Update Terraform

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
archive (source)	required_provider	patch	2.8.0 → 2.8.1
aws (source)	required_provider	minor	< 6.55 → < 6.70
aws (source)	required_provider	minor	6.54.0 → 6.69.0
aws (source)	required_provider	minor	6.37.0 → 6.69.0
google (source)	required_provider	minor	7.39.0 → 7.46.1
null (source)	required_provider	patch	3.3.0 → 3.3.2
random (source)	required_provider	patch	3.9.0 → 3.9.1
terraform-aws-modules/ecs/aws (source)	module	minor	7.5.0 → 7.6.1
terraform-aws-modules/vpc/aws (source)	module	minor	< 6.7 → < 6.8

---

Release Notes

hashicorp/terraform-provider-archive (archive)

v2.8.1

Compare Source

NOTES:

• Upgrade the Go toolchain to 1.26.8. (#​534)
• Update golang.org/x/crypto to v0.56.0, golang.org/x/mod to v0.40.0, and google.golang.org/protobuf to v1.36.12. (#​535)

hashicorp/terraform-provider-aws (aws)

v6.69.0

Compare Source

FEATURES:

• New List Resource: aws_cloudwatchomni_domain (#​50329)
• New List Resource: aws_cloudwatchomni_space (#​50385)
• New List Resource: aws_devopsagent_agent_space (#​47795)
• New List Resource: aws_pricingplanmanager_subscription (#​49235)
• New List Resource: aws_ram_principal_association (#​50427)
• New List Resource: aws_ssm_service_setting (#​50359)
• New Resource: aws_cloudwatch_resource_metrics_configuration (#​50254)
• New Resource: aws_cloudwatchomni_domain (#​50329)
• New Resource: aws_cloudwatchomni_space (#​50385)
• New Resource: aws_devopsagent_agent_space (#​47795)
• New Resource: aws_pricingplanmanager_subscription (#​49235)

ENHANCEMENTS:

• data-source/aws_resiliencehubv2_policy: Add sharing_enabled attribute (#​50241)
• resource/aws_bedrockagent_data_source: Add data_source_configuration.managed_knowledge_base_connector_configuration.sync_schedule configuration block (#​50276)
• resource/aws_bedrockagent_data_source: Add vector_ingestion_configuration.context_enrichment_configuration configuration block (#​50276)
• resource/aws_cloudwatch_metric_alarm: Add evaluation_window argument to support wall clock evaluation windows (#​50373)
• resource/aws_cloudwatch_otel_enrichment: Add include_filter and exclude_filter arguments (#​50390)
• resource/aws_observabilityadmin_telemetry_evaluation: Add all_regions and regions attributes (#​50402)
• resource/aws_opensearch_domain: Increase default timeouts.delete value to 120m (#​46969)
• resource/aws_quicksight_custom_permissions: Add action, analysis, automate, chat_agent, create_chat_agents, dashboard, flow, knowledge_base, perform_flow_ui_task, publish_without_approval, research, space, use_agent_web_search, and use_bedrock_models to capabilities configuration block (#​47135)
• resource/aws_ram_principal_association: Add resource identity support (#​50427)
• resource/aws_rds_cluster: Add publicly_accessible argument (#​50354)
• resource/aws_resiliencehubv2_input_source: Add resource_configuration.eks.label_selector argument (#​50075)
• resource/aws_resiliencehubv2_policy: Add sharing_enabled argument (#​50241)
• resource/aws_s3files_file_system: Support misconfigured lifecycle state during create and delete (#​50336)
• resource/aws_ssm_service_setting: Add resource identity support (#​50359)
• resource/aws_wafv2_rule_group: Add monetize action to the rule action block and add the monetization_config argument (#​48419)
• resource/aws_wafv2_web_acl: Add monetize action to the rule action block and add the monetization_config argument (#​48419)

BUG FIXES:

• resource/aws_agentregistry_registry: Fix validation of custom_claim-only custom JWT authorizers (#​50298)
• resource/aws_api_gateway_method: Fix deserialization failed, expected string, got null failure during Read (#​50444)
• resource/aws_ec2_transit_gateway_peering_attachment: Prevent erroneous forced replacement when the DescribeTransitGatewayPeeringAttachments API returns a present-but-empty Options object (#​50405)
• resource/aws_ecs_cluster_capacity_providers: Fix delete handling for inactive clusters (#​50374)
• resource/aws_observabilityadmin_telemetry_rule: Fix updates when all_regions is enabled (#​50150)
• resource/aws_opensearch_domain: Remove hardcoded enum validation for cluster_config.warm_type to support newer instance types (e.g., oi2.large.search) (#​46969)

v6.68.0

Compare Source

BREAKING CHANGES:

• resource/aws_docdb_cluster: availability_zones now validates that at most 3 items are provided at plan time. This is acceptable in a minor version because AWS would always reject requests with more than 3 availability zones at apply time. (#​50015)
• resource/aws_rds_cluster: availability_zones now validates that at most 3 items are provided at plan time. This is acceptable in a minor version because AWS would always reject requests with more than 3 availability zones at apply time. (#​50014)

FEATURES:

• New Data Source: aws_lambdamicrovms_image_version (#​50299)
• New Data Source: aws_odb_autonomous_database (#​48991)
• New List Resource: aws_ec2_transit_gateway_route (#​50202)
• New List Resource: aws_ram_resource_association (#​49901)
• New Resource: aws_odb_autonomous_database (#​48991)
• New Resource: aws_odb_autonomous_database_secrets_manager_integration (#​48991)

ENHANCEMENTS:

• resource/aws_bedrockagentcore_agent_runtime: Add platform_version argument (#​50081)
• resource/aws_docdb_cluster: Add validation that availability_zones contains at most 3 items, failing at plan time instead of forcing a destructive replacement (#​50015)
• resource/aws_ec2_transit_gateway_route: Add resource identity support (#​50202)
• resource/aws_grafana_workspace: Update grafana_version argument to support v13.2 (#​50234)
• resource/aws_network_interface: Add connection_tracking_specification argument (#​50119)
• resource/aws_ram_resource_association: Add resource identity support (#​49901)
• resource/aws_rds_cluster: Add validation that availability_zones contains at most 3 items, failing at plan time instead of forcing a destructive replacement (#​50014)

BUG FIXES:

• provider: Fixes error when parsing YAML documents with literal tab characters in double-quoted string (#​50340)
• resource/aws_odb_autonomous_database_secrets_manager_integration: Avoid redundant disable requests when the integration is already absent or terminating (#​48991)
• resource/aws_redshiftserverless_workgroup: Restores fully reading config_parameter when not specified (#​50255)

v6.67.0

Compare Source

NOTES:

• resource/aws_route53_record: Batched reads is experimental. The behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#​48525)

FEATURES:

• New Ephemeral Resource: aws_bedrockruntime_apply_guardrail (#​50155)
• New List Resource: aws_default_security_group (#​50120)
• New List Resource: aws_directory_service_ip_route (#​50138)
• New List Resource: aws_directoryservicedata_user (#​50001)
• New List Resource: aws_ec2_transit_gateway_route_table_propagation (#​50193)
• New Resource: aws_directory_service_ip_route (#​50138)
• New Resource: aws_directory_service_ip_routes_exclusive (#​50204)
• New Resource: aws_directoryservicedata_user (#​50001)

ENHANCEMENTS:

• resource/aws_apprunner_custom_domain_association: Add validation to prevent trailing dot on domain_name (#​50189)
• resource/aws_apprunner_custom_domain_association: Add validation to require enable_www_subdomain to be false for wildcard domain (#​50189)
• resource/aws_bedrockagentcore_workload_identity: Add tags and tags_all attributes (#​49746)
• resource/aws_bedrockagentcore_workload_identity: Add resource identity support (#​49746)
• resource/aws_default_security_group: Add Resource Identity support (#​50120)
• resource/aws_ec2_transit_gateway_route_table_propagation: Add Resource Identity support (#​50193)
• resource/aws_route53_record: Add the TF_AWS_ROUTE53_RECORD_BATCH_READS environment variable to reduce AWS API calls when managing many records in a zone (#​48525)
• resource/aws_sns_topic: Add maximum_message_size argument (#​50111)

BUG FIXES:

• list-resource/aws_dynamodb_table_replica: Fix eventual consistency error when replacing resource. (#​50133)
• resource/aws_apprunner_custom_domain_association: Populate dns_target when importing (#​50206)
• resource/aws_autoscaling_group: Fix interface conversion: interface {} is nil, not map[string]interface {} panics when capacity_reservation_target is empty (#​50084)
• resource/aws_bedrockagentcore_harness: Fix "inconsistent result after apply" when environment_variables is unset (#​50088)
• resource/aws_config_aggregate_authorization: Fix region to authorized_aws_region migration incorrectly forcing resource replacement (#​49851)
• resource/aws_rds_global_cluster: Wait for source cluster promotion to complete when source_db_cluster_identifier is specified, fixing race condition with downstream resources (#​48076)

v6.66.0

Compare Source

NOTES:

• resource/aws_iam_openid_connect_provider: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​50024)

FEATURES:

• New List Resource: aws_efs_mount_target (#​50057)
• New List Resource: aws_iam_openid_connect_provider (#​50024)
• New Resource: aws_msk_channel (#​49266)

ENHANCEMENTS:

• data-source/aws_ecs_service: Add target_type and timeout_configuration attributes to the lifecycle_hook block. (#​48128)
• resource/aws_bedrockagentcore_api_key_credential_provider: Add Resource Identity support (#​48629)
• resource/aws_bedrockagentcore_api_key_credential_provider: Add api_key_secret_source argument and api_key_secret_config configuration block to support customer-managed AWS Secrets Manager secrets (#​48629)
• resource/aws_ecs_service: Add target_type and timeout_configuration arguments to the lifecycle_hook configuration block to support ECS PAUSE deployment hooks. hook_target_arn and role_arn are now Optional (still required for AWS_LAMBDA hooks). (#​48128)
• resource/aws_efs_access_point: Add Resource Identity support (#​50026)
• resource/aws_efs_backup_policy: Add Resource Identity support (#​50026)
• resource/aws_efs_file_system: Add Resource Identity support (#​50026)
• resource/aws_efs_file_system_policy: Add Resource Identity support (#​50026)
• resource/aws_efs_mount_target: Add Resource Identity support (#​50026)
• resource/aws_efs_replication_configuration: Add Resource Identity support (#​50026)

BUG FIXES:

• list-resource/aws_rds_cluster_instance: Cache cluster using the DBClusterIdentifier as the key (#​50040)
• resource/aws_pipes_pipe: Fix source_parameters.self_managed_kafka_parameters.server_root_ca_certificate being sent to the API as an empty string instead of being omitted, which caused UpdatePipe to fail with a ValidationException when the attribute was unset (#​40116)
• resource/aws_redshiftserverless_workgroup: Filter server-only config_parameter entries from state and allow newly returned config parameter keys without a provider update (#​49939)

v6.65.0

Compare Source

NOTES:

• resource/aws_dx_bgp_peer: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49590)
• resource/aws_dx_hosted_private_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49591)
• resource/aws_dx_hosted_public_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49591)
• resource/aws_dx_hosted_transit_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49591)
• resource/aws_dx_public_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49589)

FEATURES:

• New List Resource: aws_api_gateway_deployment (#​49820)
• New List Resource: aws_apigatewayv2_integration (#​48425)
• New List Resource: aws_dms_migration_project (#​49936)
• New List Resource: aws_ec2_transit_gateway_policy_table_entry (#​49256)
• New List Resource: aws_glue_catalog_table (#​49953)
• New List Resource: aws_iam_group (#​49994)
• New List Resource: aws_iam_user_policy (#​49993)
• New List Resource: aws_lambda_resource_policy (#​49866)
• New List Resource: aws_network_acl (#​50020)
• New List Resource: aws_network_acl_rule (#​49916)
• New List Resource: aws_rds_cluster_instance (#​50036)
• New List Resource: aws_wafv2_ip_set (#​50031)
• New Resource: aws_dms_migration_project (#​49936)
• New Resource: aws_ec2_transit_gateway_policy_table_entry (#​49256)
• New Resource: aws_lambda_resource_policy (#​49866)

ENHANCEMENTS:

• data-source/aws_agentregistry_registry: Add discovery_configuration.authorizer_configuration.custom_jwt_authorizer.private_endpoint and discovery_configuration.authorizer_configuration.custom_jwt_authorizer.private_endpoint_override attributes (#​49964)
• data-source/aws_agentregistry_registry: Add encryption_configuration attribute (#​49964)
• resource/aws_agentregistry_registry: Add auto_detection_configuration and encryption_configuration configuration blocks (#​49964)
• resource/aws_agentregistry_registry: Add discovery_configuration.authorizer_configuration.custom_jwt_authorizer.private_endpoint and discovery_configuration.authorizer_configuration.custom_jwt_authorizer.private_endpoint_override configuration blocks (#​49964)
• resource/aws_api_gateway_deployment: Add resource identity support (#​49820)
• resource/aws_apigatewayv2_integration: Add resource identity support (#​48425)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add callback_url attribute (#​48517)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add client_authentication_method, on_behalf_of_token_exchange_config, private_endpoint, private_endpoint_override, and private_key_jwt_config arguments to oauth2_provider_config.custom_oauth2_provider_config configuration block (#​48517)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add client_secret_config and client_secret_source arguments to oauth2_provider_config.custom_oauth2_provider_config, oauth2_provider_config.github_oauth2_provider_config, oauth2_provider_config.google_oauth2_provider_config, oauth2_provider_config.microsoft_oauth2_provider_config, oauth2_provider_config.salesforce_oauth2_provider_config, and oauth2_provider_config.slack_oauth2_provider_config configuration blocks (#​48517)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add oauth2_provider_config.atlassian_oauth2_provider_config, oauth2_provider_config.included_oauth2_provider_config, and oauth2_provider_config.linkedin_oauth2_provider_config configuration blocks (#​48517)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add oauth2_provider_config.microsoft_oauth2_provider_config.tenant_id, oauth2_provider_config.microsoft_oauth2_provider_config.tenant_id_wo, and oauth2_provider_config.microsoft_oauth2_provider_config.tenant_id_wo_version arguments (#​48517)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add token_endpoint_auth_methods attribute to all oauth2_provider_config.*.oauth_discovery configuration blocks (#​48517)
• resource/aws_dx_bgp_peer: Add bgp_asn_long argument (#​49590)
• resource/aws_dx_hosted_private_virtual_interface: Add bgp_asn_long argument (#​49591)
• resource/aws_dx_hosted_public_virtual_interface: Add bgp_asn_long argument (#​49591)
• resource/aws_dx_hosted_transit_virtual_interface: Add bgp_asn_long argument (#​49591)
• resource/aws_dx_public_virtual_interface: Add bgp_asn_long argument (#​49589)
• resource/aws_glue_catalog_table: Add resource identity support (#​49953)
• resource/aws_glue_catalog_table: Change storage_descriptor.additional_locations, storage_descriptor.bucket_columns, storage_descriptor.columns.parameters, storage_descriptor.parameters, storage_descriptor.ser_de_info, storage_descriptor.ser_de_info.parameters, view_definition, view_definition.definer, view_definition.is_protected, view_definition.representations.validation_connection, view_definition.representations.view_expanded_text, view_definition.representations.view_original_text, view_definition.sub_object_version_ids, and view_definition.sub_objects to Optional and Computed (#​49953)
• resource/aws_iam_group: Add resource identity support (#​49994)
• resource/aws_iam_user_policy: Add resource identity support (#​49993)
• resource/aws_mailmanager_ingress_point: Add status_to_update argument (#​49954)
• resource/aws_network_acl: Add resource identity support (#​50020)
• resource/aws_network_acl_rule: Remove filtering of default Ipv4 and Ipv6 rules from list (#​50017)
• resource/aws_rds_cluster_instance: Add resource identity support (#​50036)
• resource/aws_wafv2_ip_set: Add Resource Identity support (#​50031)

BUG FIXES:

• resource/aws_agentregistry_registry: Correct attribute validation so that at least one of discovery_configuration.authorizer_configuration.custom_jwt_authorizer.allowed_audience, discovery_configuration.authorizer_configuration.custom_jwt_authorizer.allowed_clients, or discovery_configuration.authorizer_configuration.custom_jwt_authorizer.allowed_scopes is configured (#​50025)
• resource/aws_amplify_app: Fix BadRequestException: Environment variables cannot have an empty key when clearing auto_branch_creation_config.environment_variables (#​49858)
• resource/aws_amplify_branch: Fix BadRequestException: Environment variables cannot have an empty key when clearing environment_variables (#​49858)
• resource/aws_bedrockagent_data_source: Change data_source_configuration.managed_knowledge_base_connector_configuration.deletion_protection_configuration.deletion_protection_threshold to Optional and Computed (#​49977)
• resource/aws_mailmanager_traffic_policy: Make policy_statement optional (#​49509)
• resource/aws_secretsmanager_secret: Fix removal of all replica blocks not being detected as a change (#​39235)
• resource/aws_wafv2_rule_group: Fix field_to_match.single_header.name and field_to_match.single_query_argument.name rejecting values the AWS WAF API accepts, such as names containing . (#​49984)
• resource/aws_wafv2_web_acl: Fix field_to_match.single_header.name and field_to_match.single_query_argument.name rejecting values the AWS WAF API accepts, such as names containing . (#​49984)

v6.64.0

Compare Source

FEATURES:

• New Data Source: aws_accountaccess_application (#​49553)
• New Data Source: aws_accountaccess_entitlements (#​49554)
• New Data Source: aws_agentregistry_registry (#​49806)
• New Data Source: aws_rds_events (#​49783)
• New List Resource: aws_accountaccess_entitlement (#​49552)
• New List Resource: aws_agentregistry_registry (#​49549)
• New List Resource: aws_bedrock_model_invocation_job (#​49877)
• New List Resource: aws_dms_data_provider (#​49897)
• New List Resource: aws_dms_instance_profile (#​49747)
• New List Resource: aws_fis_safety_lever_state (#​49841)
• New List Resource: aws_lambda_alias (#​49706)
• New Resource: aws_accountaccess_entitlement (#​49552)
• New Resource: aws_agentregistry_registry (#​49549)
• New Resource: aws_bedrock_model_invocation_job (#​49877)
• New Resource: aws_dms_data_provider (#​49897)
• New Resource: aws_dms_instance_profile (#​49747)
• New Resource: aws_fis_safety_lever_state (#​49841)

ENHANCEMENTS:

• data-source/aws_workspaces_directory: Add workspace_access_properties.access_endpoint_config attribute (#​49849)
• resource/aws_appconfig_hosted_configuration_version: Add version_label argument (#​49881)
• resource/aws_bedrockagentcore_harness: Add model.bedrock_model_config.additional_params argument (#​48498)
• resource/aws_bedrockagentcore_harness: Add model.bedrock_model_config.api_format and model.openai_model_config.api_format arguments (#​48521)
• resource/aws_bedrockagentcore_harness: Add model.gemini_model_config.additional_params and model.openai_model_config.additional_params arguments (#​48656)
• resource/aws_bedrockagentcore_harness: Add model.litellm_model_config configuration block (#​48656)
• resource/aws_bedrockagentcore_harness: Add skill.aws_skills, skill.git, and skill.s3 configuration blocks (#​48656)
• resource/aws_bedrockagentcore_harness: Change max_tokens to Optional and Computed (#​48656)
• resource/aws_bedrockagentcore_harness: Change skill.path to Optional (#​48656)
• resource/aws_bedrockagentcore_harness: Change system_prompt to Required (#​48656)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add Resource Identity support (#​49900)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add configurable resource timeouts (#​49900)
• resource/aws_cloudwatch_metric_alarm: Add warm_up_configuration configuration block (#​49873)
• resource/aws_db_instance: Add warning_event_categories argument. When set, surface a warning diagnostic for each matching RDS event reported during create or update. Requires the rds:DescribeEvents IAM permission (#​49783)
• resource/aws_ecs_capacity_provider: Add managed_instances_provider.auto_repair_configuration configuration block (#​49763)
• resource/aws_msk_replicator: Add kafka_cluster.client_authentication to configure mtls or sasl_scram authentication to an Apache Kafka cluster (#​49265)
• resource/aws_msk_replicator: Add kafka_cluster.encryption_in_transit to supply a custom root CA certificate for an Apache Kafka cluster (#​49265)
• resource/aws_msk_replicator: Support self-managed and on-premises Apache Kafka clusters as a replication source or target, via the kafka_cluster.apache_kafka_cluster block and the replication_info_list.source_kafka_cluster_id and target_kafka_cluster_id arguments (#​49265)
• resource/aws_rds_cluster: Add warning_event_categories argument. When set, surface a warning diagnostic for each matching RDS event reported during create or update. Requires the rds:DescribeEvents IAM permission (#​49783)
• resource/aws_rds_cluster_instance: Add warning_event_categories argument. When set, surface a warning diagnostic for each matching RDS event reported during create or update. Requires the rds:DescribeEvents IAM permission (#​49783)

BUG FIXES:

• data-source/aws_workspaces_directory: Fix setting workspace_access_properties: Invalid address to set errors (#​49849)
• resource/aws_bedrockagentcore_harness: Retry Role validation failed for '...'. Please verify that the role exists and its trust policy allows assumption by this service IAM eventual consistency errors on Create. Because this error is returned while waiting for a newly-created harness to stabilize, the failed harness is deleted and creation is restarted. You may see CloudTrail events that reflect this sequence of operations (#​48656)
• resource/aws_db_instance: Fix error when restoring multi-az SQL Server from snapshot. (#​49846)
• resource/aws_rds_global_cluster: Fix potential eventual consistency error when re-creating resource. (#​49804)

v6.63.0

Compare Source

FEATURES:

• New List Resource: aws_accountaccess_application (#​49551)
• New List Resource: aws_key_pair (#​49712)
• New List Resource: aws_lambdamicrovms_image (#​49724)
• New List Resource: aws_lambdamicrovms_microvm (#​48984)
• New List Resource: aws_mailmanager_archive (#​49580)
• New List Resource: aws_opensearchserverless_access_policy (#​49717)
• New List Resource: aws_opensearchserverless_lifecycle_policy (#​49718)
• New List Resource: aws_opensearchserverless_security_config (#​49769)
• New List Resource: aws_opensearchserverless_security_policy (#​49770)
• New List Resource: aws_opensearchserverless_vpc_endpoint (#​49774)
• New Resource: aws_accountaccess_application (#​49551)
• New Resource: aws_datazone_policy_grant (#​47050)
• New Resource: aws_lambdamicrovms_microvm (#​48984)
• New Resource: aws_mailmanager_archive (#​49580)

ENHANCEMENTS:

• data-source/aws_dx_connection: Add prefix_pool_size_ipv4, prefix_pool_size_ipv6, prefix_pool_unallocated_count_ipv4, and prefix_pool_unallocated_count_ipv6 attributes (#​49711)
• data-source/aws_dx_connection: Add rate_limiter_status attribute (#​48910)
• data-source/aws_eks_cluster: Add pod_gc_controller_config attribute to the kube_controller_manager_config configuration block (#​49728)
• data-source/aws_eks_cluster_versions: Add pod_gc_controller_config attribute to the control_plane_component_config.kube_controller_manager_config configuration block (#​49730)
• resource/aws_bedrockagentcore_gateway_target: Add Resource Identity support (#​48706)
• resource/aws_bedrockagentcore_gateway_target: Add target_configuration.http.agentcore_runtime.schema and target_configuration.http.passthrough configuration blocks (#​48704)
• resource/aws_bedrockagentcore_gateway_target: Add target_configuration.inference configuration block (#​48705)
• resource/aws_bedrockagentcore_gateway_target: Add target_configuration.mcp.connector configuration block (#​48706)
• resource/aws_dx_connection: Add prefix_pool_size_ipv4, prefix_pool_size_ipv6, prefix_pool_unallocated_count_ipv4, and prefix_pool_unallocated_count_ipv6 attributes (#​49711)
• resource/aws_dx_connection: Add rate_limiter_status attribute (#​48910)
• resource/aws_dx_hosted_private_virtual_interface: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 attributes (#​49711)
• resource/aws_dx_hosted_private_virtual_interface: Add rate_limit argument (#​48910)
• resource/aws_dx_hosted_private_virtual_interface_accepter: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 arguments (#​49711)
• resource/aws_dx_hosted_public_virtual_interface: Add rate_limit argument (#​48910)
• resource/aws_dx_hosted_transit_virtual_interface: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 attributes (#​49711)
• resource/aws_dx_hosted_transit_virtual_interface: Add rate_limit argument (#​48910)
• resource/aws_dx_hosted_transit_virtual_interface_accepter: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 arguments (#​49711)
• resource/aws_dx_lag: Add rate_limiter_status attribute (#​48910)
• resource/aws_dx_private_virtual_interface: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 arguments (#​49711)
• resource/aws_dx_private_virtual_interface: Add rate_limit argument (#​48910)
• resource/aws_dx_public_virtual_interface: Add rate_limit argument (#​48910)
• resource/aws_dx_transit_virtual_interface: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 arguments (#​49711)
• resource/aws_dx_transit_virtual_interface: Add rate_limit argument (#​48910)
• resource/aws_eks_cluster: Add pod_gc_controller_config argument to the kube_controller_manager_config configuration block (#​49725)
• resource/aws_key_pair: Add resource identity support (#​49712)
• resource/aws_synthetics_canary: Add kms_key_arn argument (#​49406)

BUG FIXES:

• provider: Fix assume_role_with_web_identity.web_identity_token being rejected when AWS_WEB_IDENTITY_TOKEN_FILE is set (#​49671)
• resource/aws_db_parameter_group: Fix name_prefix length validation to allow the correct maximum of 229 characters (#​49197)
• resource/aws_docdb_cluster_parameter_group: Fix name_prefix length validation to allow the correct maximum of 229 characters (#​49197)
• resource/aws_observabilityadmin_telemetry_rule_for_organization: Fix updates when all_regions is enabled (#​49743)
• resource/aws_rds_cluster_parameter_group: Fix name_prefix length validation to allow the correct maximum of 229 characters (#​49197)
• resource/aws_redshift_namespace_registration: Fixes errors when Importing by ID (#​49690)
• resource/aws_redshift_namespace_registration: Fixes errors when Importing by Identity (#​49690)
• resource/aws_s3_bucket: Setting object_lock_configuration.object_lock_enabled to Enabled no longer forces a replacement (#​36530)
• resource/aws_s3_bucket: Setting object_lock_enabled to true no longer forces a replacement (#​36530)

v6.62.0

Compare Source

NOTES:

• resource/aws_db_instance: When manage_master_user_password is enabled, the managed secret's automatic rotation can now be disabled using aws_secretsmanager_secret_rotation with rotation_enabled = false (#​49659)
• resource/aws_rds_cluster: When manage_master_user_password is enabled, the managed secret's automatic rotation can now be disabled using aws_secretsmanager_secret_rotation with rotation_enabled = false (#​49659)
• resource/aws_savingsplans_savings_plan: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49264)

FEATURES:

• New List Resource: aws_db_instance (#​49602)
• New List Resource: aws_dsql_cluster (#​49657)
• New List Resource: aws_dsql_cluster_policy (#​49676)
• New List Resource: aws_ecr_lifecycle_policy (#​49696)
• New List Resource: aws_ecs_cluster (#​49682)
• New List Resource: aws_pinpointsmsvoicev2_keyword (#​48967)
• New Resource: aws_pinpointsmsvoicev2_keyword (#​48967)
• New Resource: aws_sesv2_multi_region_endpoint (#​49660)

ENHANCEMENTS:

• data-source/aws_resiliencehubv2_service: Add associated_system.user_journey_ids attribute (#​49603)
• resource/aws_bedrockagentcore_browser: Add plan-time validation of name (#​48766)
• resource/aws_bedrockagentcore_memory: Add Resource Identity support (#​48766)
• resource/aws_bedrockagentcore_memory: Allow adding indexed_key entries in place instead of forcing a new resource (#​48877)
• resource/aws_bedrockagentcore_memory: Change indexed_key from List to Set to ignore ordering (#​48877)
• resource/aws_bedrockagentcore_memory_strategy: Add Resource Identity support (#​48766)
• resource/aws_bedrockagentcore_memory_strategy: Add configuration.self_managed_configuration argument in support of self-managed strategies (#​48766)
• resource/aws_bedrockagentcore_memory_strategy: Add memory_record_schema argument (#​48765)
• resource/aws_bedrockagentcore_memory_strategy: Add plan-time validation of description (#​48766)
• resource/aws_bedrockagentcore_memory_strategy: Change description to Optional and Computed (#​48766)
• resource/aws_cloudfront_function: Validate name, code, and comment against CloudFront's documented constraints during plan instead of failing at apply time (#​49395)
• resource/aws_db_instance: Add resource identity support (#​49602)
• resource/aws_dsql_cluster: Add resource identity support (#​49657)
• resource/aws_dx_private_virtual_interface: Add bgp_asn_long argument (#​49587)
• resource/aws_dx_transit_virtual_interface: Add bgp_asn_long argument (#​49588)
• resource/aws_ecs_cluster: Add resource identity support (#​49682)
• resource/aws_elasticache_replication_group: Add auth_token_wo and auth_token_wo_version write-only arguments (#​49268)
• resource/aws_observabilityadmin_centralization_rule_for_organizatio

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • "before 10am on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Caution

[High Risk] Replacing the only registered targets will leave both load balancers temporarily without healthy backends

Both target group attachments being replaced are single-target backends today. The NLB listener for fraud-ingest-terraform-example forwards only to target group txn-feed-terraform-example, which currently has one healthy IP target, 10.0.101.34:9090, on the core-api instance. The ALB listener for api-207c90ee-alb forwards only to target group api-207c90ee-tg, which currently has one healthy instance target, i-0bf4039822e01f430, on port 80.

Because the backing EC2 instances are also being replaced, Terraform cannot keep the existing attachment in place through the whole rollout. AWS removes a target from service as soon as it is deregistered, and only starts routing to a newly registered target after registration completes and the target passes its initial health checks. With only one current target in each group, any detach-before-healthy-register sequence creates a period with zero healthy backends. That will interrupt traffic through both load balancers, and the core-api replacement also includes moving EIP 13.134.236.98 off the old instance, creating an additional gap where clients using that address hit no running backend.
_{View reasoning tree here.}

Caution

[High Risk] Singleton instance replacements will cause endpoint downtime during cutover

The change replaces singleton compute instances that currently back live endpoints, including the ALB-backed API server 540044833068.eu-west-2.ec2-instance.i-0bf4039822e01f430 and the EIP/NLB-backed core API host 540044833068.eu-west-2.ec2-instance.i-0cff13d553da3fe3a. Their target-group attachments are being replaced at the same time, so Terraform will remove the old targets and only register the new instances after they boot, run user data, and pass health checks.

That will cause a service interruption even if the new AMIs are otherwise valid. The API server currently has a single healthy ALB target on port 80 with /health, and the core API feed currently has a single healthy TCP target on 10.0.101.34:9090; there is no evidence of redundant targets absorbing the replacement. Requests will fail during the cutover window while the old instances are destroyed or deregistered and the replacements are still starting.
_{View reasoning tree here.}

Signals

Routine → Multiple compute, alerting, and messaging resources showing unusual infrequent routine changes at 1 event/week for the last 2-5 months, with several related resources also changing only 2-4 events/week for the last 3-5 months.

_{Additional Change Details:} Items 81 Edges 161 model|risks_v6 ✨Encryption Key State Risk ✨KMS Key Creation