From 3480bc5d60731c4747b973132e447201ff48540d Mon Sep 17 00:00:00 2001
From: Cola Chen <6825116+colachg@users.noreply.github.com>
Date: Thu, 23 Jul 2026 17:12:48 +0900
Subject: [PATCH 1/2] fix: expose selected output attributes to avoid
 deprecated source warnings

Terraform 1.12+ with AWS provider v6 emits 'Value derived from a
deprecated source' warnings for every module output that exports a whole
aws_iam_role (managed_policy_arns is deprecated) or aws_s3_bucket (acl,
policy, website_*, acceleration_status, request_payer are deprecated)
resource.

Replace whole-resource role and bucket outputs with explicit attribute
objects (id, arn, name for roles; id, arn, bucket, region for the
distribution bucket). All internal consumers only read these attributes.

Fixes #5159
---
 modules/ami-housekeeper/outputs.tf        |  8 +++++++-
 modules/lambda/outputs.tf                 |  8 +++++++-
 modules/runner-binaries-syncer/outputs.tf | 17 +++++++++++++++--
 modules/runners/outputs.tf                | 20 +++++++++++++++++---
 modules/runners/pool/outputs.tf           |  8 +++++++-
 modules/webhook/direct/outputs.tf         |  8 +++++++-
 modules/webhook/eventbridge/outputs.tf    | 14 ++++++++++++--
 7 files changed, 72 insertions(+), 11 deletions(-)

diff --git a/modules/ami-housekeeper/outputs.tf b/modules/ami-housekeeper/outputs.tf
index 8fcd7f4e5e..bdda99417b 100644
--- a/modules/ami-housekeeper/outputs.tf
+++ b/modules/ami-housekeeper/outputs.tf
@@ -6,6 +6,12 @@ output "lambda_log_group" {
   value = aws_cloudwatch_log_group.ami_housekeeper
 }
 
+# Expose selected role attributes instead of the whole resource to avoid
+# "Value derived from a deprecated source" warnings (managed_policy_arns).
 output "lambda_role" {
-  value = aws_iam_role.ami_housekeeper
+  value = {
+    id   = aws_iam_role.ami_housekeeper.id
+    arn  = aws_iam_role.ami_housekeeper.arn
+    name = aws_iam_role.ami_housekeeper.name
+  }
 }
diff --git a/modules/lambda/outputs.tf b/modules/lambda/outputs.tf
index a4704e66f9..2ac14aaf15 100644
--- a/modules/lambda/outputs.tf
+++ b/modules/lambda/outputs.tf
@@ -2,6 +2,12 @@ output "lambda" {
   value = {
     function  = aws_lambda_function.main
     log_group = aws_cloudwatch_log_group.main
-    role      = aws_iam_role.main
+    # Expose selected role attributes instead of the whole resource to avoid
+    # "Value derived from a deprecated source" warnings (managed_policy_arns).
+    role = {
+      id   = aws_iam_role.main.id
+      arn  = aws_iam_role.main.arn
+      name = aws_iam_role.main.name
+    }
   }
 }
diff --git a/modules/runner-binaries-syncer/outputs.tf b/modules/runner-binaries-syncer/outputs.tf
index 09dd0ad58f..1bbd338543 100644
--- a/modules/runner-binaries-syncer/outputs.tf
+++ b/modules/runner-binaries-syncer/outputs.tf
@@ -1,5 +1,12 @@
+# Expose selected bucket attributes instead of the whole resource to avoid
+# "Value derived from a deprecated source" warnings (acl, policy, website_*, ...).
 output "bucket" {
-  value = aws_s3_bucket.action_dist
+  value = {
+    id     = aws_s3_bucket.action_dist.id
+    arn    = aws_s3_bucket.action_dist.arn
+    bucket = aws_s3_bucket.action_dist.bucket
+    region = aws_s3_bucket.action_dist.region
+  }
 }
 
 output "runner_distribution_object_key" {
@@ -14,6 +21,12 @@ output "lambda_log_group" {
   value = aws_cloudwatch_log_group.syncer
 }
 
+# Expose selected role attributes instead of the whole resource to avoid
+# "Value derived from a deprecated source" warnings (managed_policy_arns).
 output "lambda_role" {
-  value = aws_iam_role.syncer_lambda
+  value = {
+    id   = aws_iam_role.syncer_lambda.id
+    arn  = aws_iam_role.syncer_lambda.arn
+    name = aws_iam_role.syncer_lambda.name
+  }
 }
diff --git a/modules/runners/outputs.tf b/modules/runners/outputs.tf
index 8f366dce90..f2398070dd 100644
--- a/modules/runners/outputs.tf
+++ b/modules/runners/outputs.tf
@@ -2,8 +2,14 @@ output "launch_template" {
   value = aws_launch_template.runner
 }
 
+# Role outputs expose selected attributes instead of the whole resource to
+# avoid "Value derived from a deprecated source" warnings (managed_policy_arns).
 output "role_runner" {
-  value = aws_iam_role.runner
+  value = [for role in aws_iam_role.runner : {
+    id   = role.id
+    arn  = role.arn
+    name = role.name
+  }]
 }
 
 output "lambda_scale_up" {
@@ -15,7 +21,11 @@ output "lambda_scale_up_log_group" {
 }
 
 output "role_scale_up" {
-  value = aws_iam_role.scale_up
+  value = {
+    id   = aws_iam_role.scale_up.id
+    arn  = aws_iam_role.scale_up.arn
+    name = aws_iam_role.scale_up.name
+  }
 }
 
 output "lambda_scale_down" {
@@ -27,7 +37,11 @@ output "lambda_scale_down_log_group" {
 }
 
 output "role_scale_down" {
-  value = aws_iam_role.scale_down
+  value = {
+    id   = aws_iam_role.scale_down.id
+    arn  = aws_iam_role.scale_down.arn
+    name = aws_iam_role.scale_down.name
+  }
 }
 
 output "lambda_pool" {
diff --git a/modules/runners/pool/outputs.tf b/modules/runners/pool/outputs.tf
index 7a4d70ca9f..925d59dbb5 100644
--- a/modules/runners/pool/outputs.tf
+++ b/modules/runners/pool/outputs.tf
@@ -1,5 +1,11 @@
+# Expose selected role attributes instead of the whole resource to avoid
+# "Value derived from a deprecated source" warnings (managed_policy_arns).
 output "role_pool" {
-  value = aws_iam_role.pool
+  value = {
+    id   = aws_iam_role.pool.id
+    arn  = aws_iam_role.pool.arn
+    name = aws_iam_role.pool.name
+  }
 }
 
 output "lambda" {
diff --git a/modules/webhook/direct/outputs.tf b/modules/webhook/direct/outputs.tf
index 891821c727..d8b48c28ae 100644
--- a/modules/webhook/direct/outputs.tf
+++ b/modules/webhook/direct/outputs.tf
@@ -7,6 +7,12 @@ output "webhook" {
   value = {
     lambda    = aws_lambda_function.webhook
     log_group = aws_cloudwatch_log_group.webhook
-    role      = aws_iam_role.webhook_lambda
+    # Expose selected role attributes instead of the whole resource to avoid
+    # "Value derived from a deprecated source" warnings (managed_policy_arns).
+    role = {
+      id   = aws_iam_role.webhook_lambda.id
+      arn  = aws_iam_role.webhook_lambda.arn
+      name = aws_iam_role.webhook_lambda.name
+    }
   }
 }
diff --git a/modules/webhook/eventbridge/outputs.tf b/modules/webhook/eventbridge/outputs.tf
index 3f7c4fde1d..172d5c611f 100644
--- a/modules/webhook/eventbridge/outputs.tf
+++ b/modules/webhook/eventbridge/outputs.tf
@@ -9,7 +9,13 @@ output "webhook" {
   value = {
     lambda    = aws_lambda_function.webhook
     log_group = aws_cloudwatch_log_group.webhook
-    role      = aws_iam_role.webhook_lambda
+    # Expose selected role attributes instead of the whole resource to avoid
+    # "Value derived from a deprecated source" warnings (managed_policy_arns).
+    role = {
+      id   = aws_iam_role.webhook_lambda.id
+      arn  = aws_iam_role.webhook_lambda.arn
+      name = aws_iam_role.webhook_lambda.name
+    }
   }
 }
 
@@ -17,6 +23,10 @@ output "dispatcher" {
   value = {
     lambda    = aws_lambda_function.dispatcher
     log_group = aws_cloudwatch_log_group.dispatcher
-    role      = aws_iam_role.dispatcher_lambda
+    role = {
+      id   = aws_iam_role.dispatcher_lambda.id
+      arn  = aws_iam_role.dispatcher_lambda.arn
+      name = aws_iam_role.dispatcher_lambda.name
+    }
   }
 }

From 08017e7e2b1fbdd5faceec8fe124e0fadcfc0955 Mon Sep 17 00:00:00 2001
From: Cola Chen <6825116+colachg@users.noreply.github.com>
Date: Mon, 27 Jul 2026 09:36:08 +0900
Subject: [PATCH 2/2] fix: keep full output contract when avoiding deprecated
 source warnings

Instead of exposing only id/arn/name, list every non-deprecated attribute of
aws_iam_role and aws_s3_bucket so existing consumers of these module outputs
keep working. Only the attributes that trigger "Value derived from a deprecated
source" warnings are dropped:

- aws_iam_role: managed_policy_arns, inline_policy
- aws_s3_bucket: acceleration_status, acl, policy, request_payer,
  website_domain, website_endpoint, cors_rule, grant, lifecycle_rule, logging,
  object_lock_configuration, replication_configuration,
  server_side_encryption_configuration, versioning, website

Attribute lists are taken from the provider schema at the modules' minimum
supported version (aws 6.21), so bucket_namespace is intentionally excluded.
---
 modules/ami-housekeeper/outputs.tf        | 22 +++++++--
 modules/lambda/outputs.tf                 | 22 +++++++--
 modules/runner-binaries-syncer/outputs.tf | 48 ++++++++++++++-----
 modules/runners/outputs.tf                | 56 ++++++++++++++++++-----
 modules/runners/pool/outputs.tf           | 22 +++++++--
 modules/webhook/direct/outputs.tf         | 22 +++++++--
 modules/webhook/eventbridge/outputs.tf    | 39 ++++++++++++----
 7 files changed, 181 insertions(+), 50 deletions(-)

diff --git a/modules/ami-housekeeper/outputs.tf b/modules/ami-housekeeper/outputs.tf
index bdda99417b..a368c22107 100644
--- a/modules/ami-housekeeper/outputs.tf
+++ b/modules/ami-housekeeper/outputs.tf
@@ -6,12 +6,24 @@ output "lambda_log_group" {
   value = aws_cloudwatch_log_group.ami_housekeeper
 }
 
-# Expose selected role attributes instead of the whole resource to avoid
-# "Value derived from a deprecated source" warnings (managed_policy_arns).
+# List all non-deprecated role attributes instead of the whole resource to avoid
+# "Value derived from a deprecated source" warnings. Only the deprecated
+# `managed_policy_arns` and `inline_policy` are omitted.
 output "lambda_role" {
   value = {
-    id   = aws_iam_role.ami_housekeeper.id
-    arn  = aws_iam_role.ami_housekeeper.arn
-    name = aws_iam_role.ami_housekeeper.name
+    arn                   = aws_iam_role.ami_housekeeper.arn
+    assume_role_policy    = aws_iam_role.ami_housekeeper.assume_role_policy
+    create_date           = aws_iam_role.ami_housekeeper.create_date
+    description           = aws_iam_role.ami_housekeeper.description
+    force_detach_policies = aws_iam_role.ami_housekeeper.force_detach_policies
+    id                    = aws_iam_role.ami_housekeeper.id
+    max_session_duration  = aws_iam_role.ami_housekeeper.max_session_duration
+    name                  = aws_iam_role.ami_housekeeper.name
+    name_prefix           = aws_iam_role.ami_housekeeper.name_prefix
+    path                  = aws_iam_role.ami_housekeeper.path
+    permissions_boundary  = aws_iam_role.ami_housekeeper.permissions_boundary
+    tags                  = aws_iam_role.ami_housekeeper.tags
+    tags_all              = aws_iam_role.ami_housekeeper.tags_all
+    unique_id             = aws_iam_role.ami_housekeeper.unique_id
   }
 }
diff --git a/modules/lambda/outputs.tf b/modules/lambda/outputs.tf
index 2ac14aaf15..021c60d69b 100644
--- a/modules/lambda/outputs.tf
+++ b/modules/lambda/outputs.tf
@@ -2,12 +2,24 @@ output "lambda" {
   value = {
     function  = aws_lambda_function.main
     log_group = aws_cloudwatch_log_group.main
-    # Expose selected role attributes instead of the whole resource to avoid
-    # "Value derived from a deprecated source" warnings (managed_policy_arns).
+    # List all non-deprecated role attributes instead of the whole resource to
+    # avoid "Value derived from a deprecated source" warnings. Only the deprecated
+    # `managed_policy_arns` and `inline_policy` are omitted.
     role = {
-      id   = aws_iam_role.main.id
-      arn  = aws_iam_role.main.arn
-      name = aws_iam_role.main.name
+      arn                   = aws_iam_role.main.arn
+      assume_role_policy    = aws_iam_role.main.assume_role_policy
+      create_date           = aws_iam_role.main.create_date
+      description           = aws_iam_role.main.description
+      force_detach_policies = aws_iam_role.main.force_detach_policies
+      id                    = aws_iam_role.main.id
+      max_session_duration  = aws_iam_role.main.max_session_duration
+      name                  = aws_iam_role.main.name
+      name_prefix           = aws_iam_role.main.name_prefix
+      path                  = aws_iam_role.main.path
+      permissions_boundary  = aws_iam_role.main.permissions_boundary
+      tags                  = aws_iam_role.main.tags
+      tags_all              = aws_iam_role.main.tags_all
+      unique_id             = aws_iam_role.main.unique_id
     }
   }
 }
diff --git a/modules/runner-binaries-syncer/outputs.tf b/modules/runner-binaries-syncer/outputs.tf
index 1bbd338543..10d934f932 100644
--- a/modules/runner-binaries-syncer/outputs.tf
+++ b/modules/runner-binaries-syncer/outputs.tf
@@ -1,11 +1,25 @@
-# Expose selected bucket attributes instead of the whole resource to avoid
-# "Value derived from a deprecated source" warnings (acl, policy, website_*, ...).
+# List all non-deprecated bucket attributes instead of the whole resource to avoid
+# "Value derived from a deprecated source" warnings. Only the deprecated
+# `acceleration_status`, `acl`, `policy`, `request_payer`, `website_domain`,
+# `website_endpoint` and the deprecated nested blocks (`cors_rule`, `grant`,
+# `lifecycle_rule`, `logging`, `object_lock_configuration`,
+# `replication_configuration`, `server_side_encryption_configuration`,
+# `versioning`, `website`) are omitted.
 output "bucket" {
   value = {
-    id     = aws_s3_bucket.action_dist.id
-    arn    = aws_s3_bucket.action_dist.arn
-    bucket = aws_s3_bucket.action_dist.bucket
-    region = aws_s3_bucket.action_dist.region
+    arn                         = aws_s3_bucket.action_dist.arn
+    bucket                      = aws_s3_bucket.action_dist.bucket
+    bucket_domain_name          = aws_s3_bucket.action_dist.bucket_domain_name
+    bucket_prefix               = aws_s3_bucket.action_dist.bucket_prefix
+    bucket_region               = aws_s3_bucket.action_dist.bucket_region
+    bucket_regional_domain_name = aws_s3_bucket.action_dist.bucket_regional_domain_name
+    force_destroy               = aws_s3_bucket.action_dist.force_destroy
+    hosted_zone_id              = aws_s3_bucket.action_dist.hosted_zone_id
+    id                          = aws_s3_bucket.action_dist.id
+    object_lock_enabled         = aws_s3_bucket.action_dist.object_lock_enabled
+    region                      = aws_s3_bucket.action_dist.region
+    tags                        = aws_s3_bucket.action_dist.tags
+    tags_all                    = aws_s3_bucket.action_dist.tags_all
   }
 }
 
@@ -21,12 +35,24 @@ output "lambda_log_group" {
   value = aws_cloudwatch_log_group.syncer
 }
 
-# Expose selected role attributes instead of the whole resource to avoid
-# "Value derived from a deprecated source" warnings (managed_policy_arns).
+# List all non-deprecated role attributes instead of the whole resource to avoid
+# "Value derived from a deprecated source" warnings. Only the deprecated
+# `managed_policy_arns` and `inline_policy` are omitted.
 output "lambda_role" {
   value = {
-    id   = aws_iam_role.syncer_lambda.id
-    arn  = aws_iam_role.syncer_lambda.arn
-    name = aws_iam_role.syncer_lambda.name
+    arn                   = aws_iam_role.syncer_lambda.arn
+    assume_role_policy    = aws_iam_role.syncer_lambda.assume_role_policy
+    create_date           = aws_iam_role.syncer_lambda.create_date
+    description           = aws_iam_role.syncer_lambda.description
+    force_detach_policies = aws_iam_role.syncer_lambda.force_detach_policies
+    id                    = aws_iam_role.syncer_lambda.id
+    max_session_duration  = aws_iam_role.syncer_lambda.max_session_duration
+    name                  = aws_iam_role.syncer_lambda.name
+    name_prefix           = aws_iam_role.syncer_lambda.name_prefix
+    path                  = aws_iam_role.syncer_lambda.path
+    permissions_boundary  = aws_iam_role.syncer_lambda.permissions_boundary
+    tags                  = aws_iam_role.syncer_lambda.tags
+    tags_all              = aws_iam_role.syncer_lambda.tags_all
+    unique_id             = aws_iam_role.syncer_lambda.unique_id
   }
 }
diff --git a/modules/runners/outputs.tf b/modules/runners/outputs.tf
index f2398070dd..c2286c2241 100644
--- a/modules/runners/outputs.tf
+++ b/modules/runners/outputs.tf
@@ -2,13 +2,25 @@ output "launch_template" {
   value = aws_launch_template.runner
 }
 
-# Role outputs expose selected attributes instead of the whole resource to
-# avoid "Value derived from a deprecated source" warnings (managed_policy_arns).
+# Role outputs list all non-deprecated attributes instead of the whole resource
+# to avoid "Value derived from a deprecated source" warnings. Only the deprecated
+# `managed_policy_arns` and `inline_policy` are omitted.
 output "role_runner" {
   value = [for role in aws_iam_role.runner : {
-    id   = role.id
-    arn  = role.arn
-    name = role.name
+    arn                   = role.arn
+    assume_role_policy    = role.assume_role_policy
+    create_date           = role.create_date
+    description           = role.description
+    force_detach_policies = role.force_detach_policies
+    id                    = role.id
+    max_session_duration  = role.max_session_duration
+    name                  = role.name
+    name_prefix           = role.name_prefix
+    path                  = role.path
+    permissions_boundary  = role.permissions_boundary
+    tags                  = role.tags
+    tags_all              = role.tags_all
+    unique_id             = role.unique_id
   }]
 }
 
@@ -22,9 +34,20 @@ output "lambda_scale_up_log_group" {
 
 output "role_scale_up" {
   value = {
-    id   = aws_iam_role.scale_up.id
-    arn  = aws_iam_role.scale_up.arn
-    name = aws_iam_role.scale_up.name
+    arn                   = aws_iam_role.scale_up.arn
+    assume_role_policy    = aws_iam_role.scale_up.assume_role_policy
+    create_date           = aws_iam_role.scale_up.create_date
+    description           = aws_iam_role.scale_up.description
+    force_detach_policies = aws_iam_role.scale_up.force_detach_policies
+    id                    = aws_iam_role.scale_up.id
+    max_session_duration  = aws_iam_role.scale_up.max_session_duration
+    name                  = aws_iam_role.scale_up.name
+    name_prefix           = aws_iam_role.scale_up.name_prefix
+    path                  = aws_iam_role.scale_up.path
+    permissions_boundary  = aws_iam_role.scale_up.permissions_boundary
+    tags                  = aws_iam_role.scale_up.tags
+    tags_all              = aws_iam_role.scale_up.tags_all
+    unique_id             = aws_iam_role.scale_up.unique_id
   }
 }
 
@@ -38,9 +61,20 @@ output "lambda_scale_down_log_group" {
 
 output "role_scale_down" {
   value = {
-    id   = aws_iam_role.scale_down.id
-    arn  = aws_iam_role.scale_down.arn
-    name = aws_iam_role.scale_down.name
+    arn                   = aws_iam_role.scale_down.arn
+    assume_role_policy    = aws_iam_role.scale_down.assume_role_policy
+    create_date           = aws_iam_role.scale_down.create_date
+    description           = aws_iam_role.scale_down.description
+    force_detach_policies = aws_iam_role.scale_down.force_detach_policies
+    id                    = aws_iam_role.scale_down.id
+    max_session_duration  = aws_iam_role.scale_down.max_session_duration
+    name                  = aws_iam_role.scale_down.name
+    name_prefix           = aws_iam_role.scale_down.name_prefix
+    path                  = aws_iam_role.scale_down.path
+    permissions_boundary  = aws_iam_role.scale_down.permissions_boundary
+    tags                  = aws_iam_role.scale_down.tags
+    tags_all              = aws_iam_role.scale_down.tags_all
+    unique_id             = aws_iam_role.scale_down.unique_id
   }
 }
 
diff --git a/modules/runners/pool/outputs.tf b/modules/runners/pool/outputs.tf
index 925d59dbb5..531610b751 100644
--- a/modules/runners/pool/outputs.tf
+++ b/modules/runners/pool/outputs.tf
@@ -1,10 +1,22 @@
-# Expose selected role attributes instead of the whole resource to avoid
-# "Value derived from a deprecated source" warnings (managed_policy_arns).
+# List all non-deprecated role attributes instead of the whole resource to avoid
+# "Value derived from a deprecated source" warnings. Only the deprecated
+# `managed_policy_arns` and `inline_policy` are omitted.
 output "role_pool" {
   value = {
-    id   = aws_iam_role.pool.id
-    arn  = aws_iam_role.pool.arn
-    name = aws_iam_role.pool.name
+    arn                   = aws_iam_role.pool.arn
+    assume_role_policy    = aws_iam_role.pool.assume_role_policy
+    create_date           = aws_iam_role.pool.create_date
+    description           = aws_iam_role.pool.description
+    force_detach_policies = aws_iam_role.pool.force_detach_policies
+    id                    = aws_iam_role.pool.id
+    max_session_duration  = aws_iam_role.pool.max_session_duration
+    name                  = aws_iam_role.pool.name
+    name_prefix           = aws_iam_role.pool.name_prefix
+    path                  = aws_iam_role.pool.path
+    permissions_boundary  = aws_iam_role.pool.permissions_boundary
+    tags                  = aws_iam_role.pool.tags
+    tags_all              = aws_iam_role.pool.tags_all
+    unique_id             = aws_iam_role.pool.unique_id
   }
 }
 
diff --git a/modules/webhook/direct/outputs.tf b/modules/webhook/direct/outputs.tf
index d8b48c28ae..d423786741 100644
--- a/modules/webhook/direct/outputs.tf
+++ b/modules/webhook/direct/outputs.tf
@@ -7,12 +7,24 @@ output "webhook" {
   value = {
     lambda    = aws_lambda_function.webhook
     log_group = aws_cloudwatch_log_group.webhook
-    # Expose selected role attributes instead of the whole resource to avoid
-    # "Value derived from a deprecated source" warnings (managed_policy_arns).
+    # List all non-deprecated role attributes instead of the whole resource to
+    # avoid "Value derived from a deprecated source" warnings. Only the deprecated
+    # `managed_policy_arns` and `inline_policy` are omitted.
     role = {
-      id   = aws_iam_role.webhook_lambda.id
-      arn  = aws_iam_role.webhook_lambda.arn
-      name = aws_iam_role.webhook_lambda.name
+      arn                   = aws_iam_role.webhook_lambda.arn
+      assume_role_policy    = aws_iam_role.webhook_lambda.assume_role_policy
+      create_date           = aws_iam_role.webhook_lambda.create_date
+      description           = aws_iam_role.webhook_lambda.description
+      force_detach_policies = aws_iam_role.webhook_lambda.force_detach_policies
+      id                    = aws_iam_role.webhook_lambda.id
+      max_session_duration  = aws_iam_role.webhook_lambda.max_session_duration
+      name                  = aws_iam_role.webhook_lambda.name
+      name_prefix           = aws_iam_role.webhook_lambda.name_prefix
+      path                  = aws_iam_role.webhook_lambda.path
+      permissions_boundary  = aws_iam_role.webhook_lambda.permissions_boundary
+      tags                  = aws_iam_role.webhook_lambda.tags
+      tags_all              = aws_iam_role.webhook_lambda.tags_all
+      unique_id             = aws_iam_role.webhook_lambda.unique_id
     }
   }
 }
diff --git a/modules/webhook/eventbridge/outputs.tf b/modules/webhook/eventbridge/outputs.tf
index 172d5c611f..bc863ce296 100644
--- a/modules/webhook/eventbridge/outputs.tf
+++ b/modules/webhook/eventbridge/outputs.tf
@@ -9,12 +9,24 @@ output "webhook" {
   value = {
     lambda    = aws_lambda_function.webhook
     log_group = aws_cloudwatch_log_group.webhook
-    # Expose selected role attributes instead of the whole resource to avoid
-    # "Value derived from a deprecated source" warnings (managed_policy_arns).
+    # List all non-deprecated role attributes instead of the whole resource to
+    # avoid "Value derived from a deprecated source" warnings. Only the deprecated
+    # `managed_policy_arns` and `inline_policy` are omitted.
     role = {
-      id   = aws_iam_role.webhook_lambda.id
-      arn  = aws_iam_role.webhook_lambda.arn
-      name = aws_iam_role.webhook_lambda.name
+      arn                   = aws_iam_role.webhook_lambda.arn
+      assume_role_policy    = aws_iam_role.webhook_lambda.assume_role_policy
+      create_date           = aws_iam_role.webhook_lambda.create_date
+      description           = aws_iam_role.webhook_lambda.description
+      force_detach_policies = aws_iam_role.webhook_lambda.force_detach_policies
+      id                    = aws_iam_role.webhook_lambda.id
+      max_session_duration  = aws_iam_role.webhook_lambda.max_session_duration
+      name                  = aws_iam_role.webhook_lambda.name
+      name_prefix           = aws_iam_role.webhook_lambda.name_prefix
+      path                  = aws_iam_role.webhook_lambda.path
+      permissions_boundary  = aws_iam_role.webhook_lambda.permissions_boundary
+      tags                  = aws_iam_role.webhook_lambda.tags
+      tags_all              = aws_iam_role.webhook_lambda.tags_all
+      unique_id             = aws_iam_role.webhook_lambda.unique_id
     }
   }
 }
@@ -24,9 +36,20 @@ output "dispatcher" {
     lambda    = aws_lambda_function.dispatcher
     log_group = aws_cloudwatch_log_group.dispatcher
     role = {
-      id   = aws_iam_role.dispatcher_lambda.id
-      arn  = aws_iam_role.dispatcher_lambda.arn
-      name = aws_iam_role.dispatcher_lambda.name
+      arn                   = aws_iam_role.dispatcher_lambda.arn
+      assume_role_policy    = aws_iam_role.dispatcher_lambda.assume_role_policy
+      create_date           = aws_iam_role.dispatcher_lambda.create_date
+      description           = aws_iam_role.dispatcher_lambda.description
+      force_detach_policies = aws_iam_role.dispatcher_lambda.force_detach_policies
+      id                    = aws_iam_role.dispatcher_lambda.id
+      max_session_duration  = aws_iam_role.dispatcher_lambda.max_session_duration
+      name                  = aws_iam_role.dispatcher_lambda.name
+      name_prefix           = aws_iam_role.dispatcher_lambda.name_prefix
+      path                  = aws_iam_role.dispatcher_lambda.path
+      permissions_boundary  = aws_iam_role.dispatcher_lambda.permissions_boundary
+      tags                  = aws_iam_role.dispatcher_lambda.tags
+      tags_all              = aws_iam_role.dispatcher_lambda.tags_all
+      unique_id             = aws_iam_role.dispatcher_lambda.unique_id
     }
   }
 }