OpenTofu will perform the following actions:

  # aws_iam_openid_connect_provider.github_actions will be created
  + resource "aws_iam_openid_connect_provider" "github_actions" {
      + arn             = (known after apply)
      + client_id_list  = [
          + "sts.amazonaws.com",
        ]
      + id              = (known after apply)
      + tags            = {
          + "ManagedBy" = "Terraform"
        }
      + tags_all        = {
          + "ManagedBy" = "Terraform"
        }
      + thumbprint_list = [
          + "6938fd4d98bab03faadb97b34396831e3780aea1",
        ]
      + url             = "https://token.actions.githubusercontent.com"
    }

  # aws_iam_role.github_actions_sops_kms will be created
  + resource "aws_iam_role" "github_actions_sops_kms" {
      + arn                   = (known after apply)
      + assume_role_policy    = (known after apply)
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "github-actions-sops-kms"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags                  = {
          + "ManagedBy" = "Terraform"
        }
      + tags_all              = {
          + "ManagedBy" = "Terraform"
        }
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # aws_iam_role_policy.github_actions_sops_kms will be created
  + resource "aws_iam_role_policy" "github_actions_sops_kms" {
      + id          = (known after apply)
      + name        = "sops-kms"
      + name_prefix = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "kms:Decrypt",
                          + "kms:DescribeKey",
                          + "kms:Encrypt",
                          + "kms:GenerateDataKey*",
                          + "kms:ReEncrypt*",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:kms:us-west-2:332355796717:key/0a45c0f6-71dc-4d54-ab33-9df4de1a9e91"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + role        = (known after apply)
    }

Plan: 3 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + github_actions_sops_kms_role_arn = (known after apply)