OpenTofu will perform the following actions:

  # aws_iam_access_key.sops_secrets_operator will be created
  + resource "aws_iam_access_key" "sops_secrets_operator" {
      + create_date                    = (known after apply)
      + encrypted_secret               = (known after apply)
      + encrypted_ses_smtp_password_v4 = (known after apply)
      + id                             = (known after apply)
      + key_fingerprint                = (known after apply)
      + secret                         = (sensitive value)
      + ses_smtp_password_v4           = (sensitive value)
      + status                         = "Active"
      + user                           = "sops-secrets-operator"
    }

  # aws_iam_user.sops_secrets_operator will be created
  + resource "aws_iam_user" "sops_secrets_operator" {
      + arn           = (known after apply)
      + force_destroy = false
      + id            = (known after apply)
      + name          = "sops-secrets-operator"
      + path          = "/"
      + tags          = {
          + "ManagedBy" = "Terraform"
          + "Purpose"   = "sops-secrets-operator"
        }
      + tags_all      = {
          + "ManagedBy" = "Terraform"
          + "Purpose"   = "sops-secrets-operator"
        }
      + unique_id     = (known after apply)
    }

  # aws_iam_user_policy.sops_secrets_operator_kms will be created
  + resource "aws_iam_user_policy" "sops_secrets_operator_kms" {
      + id          = (known after apply)
      + name        = "sops-kms-decrypt"
      + name_prefix = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "kms:Decrypt",
                          + "kms:DescribeKey",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:kms:us-west-2:332355796717:key/0a45c0f6-71dc-4d54-ab33-9df4de1a9e91"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + user        = "sops-secrets-operator"
    }

Plan: 3 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + sops_secrets_operator_access_key   = (sensitive value)
  + sops_secrets_operator_iam_user_arn = (known after apply)