update docs

README.md

@@ -71,6 +71,18 @@ git push
 
 The `variables.auto.tfvars` is there to enable this directory to be used for key rotation with the `rotate-keys.py` script.
 
+## Changes when running plan or apply
+You may see a `tf-plan` and a `tf-apply` inform you of changes to two different resources in a directory where you have used
+this access key enablement:
+
+*   module.NAME.local\_sensitive\_file.access\_key\_file[0]
+*   module.NAME.null\_resource.access\_key\_file\_decrypt\_key[0]
+
+This is because these resources are populated from `data` sources with a `templatefile()`.  As such, it does not know
+the output of the template until run time, so it re-generates that data.  If there are no changes to the key, it will simple
+create these files with the same content as before. This is not harmful, but it is important to understand when you see changes
+in a plan you know you didn't make.
+
 ## Requirements
 
 No requirements.

main.tf

@@ -71,6 +71,18 @@
 * ```
 *
 * The `variables.auto.tfvars` is there to enable this directory to be used for key rotation with the `rotate-keys.py` script.
+*
+* ## Changes when running plan or apply
+* You may see a `tf-plan` and a `tf-apply` inform you of changes to two different resources in a directory where you have used
+* this access key enablement:
+*
+* *   module.NAME.local_sensitive_file.access_key_file[0]
+* *   module.NAME.null_resource.access_key_file_decrypt_key[0]
+*
+* This is because these resources are populated from `data` sources with a `templatefile()`.  As such, it does not know
+* the output of the template until run time, so it re-generates that data.  If there are no changes to the key, it will simple
+* create these files with the same content as before. This is not harmful, but it is important to understand when you see changes
+* in a plan you know you didn't make.
 */
 
 locals {