fix: added tag mutability conditional

[Wi11Shell]

Description

Related issue: JIRA_TICKET_NUMBER

Before submitting (or marking as "ready for review")

• Does the pull request title follow the conventional commit specification?
• Have you performed a self-review of the code
• Have you have added tests that prove the fix or feature is effective and working
• Did you make sure to update any documentation relating to this change?

[github-actions]

Terraform plan for account: nonprod

Commit: 6d227c2

Plan summary

0 to add, 2 to change, 0 to destroy

🔄 Updates

module.account.module.ecr["liquibase"].aws_ecr_repository.this[0]
module.account.module.github[0].module.iam_github_oidc_provider[0].aws_iam_openid_connect_provider.this[0]

---

Show full plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.account.module.ecr["liquibase"].aws_ecr_repository.this[0] will be updated in-place
  ~ resource "aws_ecr_repository" "this" {
        id                   = "vol-app/liquibase"
      ~ image_tag_mutability = "IMMUTABLE" -> "MUTABLE"
        name                 = "vol-app/liquibase"
        tags                 = {}
        # (4 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.account.module.github[0].module.iam_github_oidc_provider[0].aws_iam_openid_connect_provider.this[0] will be updated in-place
  ~ resource "aws_iam_openid_connect_provider" "this" {
        id              = "arn:aws:iam::054614622558:oidc-provider/token.actions.githubusercontent.com"
        tags            = {}
      ~ tags_all        = {
          + "Repository" = "https://github.com/dvsa/vol-app"
        }
        # (4 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

[github-actions]

Terraform plan for account: prod

Commit: 6d227c2

Plan summary

4 to add, 0 to change, 0 to destroy

🆕 Creates

module.account.module.ecr["liquibase"].aws_ecr_lifecycle_policy.this[0]
module.account.module.ecr["liquibase"].aws_ecr_registry_scanning_configuration.this[0]
module.account.module.ecr["liquibase"].aws_ecr_repository.this[0]
module.account.module.ecr["liquibase"].aws_ecr_repository_policy.this[0]

---

Show full plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.account.module.ecr["liquibase"].aws_ecr_lifecycle_policy.this[0] will be created
  + resource "aws_ecr_lifecycle_policy" "this" {
      + id          = (known after apply)
      + policy      = jsonencode(
            {
              + rules = [
                  + {
                      + action       = {
                          + type = "expire"
                        }
                      + description  = "Keep last 5 release images"
                      + rulePriority = 10
                      + selection    = {
                          + countNumber    = 5
                          + countType      = "imageCountMoreThan"
                          + tagPatternList = [
                              + "*.*.*",
                            ]
                          + tagStatus      = "tagged"
                        }
                    },
                  + {
                      + action       = {
                          + type = "expire"
                        }
                      + description  = "Keep last 5 non-release images"
                      + rulePriority = 20
                      + selection    = {
                          + countNumber = 5
                          + countType   = "imageCountMoreThan"
                          + tagStatus   = "any"
                        }
                    },
                ]
            }
        )
      + registry_id = (known after apply)
      + repository  = "vol-app/liquibase"
    }

  # module.account.module.ecr["liquibase"].aws_ecr_registry_scanning_configuration.this[0] will be created
  + resource "aws_ecr_registry_scanning_configuration" "this" {
      + id          = (known after apply)
      + registry_id = (known after apply)
      + scan_type   = "ENHANCED"

      + rule {
          + scan_frequency = "SCAN_ON_PUSH"

          + repository_filter {
              + filter      = "*"
              + filter_type = "WILDCARD"
            }
        }
      + rule {
          + scan_frequency = "CONTINUOUS_SCAN"

          + repository_filter {
              + filter      = "*.*.*"
              + filter_type = "WILDCARD"
            }
        }
    }

  # module.account.module.ecr["liquibase"].aws_ecr_repository.this[0] will be created
  + resource "aws_ecr_repository" "this" {
      + arn                  = (known after apply)
      + id                   = (known after apply)
      + image_tag_mutability = "MUTABLE"
      + name                 = "vol-app/liquibase"
      + registry_id          = (known after apply)
      + repository_url       = (known after apply)
      + tags_all             = {
          + "Repository" = "https://github.com/dvsa/vol-app"
        }

      + encryption_configuration {
          + encryption_type = "AES256"
          + kms_key         = (known after apply)
        }

      + image_scanning_configuration {
          + scan_on_push = true
        }
    }

  # module.account.module.ecr["liquibase"].aws_ecr_repository_policy.this[0] will be created
  + resource "aws_ecr_repository_policy" "this" {
      + id          = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "ecr:ListTagsForResource",
                          + "ecr:ListImages",
                          + "ecr:GetRepositoryPolicy",
                          + "ecr:GetLifecyclePolicyPreview",
                          + "ecr:GetLifecyclePolicy",
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:GetAuthorizationToken",
                          + "ecr:DescribeRepositories",
                          + "ecr:DescribeImages",
                          + "ecr:DescribeImageScanFindings",
                          + "ecr:BatchGetImage",
                          + "ecr:BatchCheckLayerAvailability",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = [
                              + "arn:aws:iam::146997448015:role/vol-app-github-actions-role",
                              + "arn:aws:iam::146997448015:role/vol-app-github-actions-readonly-role",
                            ]
                        }
                      + Sid       = "PrivateReadOnly"
                    },
                  + {
                      + Action    = [
                          + "ecr:UploadLayerPart",
                          + "ecr:PutImage",
                          + "ecr:InitiateLayerUpload",
                          + "ecr:CompleteLayerUpload",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::146997448015:role/vol-app-github-actions-role"
                        }
                      + Sid       = "ReadWrite"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + registry_id = (known after apply)
      + repository  = "vol-app/liquibase"
    }

Plan: 4 to add, 0 to change, 0 to destroy.