From 74ed0ef10925ed08f3d2e3f7afcae07aea48daef Mon Sep 17 00:00:00 2001
From: Dave Arnold <user@example.com>
Date: Wed, 8 Jul 2026 15:52:25 -0400
Subject: [PATCH] style: replace string interpolation with format() org-wide
 convention

- locals.tf: all resource/log group name expressions
- lambda.tf: path.module archive sources and layer source_path
- sqs.tf: policy_id fields and owner ARN identifiers
- policies.tf: all ARN constructions (iam, lambda, logs, rds-db) and org path
- roles.tf: module source git@ format + role_description strings

Also corrects roles.tf module sources from git::https:// to git@ per
terraform-support naming convention.
---
 lambda.tf   | 14 +++++++-------
 locals.tf   | 38 +++++++++++++++++++-------------------
 policies.tf | 20 ++++++++++----------
 roles.tf    | 12 ++++++------
 sqs.tf      | 12 ++++++------
 5 files changed, 48 insertions(+), 48 deletions(-)

diff --git a/lambda.tf b/lambda.tf
index 8438faa..aca42ca 100644
--- a/lambda.tf
+++ b/lambda.tf
@@ -1,19 +1,19 @@
 data "archive_file" "dispatcher" {
   type        = "zip"
-  source_dir  = "${path.module}/lambda-dispatcher"
-  output_path = "${path.module}/builds/dispatcher.zip"
+  source_dir  = format("%v/lambda-dispatcher", path.module)
+  output_path = format("%v/builds/dispatcher.zip", path.module)
 }
 
 data "archive_file" "step_result" {
   type        = "zip"
-  source_dir  = "${path.module}/lambda-step-result"
-  output_path = "${path.module}/builds/step-result.zip"
+  source_dir  = format("%v/lambda-step-result", path.module)
+  output_path = format("%v/builds/step-result.zip", path.module)
 }
 
 data "archive_file" "worker" {
   type        = "zip"
-  source_dir  = "${path.module}/lambda-worker"
-  output_path = "${path.module}/builds/worker.zip"
+  source_dir  = format("%v/lambda-worker", path.module)
+  output_path = format("%v/builds/worker.zip", path.module)
 }
 
 module "lambda_layer" {
@@ -30,7 +30,7 @@ module "lambda_layer" {
 
   source_path = [
     {
-      path             = "${path.module}/lambda-layer"
+      path             = format("%v/lambda-layer", path.module)
       pip_requirements = true
       prefix_in_zip    = "python"
     }
diff --git a/locals.tf b/locals.tf
index 36c6e81..64d1cf7 100644
--- a/locals.tf
+++ b/locals.tf
@@ -8,33 +8,33 @@ locals {
   tags_iam        = merge(module.tags.tags, module.tags.finops_roles["iam"])
 
   # ─── Resource Names ─────────────────────────────────────────────────────────
-  lambda_dispatcher_name  = "${var.name_prefix}-dispatcher"
-  lambda_step_result_name = "${var.name_prefix}-step-result"
-  lambda_worker_name      = "${var.name_prefix}-worker-lambda"
-  lambda_layer_name       = "${var.name_prefix}-layer-v1"
+  lambda_dispatcher_name  = format("%v-dispatcher", var.name_prefix)
+  lambda_step_result_name = format("%v-step-result", var.name_prefix)
+  lambda_worker_name      = format("%v-worker-lambda", var.name_prefix)
+  lambda_layer_name       = format("%v-layer-v1", var.name_prefix)
 
-  sqs_dispatch_lambda_name           = "${var.name_prefix}-dispatch-lambda"
-  sqs_dispatch_remote_execution_name = "${var.name_prefix}-dispatch-remote-execution"
-  sqs_results_name                   = "${var.name_prefix}-results"
+  sqs_dispatch_lambda_name           = format("%v-dispatch-lambda", var.name_prefix)
+  sqs_dispatch_remote_execution_name = format("%v-dispatch-remote-execution", var.name_prefix)
+  sqs_results_name                   = format("%v-results", var.name_prefix)
 
   db_cluster_name  = var.name_prefix
-  db_instance_name = "${var.name_prefix}-instance-1"
-  db_name          = replace("${var.name_prefix}_db", "-", "_")
-  db_user_name     = "${replace(var.name_prefix, "-", "")}lambda_iam"
+  db_instance_name = format("%v-instance-1", var.name_prefix)
+  db_name          = replace(format("%v_db", var.name_prefix), "-", "_")
+  db_user_name     = format("%vlambda_iam", replace(var.name_prefix, "-", ""))
 
-  kms_alias_name = "k-kms-${var.name_prefix}"
+  kms_alias_name = format("k-kms-%v", var.name_prefix)
 
   patch_role_name           = var.name_prefix
-  patch_execution_role_name = "${var.name_prefix}-execution"
-  patch_execproxy_role_name = "${var.name_prefix}-execproxy"
+  patch_execution_role_name = format("%v-execution", var.name_prefix)
+  patch_execproxy_role_name = format("%v-execproxy", var.name_prefix)
 
-  patch_policy_name           = "p-${var.name_prefix}"
-  patch_execution_policy_name = "p-${var.name_prefix}-execution"
-  patch_execproxy_policy_name = "p-${var.name_prefix}-execproxy"
+  patch_policy_name           = format("p-%v", var.name_prefix)
+  patch_execution_policy_name = format("p-%v-execution", var.name_prefix)
+  patch_execproxy_policy_name = format("p-%v-execproxy", var.name_prefix)
 
-  log_group_dispatcher  = "/aws/lambda/${local.lambda_dispatcher_name}"
-  log_group_step_result = "/aws/lambda/${local.lambda_step_result_name}"
-  log_group_worker      = "/aws/lambda/${local.lambda_worker_name}"
+  log_group_dispatcher  = format("/aws/lambda/%v", local.lambda_dispatcher_name)
+  log_group_step_result = format("/aws/lambda/%v", local.lambda_step_result_name)
+  log_group_worker      = format("/aws/lambda/%v", local.lambda_worker_name)
 
   # ─── ARN helpers ────────────────────────────────────────────────────────────
   partition  = data.aws_partition.current.partition
diff --git a/policies.tf b/policies.tf
index 4c317f8..66cbfc5 100644
--- a/policies.tf
+++ b/policies.tf
@@ -7,17 +7,17 @@ data "aws_iam_policy_document" "patch_role_assume" {
     actions = ["sts:AssumeRole"]
     principals {
       type        = "AWS"
-      identifiers = ["arn:${local.partition}:iam::${local.account_id}:root"]
+      identifiers = [format("arn:%v:iam::%v:root", local.partition, local.account_id)]
     }
     condition {
       test     = "ArnLike"
       variable = "aws:PrincipalArn"
-      values   = ["arn:${local.partition}:iam::${local.account_id}:role/${local.patch_execution_role_name}"]
+      values   = [format("arn:%v:iam::%v:role/%v", local.partition, local.account_id, local.patch_execution_role_name)]
     }
     condition {
       test     = "ForAnyValue:StringLike"
       variable = "aws:PrincipalOrgPaths"
-      values   = ["${data.aws_organizations_organization.org.id}/*"]
+      values   = [format("%v/*", data.aws_organizations_organization.org.id)]
     }
   }
 }
@@ -36,7 +36,7 @@ data "aws_iam_policy_document" "patch_execution_role_assume" {
     actions = ["sts:AssumeRole"]
     principals {
       type        = "AWS"
-      identifiers = ["arn:${local.partition}:iam::${local.account_id}:role/${local.patch_execproxy_role_name}"]
+      identifiers = [format("arn:%v:iam::%v:role/%v", local.partition, local.account_id, local.patch_execproxy_role_name)]
     }
   }
 }
@@ -94,9 +94,9 @@ data "aws_iam_policy_document" "patch_execution_role" {
     effect  = "Allow"
     actions = ["lambda:InvokeFunction"]
     resources = [
-      "arn:${local.partition}:lambda:${local.region}:${local.account_id}:function/${local.lambda_dispatcher_name}",
-      "arn:${local.partition}:lambda:${local.region}:${local.account_id}:function/${local.lambda_worker_name}",
-      "arn:${local.partition}:lambda:${local.region}:${local.account_id}:function/${local.lambda_step_result_name}",
+      format("arn:%v:lambda:%v:%v:function/%v", local.partition, local.region, local.account_id, local.lambda_dispatcher_name),
+      format("arn:%v:lambda:%v:%v:function/%v", local.partition, local.region, local.account_id, local.lambda_worker_name),
+      format("arn:%v:lambda:%v:%v:function/%v", local.partition, local.region, local.account_id, local.lambda_step_result_name),
     ]
   }
   statement {
@@ -109,7 +109,7 @@ data "aws_iam_policy_document" "patch_execution_role" {
     ]
     # Scoped to log groups owned by this module
     resources = [
-      "arn:${local.partition}:logs:${local.region}:${local.account_id}:log-group:/aws/lambda/${var.name_prefix}*",
+      format("arn:%v:logs:%v:%v:log-group:/aws/lambda/%v*", local.partition, local.region, local.account_id, var.name_prefix),
     ]
   }
   statement {
@@ -149,7 +149,7 @@ data "aws_iam_policy_document" "patch_execution_role" {
     effect  = "Allow"
     actions = ["rds-db:connect"]
     resources = [
-      "arn:${local.partition}:rds-db:${local.region}:${local.account_id}:dbuser:cluster-*/${local.db_user_name}",
+      format("arn:%v:rds-db:%v:%v:dbuser:cluster-*/%v", local.partition, local.region, local.account_id, local.db_user_name),
     ]
   }
 }
@@ -160,7 +160,7 @@ data "aws_iam_policy_document" "patch_execproxy_role" {
     effect  = "Allow"
     actions = ["rds-db:connect"]
     resources = [
-      "arn:${local.partition}:rds-db:${local.region}:${local.account_id}:dbuser:cluster-*/${local.db_user_name}",
+      format("arn:%v:rds-db:%v:%v:dbuser:cluster-*/%v", local.partition, local.region, local.account_id, local.db_user_name),
     ]
   }
   statement {
diff --git a/roles.tf b/roles.tf
index 53f17a5..aeccc9d 100644
--- a/roles.tf
+++ b/roles.tf
@@ -1,9 +1,9 @@
 # patch_role — assumed by patch_execution_role to perform EC2 operations in target accounts
 module "patch_role" {
-  source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade"
+  source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade"
 
   role_name              = local.patch_role_name
-  role_description       = "Assumed by ${local.patch_execution_role_name} to execute patching operations on EC2 instances in target accounts"
+  role_description       = format("Assumed by %v to execute patching operations on EC2 instances in target accounts", local.patch_execution_role_name)
   assume_policy_document = data.aws_iam_policy_document.patch_role_assume.json
   attached_policies      = [aws_iam_policy.patch_role.arn]
 
@@ -12,10 +12,10 @@ module "patch_role" {
 
 # patch_execution_role — assumed by Lambda functions to orchestrate patching
 module "patch_execution_role" {
-  source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade"
+  source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade"
 
   role_name              = local.patch_execution_role_name
-  role_description       = "Assumed by Lambda functions to invoke patch operations, access SQS/RDS, and assume ${local.patch_role_name} in target accounts"
+  role_description       = format("Assumed by Lambda functions to invoke patch operations, access SQS/RDS, and assume %v in target accounts", local.patch_role_name)
   assume_policy_document = data.aws_iam_policy_document.patch_execution_role_assume.json
   attached_policies      = [aws_iam_policy.patch_execution_role.arn]
 
@@ -26,10 +26,10 @@ module "patch_execution_role" {
 # This instance profile is used by the EC2 host running p4proxy to authenticate
 # to RDS via IAM and to assume patch_execution_role for orchestration tasks.
 module "patch_execproxy_role" {
-  source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade"
+  source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade"
 
   role_name               = local.patch_execproxy_role_name
-  role_description        = "Applied to the EC2 host running p4proxy; allows RDS IAM auth and assumption of ${local.patch_execution_role_name}"
+  role_description        = format("Applied to the EC2 host running p4proxy; allows RDS IAM auth and assumption of %v", local.patch_execution_role_name)
   assume_policy_document  = data.aws_iam_policy_document.patch_execproxy_role_assume.json
   attached_policies       = [aws_iam_policy.patch_execproxy_role.arn]
   enable_instance_profile = true
diff --git a/sqs.tf b/sqs.tf
index 0f9874d..cc79761 100644
--- a/sqs.tf
+++ b/sqs.tf
@@ -3,7 +3,7 @@
 # policy_id and sid are set explicitly per review feedback.
 
 data "aws_iam_policy_document" "sqs_dispatch_lambda" {
-  policy_id = "${local.sqs_dispatch_lambda_name}-policy"
+  policy_id = format("%v-policy", local.sqs_dispatch_lambda_name)
 
   statement {
     sid     = "AllowAccountOwnerFullAccess"
@@ -12,7 +12,7 @@ data "aws_iam_policy_document" "sqs_dispatch_lambda" {
 
     principals {
       type        = "AWS"
-      identifiers = ["arn:${local.partition}:iam::${local.account_id}:root"]
+      identifiers = [format("arn:%v:iam::%v:root", local.partition, local.account_id)]
     }
 
     resources = [aws_sqs_queue.dispatch_lambda.arn]
@@ -20,7 +20,7 @@ data "aws_iam_policy_document" "sqs_dispatch_lambda" {
 }
 
 data "aws_iam_policy_document" "sqs_dispatch_remote_execution" {
-  policy_id = "${local.sqs_dispatch_remote_execution_name}-policy"
+  policy_id = format("%v-policy", local.sqs_dispatch_remote_execution_name)
 
   statement {
     sid     = "AllowAccountOwnerFullAccess"
@@ -29,7 +29,7 @@ data "aws_iam_policy_document" "sqs_dispatch_remote_execution" {
 
     principals {
       type        = "AWS"
-      identifiers = ["arn:${local.partition}:iam::${local.account_id}:root"]
+      identifiers = [format("arn:%v:iam::%v:root", local.partition, local.account_id)]
     }
 
     resources = [aws_sqs_queue.dispatch_remote_execution.arn]
@@ -37,7 +37,7 @@ data "aws_iam_policy_document" "sqs_dispatch_remote_execution" {
 }
 
 data "aws_iam_policy_document" "sqs_results" {
-  policy_id = "${local.sqs_results_name}-policy"
+  policy_id = format("%v-policy", local.sqs_results_name)
 
   statement {
     sid     = "AllowAccountOwnerFullAccess"
@@ -46,7 +46,7 @@ data "aws_iam_policy_document" "sqs_results" {
 
     principals {
       type        = "AWS"
-      identifiers = ["arn:${local.partition}:iam::${local.account_id}:root"]
+      identifiers = [format("arn:%v:iam::%v:root", local.partition, local.account_id)]
     }
 
     resources = [aws_sqs_queue.results.arn]