Tag log groups, Cognito pools and the website bucket with project

[ale210]

Part of #197, under epic #206.

Adds the project tag to the three untagged resource types that Terraform can actually reach:

Resource	Where	Covers
ECS log group	modules/container/main.tf — the tags block was there but empty	all 10 /ecs/* groups
Cognito user pools	projects/home-unite-us/cognito-{prod,qa}.tf	2 of the account's 3 pools
Website bucket	projects/civic-tech-index/s3.tf	civictechindex.org

What to look for in the plan

Tags-only changes, nothing added, destroyed or replaced. In particular both Cognito pools must show a tag change and nothing else — cognito-prod.tf carries a header comment stating that a proposed change to that file is a defect rather than drift, and this PR is the intended exception to it.

The bucket's tag value is written literally on purpose

local.project_name in projects/civic-tech-index/ is civic-tech-index, but the tag standard's value is civictechindex — the same reason ecr.tf hardcodes it. Using the local there would have added a fifth resource to the wrong side of that split. The two spellings are reconciled in #217; the comment in s3.tf says not to switch it back before then.

Not in this PR

These are untagged and stay untagged, because none of them is in Terraform — tagging them would mean a hand-applied change to a resource whose import ticket is already open:

• Cognito pool us-west-2_Fn4rkZpuB (Add Cognito to Terraform #17)
• /aws/rds/instance/incubator-prod-database/{postgresql,upgrade} (Import the RDS subnet group and log groups into Terraform #214)
• RDSOSMetrics, ecs/homeuniteus, and the four /aws/lambda/* log groups
• the CloudTrail and Terraform state buckets
• the 15 machine IAM roles, which are Add the project tag to the CI/CD role #198 and Add the project tag to the ECS task role and delete the placeholder tag #199

Verification

terraform init -backend=false and terraform validate pass locally on Terraform 1.16.0, the pinned version. terraform fmt -check is clean on all four changed files.

After this merges and applies, ./aws-terraform-coverage.ps1 -ProjectTag (added in hackforla/devops#225) should move 13 resources out of missing.

[github-actions]

Terraform plan in terraform
With backend config files: terraform/prod.backend.tfvars

Plan: 0 to add, 13 to change, 0 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place

Terraform will perform the following actions:

  # module.civic-tech-index.aws_s3_bucket.website will be updated in-place
!~  resource "aws_s3_bucket" "website" {
        id                          = "civictechindex.org"
!~      tags                        = {
+           "project" = "civictechindex"
        }
!~      tags_all                    = {
+           "project"    = "civictechindex"
#            (1 unchanged element hidden)
        }
#        (16 unchanged attributes hidden)

#        (4 unchanged blocks hidden)
    }

  # module.home-unite-us.aws_cognito_user_pool.homeuniteus will be updated in-place
!~  resource "aws_cognito_user_pool" "homeuniteus" {
        id                         = "us-west-2_rWxdMKVzy"
        name                       = "home-unite-us"
!~      tags                       = {
+           "project" = "home-unite-us"
        }
!~      tags_all                   = {
+           "project"    = "home-unite-us"
#            (1 unchanged element hidden)
        }
#        (17 unchanged attributes hidden)

#        (11 unchanged blocks hidden)
    }

  # module.home-unite-us.aws_cognito_user_pool.homeuniteus_prod will be updated in-place
!~  resource "aws_cognito_user_pool" "homeuniteus_prod" {
        id                         = "us-west-2_VH24AGQ3p"
        name                       = "Home Unite Us"
!~      tags                       = {
+           "project" = "home-unite-us"
        }
!~      tags_all                   = {
+           "project"    = "home-unite-us"
#            (1 unchanged element hidden)
        }
#        (17 unchanged attributes hidden)

#        (11 unchanged blocks hidden)
    }

  # module.civic-tech-index.module.backend_prod_service.aws_cloudwatch_log_group.this will be updated in-place
!~  resource "aws_cloudwatch_log_group" "this" {
        id                          = "/ecs/cti-backend-prod"
        name                        = "/ecs/cti-backend-prod"
!~      tags                        = {
+           "project" = "civictechindex"
        }
!~      tags_all                    = {
+           "project"    = "civictechindex"
#            (1 unchanged element hidden)
        }
#        (8 unchanged attributes hidden)
    }

  # module.civic-tech-index.module.backend_stage_service.aws_cloudwatch_log_group.this will be updated in-place
!~  resource "aws_cloudwatch_log_group" "this" {
        id                          = "/ecs/cti-backend-stage"
        name                        = "/ecs/cti-backend-stage"
!~      tags                        = {
+           "project" = "civictechindex"
        }
!~      tags_all                    = {
+           "project"    = "civictechindex"
#            (1 unchanged element hidden)
        }
#        (8 unchanged attributes hidden)
    }

  # module.civic-tech-jobs.module.civic_tech_jobs_fullstack_stage_service.aws_cloudwatch_log_group.this will be updated in-place
!~  resource "aws_cloudwatch_log_group" "this" {
        id                          = "/ecs/civic-tech-jobs-fs-stage"
        name                        = "/ecs/civic-tech-jobs-fs-stage"
!~      tags                        = {
+           "project" = "civic-tech-jobs"
        }
!~      tags_all                    = {
+           "project"    = "civic-tech-jobs"
#            (1 unchanged element hidden)
        }
#        (8 unchanged attributes hidden)
    }

  # module.home-unite-us.module.prod_service.aws_cloudwatch_log_group.this will be updated in-place
!~  resource "aws_cloudwatch_log_group" "this" {
        id                          = "/ecs/home-unite-us-fullstack-prod"
        name                        = "/ecs/home-unite-us-fullstack-prod"
!~      tags                        = {
+           "project" = "home-unite-us"
        }
!~      tags_all                    = {
+           "project"    = "home-unite-us"
#            (1 unchanged element hidden)
        }
#        (8 unchanged attributes hidden)
    }

  # module.home-unite-us.module.qa_service.aws_cloudwatch_log_group.this will be updated in-place
!~  resource "aws_cloudwatch_log_group" "this" {
        id                          = "/ecs/home-unite-us-fullstack-qa"
        name                        = "/ecs/home-unite-us-fullstack-qa"
!~      tags                        = {
+           "project" = "home-unite-us"
        }
!~      tags_all                    = {
+           "project"    = "home-unite-us"
#            (1 unchanged element hidden)
        }
#        (8 unchanged attributes hidden)
    }

  # module.people-depot.module.backend_dev_service.aws_cloudwatch_log_group.this will be updated in-place
!~  resource "aws_cloudwatch_log_group" "this" {
        id                          = "/ecs/people-depot-backend-dev"
        name                        = "/ecs/people-depot-backend-dev"
!~      tags                        = {
+           "project" = "people-depot"
        }
!~      tags_all                    = {
+           "project"    = "people-depot"
#            (1 unchanged element hidden)
        }
#        (8 unchanged attributes hidden)
    }

  # module.vrms.module.backend_dev_service.aws_cloudwatch_log_group.this will be updated in-place
!~  resource "aws_cloudwatch_log_group" "this" {
        id                          = "/ecs/vrms-backend-dev"
        name                        = "/ecs/vrms-backend-dev"
!~      tags                        = {
+           "project" = "vrms"
        }
!~      tags_all                    = {
+           "project"    = "vrms"
#            (1 unchanged element hidden)
        }
#        (8 unchanged attributes hidden)
    }

  # module.vrms.module.backend_prod_service.aws_cloudwatch_log_group.this will be updated in-place
!~  resource "aws_cloudwatch_log_group" "this" {
        id                          = "/ecs/vrms-backend-prod"
        name                        = "/ecs/vrms-backend-prod"
!~      tags                        = {
+           "project" = "vrms"
        }
!~      tags_all                    = {
+           "project"    = "vrms"
#            (1 unchanged element hidden)
        }
#        (8 unchanged attributes hidden)
    }

  # module.vrms.module.frontend_dev_service.aws_cloudwatch_log_group.this will be updated in-place
!~  resource "aws_cloudwatch_log_group" "this" {
        id                          = "/ecs/vrms-frontend-dev"
        name                        = "/ecs/vrms-frontend-dev"
!~      tags                        = {
+           "project" = "vrms"
        }
!~      tags_all                    = {
+           "project"    = "vrms"
#            (1 unchanged element hidden)
        }
#        (8 unchanged attributes hidden)
    }

  # module.vrms.module.frontend_prod_service.aws_cloudwatch_log_group.this will be updated in-place
!~  resource "aws_cloudwatch_log_group" "this" {
        id                          = "/ecs/vrms-frontend-prod"
        name                        = "/ecs/vrms-frontend-prod"
!~      tags                        = {
+           "project" = "vrms"
        }
!~      tags_all                    = {
+           "project"    = "vrms"
#            (1 unchanged element hidden)
        }
#        (8 unchanged attributes hidden)
    }

Plan: 0 to add, 13 to change, 0 to destroy.

✅ Plan applied in Terraform apply (OIDC) #78