output "identity" {
  description = "Non-secret Google-to-AWS identity and Regional endpoint contract."
  value = {
    audience                  = var.audience
    regional_endpoint_host    = aws_route53_record.regional.fqdn
    regional_endpoint_url     = "https://${trimsuffix(aws_route53_record.regional.fqdn, ".")}"
    role_arn                  = aws_iam_role.runtime.arn
    service_account_unique_id = var.service_account_unique_id
  }
}

output "regional_tls" {
  description = "Session-owned Regional Kong TLS material; persisted only in the private Terraform workspace."
  sensitive   = true
  value = {
    certificate       = aws_acmpca_certificate.regional.certificate
    certificate_chain = aws_acmpca_certificate.regional.certificate_chain
    private_key       = tls_private_key.regional.private_key_pem
  }
}