{
  "tenant"                 : "<contino|squad0>",                     #  selects the tenant to deply into 
  "owner"                  : "<any string>",                         #  requesting users name
  "email"                  : "<valid email @contino.io>",            #  requesting users email - will be used as owner email
  "purpose"                : "ea_testing_s0",                        #  for housekeeping and management
  "alias"                  : "<must be unique subscription alias>",  #  
  "subscription_name"      : "<must be unique repository name>",     #  if not entered, a programmatic name wll be created
  "workload"               : "<Production|DevTest>",                 #  for Contino must be Production for all others DevTest
  "apply_budget"           : true,                                   #  skip adding rhe 60GBP budget
  "github_repository"      : <""|"new"|"<existing>">,                #  if "new" creates new, or specify a repo to use existing
  "github_username"        : "pknw1",                                #  github username to add as a new repo owner
  "github_repo_org"        : "<contino|contino-squad0>",             #  specify the target org for the repo
  "template_repo_org"      : "<contino|contino-squad0|pknw1>",       #  specify the target org for the repo 
  "template_repo"          : "terraform-boilerplate",                # 
  "service_principal_name" : <""|"new"|"<existing>">                 # if "new" creates new, or specify existing sp (must be owner)
  }

{
  "tenant"            : "squad0",

  "owner"             : "paul.kelleher",
  "email"             : "paul.kelleher@contino.io", 
  "purpose"           : "lbg_open_ai",
  "alias"             : "dev",
  "subscription_name" : "squad0_lbg_openai_poc",
  "workload"          : "DevTest",

  "apply_budget"      : true,
  
  "github_repository" : "new",
  "github_username"   : "pknw1",

  "template_repo_org"   : "pknw1",
  "template_repo"       : "terraform-boilerplate",
  "service_principal_name" : "new",
  "enrollment_account" : ""
  }

{
  "tenant"            : "contino",

  "owner"             : "paul.kelleher",
  "email"             : "paul.kelleher@contino.io", 
  "purpose"           : "lbg_open_ai",
  "alias"             : "dev",
  "subscription_name" : "continohq_lbg_openai_poc",
  "workload"          : "Production",

  "apply_budget"      : true,
  
  "github_repository" : "",
  "github_username"   : "",

  "template_repo_org"   : "pknw1",
  "template_repo"       : "terraform-boilerplate",
  "service_principal_name" : "",
  "enrollment_account" : ""
  }

  # module.azurerm_ea_subscription["subscription_name_tag"].azurerm_consumption_budget_subscription.s0[0] will be created
  + resource "azurerm_consumption_budget_subscription" "s0" {
      + amount          = 60
      + etag            = (known after apply)
      + id              = (known after apply)
      + name            = "subscription_name_tag"
      + subscription_id = (known after apply)
      + time_grain      = "Monthly"

      + notification {
          + contact_emails = [
              + "paul.kelleher@contino.io",
            ]
          + contact_groups = []
          + contact_roles  = [
              + "Owner",
            ]
          + enabled        = true
          + operator       = "EqualTo"
          + threshold      = 90
          + threshold_type = "Actual"
        }
      + notification {
          + contact_emails = [
              + "paul.kelleher@contino.io",
            ]
          + contact_groups = []
          + contact_roles  = []
          + enabled        = false
          + operator       = "GreaterThan"
          + threshold      = 100
          + threshold_type = "Forecasted"
        }

      + time_period {
          + end_date   = (known after apply)
          + start_date = (known after apply)
        }
    }

  # module.azurerm_ea_subscription["subscription_name_tag"].azurerm_role_assignment.subscriptiption[0] will be created
  + resource "azurerm_role_assignment" "subscriptiption" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "79ff1f2c-1133-416d-bed5-d8f83fae55f3"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Owner"
      + scope                            = (known after apply)
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.azurerm_ea_subscription["subscription_name_tag"].azurerm_subscription.create_s0[0] will be created
  + resource "azurerm_subscription" "create_s0" {
      + alias             = (known after apply)
      + billing_scope_id  = "/providers/Microsoft.Billing/billingAccounts/87561154/enrollmentAccounts/340292"
      + id                = (known after apply)
      + subscription_id   = (known after apply)
      + subscription_name = "subscription_name_tag"
      + tenant_id         = (known after apply)
      + workload          = "DevTest"
    }

  # module.azurerm_ea_subscription["subscription_name_tag"].module.iac[0].data.azurerm_subscription.create_s0[0] will be read during apply
  # (config refers to values not yet known)
 <= data "azurerm_subscription" "create_s0" {
      + display_name          = (known after apply)
      + id                    = (known after apply)
      + location_placement_id = (known after apply)
      + quota_id              = (known after apply)
      + spending_limit        = (known after apply)
      + state                 = (known after apply)
      + subscription_id       = (known after apply)
      + tags                  = (known after apply)
      + tenant_id             = (known after apply)
    }

  # module.azurerm_ea_subscription["subscription_name_tag"].module.iac[0].data.github_actions_public_key.public_key[0] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "github_actions_public_key" "public_key" {
      + id         = (known after apply)
      + key        = (known after apply)
      + key_id     = (known after apply)
      + repository = "azure_iac_subscription_name_tag"
    }

  # module.azurerm_ea_subscription["subscription_name_tag"].module.iac[0].azuread_application.sp_s0[0] will be created
  + resource "azuread_application" "sp_s0" {
      + app_role_ids                = (known after apply)
      + application_id              = (known after apply)
      + disabled_by_microsoft       = (known after apply)
      + display_name                = (known after apply)
      + id                          = (known after apply)
      + logo_url                    = (known after apply)
      + oauth2_permission_scope_ids = (known after apply)
      + object_id                   = (known after apply)
      + owners                      = [
          + "79ff1f2c-1133-416d-bed5-d8f83fae55f3",
        ]
      + prevent_duplicate_names     = false
      + publisher_domain            = (known after apply)
      + sign_in_audience            = "AzureADMyOrg"
      + tags                        = (known after apply)
      + template_id                 = (known after apply)
    }

  # module.azurerm_ea_subscription["subscription_name_tag"].module.iac[0].azuread_service_principal.sp_s0[0] will be created
  + resource "azuread_service_principal" "sp_s0" {
      + account_enabled              = true
      + app_role_assignment_required = false
      + app_role_ids                 = (known after apply)
      + app_roles                    = (known after apply)
      + application_id               = (known after apply)
      + application_tenant_id        = (known after apply)
      + display_name                 = (known after apply)
      + homepage_url                 = (known after apply)
      + id                           = (known after apply)
      + logout_url                   = (known after apply)
      + oauth2_permission_scope_ids  = (known after apply)
      + oauth2_permission_scopes     = (known after apply)
      + object_id                    = (known after apply)
      + owners                       = [
          + "79ff1f2c-1133-416d-bed5-d8f83fae55f3",
        ]
      + redirect_uris                = (known after apply)
      + saml_metadata_url            = (known after apply)
      + service_principal_names      = (known after apply)
      + sign_in_audience             = (known after apply)
      + tags                         = (known after apply)
      + type                         = (known after apply)
    }

  # module.azurerm_ea_subscription["subscription_name_tag"].module.iac[0].azurerm_role_assignment.subscription_s0[0] will be created
  + resource "azurerm_role_assignment" "subscription_s0" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = (known after apply)
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Owner"
      + scope                            = (known after apply)
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.azurerm_ea_subscription["subscription_name_tag"].module.iac[0].github_actions_secret.ARM_CLIENT_ID[0] will be created
  + resource "github_actions_secret" "ARM_CLIENT_ID" {
      + created_at      = (known after apply)
      + id              = (known after apply)
      + plaintext_value = (sensitive value)
      + repository      = "azure_iac_subscription_name_tag"
      + secret_name     = "ARM_CLIENT_ID"
      + updated_at      = (known after apply)
    }

  # module.azurerm_ea_subscription["subscription_name_tag"].module.iac[0].github_actions_secret.ARM_SUBSCRIPTION_ID[0] will be created
  + resource "github_actions_secret" "ARM_SUBSCRIPTION_ID" {
      + created_at      = (known after apply)
      + id              = (known after apply)
      + plaintext_value = (sensitive value)
      + repository      = "azure_iac_subscription_name_tag"
      + secret_name     = "ARM_SUBSCRIPTION_ID"
      + updated_at      = (known after apply)
    }

  # module.azurerm_ea_subscription["subscription_name_tag"].module.iac[0].github_actions_secret.ARM_TENANT_ID[0] will be created
  + resource "github_actions_secret" "ARM_TENANT_ID" {
      + created_at      = (known after apply)
      + id              = (known after apply)
      + plaintext_value = (sensitive value)
      + repository      = "azure_iac_subscription_name_tag"
      + secret_name     = "ARM_TENANT_ID"
      + updated_at      = (known after apply)
    }

  # module.azurerm_ea_subscription["subscription_name_tag"].module.iac[0].github_actions_secret.org_gh_token[0] will be created
  + resource "github_actions_secret" "org_gh_token" {
      + created_at  = (known after apply)
      + id          = (known after apply)
      + repository  = "azure_iac_subscription_name_tag"
      + secret_name = "org_gh_token"
      + updated_at  = (known after apply)
    }

  # module.azurerm_ea_subscription["subscription_name_tag"].module.iac[0].github_repository.repo[0] will be created
  + resource "github_repository" "repo" {
      + allow_auto_merge            = false
      + allow_merge_commit          = true
      + allow_rebase_merge          = true
      + allow_squash_merge          = true
      + archived                    = false
      + auto_init                   = true
      + default_branch              = (known after apply)
      + delete_branch_on_merge      = false
      + description                 = "Automation repository for subscription_name_tag"
      + etag                        = (known after apply)
      + full_name                   = (known after apply)
      + git_clone_url               = (known after apply)
      + html_url                    = (known after apply)
      + http_clone_url              = (known after apply)
      + id                          = (known after apply)
      + merge_commit_message        = "PR_TITLE"
      + merge_commit_title          = "MERGE_MESSAGE"
      + name                        = "azure_iac_subscription_name_tag"
      + node_id                     = (known after apply)
      + private                     = (known after apply)
      + repo_id                     = (known after apply)
      + squash_merge_commit_message = "COMMIT_MESSAGES"
      + squash_merge_commit_title   = "COMMIT_OR_PR_TITLE"
      + ssh_clone_url               = (known after apply)
      + svn_url                     = (known after apply)
      + visibility                  = "private"

      + template {
          + include_all_branches = false
          + owner                = "pknw1"
          + repository           = "terraform-boilerplate"
        }
    }

  # module.azurerm_ea_subscription["test_subscription_1"].module.iac[0].github_actions_secret.ARM_CLIENT_ID has moved to module.azurerm_ea_subscription["test_subscription_1"].module.iac[0].github_actions_secret.ARM_CLIENT_ID[0]
    resource "github_actions_secret" "ARM_CLIENT_ID" {
        id              = "azure_iac_test_subscription_1:ARM_CLIENT_ID"
        # (5 unchanged attributes hidden)
    }

  # module.azurerm_ea_subscription["test_subscription_1"].module.iac[0].github_actions_secret.ARM_SUBSCRIPTION_ID has moved to module.azurerm_ea_subscription["test_subscription_1"].module.iac[0].github_actions_secret.ARM_SUBSCRIPTION_ID[0]
    resource "github_actions_secret" "ARM_SUBSCRIPTION_ID" {
        id              = "azure_iac_test_subscription_1:ARM_SUBSCRIPTION_ID"
        # (5 unchanged attributes hidden)
    }

  # module.azurerm_ea_subscription["test_subscription_1"].module.iac[0].github_actions_secret.ARM_TENANT_ID has moved to module.azurerm_ea_subscription["test_subscription_1"].module.iac[0].github_actions_secret.ARM_TENANT_ID[0]
    resource "github_actions_secret" "ARM_TENANT_ID" {
        id              = "azure_iac_test_subscription_1:ARM_TENANT_ID"
        # (5 unchanged attributes hidden)
    }

  # module.azurerm_ea_subscription["test_subscription_1"].module.iac[0].github_actions_secret.org_gh_token has moved to module.azurerm_ea_subscription["test_subscription_1"].module.iac[0].github_actions_secret.org_gh_token[0]
    resource "github_actions_secret" "org_gh_token" {
        id          = "azure_iac_test_subscription_1:org_gh_token"
        # (4 unchanged attributes hidden)
    }

Plan: 11 to add, 0 to change, 0 to destroy.

erraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following
symbols:
  + create

Terraform will perform the following actions:

  # module.azurerm_ea_subscription["minimal_options"].azurerm_consumption_budget_subscription.s0[0] will be created
  + resource "azurerm_consumption_budget_subscription" "s0" {
      + amount          = 60
      + etag            = (known after apply)
      + id              = (known after apply)
      + name            = "minimal_options"
      + subscription_id = (known after apply)
      + time_grain      = "Monthly"

      + notification {
          + contact_emails = [
              + "paul.kelleher@contino.io",
            ]
          + contact_groups = []
          + contact_roles  = [
              + "Owner",
            ]
          + enabled        = true
          + operator       = "EqualTo"
          + threshold      = 90
          + threshold_type = "Actual"
        }
      + notification {
          + contact_emails = [
              + "paul.kelleher@contino.io",
            ]
          + contact_groups = []
          + contact_roles  = []
          + enabled        = false
          + operator       = "GreaterThan"
          + threshold      = 100
          + threshold_type = "Forecasted"
        }

      + time_period {
          + end_date   = (known after apply)
          + start_date = (known after apply)
        }
    }

  # module.azurerm_ea_subscription["minimal_options"].azurerm_role_assignment.subscriptiption[0] will be created
  + resource "azurerm_role_assignment" "subscriptiption" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "79ff1f2c-1133-416d-bed5-d8f83fae55f3"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Owner"
      + scope                            = (known after apply)
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.azurerm_ea_subscription["minimal_options"].azurerm_subscription.create_s0[0] will be created
  + resource "azurerm_subscription" "create_s0" {
      + alias             = (known after apply)
      + billing_scope_id  = "/providers/Microsoft.Billing/billingAccounts/87561154/enrollmentAccounts/340292"
      + id                = (known after apply)
      + subscription_id   = (known after apply)
      + subscription_name = "minimal_options"
      + tenant_id         = (known after apply)
      + workload          = "DevTest"
    }