_infra_error: Refreshing state... [id=dfo-dev-search-engine-infra-error]
google_logging_metric.search_resolve_5xx: Refreshing state... [id=dfo-dev-search-resolve-5xx]
google_cloud_run_v2_job.datasets_maintenance: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-datasets-maintenance]
google_monitoring_alert_policy.graph_release_memory: Refreshing state... [id=projects/dev-fin-observatory/alertPolicies/4193518087020554251]
google_logging_metric.graph_release_recheck_failed: Refreshing state... [id=dfo-dev-graph-release-recheck-failed]
google_cloud_run_v2_job_iam_member.origin_catalogue_scheduler_invoker: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-origin-catalogue/roles/run.invoker/serviceAccount:dfo-dev-origin-cat-scheduler@dev-fin-observatory.iam.gserviceaccount.com]
google_logging_metric.origin_catalogue_heartbeat: Refreshing state... [id=dfo-dev-origin-catalogue-heartbeat]
google_cloud_run_v2_job_iam_member.origin_catalogue_deployer_run_developer: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-origin-catalogue/roles/run.developer/serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com]
google_logging_metric.origin_catalogue_stale: Refreshing state... [id=dfo-dev-origin-catalogue-publish-stale]
time_sleep.search_metric_propagation: Refreshing state... [id=2026-10-24T12:24:43Z]
module.psc_network.google_compute_forwarding_rule.psc_endpoint: Refreshing state... [id=projects/dev-fin-observatory/regions/northamerica-northeast1/forwardingRules/dfo-dev-apis-psc-fwd]
module.psc_network.google_dns_record_set.psc: Refreshing state... [id=projects/dev-fin-observatory/managedZones/dfo-dev-apis-psc-sql/rrsets/bbd723248b19.3niso0mm9bket.northamerica-northeast1.sql.goog./A]
google_logging_metric.search_catalogue_line_dropped: Refreshing state... [id=dfo-dev-search-catalogue-line-dropped]
google_monitoring_alert_policy.search_catalogue_failed: Refreshing state... [id=projects/dev-fin-observatory/alertPolicies/4294792089682635760]
google_cloud_run_v2_job_iam_member.graph_release_job_catalogue_invoker: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-search-catalogue/roles/run.invoker/serviceAccount:dfo-dev-graph-release-job@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_run_v2_job.datasets_migrate: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-datasets-migrate]
google_cloud_run_v2_job_iam_member.search_catalogue_deployer_run_developer: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-search-catalogue/roles/run.developer/serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_run_v2_job.graph_release: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-graph-release]
google_cloud_run_v2_job.presentation_migrate: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-presentation-migrate]
google_monitoring_alert_policy.search_failing: Refreshing state... [id=projects/dev-fin-observatory/alertPolicies/12731113471018509293]
time_sleep.origin_catalogue_metric_propagation: Refreshing state... [id=2026-10-01T08:02:47Z]
google_cloud_run_v2_job_iam_member.datasets_maintenance_scheduler_executor: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-datasets-maintenance/roles/run.jobsExecutorWithOverrides/serviceAccount:dfo-dev-dsmaint-scheduler@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_run_v2_job_iam_member.datasets_maintenance_deployer_run_developer: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-datasets-maintenance/roles/run.developer/serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com]
time_sleep.search_catalogue_metric_propagation: Refreshing state... [id=2026-10-01T18:01:02Z]
google_cloud_scheduler_job.origin_catalogue: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-origin-catalogue-tick]
google_monitoring_alert_policy.origin_catalogue_stale: Refreshing state... [id=projects/dev-fin-observatory/alertPolicies/16299952155658024343]
google_monitoring_alert_policy.origin_catalogue_heartbeat: Refreshing state... [id=projects/dev-fin-observatory/alertPolicies/16982739230211407466]
google_cloud_run_v2_job_iam_member.datasets_migrate_deployer_run_developer: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-datasets-migrate/roles/run.developer/serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com]
google_monitoring_alert_policy.search_catalogue_line_dropped: Refreshing state... [id=projects/dev-fin-observatory/alertPolicies/7986943259385962425]
google_cloud_run_v2_job_iam_member.graph_release_scheduler_invoker: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-graph-release/roles/run.invoker/serviceAccount:dfo-dev-graph-rel-scheduler@dev-fin-observatory.iam.gserviceaccount.com]
google_logging_metric.graph_release_unavailable: Refreshing state... [id=dfo-dev-graph-release-unavailable]
google_cloud_run_v2_job_iam_member.graph_release_deployer_run_developer: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-graph-release/roles/run.developer/serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com]
google_logging_metric.graph_release_heartbeat: Refreshing state... [id=dfo-dev-graph-release-heartbeat]
google_logging_metric.graph_release_blind_spots: Refreshing state... [id=dfo-dev-graph-release-blind-spots]
google_logging_metric.graph_release_catalogue_trigger_failed: Refreshing state... [id=dfo-dev-graph-release-catalogue-trigger-failed]
google_logging_metric.graph_release_stale: Refreshing state... [id=dfo-dev-graph-release-stale]
google_logging_metric.graph_release_gate_failed: Refreshing state... [id=dfo-dev-graph-release-gate-failed]
google_cloud_run_v2_job_iam_member.presentation_migrate_deployer_run_developer: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-presentation-migrate/roles/run.developer/serviceAccount:dfo-apis-deployer@dev-fin-observatory.iam.gserviceaccount.com]
google_cloud_scheduler_job.datasets_maintenance["sweep"]: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-datasets-sweep]
google_cloud_scheduler_job.datasets_maintenance["age-operations"]: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-datasets-age-operations]
time_sleep.graph_release_metric_propagation: Refreshing state... [id=2026-10-21T07:11:28Z]
google_monitoring_alert_policy.graph_release_blind_spots: Refreshing state... [id=projects/dev-fin-observatory/alertPolicies/6096118064219509634]
google_monitoring_alert_policy.graph_release_serving: Refreshing state... [id=projects/dev-fin-observatory/alertPolicies/3228953330872562333]
google_monitoring_alert_policy.graph_release_stale: Refreshing state... [id=projects/dev-fin-observatory/alertPolicies/776193490013362977]
google_monitoring_alert_policy.graph_release_heartbeat: Refreshing state... [id=projects/dev-fin-observatory/alertPolicies/3672510219378109768]
google_cloud_scheduler_job.graph_release: Refreshing state... [id=projects/dev-fin-observatory/locations/northamerica-northeast1/jobs/dfo-dev-graph-release-tick]
ephemeral.random_password.caller_hmac_key: Closing...
ephemeral.random_password.datasets_pin_principal: Closing...
ephemeral.random_password.share_import_principal: Closing...
ephemeral.random_password.caller_principal: Closing...
ephemeral.random_password.search_query_hmac_key: Closing...
ephemeral.random_password.live_refresh_principal: Closing...
ephemeral.random_password.datasets_first_party_principal: Closing...
ephemeral.random_password.datasets_first_party_principal: Closing complete after 0s
ephemeral.random_password.live_refresh_principal: Closing complete after 0s
ephemeral.random_password.datasets_pin_principal: Closing complete after 0s
ephemeral.random_password.search_query_hmac_key: Closing complete after 0s
ephemeral.random_password.caller_principal: Closing complete after 0s
ephemeral.random_password.caller_hmac_key: Closing complete after 0s
ephemeral.random_password.share_import_principal: Closing complete after 0s

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.apis_service.google_cloud_run_v2_service.this has changed
  ~ resource "google_cloud_run_v2_service" "this" {
        id                      = "projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-apis"
        name                    = "dfo-dev-apis"
        # (36 unchanged attributes hidden)

      ~ template {
            # (11 unchanged attributes hidden)

          ~ containers {
              ~ image          = "northamerica-northeast1-docker.pkg.dev/dev-fin-observatory/datacommons/dfo-apis:91baa8a39116b07001addd2d50a66cce645c916d" -> "northamerica-northeast1-docker.pkg.dev/dev-fin-observatory/datacommons/dfo-apis:9f3a853106ddb9db3ef051b5966d3106a52ada2c"
                name           = null
                # (6 unchanged attributes hidden)

                # (47 unchanged blocks hidden)
            }

            # (2 unchanged blocks hidden)
        }

        # (2 unchanged blocks hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # google_cloud_scheduler_job.datasets_maintenance["sweep-export-claims"] will be created
  + resource "google_cloud_scheduler_job" "datasets_maintenance" {
      + deletion_policy = "DELETE"
      + id              = (known after apply)
      + name            = "dfo-dev-datasets-sweep-export-claims"
      + paused          = (known after apply)
      + project         = "dev-fin-observatory"
      + region          = "northamerica-northeast1"
      + schedule        = "*/5 * * * *"
      + state           = (known after apply)
      + time_zone       = "Etc/UTC"

      + http_target {
          + body        = "eyJvdmVycmlkZXMiOnsiY29udGFpbmVyT3ZlcnJpZGVzIjpbeyJhcmdzIjpbInN3ZWVwLWV4cG9ydC1jbGFpbXMiXX1dfX0="
          + headers     = {
              + "Content-Type" = "application/json"
            }
          + http_method = "POST"
          + uri         = "https://northamerica-northeast1-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/dev-fin-observatory/jobs/dfo-dev-datasets-maintenance:run"

          + oauth_token {
              + scope                 = "https://www.googleapis.com/auth/cloud-platform"
              + service_account_email = "dfo-dev-dsmaint-scheduler@dev-fin-observatory.iam.gserviceaccount.com"
            }
        }
    }

  # google_secret_manager_secret.search_query_hmac_key will be created
  + resource "google_secret_manager_secret" "search_query_hmac_key" {
      + create_time           = (known after apply)
      + deletion_policy       = "DELETE"
      + deletion_protection   = false
      + effective_annotations = (known after apply)
      + effective_labels      = {
          + "goog-terraform-provisioned" = "true"
        }
      + expire_time           = (known after apply)
      + id                    = (known after apply)
      + name                  = (known after apply)
      + project               = "dev-fin-observatory"
      + secret_id             = "dfo-dev-search-query-hmac-key"
      + terraform_labels      = {
          + "goog-terraform-provisioned" = "true"
        }

      + replication {
          + auto {
            }
        }
    }

  # google_secret_manager_secret_version.search_query_hmac_key will be created
  + resource "google_secret_manager_secret_version" "search_query_hmac_key" {
      + create_time            = (known after apply)
      + deletion_policy        = (known after apply)
      + destroy_time           = (known after apply)
      + enabled                = true
      + id                     = (known after apply)
      + name                   = (known after apply)
      + project                = (known after apply)
      + secret                 = (known after apply)
      + secret_data_wo         = (write-only attribute)
      + secret_data_wo_version = 1
      + version                = (known after apply)
    }

  # module.apis_service.google_cloud_run_v2_service.this will be updated in-place
  ~ resource "google_cloud_run_v2_service" "this" {
        id                      = "projects/dev-fin-observatory/locations/northamerica-northeast1/services/dfo-dev-apis"
        name                    = "dfo-dev-apis"
        # (36 unchanged attributes hidden)

      ~ template {
            # (11 unchanged attributes hidden)

          ~ containers {
                name           = null
                # (7 unchanged attributes hidden)

              + env {
                  + name  = "SEARCH_QUERY_HMAC_KEY"
                    # (1 unchanged attribute hidden)

                  + value_source {
                      + secret_key_ref {
                          + secret  = "dfo-dev-search-query-hmac-key"
                          + version = (known after apply)
                        }
                    }
                }

                # (47 unchanged blocks hidden)
            }

            # (2 unchanged blocks hidden)
        }

        # (2 unchanged blocks hidden)
    }

  # module.apis_service.google_secret_manager_secret_iam_member.runtime_secret_access["dfo-dev-search-query-hmac-key"] will be created
  + resource "google_secret_manager_secret_iam_member" "runtime_secret_access" {
      + etag      = (known after apply)
      + id        = (known after apply)
      + member    = "serviceAccount:dfo-dev-apis-run@dev-fin-observatory.iam.gserviceaccount.com"
      + project   = (known after apply)
      + role      = "roles/secretmanager.secretAccessor"
      + secret_id = "dfo-dev-search-query-hmac-key"
    }

Plan: 4 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

_{Stack apis · 1174758 · @jm-rivera · run}

feat(apis): key the search query digest, sweep export claims, and giv…

941cafc

…e maintenance graph access

jm-rivera mentioned this pull request Oct 31, 2026

fix(apis): run sweep-export-claims every five minutes #136

Closed

Merge remote-tracking branch 'origin/dev' into chore/apis-query-key-a…

938830b

…nd-claim-sweep # Conflicts: # infra/dfo-dev/apis/README.md # infra/stacks/apis/datasets_maintenance_job.tf

jm-rivera changed the title ~~feat(apis): key the search query digest, sweep export claims, and give maintenance graph access~~ feat(apis): key the search query digest and sweep export claims every five minutes Nov 1, 2026

jm-rivera marked this pull request as ready for review November 1, 2026 18:36

jm-rivera had a problem deploying to dev-plan November 1, 2026 18:36 — with GitHub Actions Failure

fix(apis): link the search query key into the dev and prod apis stacks

1174758

jm-rivera deployed to dev-plan November 1, 2026 18:38 — with GitHub Actions Active

jm-rivera merged commit 74da90b into dev Nov 1, 2026
5 checks passed

jm-rivera mentioned this pull request Nov 1, 2026

release: infra ae35bc0 to production #138

Merged

Navigation Menu

Repository navigation

feat(apis): key the search query digest and sweep export claims every five minutes - #130

feat(apis): key the search query digest and sweep export claims every five minutes#130
jm-rivera merged 3 commits into
devfrom
chore/apis-query-key-and-claim-sweep

jm-rivera commented Oct 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 1, 2026 •

edited

Loading

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jm-rivera commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Terraform Apply — apis

Uh oh!

github-actions Bot commented Nov 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Terraform Plan — apis

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jm-rivera commented Oct 31, 2026 •

edited

Loading

github-actions Bot commented Nov 1, 2026 •

edited

Loading

Terraform Apply — `apis`

github-actions Bot commented Nov 1, 2026 •

edited

Loading

Terraform Plan — `apis`