chore(deps): update terraform aws to v5 - autoclosed (!1436) · Merge requests · Forge / infra / infrastructure

Renovate Bot requested to merge renovate/aws-5.x into main May 25, 2023

This MR contains the following updates:

Package	Type	Update	Change
aws (source)	required_provider	major	`~> 4.23.0` -> `~> 5.100.0`

⚠ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

hashicorp/terraform-provider-aws (aws)

`v5.100.0`

Compare Source

NOTES:

resource/aws_route53_vpc_association_authorization: Because we cannot easily replicate the highly concurrent environments in which these errors have been observed, this fix is best effort and we ask for community help in verifying the reported issues are resolved by this change (#42948)

FEATURES:

New Resource: aws_dsql_cluster (#41868)
New Resource: aws_dsql_cluster_peering (#41868)
New Resource: aws_prometheus_workspace_configuration (#42478)
New Resource: aws_s3control_directory_bucket_access_point_scope (#42338)
New Resource: aws_vpc_route_server (#42392)
New Resource: aws_vpc_route_server_endpoint (#42392)
New Resource: aws_vpc_route_server_peer (#42392)
New Resource: aws_vpc_route_server_propagation (#42392)
New Resource: aws_vpc_route_server_vpc_association (#42392)
New Resource: aws_workspacesweb_data_protection_settings (#42852)
New Resource: aws_workspacesweb_ip_access_settings (#42863)
New Resource: aws_workspacesweb_user_access_logging_settings (#42868)

ENHANCEMENTS:

data-source/aws_elb_hosted_zone_id: Add hosted zone ID for ap-east-2 AWS Region (#42915)
data-source/aws_lb_hosted_zone_id: Add hosted zone IDs for ap-east-2 AWS Region (#42915)
data-source/aws_neptune_engine_version: Add several arguments and attributes to support dynamic selection of versions including latest, has_major_target, preferred_major_targets, and preferred_upgrade_targets (#42854)
data-source/aws_s3_bucket: Add hosted zone ID for ap-east-2 AWS Region (#42915)
provider: Support ap-east-2 as a valid AWS Region (#42906)
resource/aws_fsx_lustre_file_system: Add data_read_cache_configuration and throughput_capacity arguments in support of the Intelligent-Tiering storage class (#42839)
resource/aws_pinpointsmsvoicev2_phone_number: Add two_way_channel_role argument (#42950)
resource/aws_route53_vpc_association_authorization: Add configurable timeouts for create, read, and delete (#42948)
resource/aws_s3_access_point: Add support for S3 Directory Buckets (#42338)
resource/aws_s3control_access_point_policy: Add support for S3 Directory Buckets (#42338)
resource/aws_vpn_connection: Add preshared_key_storage argument and preshared_key_arn attribute (#42819)
resource/aws_wafv2_rule_group: Add statement.asn_match_statement configuration block (#42965)
resource/aws_wafv2_web_acl: Add statement.asn_match_statement configuration block (#42965)

BUG FIXES:

resource/aws_cloudfrontkeyvaluestore_keys_exclusive: Batch update operations to stay under the Key Value Store Service Quota. The max_batch_size argument can be used to override the default value of 50 items. (#42795)
resource/aws_cloudwatch_log_destination: Fix to return the first matched destination name during the read operation. This fixes a regression introduced in v5.83.0 (#42896)
resource/aws_cloudwatch_log_group: Fix to return the first matched group name during the read operation. This fixes a regression introduced in v5.83.0 (#42896)
resource/aws_cloudwatch_log_metric_filter: Fix to return the first matched filter name during the read operation. This fixes a regression introduced in v5.83.0 (#42896)
resource/aws_cloudwatch_log_query_definition: Fix to return the first matched query definition ID during the read operation. This fixes a regression introduced in v5.83.0 (#42896)
resource/aws_cloudwatch_log_resource_policy: Fix to return the first matched policy name during the read operation. This fixes a regression introduced in v5.83.0 (#42896)
resource/aws_cloudwatch_log_subscription_filter: Fix to return the first matched filter name during the read operation. This fixes a regression introduced in v5.83.0 (#42896)
resource/aws_dynamodb_table: Set new computed value for stream_arn attribute when changing stream_view_type (#42561)
resource/aws_neptune_cluster: Enable minor and major version upgrades by fixing various issues preventing them (#42854)
resource/aws_neptune_global_cluster: Enable minor and major version upgrades by fixing various issues preventing them (#42854)
resource/aws_route53_vpc_association_authorization: Retry InvalidPaginationToken errors on read (#42948)
resource/aws_verifiedaccess_endpoint: Fix InvalidParameterValue: The value of loadBalancerOptions.port you provided is not valid errors when creating TCP load balancer endpoints (#42736)
resource/aws_vpc_endpoint_subnet_association: Fix OperationInProgress: VpcEndpoint modify operation in progress errors when deleting multiple associations in parallel (#42884)

`v5.99.1`

Compare Source

BUG FIXES:

resource/aws_fms_admin_account: Fix panic: runtime error: invalid memory address or nil pointer dereference (#42813)
resource/aws_lb: Ignore InvalidAction exceptions for DescribeCapacityReservation operations. This fixes a regression introduced in v5.99.0 (#42812)
resource/aws_s3_bucket_lifecycle_configuration: Correctly handles switching child attributes of rule.filter. (#42655)

`v5.99.0`

Compare Source

FEATURES:

New Resource: aws_notifications_channel_association (#42575)
New Resource: aws_notifications_event_rule (#42575)
New Resource: aws_notifications_notification_configuration (#42575)
New Resource: aws_notifications_notification_hub (#42544)
New Resource: aws_notificationscontacts_email_contact (#42575)
New Resource: aws_quicksight_account_settings (#42185)
New Resource: aws_workspacesweb_browser_settings (#42681)
New Resource: aws_workspacesweb_network_settings (#42722)
New Resource: aws_workspacesweb_user_settings (#42783)

ENHANCEMENTS:

data-source/aws_ami: Add block_device_mappings.ebs["volume_initialization_rate"] attribute (#42684)
data-source/aws_launch_template: Add block_device_mappings.ebs.volume_initialization_rate attribute (#42684)
data-source/aws_verifiedpermissions_policy_store: Add tags attribute. This functionality requires the verifiedpermissions:ListTagsForResource IAM permission (#42663)
resource/aws_ecs_service: Add volume_configuration.managed_ebs_volume.volume_initialization_rate argument (#42750)
resource/aws_launch_template: Add block_device_mappings.ebs.volume_initialization_rate argument (#42684)
resource/aws_lb: Add minimum_load_balancer_capacity configuration block. This functionality requires the elasticloadbalancing:DescribeCapacityReservations and elasticloadbalancing:ModifyCapacityReservation IAM permissions (#42685)
resource/aws_organizations_account: Allow name to be updated in-place. This functionality requires the account:PutAccountName IAM permission (#42350)
resource/aws_securityhub_standards_subscription: Add configurable Create and Delete timeouts (#42759)
resource/aws_verifiedpermissions_policy_store: Add tags argument and tags_all attribute. This functionality requires the verifiedpermissions:ListTagsForResource, verifiedpermissions:TagResource, and verifiedpermissions:UntagResource IAM permissions (#42663)

BUG FIXES:

data-source/aws_ecr_repository_creation_template: prefix can now be up to 256 characters (#42723)
resource/aws_cloudwatch_log_stream: Fix to return the first matched stream name during the read operation. This fixes a regression introduced in v5.83.0 (#42719)
resource/aws_cognitoidp_user_pool: Fix crash when the user_pool_add_ons.advanced_security_additional_flows block is non-empty, but contains only a single nil value. (#42793)
resource/aws_ecr_repository_creation_template: prefix can now be up to 256 characters (#42723)
resource/aws_elasticache_replication_group: Fix crash during read operations where configuration endpoint and node groups are nil and empty, respectively (#42726)
resource/aws_s3_bucket: Ensure that HeadBucket S3 API calls are made using configured credentials. This fixes a regression introduced in v5.98.0 (#42786)
resource/aws_s3_bucket_lifecycle_configuration: No longer returns warning on empty rule.filter. (#42624)
resource/aws_vpc_endpoint: Fix issue where dns_options were not being updated correctly when private_dns_enabled was set to true (#42746)

`v5.98.0`

Compare Source

FEATURES:

New Data Source: aws_account_primary_contact (#42526)
New Data Source: aws_dynamodb_tables (#42339)
New Resource: aws_bedrockagent_prompt (#42211)
New Resource: aws_cloudfrontkeyvaluestore_keys_exclusive (#42246)
New Resource: aws_dataexchange_revision_assets (#42272)
New Resource: aws_inspector2_filter (#42374)
New Resource: aws_wafv2_api_key (#42525)

ENHANCEMENTS:

data-source/aws_cloudwatch_event_bus: Add dead_letter_config attribute (#42471)
data-source/aws_cloudwatch_event_connection: Add kms_key_identifier attribute (#42385)
data-source/aws_cognito_user_pool_client: Add refresh_token_rotation attribute (#42430)
data-source/aws_cognitoidp_user_pool: Add user_pool_add_ons attribute (#42470)
data-source/aws_dynamodb_table: Add point_in_time_recovery.recovery_period_in_days attribute (#41484)
data-source/aws_ec2_client_vpn_endpoint: Add client_route_enforcement_options attribute (#42424)
data-source/aws_imagebuilder_distribution_configuration: Add distribution.ssm_parameter_configuration attribute (#42604)
data-source/aws_redshiftserverless_workgroup: Add track_name attribute (#42451)
data-source/aws_workspaces_directory: Add active_directory_config, user_identity_type, workspace_directory_description, workspace_directory_name, and workspace_type attributes (#42330)
resource/aws_appflow_flow: Add destination_flow_config.destination_connector_properties.salesforce.data_transfer_api argument (#42479)
resource/aws_autoscaling_group: Add capacity_reservation_specification argument (#42380)
resource/aws_bedrockagent_agent: Add prepared_at attribute. (#42586)
resource/aws_bedrockagent_agent: Increase instruction max length for validation to 20000 (#42596)
resource/aws_cloudwatch_event_bus: Add dead_letter_config argument (#42471)
resource/aws_cloudwatch_event_connection: Add kms_key_identifier argument (#42385)
resource/aws_cognito_managed_user_pool_client: Add refresh_token_rotation argument (#42430)
resource/aws_cognito_user_pool_client: Add refresh_token_rotation argument (#42430)
resource/aws_cognitoidp_user_pool: Add user_pool_add_ons.advanced_security_additional_flows argument (#42470)
resource/aws_docdb_cluster: Add manage_master_user_password argument and master_user_secret attribute (#42563)
resource/aws_dynamodb_table: Add point_in_time_recovery.recovery_period_in_days argument (#41484)
resource/aws_ec2_client_vpn_endpoint: Add client_route_enforcement_options argument (#42424)
resource/aws_ecs_account_setting_default: Add support for defaultLogDriverMode value in Name argument (#42418)
resource/aws_imagebuilder_distribution_configuration: Add distribution.ssm_parameter_configuration argument (#42604)
resource/aws_iot_domain_configuration: Add application_protocol and authentication_type arguments (#42534)
resource/aws_msk_serverless_cluster: Add bootstrap_brokers_sasl_iam attribute. This functionality requires the kafka:GetBootstrapBrokers IAM permission (#42148)
resource/aws_redshiftserverless_workgroup: Add track_name argument (#42451)
resource/aws_rum_app_monitor: Add domain_list argument (#42456)
resource/aws_rum_app_monitor: Mark domain as Optional (#42456)
resource/aws_s3tables_table: Add encryption_configuration argument. This functionality requires the s3tables:GetTableEncryption IAM permission (#42356)
resource/aws_s3tables_table_bucket: Add encryption_configuration argument. This functionality requires the s3tables:GetTableBucketEncryption IAM permission (#42356)
resource/aws_securityhub_finding_aggregator: Support NO_REGIONS as a valid value for linking_mode (#42574)
resource/aws_sns_topic: Add fifo_throughput_scope argument (#42508)
resource/aws_wafv2_rule_group: Add uri_fragment to field_to_match configuration blocks (#42407)
resource/aws_wafv2_web_acl: Add data_protection_config argument (#42404)
resource/aws_wafv2_web_acl: Add uri_fragment to field_to_match configuration blocks (#42407)
resource/aws_workspaces_directory: Add active_directory_config, user_identity_type, workspace_directory_description, workspace_directory_name, and workspace_type arguments in support of WorkSpaces Pools (#42330)
resource/aws_workspaces_directory: Mark directory_id as Optional (#42330)

BUG FIXES:

aws_sagemaker_mlflow_tracking_server: Fix ValidationException: The provided MLflow version is not supported errors (#42435)
data-source/aws_networkfirewall_firewall_policy: Add firewall_policy.policy_variables configuration block (#42473)
resource/aws_bedrockagent_agent_alias: Stop using state for unknown on routing_configuration so we only send it on update when explicility configured. This allows updates to aliases to create new versions. (#42603)
resource/aws_cloudwatch_metric_alarm: Support 20 as a valid value for metric_query.metric.period, metric_query.period, and period (#42390)
resource/aws_controltower_control: Fix handling ResourceNotFound exceptions during delete (#42494)
resource/aws_controltower_control: Fix handling of parameters block removal (#42494)
resource/aws_ec2_network_insights_path: Fix failure when filter_at_source.source_address is unspecified. (#42369)
resource/aws_instance: Fix InvalidNetworkInterface.InUse errors on Create (#42623)
resource/aws_lb_listener: Don't send zero value (false, 0 or "") for unconfigured listener attributes on Create (#41846)
resource/aws_rds_cluster_parameter_group: Fix InvalidParameterValue: collation_server '..' is not valid for character_set '...' errors on Create (#42559)

`v5.97.0`

Compare Source

FEATURES:

New Resource: aws_ec2_default_credit_specification (#42345)

ENHANCEMENTS:

data-source/aws_glue_connection: Support athena_properties attribute (#42262)
data-source/aws_imagebuilder_infrastructure_configuration: Add placement attribute (#42347)
data-source/aws_networkfirewall_firewall: Add enabled_analysis_types attribute (#42160)
data-source/aws_workspaces_directory: Add certificate_based_auth_properties attribute (#42269)
resource/aws_accessanalyzer_analyzer: Add configuration.unused_access.analysis_rule argument (#42332)
resource/aws_fis_experiment_template: Add support for ManagedResources to action.*.target (#42376)
resource/aws_glue_connection: Add athena_properties argument and allow DYNAMODB connection type. (#42262)
resource/aws_glue_connection: Support DYNAMODB as a valid value for connection_type (#42262)
resource/aws_imagebuilder_infrastructure_configuration: Add placement argument (#42347)
resource/aws_networkfirewall_firewall: Add enabled_analysis_types argument (#42160)
resource/aws_workspaces_directory: Add certificate_based_auth_properties configuration block (#42269)

BUG FIXES:

resource/aws_vpclattice_listener_rule: Prevents error when setting listener_identifier to ARN. (#42215)
resource/aws_vpclattice_listener_rule: Prevents error when setting service_identifier to ARN. (#42215)
resource/aws_vpclattice_listener_rule: Requires match.http_match. (#42215)
resource/aws_vpclattice_listener_rule: Requires exactly one of action.fixed_response or action.forward. (#42215)

`v5.96.0`

Compare Source

FEATURES:

New Data Source: aws_fis_experiment_templates (#37060)
New Data Source: aws_vpc_endpoint_associations (#41918)

ENHANCEMENTS:

data-source/aws_api_gateway_domain_name: Add endpoint_configuration.ip_address_type attribute (#42146)
data-source/aws_api_gateway_rest_api: Add endpoint_configuration.ip_address_type attribute (#42146)
data-source/aws_apigatewayv2_api: Add ip_address_type attribute (#42145)
data-source/aws_dms_endpoint: Add kinesis_settings.use_large_integer_value attribute (#42300)
data-source/aws_guardduty_detector: Add arn attribute (#42344)
data-source/aws_guardduty_detector: Add tags attribute (#42344)
resource/aws_api_gateway_domain_name: Add endpoint_configuration.ip_address_type argument to support dual-stack (IPv4 and IPv6) endpoints (#42146)
resource/aws_api_gateway_rest_api: Add endpoint_configuration.ip_address_type argument to support dual-stack (IPv4 and IPv6) endpoints (#42146)
resource/aws_apigatewayv2_api: Add ip_address_type argument to support dual-stack (IPv4 and IPv6) endpoints (#42145)
resource/aws_apigatewayv2_domain_name: Add domain_name_configuration.ip_address_type argument to support dual-stack (IPv4 and IPv6) endpoints (#42145)
resource/aws_dms_endpoint: Add kinesis_settings.use_large_integer_value argument (#42300)
resource/aws_fis_experiment_template: Add experiment_report_configuration argument (#41120)

BUG FIXES:

resource/aws_elasticache_replication_group: Fix malformed version error when parsing 7.x redis engine versions (#42346)
resource/aws_iam_user: Retry ConcurrentModificationExceptions during user creation (#42081)
resource/aws_rds_cluster: Fix InvalidParameterValue: SecondsUntilAutoPause can only be specified when minimum capacity is 0 errors when removing serverlessv2_scaling_configuration.seconds_until_auto_pause (#41180)

`v5.95.0`

Compare Source

NOTES:

resource/aws_api_gateway_deployment: Computed attributes invoke_url and execution_arn are deprecated. Use the invoke_url and execution_arn attributes of the aws_api_gateway_stage resource instead. (#42244)

FEATURES:

New Resource: aws_redshift_integration (#42105)

ENHANCEMENTS:

data-source/aws_ec2_network_insights_path: Support filter_at_destination and filter_at_source attributes (#42214)
resource/aws_amplify_app: Add compute_role_arn argument (#41650)
resource/aws_codebuild_webhook: Add manual_creation argument (#40155)
resource/aws_cognito_user_pool_domain: Add managed_login_version argument (#40855)
resource/aws_ec2_network_insights_path: Add filter_at_destination and filter_at_source configuration blocks (#42214)
resource/aws_eks_cluster: Add force_update_version argument (#42134)
resource/aws_prometheus_scraper: Allow alias, destination, role_configuration, and scrape_configuration to be updated in-place (#42109)
resource/aws_redshiftserverless_workgroup: Add price_performance_target argument (#40946)
resource/aws_sagemaker_image_version: Add horovod, job_type, ml_framework, processor, programming_lang, release_notes, and vendor_guidance arguments (#42143)
resource/aws_sagemaker_notebook_lifecycle_configuration: Add tags argument and tags_all attribute (#42141)
resource/aws_transfer_server: Add TransferSecurityPolicy-2025-03, TransferSecurityPolicy-FIPS-2025-03, and TransferSecurityPolicy-SshAuditCompliant-2025-02 as valid values for security_policy_name (#42164)

BUG FIXES:

resource/aws_elasticache_serverless_cache: Fix to allow in-place updates when engine is changed from redis to valkey (#42208)
resource/aws_kms_custom_key_store: Fix panic: runtime error: invalid memory address or nil pointer dereference when no XksProxyConfiguration is returned (#42241)
resource/aws_s3_bucket_lifecycle_configuration: Fix errors when removing rule from top of list (#42228)
resource/aws_s3_bucket_lifecycle_configuration: Fix potential eventual consistency errors in some regions (#41764)
resource/aws_s3_bucket_lifecycle_configuration: No longer allows empty rule.filter.and.tags (#42041)
resource/aws_sagemaker_domain: Allow default_user_settings.custom_file_system_config and default_space_settings.custom_file_system_config to be removed on Update (#42144)
resource/aws_sagemaker_user_profile: Allow user_settings.custom_file_system_config to be removed on Update (#42144)

`v5.94.1`

Compare Source

BUG FIXES:

resource/aws_sns_topic_subscription: Ignore AuthorizationError exceptions for ListSubscriptionByTopic operations. This fixes a regression introduced in v5.94.0. (#42117)

`v5.94.0`

Compare Source

NOTES:

resource/aws_ssm_parameter: The overwrite argument is no longer deprecated (#42030)

ENHANCEMENTS:

data-source/aws_ami: Add last_launched_time attribute (#42049)
resource/aws_ami: Add last_launched_time attribute (#42049)
resource/aws_ami_copy: Add last_launched_time attribute (#42049)
resource/aws_ami_from_instance: Add last_launched_time attribute (#42049)
resource/aws_glue_job: Add source_control_details argument (#42046)
resource/aws_lambda_function: Add support for ruby3.4 runtime value (#42052)
resource/aws_lambda_layer_version: Add support for ruby3.4 compatible_runtimes value (#42052)
resource/aws_prometheus_scraper: Add role_configuration argument (#42039)
resource/aws_s3_bucket_lifecycle_configuration: Adds warning if multiple attributes in rule.expiration are set (#42036)
resource/aws_s3_bucket_lifecycle_configuration: Adds warning if neither rule.prefix nor rule.filter is set (#42036)
resource/aws_s3_bucket_lifecycle_configuration: Adds warning if neither rule.transition.date nor rule.transition.days is set and error if both are set (#42036)
resource/aws_s3_bucket_lifecycle_configuration: Removes spurious "known after apply" notations in plan (#42036)

BUG FIXES:

resource/aws_cloudformation_type: Set the default version of an extension to the newly created version. This fixes CFNRegistryException: Version '...' is the default version and cannot be deregistered errors when deregistering an extension and the create_before_destroy meta-argument is true (#38855)
resource/aws_connect_queue: Fix API limitation when assigning more than 50 Quick Connects to a queue (#42108)
resource/aws_ecs_service: Fix missing volume_configuration and service_connect_configurations values from state read/refresh (#41998)
resource/aws_ecs_service: Mark service_connect_configuration.service.discovery_name and service_connect_configuration.service.client_alias.dns_name as Computed (#41998)
resource/aws_msk_cluster: Fix Provider produced inconsistent final plan errors when configuration_info.revision is unknown (#42037)
resource/aws_quicksight_data_set: Fix perpetual diff when refresh_properties is not configured (#42076)
resource/aws_s3_bucket_lifecycle_configuration: Removes incorrect warning for empty rule.filter (#42036)
resource/aws_sns_topic_subscription: Fix to handle eventually consistent subscription read operations (#42093)
resource/aws_sqs_queue: Fix waiting for SQS Queue... attributes create: timeout while waiting errors when sqs_managed_sse_enabled = false or omitted and kms_master_key_id is not set but kms_data_key_reuse_period_seconds is set to a non-default value. (#42062)
resource/aws_workspaces_workspace: Properly update workspace_properties.running_mode_auto_stop_timeout_in_minutes when modified (#40953)

`v5.93.0`

Compare Source

FEATURES:

New Resource: aws_api_gateway_rest_api_put (#41375)

ENHANCEMENTS:

data-source/aws_ecr_pull_through_cache_rule: Add custom_role_arn and upstream_repository_prefix attributes (#41933)
resource/aws_bedrockagent_agent: Add memory_configuration configuration block (#39970)
resource/aws_codepipeline: Adds trigger_all attribute (#42008)
resource/aws_codepipeline: Removal of trigger argument now properly removes custom trigger definitions (#42008)
resource/aws_cognitoidp_user_pool: Mark the username_configuration and username_configuration.case_sensitive arguments as optional and computed. This will future proof the provider against upstream API changes which may return a default value for the block when omitted during create operations. (#35439)
resource/aws_datasync_task: Add task_mode argument (#39979)
resource/aws_ecr_pull_through_cache_rule: Add custom_role_arn and upstream_repository_prefix arguments (#41933)
resource/aws_ecr_pull_through_cache_rule: Correct plan-time validation of ecr_repository_prefix to support a value of "ROOT" (#41933)
resource/aws_elasticache_cluster: Add configurable timeouts for create, update, and delete operations (#41940)
resource/aws_kinesisanalyticsv2_application: Allow runtime_environment to be updated in-place (#41935)
resource/aws_verified_access_endpoint: Add cidr_options, load_balancer.port_range, network_interface_options.port_range, and rds_options arguments (#41957)
resource/aws_verified_access_endpoint: Mark application_domain, domain_certificate_arn and endpoint_domain_prefix as Optional (#41957)
resource/aws_verified_access_endpoint: Support cidr and rds as valid values for endpoint_type (#41957)
resource/aws_verified_access_instance: Add cidr_endpoint_custom_subdomain argument and name_servers attribute (#41957)
resource/aws_verified_access_trust_provider: Add native_application_oidc_options and sse_specification arguments (#41957)

BUG FIXES:

resource/aws_db_instance: Fix InvalidParameterCombination: To enable the Advanced mode of Database Insights, modify your cluster to enable Performance Insights and set the retention period for Performance Insights to at least 465 days errors when enabling database_insights_mode on existing instances (#41960)
resource/aws_eip: Prevents application from failing when hitting "InvalidAction" error for specific regions (#41920)
resource/aws_elasticache_replication_group: Retry InvalidReplicationGroupState exceptions during tagging operations (#41954)
resource/aws_elasticache_replication_group: Wait for replication group to become available before all modification operations (#40320)
resource/aws_iot_domain_configuration: Change domain_name to Computed (#41985)
resource/aws_lakeformation_opt_in: Fix error when expanding resource_data.table_wildcard attribute (#41939)

`v5.92.0`

Compare Source

NOTES:

resource/aws_kendra_data_source: The configuration.s3_configuration argument is deprecated. Use configuration.template_configuration instead, which supports the upgraded Amazon S3 connector. Amazon has ended support for the older architecture as of June 2024, and resources created with this argument cannot be edited or updated. See the Amazon Kendra documentation for additional details. (#35437)
resource/aws_kendra_data_source: The configuration.web_crawler_configuration argument is deprecated. Use configuration.template_configuration instead, which supports the Amazon Kendra Web Crawler connector v2.0. See the Amazon Kendra documentation for additional details. (#35437)

FEATURES:

New Data Source: aws_api_gateway_api_keys (#39335)
New Data Source: aws_eks_cluster_versions (#40741)
New Data Source: aws_identitystore_group_memberships (#31589)
New Data Source: aws_identitystore_users (#31688)
New Resource: aws_athena_capacity_reservation (#41858)

ENHANCEMENTS:

data-source/aws_connect_user: Add identity_info.secondary_email attribute (#41001)
data-source/aws_db_instance: Add database_insights_mode attribute (#41607)
data-source/aws_ebs_volume: Add create_time attribute (#41839)
data-source/aws_lb: Add ipam_pools attribute (#41822)
provider: Support aws-marketplace as a valid account ID in ARNs (#41867)
resource/aws_appconfig_extension_association: Add plan-time validation of extension_arn and resource_arn (#41907)
resource/aws_connect_user: Add identity_info.secondary_email attribute (#41001)
resource/aws_db_instance: Add database_insights_mode argument (#41607)
resource/aws_ebs_volume: Add create_time attribute (#41839)
resource/aws_kendra_data_source: Add configuration.template_configuration argument (#35437)
resource/aws_lb: Add ipam_pools configuration block (#41822)

BUG FIXES:

resource/aws_api_gateway_rest_api: Avoid unnecessary remove and add operations for vpc_endpoint_ids (#41836)
resource/aws_bedrockagent_agent: Fix instruction validator to consider multi-byte chars so not to artificially limit instruction length (#41921)
resource/aws_eks_cluster: Allow compute_config.node_role_arn to update in place when previously unset (#41925)
resource/aws_rds_cluster: Ensure that performance_insights_enabled takes effect when creating a cluster that is a member of a global cluster (#41737)
resource/aws_rds_cluster: Fix InvalidParameterCombination: To enable the Advanced mode of Database Insights, modify your cluster to enable Performance Insights and set the retention period for Performance Insights to at least 465 days errors when enabling database_insights_mode on existing clusters (#41737)
resource/aws_timestreaminfluxdb_db_instance: Set new computed value for secondary_availability_zone attribute when changing deployment_type (#41849)

`v5.91.0`

Compare Source

NOTES:

resource/aws_network_interface_permission: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#40797)

FEATURES:

New Resource: aws_network_interface_permission (#40797)
New Resource: aws_route53_records_exclusive (#41741)

ENHANCEMENTS:

resource/aws_codebuild_project: Add secondary_sources.auth configuration block (#40191)
resource/aws_kinesis_firehose_delivery_stream: Add msk_source_configuration.read_from_timestamp argument (#41794)
resource/aws_route53_hosted_zone_dnssec: Add configurable operation timeouts (#41741)
resource/aws_route53_key_signing_key: Add configurable operation timeouts (#41741)
resource/aws_route53_record: Add configurable operation timeouts (#41741)
resource/aws_route53_zone: Add configurable operation timeouts (#41741)
resource/aws_route53_zone_association: Add configurable operation timeouts (#41741)
resource/aws_timestreaminfluxdb_db_instance: Add network_type and port attributes. The following can now be updated in place: allocated_storage, db_instance_type, db_storage_type and deployment_type (#40661)
resource/aws_vpc_ipv4_cidr_block_association: Support optional import of the ipv4_ipam_pool_id and ipv4_netmask_length attributes (#41779)
resource/aws_vpc_ipv6_cidr_block_association: Support optional import of the ipv6_ipam_pool_id and ipv6_netmask_length attributes (#41779)
resource/aws_wafv2_ip_set: Add name_prefix argument and plan-time validation of name (#40889)
resource/aws_wafv2_regex_pattern_set: Add name_prefix argument and plan-time validation of name (#40889)
resource/aws_wafv2_web_acl: Add name_prefix argument (#40889)
resource/aws_wafv2_web_acl: Add rule.challenge_config argument (#40123)

BUG FIXES:

resource/aws_msk_cluster: Ensure that storage_mode updates are actually applied to the cluster (#41773)

`v5.90.1`

Compare Source

NOTES:

provider: Restore the godebug tlskyber=0 directive in go.mod. This disables the experimental the post-quantum key exchange mechanism X25519Kyber768Draft00, fixing failed or hanging network connections to various AWS services. This fixes a regression introduced in v5.90.0 (#41740)

FEATURES:

New Data Source: aws_datazone_domain (#41480)

ENHANCEMENTS:

resource/aws_codepipeline: Add stage.before_entry, stage.on_success and stage.on_failure configuration blocks (#41663)
resource/aws_mskconnect_connector: Allow connector_configuration to be updated in-place (#41685)
resource/aws_wafv2_rule_group: Add ja3_fingerprint and ja4_fingerprint to custom_key configuration blocks (#41719)
resource/aws_wafv2_rule_group: Add ja4_fingerprint to field_to_match configuration blocks (#41719)
resource/aws_wafv2_web_acl: Add ja3_fingerprint and ja4_fingerprint to custom_key configuration blocks (#41719)
resource/aws_wafv2_web_acl: Add ja4_fingerprint to field_to_match configuration blocks (#41719)

`v5.90.0`

Compare Source

BREAKING CHANGES:

resource/aws_s3_bucket_lifecycle_configuration: rule.noncurrent_version_expiration.noncurrent_days and rule.noncurrent_version_transition.noncurrent_days are Required (#40796)

NOTES:

data-source/aws_launch_template: elastic_gpu_specifications and elastic_inference_accelerator are deprecated. AWS no longer supports Elastic Graphics or Elastic Inference. (#41677)
provider: In preparation for Go 1.24, we are re-enabling the experimental post-quantum key exchange mechanism, X25519Kyber768Draft00. Previously, in environments using AWS Network Firewall, the Provider would hang due to a handshake issue between Go 1.23 and Network Firewall, which supported Suricata 6.0.9. We had disabled the post-quantum key exchange to resolve the issue. Since November 2024, AWS Network Firewall has upgraded to Suricata 7.0, which no longer has this issue. However, if you use AWS Network Firewall, we’d appreciate your help in identifying any remaining issues related to this change. (#41655)
provider: On December 3, 2024, Amazon SageMaker was renamed to Amazon SageMaker AI. While resource and data source names remain the same in the provider, documentation and error messages have been updated to reflect the name change. (#41673)
resource/aws_ecs_task_execution: overrides.inference_accelerator_overrides is deprecated. AWS no longer provides the Elastic Inference service. (#41676)
resource/aws_launch_template: elastic_gpu_specifications and elastic_inference_accelerator are deprecated. AWS no longer supports Elastic Graphics or Elastic Inference. (#41677)
resource/aws_opsworks_application: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_custom_layer: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_ecs_cluster_layer: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_ganglia_layer: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_haproxy_layer: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_instance: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_java_app_layer: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_memcached_layer: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_mysql_layer: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_nodejs_app_layer: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_permission: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_php_app_layer: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_rails_app_layer: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_rds_db_instance: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_stack: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_static_web_layer: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_opsworks_user_profile: OpsWorks is no longer supported by AWS. This resource is deprecated and will be removed in the next major version. (#41674)
resource/aws_sagemaker_notebook_instance: accelerator_types is deprecated and will be removed in a future version. Use instance_type instead. (#41673)

FEATURES:

New Resource: aws_dataexchange_event_action (#40552)
New Resource: aws_lakeformation_opt_in (#41611)

ENHANCEMENTS:

data-source/aws_cloudfront_cache_policy: Add arn attribute (#41660)
data-source/aws_cloudfront_origin_access_control: Add arn attribute (#41660)
data-source/aws_cloudfront_origin_access_identity: Add arn attribute (#41660)
data-source/aws_cloudfront_origin_request_policy: Add arn attribute (#41660)
data-source/aws_cloudfront_response_headers_policy: Add arn attribute (#41660)
data-source/aws_dx_connection: Add state attribute (#41575)
data-source/aws_opensearch_domain: Add cluster_config.node_options attribute (#40181)
resource/aws_account_region: Allow adoption of regions in an ENABLED or DISABLED state without an explicit import operation (#41678)
resource/aws_account_region: Prevent errors when the region is an ENABLING or DISABLING state during creation (#41678)
resource/aws_cloudfront_cache_policy: Add arn attribute (#41660)
resource/aws_cloudfront_continuous_deployment_policy: Add arn attribute (#41660)
resource/aws_cloudfront_field_level_encryption_config: Add arn attribute (#41660)
resource/aws_cloudfront_field_level_encryption_profile: Add arn attribute (#41660)
resource/aws_cloudfront_origin_access_control: Add arn attribute (#41660)
resource/aws_cloudfront_origin_access_identity: Add arn attribute (#41660)
resource/aws_cloudfront_origin_request_policy: Add arn attribute (#41660)
resource/aws_cloudfront_response_headers_policy: Add arn attribute (#41660)
resource/aws_ec2_client_vpn_endpoint: Add disconnect_on_session_timeout attribute (#41621)
resource/aws_mwaa_environment: Lower the minimum value of the max_webservers and min_webservers arguments from 2 to 1 in support of Amazon MWAA micro environments (#40244)
resource/aws_opensearch_domain: Add cluster_config.node_options configuration block in support of dedicated coordinator nodes (#40181)
resource/aws_osis_pipeline: Add vpc_options.vpc_endpoint_management argument (#38001)
resource/aws_prometheus_rule_group_namespace: Add arn attribute (#41645)
resource/aws_prometheus_rule_group_namespace: Add tags argument and tags_all attribute (#41645)
resource/aws_route53_traffic_policy: Add arn attribute (#41660)
resource/aws_route53_traffic_policy_instance: Add arn attribute (#41660)
resource/aws_s3_bucket_lifecycle_configuration: Adds warning validation to require exactly one of the elements of rule.filter (#41662)
resource/aws_s3_bucket_lifecycle_configuration: rule.noncurrent_version_expiration.noncurrent_days and rule.noncurrent_version_transition.noncurrent_days are Required. Technically this is a breaking change, but failure to configure this attribute would have led to InvalidArgument or MalformedXML errors (#40796)
resource/aws_waf_byte_match_set: Add arn attribute (#41660)
resource/aws_waf_sql_injection_match_set: Add arn attribute (#41660)

BUG FIXES:

ephemeral/aws_secrets_manager_random_password: Change exclude_characters from Bool to String (#41546)
resource/aws_ecs_service: Fix removal of all vpc_lattice_configurations blocks (#41594)
resource/aws_s3_bucket_lifecycle_configuration: Fix error when converting rule configuration from filter.prefix to filter.and.prefix (#41662)
resource/aws_s3_bucket_lifecycle_configuration: Fix error when converting rule configuration from prefix to filter.prefix or filter.and.prefix (#41662)
resource/aws_sagemaker_mlflow_tracking_server: Increased the timeout from 30 to 45 minutes (#41463)
resource/aws_vpclattice_target_group: Retry ConflictException errors on delete (#41594)

`v5.89.0`

Compare Source

FEATURES:

New Resource: aws_macie2_organization_configuration (#41475)
New Resource: aws_neptunegraph_graph (#41216)
New Resource: aws_quicksight_role_membership (#41589)
New Resource: aws_rds_shard_group (#41254)
New Resource: aws_xray_resource_policy (#41517)

ENHANCEMENTS:

data-source/aws_cloudwatch_log_data_protection_policy_document: Add configuration argument (#41524)
data-source/aws_rds_cluster: Add cluster_scalability_type attribute (#41254)
data-source/aws_rds_cluster: Add database_insights_mode attribute (#41254)
data-source/aws_s3_bucket_object: Add application/yaml to the list of Content-Types that return a body (#41443)
data-source/aws_s3_object: Add application/yaml to the list of Content-Types that return a body (#41443)
data-source/aws_s3_object: Add checksum_crc64nvme attribute (#41015)
resource/aws_autoscaling_policy: Add target_tracking_configuration.customized_metric_specification.period argument to support high-resolution metrics (#41385)
resource/aws_db_instance: Add RequiredWith validation password_wo and password_wo_version. Remove PreferWriteOnlyAttribute validation (#41562)
resource/aws_docdb_cluster: Add RequiredWith validation master_password_wo and master_password_wo_version. Remove PreferWriteOnlyAttribute validation (#41562)
resource/aws_dx_connection: Add 25Gbps and 400Gbps as supported bandwidth values (#41547)
resource/aws_dx_hosted_connection: Add 25Gbps as a supported bandwidth value (#41547)
resource/aws_dx_lag: Add 400Gbps as a supported connections_bandwidth value (#41547)
resource/aws_launch_template: Add network_interfaces.ena_srd_specification configuration block (#41367)
resource/aws_lb: Add enable_zonal_shift support for Application Load Balancers (#41335)
resource/aws_macie2_classification_job: Allow tags to be updated in-place (#41266)
resource/aws_macie2_custom_data_identifier: Allow tags to be updated in-place (#41266)
resource/aws_macie2_findings_filter: Allow tags to be updated in-place (#41266)
resource/aws_macie2_member: Allow tags to be updated in-place (#41266)
resource/aws_nat_gateway: Make it possible to move from secondary_private_ip_address_count to secondary_private_ip_addresses for private NAT Gateways (#41403)
resource/aws_rds_cluster: Add RequiredWith validation master_password_wo and master_password_wo_version. Remove PreferWriteOnlyAttribute validation (#41562)
resource/aws_rds_cluster: Add cluster_scalability_type argument (#41254)
resource/aws_rds_cluster: Add database_insights_mode argument (#41254)
resource/aws_rds_cluster: Support "" as a valid value for engine_mode (#41254)
resource/aws_rds_instance: Support iam-db-auth-error as a valid value for enabled_cloudwatch_logs_exports (#41408)
resource/aws_redshift_cluster: Add RequiredWith validation master_password_wo and master_password_wo_version. Remove PreferWriteOnlyAttribute validation (#41562)
resource/aws_redshiftseverless_namespace: Add RequiredWith validation admin_user_password_wo and admin_user_password_wo_version. Remove PreferWriteOnlyAttribute validation (#41562)
resource/aws_s3_directory_bucket: The default value for data_redundancy is SingleLocalZone if location.type is LocalZone (#40944)
resource/aws_s3_object: Add checksum_crc64nvme attribute (#41015)
resource/aws_s3_object_copy: Add checksum_crc64nvme attribute (#41015)
resource/aws_secretsmanager_secret_version: Add RequiredWith validation secret_string_wo and secret_string_wo_version. Remove PreferWriteOnlyAttribute validation (#41562)
resource/aws_ssm_parameter: Remove PreferWriteOnlyAttribute validation (#41562)

BUG FIXES:

resource/aws_cloudwatch_log_delivery: Fix Provider produced inconsistent result error on s3_delivery_configuration.suffix_path (#41497)
resource/aws_ec2_fleet: Add spot_options.max_total_price, spot_options.min_target_capacity, spot_options.single_instance_type, and spot_options.single_availability_zone arguments (#41272)
resource/aws_lb_listener: Ensure that routing_http_response_server_enabled, routing_http_response_strict_transport_security_header_value, routing_http_response_access_control_allow_origin_header_value, routing_http_response_access_control_allow_methods_header_value, routing_http_response_access_control_allow_headers_header_value, routing_http_response_access_control_allow_credentials_header_value, routing_http_response_access_control_expose_headers_header_value, routing_http_response_access_control_max_age_header_value, routing_http_response_content_security_policy_header_value, routing_http_response_x_content_type_options_header_value, routing_http_response_x_frame_options_header_value, routing_http_request_x_amzn_mtls_clientcert_serial_number_header_name, routing_http_request_x_amzn_mtls_clientcert_issuer_header_name, routing_http_request_x_amzn_mtls_clientcert_subject_header_name, routing_http_request_x_amzn_mtls_clientcert_validity_header_name, routing_http_request_x_amzn_mtls_clientcert_leaf_header_name, routing_http_request_x_amzn_mtls_clientcert_header_name, routing_http_request_x_amzn_tls_version_header_name, and routing_http_request_x_amzn_tls_cipher_suite_header_name are updated if tcp_idle_timeout_seconds does not change (#41299)
resource/aws_macie2_classification_job: Ensure that only status and tags can be updated in-place (#41266)
resource/aws_nat_gateway: Allow secondary_allocation_ids to be updated in-place (#41403)
resource/aws_redshift_cluster: Fix master_username validation (#41556)
resource/aws_s3_bucket_lifecycle_configuration: Prevents InvalidRequest error when rule.and.object_size_less_than not set. (#41542)
resource/aws_servicequotas_service_quota: Does not leave stuck resource in state when service quota not supported in current region. (#41509)

`v5.88.0`

Compare Source

NOTES:

resource/aws_s3_bucket_lifecycle_configuration: A warning diagnostic has been added for configurations where rule.expiration.expired_object_delete_marker is set with either rule.expiration.date or rule.expiration.days. While historically the provider allowed this invalid configuration, the migration of this resource to the Terraform Plugin Framework in v5.86.0 resulted in this misconfiguration surfacing as a hard inconsistent result after apply error. This diagnostic aims to direct users how to resolve the issue at plan time. See this issue comment for additional context. (#41462)

FEATURES:

New Data Source: aws_cloudwatch_contributor_managed_insight_rules (#41472)
New Resource: aws_cloudwatch_contributor_managed_insight_rule (#41449)
New Resource: aws_qbusiness_application (#35249)

ENHANCEMENTS:

resource/aws_bedrock_model_invocation_logging_configuration: Add video_data_delivery_enabled argument (#41317)
resource/aws_db_instance: Add password_wo write-only attribute (#41366)
resource/aws_docdb_cluster: Add master_password_wo write-only attribute (#41413)
resource/aws_glue_partition: Add storage_descriptor.additional_locations argument (#41434)
resource/aws_redshift_cluster: Add master_password_wo write-only attribute (#41411)
resource/aws_redshiftserverless_namespace: Add admin_user_password_wo write-only attribute (#41412)
resource/aws_secretsmanager_secret_version: Add secret_string_wo write-only attribute (#41371)

BUG FIXES:

data-source/aws_codebuild_fleet: Prevents panic when scaling_configuration is not empty. (#41377)
resource/aws_amplify_domain_association: Prevents unexpected state error when creating with multiple sub_domain (#36961)
resource/aws_bedrock_model_invocation_logging_configuration: Set embedding_data_delivery_enabled, image_data_delivery_enabled, and text_data_delivery_enabled arguments as optional with default value of true (#41317)
resource/aws_cloudwatch_contributor_insight_rule: Fix enable/disable rule state (#41449)
resource/aws_dynamodb_table: Fixes long delay in creation of replicas (#41451)

`v5.87.0`

Compare Source

FEATURES:

New Resource: aws_cloudwatch_contributor_insight_rule (#41373)

ENHANCEMENTS:

resource/aws_dynamodb_table_export: Add export_type and incremental_export_specification arguments (#41303)
resource/aws_quicksight_data_source: Add parameters.s3.role_arn argument to allow override an account-wide role for a specific S3 data source (#41284)
resource/aws_rds_cluster: Add master_password_wo write-only attribute (#41314)
resource/aws_rekognition_stream_processor: Deprecates stream_processor_arn in favor of arn. (#41271)
resource/aws_ssm_parameter: Add value_wo write-only attribute (#40952)
resource/aws_vpclattice_access_log_subscription: Add service_network_log_type argument (#41304)

BUG FIXES:

data-source/aws_dynamodb_table: Add missing on_demand_throughput and global_secondary_index.*.on_demand_throughput attributes to resolve read error (#41350)
resource/aws_cloudformation_stack_set_instance: Prevents overly-long creation times and possible OperationInProgress errors (#41388)
resource/aws_detective_member: No longer fails with unexpected status when adding Organization member accounts. (#41344)
resource/aws_ec2_transit_gateway_route_table_association: Fix deleting and recreating resource when dependencies changes don't require the resource be recreated. (#41292)
resource/aws_internet_gateway: Fix to continue deletion when attachment is not found (#41346)

`v5.86.1`

Compare Source

BUG FIXES:

data-source/aws_vpclattice_service: Fix regression resulting in AccessDeniedError attempting to list tags (#41295)
data-source/aws_vpclattice_service_network: Fix regression resulting in AccessDeniedError attempting to list tags (#41295)
resource/aws_cloudtrail: Fix regression issue where sns_topic_name shows perpectual diff when an ARN of a SNS topic from a different region is specified (#41279)
resource/aws_s3_bucket_lifecycle_configuration: Fixes "inconsistent result" error when rule[*].prefix is an empty string. (#41296)

`v5.86.0`

Compare Source

NOTES:

resource/aws_s3_bucket_lifecycle_configuration: When upgrading existing resources with no defined prefix, the Terraform plan will show the removal of prefix from state. This is expected, and should not occur on subsequent plans. (#41159)

ENHANCEMENTS:

data-source/aws_rds_cluster: Add monitoring_interval and monitoring_role_arn attributes (#41002)
provider: Support us-isof-east-1 and us-isof-south-1 as valid AWS Regions (#41243)
resource/aws_fms_policy: Add security_service_policy_data.policy_option.network_acl_common_policy argument to allow creation of FMS-managed NACL rules (#41219)
resource/aws_rds_cluster: Add monitoring_interval and monitoring_role_arn arguments (#41002)
resource/aws_sqs_queue: Accommodate accounts that take longer to process with customizable timeouts. (#41232)

BUG FIXES:

resource/aws_gamelift_game_server_group: Correctly plan tags_all value (#41256)
resource/aws_instance: Properly cancel spot instance requests on destroy when instance_lifecycle is spot (#41206)
resource/aws_route53_zone: Fix panic: runtime error: invalid memory address or nil pointer dereference when deleting the resource would otherwise return an error (#41260)
resource/aws_s3_bucket_lifecycle_configuration: Properly handle default value of transition_default_minimum_object_size (#41159)
resource/aws_wafv2_web_acl: Properly set rule during import (#41205)

`v5.85.0`

Compare Source

NOTES:

resource/aws_macie2_invitation_accepter: Maintainers are unable to acceptance test the regression fix included in this release. This patch is best effort, and we ask for community help in assessing the change. (#41163)

FEATURES:

New Data Source: aws_vpc_ipam (#40459)
New Data Source: aws_vpc_ipams (#40459)
New Ephemeral Resource: aws_secretsmanager_random_password (#41106)
New Resource: aws_guardduty_member_detector_feature (#35625)
New Resource: aws_route53domains_domain (#37885)
New Resource: aws_timestreamquery_scheduled_query (#41145)
New Resource: aws_vpclattice_resource_configuration (#41019)
New Resource: aws_vpclattice_service_network_resource_association (#41057)

ENHANCEMENTS:

data-source/aws_ec2_transit_gateway_dx_gateway_attachment: Add arn attribute (#41086)
data-source/aws_ec2_transit_gateway_peering_attachment: Add arn attribute (#41087)
data-source/aws_ec2_transit_gateway_vpc_attachment: Add arn attribute (#41084)
data-source/aws_ecs_task_definition: Add missing attributes (#41081)
data-source/aws_launch_template: Add network_interfaces.connection_tracking_specification attribute (#41184)
resource/aws_appflow_connector_profile: Add connector_profile_config.connector_profile_properties.salesforce.use_privatelink_for_metadata_and_authorization argument (#41175)
resource/aws_autoscaling_policy: Add target_tracking_configuration.customized_metric_specification.metrics.metric_stat.period argument to support high-resolution metrics (#41066)
resource/aws_bedrockagent_data_source: Add data_source_configuration.confluence_configuration, data_source_configuration.salesforce_configuration, data_source_configuration.share_point_configuration, and data_source_configuration.web_configuration arguments (#40711)
resource/aws_bedrockagent_knowledge_base: Add knowledge_base_configuration.vector_knowledge_base_configuration.embedding_model_configuration and knowledge_base_configuration.vector_knowledge_base_configuration.supplemental_data_storage_configuration arguments (#40737)
resource/aws_bedrockagent_knowledge_base: Improve retry handling for IAM propagation and OpenSearch data access propagation errors (#40737)
resource/aws_cloudtrail : Add sns_topic_arn attribute (#41168)
resource/aws_cloudtrail_event_data_store: Add suspend argument (#40607)
resource/aws_cloudwatch_event_connection: Add invocation_connectivity_parameters argument (#41144)
resource/aws_ec2_transit_gateway_peering_attachment: Add arn attribute (#41087)
resource/aws_ec2_transit_gateway_vpc_attachment: Add arn attribute (#41084)
resource/aws_ecs_task_definition: Add enable_fault_injection argument (#41078)
resource/aws_launch_template: Add network_interfaces.connection_tracking_specification argument (#41184)
resource/aws_media_convert_queue: Add concurrent_jobs argument (#41012)
resource/aws_medialive_multiplex_program: Add configurable create timeout (#40972)
resource/aws_organizations_account: Add configurable timeouts for Create and Delete (#41059)
resource/aws_pinpoint_email_channel: Add orchestration_sending_role_arn argument (#41043)
resource/aws_pipes_pipe: Add kms_key_identifier argument (#41082)
resource/aws_rds_cluster: Support instance as a valid value for enabled_cloudwatch_logs_exports (#41111)
resource/aws_rekognition_project: Add tags argument and tags_all attribute (#41192)
resource/aws_vpc_endpoint: Add resource_configuration_arn and service_network_arn arguments to support creating VPC Endpoints of type Resource and ServiceNetwork (#41116)
resource/aws_vpc_endpoint_security_group_association: Add import support (#41042)

BUG FIXES:

data-source/aws_opensearchserverless_collection: Prevent errant AutoFlex errors when setting created_date and last_modified_date attributes (#41105)
resource/aws_ami_ids: Fix sort_ascending to sort in ascending order (#40529)
resource/aws_bedrockagent_knowledge_base: Remove ForceNew behavior from role_arn argument (#41072)
resource/aws_cloudwatch_log_delivery: Fix Provider produced inconsistent result after apply errors for s3_delivery_configuration.enable_hive_compatible_path (#41122)
resource/aws_cloudwatch_log_delivery: Mark field_delimiter as Computed (#41122)
resource/aws_cognito_identity_provider: Correct plan-time validation of provider_name to count UTF-8 characters properly (#41187)
resource/aws_cognito_user_group: Correct plan-time validation of name to count UTF-8 characters properly (#41187)
resource/aws_cognito_user_pool_client: Correct plan-time validation of callback_urls, default_redirect_uri, logout_urls, and supported_identity_providers` to count UTF-8 characters properly (#41187)
resource/aws_dms_replication_task: Fix panic: interface conversion: interface {} is float64, not string (#41096)
resource/aws_elasticache_serverless_cache: Fix InvalidParameterCombination error during update (#40969)
resource/aws_iam_server_certificate: Allow update of name, name_prefix, and path without forcing new resource (#41186)
resource/aws_macie2_invitation_accepter: Properly set invitation_id when calling the AcceptInvitation API (#41163)

`v5.84.0`

Compare Source

NOTES:

resource/aws_kms_custom_key_store: We cannot acceptance test the support for external key stores added in this release. The impementation is best effort and we ask for community help in testing. (#40557)

FEATURES:

New Ephemeral Resource: aws_eks_cluster_auth (#40660)
New Resource: aws_media_packagev2_channel_group (#38406)

ENHANCEMENTS:

data-source/aws_ami: Add uefi_data attribute (#40210)
data-source/aws_ec2_instance_type: Add bandwidth_weightings, boot_modes, default_network_card_index, efa_maximum_interfaces, ena_srd_supported, inference_accelerators.memory_size, media_accelerators, network_cards, neuron_devices, nitro_enclaves_support, nitro_tpm_support, nitro_tpm_supported_versions, phc_support, supported_cpu_features, total_inference_memory, total_media_memory, and total_neuron_device_memory attributes (#40717)
data-source/aws_elb_hosted_zone_id: Add hosted zone ID for mx-central-1 AWS Region (#40940)
data-source/aws_lb_hosted_zone_id: Add hosted zone IDs for mx-central-1 AWS Region (#40940)
data-source/aws_s3_bucket: Add hosted zone ID for mx-central-1 AWS Region (#40940)
provider: Support mx-central-1 as a valid AWS Region (#40940)
resource/aws_ami: Add uefi_data argument (#40210)
resource/aws_ami_copy: Add uefi_data attribute (#40210)
resource/aws_ami_from_instance: Add uefi_data attribute (#40210)
resource/aws_cloudtrail: Add userIdentity.arn to advanced_event_selector.field_selector (#40629)
resource/aws_elasticache_user: engine is now case insensitive (#40794)
resource/aws_elasticache_user_group: engine is now case insensitive (#40794)
resource/aws_globalaccelerator_accelerator: Add arn attribute (#40930)
resource/aws_globalaccelerator_custom_routing_accelerator: Add arn attribute (#40930)
resource/aws_globalaccelerator_custom_routing_listener: Add arn attribute (#40930)
resource/aws_globalaccelerator_listener: Add arn attribute (#40930)
resource/aws_kms_custom_key_store: Add support for external key stores (#40557)
resource/aws_lb_listener: Add routing_http_response_server_enabled, routing_http_response_strict_transport_security_header_value, routing_http_response_access_control_allow_origin_header_value, routing_http_response_access_control_allow_methods_header_value, routing_http_response_access_control_allow_headers_header_value, routing_http_response_access_control_allow_credentials_header_value, routing_http_response_access_control_expose_headers_header_value, routing_http_response_access_control_max_age_header_value, routing_http_response_content_security_policy_header_value, routing_http_response_x_content_type_options_header_value, routing_http_response_x_frame_options_header_value, routing_http_request_x_amzn_mtls_clientcert_serial_number_header_name, routing_http_request_x_amzn_mtls_clientcert_issuer_header_name, routing_http_request_x_amzn_mtls_clientcert_subject_header_name, routing_http_request_x_amzn_mtls_clientcert_validity_header_name, routing_http_request_x_amzn_mtls_clientcert_leaf_header_name, routing_http_request_x_amzn_mtls_clientcert_header_name, routing_http_request_x_amzn_tls_version_header_name, and routing_http_request_x_amzn_tls_cipher_suite_header_name arguments in support of HTTP header modification (#40736)
resource/aws_route53_health_check: Add triggers argument to support synchronization with upstream CloudWatch alarm changes (#40918)
resource/aws_sagemaker_endpoint_configuration: Support setting production_variants.managed_instance_scaling and shadow_production_variants.managed_instance_scaling to 0 (#40882)

BUG FIXES:

resource/aws_apprunner_vpc_ingress_connection: Change ingress_vpc_configuration, name, and service_arn to ForceNew (#40927)
resource/aws_datasync_location_s3: Fix location URI global ID and subdirectory (...) does not match pattern "..." errors on Read when s3_bucket_arn is an S3 on Outposts access point (#40929)
resource/aws_ecs_task_definition: Correctly detect differences in volume.configure_at_launch and volume.docker_volume_configuration (#40853)
resource/aws_lambda_invocation: Fix failed input transformations when upgrading from a version less than v5.1.0 with an input that cannot be marshaled into a map[string]interface{} (#40958)
resource/aws_lambda_invocation: Prevent a new invocation when upgrading from a version less than v5.1.0 with no configuration changes (#40958)
resource/aws_msk_cluster: Prevent persistent differences when broker_node_group_info.0.storage_info.0.ebs_storage_info.0.provisioned_throughput is unset (#40910)
resource/aws_msk_cluster: Properly disable provisioned throughput when a previously configured broker_node_group_info.0.storage_info.0.ebs_storage_info.0.provisioned_throughput block is removed (#40910)
resource/aws_ses_receipt_rule: Retry errors caused by IAM eventual consistency (#40873)

`v5.83.1`

Compare Source

BUG FIXES:

resource/aws_route53_record: Correct fdqn value if name is a wildcard domain name (the leftmost label is *). This fixes a regression introduced in v5.83.0 (#40868)

`v5.83.0`

Compare Source

NOTES:

provider: The retry handling in the apigatewayv2 client has been updated to more extensively match ConflictException error responses. This change should be transparent to users, but if any unexpected changes in behavior with apigatewayv2 resources occur following an upgrade to this release, please open a bug report. (#40840)
resource/aws_api_gateway_domain_name_access_association: Deprecates id in favor of arn. (#40626)
resource/aws_route53_cidr_location: Deprecates id. (#40626)
resource/aws_s3_directory_bucket: Deprecates id in favor of bucket. (#40626)

FEATURES:

New Data Source: aws_cloudwatch_event_buses (#40662)
New Data Source: aws_ecs_clusters (#40638)
New Data Source: aws_route53_records (#38186)
New Ephemeral Resource: aws_cognito_identity_openid_token_for_developer_identity (#40763)
New Resource: aws_bedrockagent_agent_collaborator (#40559)
New Resource: aws_cleanrooms_membership (#35165)
New Resource: aws_cloudwatch_log_delivery (#40731)
New Resource: aws_cloudwatch_log_delivery_destination (#40731)
New Resource: aws_cloudwatch_log_delivery_destination_policy (#40731)
New Resource: aws_cloudwatch_log_delivery_source (#40731)
New Resource: aws_cloudwatch_log_index_policy (#40594)
New Resource: aws_vpclattice_resource_gateway (#40821)

ENHANCEMENTS:

data-source/aws_codebuild_fleet: Add compute_configuration attribute (#40752)
data-source/aws_dms_endpoint: Add kafka_settings.sasl_mechanism attribute (#36918)
data-source/aws_elb_hosted_zone_id: Add hosted zone ID for ap-southeast-7 AWS Region (#40850)
data-source/aws_lb_hosted_zone_id: Add hosted zone IDs for ap-southeast-7 AWS Region (#40850)
data-source/aws_rds_certificate: Add default_for_new_launches attribute (#40536)
data-source/aws_rds_engine_version: Add supports_certificate_rotation_without_restart, supports_integrations, and supports_local_write_forwarding attributes (#40700)
data-source/aws_s3_bucket: Add hosted zone ID for ap-southeast-7 AWS Region (#40850)
data-source/aws_vpc_endpoint_service: Add region attribute (#40795)
data-source/aws_vpc_endpoint_service: Add service_regions argument (#40795)
provider: Support ap-southeast-7 as a valid AWS Region (#40849)
resource/aws_appflow_flow: Add data_transfer_api attribute to destination_flow_config_list.destination_connector_properties.salesforce (#34937)
resource/aws_cloudfront_distribution: Add grpc_config argument to default_cache_behavior and ordered_cache_behavior configuration blocks (#40762)
resource/aws_codebuild_fleet: Add compute_configuration argument (#40752)
resource/aws_cognito_user_pool: Add email_mfa_configuration argument (#40734)
resource/aws_cognito_user_pool: Add sign_in_policy and web_authn_configuration arguments (#40765)
resource/aws_cognito_user_pool: Add user_pool_tier argument (#40633)
resource/aws_dms_endpoint: Add kafka_settings.sasl_mechanism argument (#36918)
resource/aws_ecr_account_setting: Add valid values for registry policy scope to name and value arguments (#40772)
resource/aws_eip_association: Adds validation to only allow one of instance_id or network_interface_id (#40769)
resource/aws_eks_node_group: Add node_repair_config configuration block (#40698)
resource/aws_elasticache_user: Add VALKEY as supported value for 'engine' argument (#40764)
resource/aws_elasticache_user_group: Add VALKEY as supported value for 'engine' argument (#40764)
resource/aws_emr_studio: Add encryption_key_arn argument (#40771)
resource/aws_quicksight_user: Add user_invitation_url attribute (#40775)
resource/aws_rds_cluster: Support iam-db-auth-error as a valid value for enabled_cloudwatch_logs_exports (#40789)
resource/aws_rds_integration: Add data_filter argument (#40816)
resource/aws_s3_object_copy: Add override_provider configuration block, allowing tags inherited from the provider default_tags configuration block to be ignored (#40689)

BUG FIXES:

resource/aws_api_gateway_domain_name: Fixed error when adding policy to existing private domain name (#40708)
resource/aws_apigatewayv2_api: Don't overwrite the configured values of description, name or version if they are not present in the OpenAPI definition body (#40707)
resource/aws_apigatewayv2_route: Fix retry handling of ConflictException error responses (#40840)
resource/aws_cloudfront_cache_policy: Fix panic: interface conversion: interface {} is nil, not map[string]interface {} when parameters_in_cache_key_and_forwarded_to_origin.cookies_config, parameters_in_cache_key_and_forwarded_to_origin.headers_config, or parameters_in_cache_key_and_forwarded_to_origin.query_strings_config are empty (#40815)
resource/aws_codebuild_fleet: Allow scaling_configuration to be removed on Update (#40773)
resource/aws_codebuild_project: Allow file_system_locations to be removed on Update (#40842)
resource/aws_ec2_instance_connect_endpoint: Set fips_dns_name to an empty value ("") when no value is returned from the EC2 API. This fixes known-after-apply loops in Regions that don't support FIPS endpoints (#37939)
resource/aws_emr_studio: Fix issue with IAM/KMS policy eventual consistency handling not working (#40771)
resource/aws_glue_catalog_database: Fix crash when expanding create_table_default_permission with a nil principal block (#40761)
resource/aws_instance: Always set http_tokens when metadata_options is updated (#40727)
resource/aws_instance: Set new computed value for public_dns and public_ip attributes when changing instance_type, user_data, or user_data_base64 (#40710)
resource/aws_internet_gateway: Handle operation error EC2: DetachInternetGateway, ..., api error InvalidInternetGatewayID.NotFound: ... errors on delete for resources deleted out-of-band (#40790)
resource/aws_internet_gateway_attachment: Handle operation error EC2: DetachInternetGateway, ..., api error InvalidInternetGatewayID.NotFound: ... errors on delete for resources deleted out-of-band (#40790)
resource/aws_quicksight_data_set: Correctly expand logical_table_map.tag_column_operation.tags.column_description (#40713)
resource/aws_rds_instance Fix manage_master_user_password being updated in state when update errors (#40538)
resource/aws_route53_record: Fix perpetual diff if alias.name contains characters that the Route 53 API escapes (#40154)
resource/aws_route53_zone: Fix perpetual diff if name contains characters that the Route 53 API escapes (#40154)
resource/aws_ses_identity_notification_topic: Prevent destroy failure when resource is already deleted outside of Terraform (#40684)
resource/aws_sesv2_configuration_set: Fix handling of delivery_options.max_delivery_seconds when not configured (#40670)
resource/aws_sesv2_configuration_set_event_destination: Retry IAM eventual consistency errors (#40843)
resource/aws_sqs_queue: Fix timeout error on creation if sqs_managed_sse_enabled=true and kms_data_key_reuse_period_seconds is configured (#40729)

`v5.82.2`

Compare Source

BUG FIXES:

data-source/aws_lb_listener: Add mutual_authentication.advertise_trust_store_ca_names attribute. This fixes a regression introduced in v5.82.0 causing setting mutual_authentication: Invalid address to set: []string{"mutual_authentication", "0", "advertise_trust_store_ca_names"} errors (#40658)

`v5.82.1`

Compare Source

ENHANCEMENTS:

resource/aws_autoscaling_group: Add availability_zone_distribution argument (#40634)

BUG FIXES:

data-source/aws_iam_policy_document: Reverts plan-time validation for statement sid (#40639)

`v5.82.0`

Compare Source

NOTES:

resource/aws_resourcegroups_resource: The format of the read-only id attribute has changed to prevent inconsistent parsing which resulted in provider crashes under certain conditions. The new format is a comma-delimited string combining group_arn and resource_arn in their entirety. Configuarations relying on the previous format may need to be updated to continue functioning correctly. (#40579)

FEATURES:

New Data Source: aws_servicecatalogappregistry_attribute_group_associations (#38306)
New Resource: aws_api_gateway_domain_name_access_association (#40566)
New Resource: aws_cloudfront_vpc_origin (#40239)
New Resource: aws_memorydb_multi_region_cluster (#40376)
New Resource: aws_networkmanager_dx_gateway_attachment (#40546)
New Resource: aws_rds_cluster_snapshot_copy (#40398)

ENHANCEMENTS:

data-source/aws_dx_gateway: Add arn attribute (#40546)
data-source/aws_iam_policy_document: Add plan-time validation that the statement sid is valid, including on alphanumeric characters (#40562)
data-source/aws_vpc_endpoint: Add service_region attribute (#40583)
resource/aws_bedrockagent_agent: Add agent_collaboration attribute to configure agent collaboration role (#40543)
resource/aws_cloudfront_distribution: Add origin.vpc_origin_config argument (#40239)
resource/aws_db_parameter_group: Support import of name_prefix argument (#40622)
resource/aws_dx_gateway: Add arn attribute (#40546)
resource/aws_fsx_lustre_file_system: Add efa_enabled argument (#40381)
resource/aws_lb_listener: Add advertise_trust_store_ca_names attribute to the mutual_authentication configuration block (#40550)
resource/aws_memorydb_cluster: Add multi_region_cluster_name argument (#40376)
resource/aws_networkmanager_attachment_accepter: Add edge_locations attribute (#40546)
resource/aws_resourcegroups_resource: Add import support (#40579)
resource/aws_vpc_endpoint: Add service_region argument (#40583)

BUG FIXES:

data-source/aws_acmpca_certificate_authority: Ignore AccessDeniedException: ... is not authorized to perform: acm-pca:GetCertificateAuthorityCsr on resource: ... errors for RAM-shared CAs (#39952)
data-source/aws_licensemanager_received_license: Fix setting entitlements: Invalid address to set: []string{"entitlements", "0", "overage"} errors (#40621)
resource/aws_amplify_domain_association: No longer ignores changes to certificate_settings when updating. (#40589)
resource/aws_amplify_domain_association: Prevent "unexpected state" error when setting certificate_settings.type to CUSTOM. (#40589)
resource/aws_amplify_domain_association: Prevent ValidationException when setting certificate_settings.type to AMPLIFY_MANAGED. (#40589)
resource/aws_amplify_domain_association: Prevent permanent diff when certificate_settings not set. (#40589)
resource/aws_amplify_domain_association: Prevents panic in some circumstances when certificate_settings is not set during update. (#40589)
resource/aws_api_gateway_domain_name: Correct arn for private custom domain names (#40566)
resource/aws_codeconnections_host: Mark vpc_configuration.tls_certificate as Optional (#40574)
resource/aws_elasticache_replication_group: Prevent perpetual diff which triggers resource replacement on at_rest_encryption_enabled when engine is valkey. (#40514)
resource/aws_lakeformation_permissions: Add support for IAMPrincipals principal group (#38600)
resource/aws_lakeformation_permissions: Fix refreshing state so order is not considered in permissions and permissions_with_grant_option attributes (#38047)
resource/aws_lakeformation_resource_lf_tag: Fix panic when resource tries to destroy a LFTag reference that does not exist (#40584)
resource/aws_lambda_invocation: Set new computed value for result attribute when changing input attribute, for lifecycle scope "CRUD" (#34263)
resource/aws_medialive_channel: Added missing teletext_destination_settings. (#33797)
resource/aws_rds_cluster: Fix issue with waiter when modifying allocated_storage (#40601)
resource/aws_resourcegroups_resource: Fix crash when parsing certain ARN formats (#40579)
resource/aws_s3_bucket: Destroying a bucket with force_destroy = true can now delete objects with non-XML-safe keys (#40537)
resource/aws_s3_directory_bucket: Destroying a directory bucket with force_destroy = true can now delete objects with non-XML-safe keys (#40537)
resource/aws_secretsmanager_secret_rotation: Fix bug where automatically_after_days was not being set properly when schedule_expression had been set previously (#34295)
resource/aws_secretsmanager_secret_rotation: Retry rotation in case it has not yet propagated when previously an error would occur: InvalidRequestException: A previous rotation isn't complete. That rotation will be reattempted. (#34295)
resource/aws_sqs_queue_redrive_allow_policy: Fix perpetual redrive_allow_policy diffs (#40604)

`v5.81.0`

Compare Source

FEATURES:

New Data Source: aws_servicecatalogappregistry_attribute_group (#38188)
New Ephemeral Resource: aws_ssm_parameter (#40313)
New Resource: aws_bedrock_inference_profile (#40294)
New Resource: aws_cloudwatch_log_anomaly_detector (#40437)
New Resource: aws_ecr_account_setting (#40219)
New Resource: aws_msk_single_scram_secret_association (#37056)
New Resource: aws_servicecatalogappregistry_attribute_group (#38183)
New Resource: aws_servicecatalogappregistry_attribute_group_association (#38290)

ENHANCEMENTS:

data-source/aws_api_gateway_domain_name: Add policy and domain_name_id attributes (#40364)
data-source/aws_servicecatalogappregistry_application: Add tags attribute (#38243)
data-source/aws_sesv2_configuration_set: Add delivery_options.max_delivery_seconds and tracking_options.https_policy attributes (#40194)
resource/aws_api_gateway_base_path_mapping: Add domain_name_id argument (#40447)
resource/aws_api_gateway_domain_name: Add policy argument and domain_name_id attribute (#40364)
resource/aws_api_gateway_domain_name: Support PRIVATE as a valid value for endpoint_configuration.types argument, enabling custom domain name support for private REST API endpoints (#40364)
resource/aws_ebs_snapshot_copy: Add completion_duration_minutes argument (#40336)
resource/aws_glue_catalog_table_optimizer: Add configuration.retention_configuration and configuration.orphan_file_deletion_configuration attributes. (#40199)
resource/aws_instance: Add enable_primary_ipv6 argument to add support for enabling primary IPv6 addresses on EC2 instances (#36425)
resource/aws_kinesis_stream: Add plan-time validation that shard_count would not exceed the AWS account's shard quota when the data stream capacity mode is PROVISIONED, preventing the provider from retrying for 1 hour in the case that the quota is exceeded. This functionality requires the kinesis:DescribeLimits IAM permission (#40499)
resource/aws_kinesis_stream: Add plan-time validation that creation of an on-demand stream would not exceed the AWS account's data stream quota, preventing the provider from retrying for 1 hour in the case that the quota is exceeded. This functionality requires the kinesis:DescribeLimits IAM permission (#40499)
resource/aws_msk_replicator: Add topic_replication.topic_name_configuration argument (#40101)
resource/aws_network_interface: Add enable_primary_ipv6 argument to add support for enabling primary IPv6 addresses for network interfaces (#36425)
resource/aws_networkfirewall_firewall_policy: Add stateful_engine_options.flow_timeouts argument (#39996)
resource/aws_rds_cluster: Add serverlessv2_scaling_configuration.seconds_until_auto_pause argument (#40441)
resource/aws_rds_global_cluster: Add tags argument and tags_all attribute (#40470)
resource/aws_sagemaker_notebook_instance: Support notebook-al2-v3 value for platform_identifier (#40484)
resource/aws_servicecatalogappregistry_application: Add tags argument and tags_all attribute (#38243)
resource/aws_sesv2_configuration_set: Add delivery_options.max_delivery_seconds and tracking_options.https_policy arguments (#40194)

BUG FIXES:

data-source/aws_kinesis_stream: Fix InvalidArgumentException: NextToken and StreamName cannot be provided together errors when the data stream has more than 1000 shards (#40499)
resource/aws_ce_cost_category: Change rule from TypeSet to TypeList as order is significant (#40521)
resource/aws_fsx_windows_file_system: Fix plan-time validation of throughput_capacity validation to allow values up to 12228 (#40468)
resource/aws_networkfirewall_logging_configuration: Correctly manage all configured logging_configuration.log_destination_configs (#40092)
resource/aws_rds_cluster: Fix InvalidDBClusterStateFault errors when deleting clusters that are members of a global cluster (#40333)
resource/aws_rds_cluster: Fix InvalidParameterValue: Serverless v2 maximum capacity 0.0 isn't valid. The maximum capacity must be at least 1.0. errors when removing serverlessv2_scaling_configuration in an update (#40511)
resource/aws_rds_cluster: Respect storage_type when restoring from S3 (#40471)
resource/aws_rds_cluster: Respect storage_type when restoring from snapshot (#40471)
resource/aws_rds_cluster: Respect storage_type when restoring to a point in time (#40471)
resource/aws_rds_global_cluster: Mark database_name as Computed. This prevents resource recreation when the source cluster specifies a database_name (#40469)

`v5.80.0`

Compare Source

FEATURES:

New Resource: aws_codeconnections_connection (#40300)
New Resource: aws_codeconnections_host (#40300)
New Resource: aws_s3tables_namespace (#40420)
New Resource: aws_s3tables_table (#40420)
New Resource: aws_s3tables_table_bucket (#40420)
New Resource: aws_s3tables_table_bucket_policy (#40420)
New Resource: aws_s3tables_table_policy (#40420)

ENHANCEMENTS:

resource/aws_bedrockagent_agent: Increase instruction max length for validation to 8000 (#40279)
resource/aws_dynamodb_table_replica: Add deletion_protection_enabled argument (#35359)
resource/aws_rds_cluster: Adjust serverlessv2_scaling_configuration.max_capacity and serverlessv2_scaling_configuration.min_capacity minimum values to 0 to support Amazon Aurora Serverless v2 scaling to 0 ACUs (#40230)
resource/aws_s3_directory_bucket: Support LocalZone as a valid value for location.type, enabling support for Amazon S3 Express One Zone in AWS Dedicated Local Zones (#40339)

BUG FIXES:

resource/aws_bedrock_provisioned_model_throughput: Properly manages tags_all when planning. (#40305)
resource/aws_connect_contact_flow: Fix deserialization failed, failed to decode response body with invalid JSON errors on Read (#40419)
resource/aws_rds_cluster_instance: Fix error when destroying from a read replica cluster (#40409)

`v5.79.0`

Compare Source

FEATURES:

New Resource: aws_vpc_block_public_access_exclusion (#40235)
New Resource: aws_vpc_block_public_access_options (#40233)

ENHANCEMENTS:

resource/aws_eks_cluster: Add compute_config, storage_config, and kubernetes_network_config.elastic_load_balancing arguments for EKS Auto Mode (#40370)
resource/aws_eks_cluster: Add remote_network_config argument for EKS Auto Mode (#40371)
resource/aws_lambda_event_source_mapping: Add metrics_config argument (#40322)
resource/aws_lambda_event_source_mapping: Add provisioned_poller_config argument (#40303)
resource/aws_rds_cluster: Add ability to promote read replica cluster to standalone (#40337)
resource/aws_vpc_endpoint_service: Add supported_regions argument (#40346)

BUG FIXES:

resource/aws_fsx_openzfs_file_system: Increase maximum value of disk_iops_configuration.iops from 350000 to 400000 for deployment_type = "SINGLE_AZ_2" (#40359)

`v5.78.0`

Compare Source

NOTES:

resource/aws_s3_bucket_lifecycle_configuration: Lifecycle configurations can now be applied to directory buckets (#40268)

FEATURES:

New Resource: aws_iam_organizations_features (#40164)

ENHANCEMENTS:

data-source/aws_memorydb_cluster: Add engine attribute (#40224)
data-source/aws_memorydb_snapshot: Add cluster_configuration.engine attribute (#40224)
resource/aws_memorydb_cluster: Add engine argument (#40224)
resource/aws_memorydb_snapshot: Add cluster_configuration.engine attribute (#40224)

BUG FIXES:

data-source/aws_rds_reserved_instance_offering: When product_description (e.g., "postgresql") is a substring of multiple products, fix Error: multiple RDS Reserved Instance Offerings matched; use additional constraints to reduce matches to a single RDS Reserved Instance Offering (#40281)
provider: Suppress Warning: AWS account ID not found for provider when skip_requesting_account_id is true (#40264)
resource/aws_batch_job_definition: Fix crash when specifying eksProperties or ecsProperties block (#40172)
resource/aws_bedrock_guardrail: Fix perpetual diff if multiple content_policy_config.filters_configs are specified. (#40304)
resource/aws_chatbot_slack_channel_configuration: Fix inconsistent provider result when order of sns_topic_arnschanges (#40253)
resource/aws_chatbot_teams_channel_configuration: Fix inconsistent provider result when order of sns_topic_arnschanges (#40291)
resource/aws_db_instance: When changing storage_type from io1 or io2 to gp3, fix bug causing error InvalidParameterCombination: You must specify both the storage size and iops when modifying the storage size or iops on a DB instance that has iops (#37257)
resource/aws_db_instance: When changing a gp3 volume's allocated_storage to a value larger than the threshold value for engine, fix bug causing error InvalidParameterCombination: You must specify both the storage size and iops when modifying the storage size or iops on a DB instance that has iops (#28847)

`v5.77.0`

Compare Source

NOTES:

New ephemeral resources aws_kms_secrets, aws_lambda_invocation, and aws_secretsmanager_secret_version now support ephemeral values. (#40009)

FEATURES:

New Ephemeral Resource: aws_kms_secrets (#40009)
New Ephemeral Resource: aws_lambda_invocation (#39988)
New Ephemeral Resource: aws_secretsmanager_secret_version (#40009)
New Resource: aws_rds_instance_state (#40180)

ENHANCEMENTS:

data-source/aws_ami: Add warning diagnostic when most_recent is true and certain filter criteria are missing (#40211)
data-source/aws_ecs_service: Add availability_zone_rebalancing attribute (#40225)
resource/aws_ecs_service: Add availability_zone_rebalancing attribute (#40225)
resource/aws_ecs_service: Add vpc_lattice_configurations argument (#40177)
resource/aws_ecs_task_definition: Add versionConsistency argument to container_definitions (#40216)
resource/aws_rds_global_cluster: Add endpoint argument to point to the writer DB instance in the current primary cluster (#39960)

BUG FIXES:

data-source/aws_subnet: Set tags from the DescribeSubnets response, removing the need for the ec2:DescribeTags IAM permission (#40144)
resource/aws_cognito_user_pool: Fix crash when hashing nil schema element (#40195)
resource/aws_eks_addon: Fix crash when pod_identity_association is modified (#40168)
resource/aws_eks_addon: Fix to prevent persistent differences when pod_identity_association is changed (#40168)

`v5.76.0`

Compare Source

FEATURES:

New Resource: aws_vpc_security_group_vpc_association (#40069)

ENHANCEMENTS:

resource/aws_medialive_channel: Add missing h265 codec settings (#40071)

BUG FIXES:

resource/aws_api_gateway_integration: Fix BadRequestException: Invalid mapping expression specified and NotFoundException: Invalid parameter name specified errors when making updates to request_parameters and/or cache_key_parameters (#40124)
resource/aws_api_gateway_method: Fix BadRequestException: Invalid mapping expression specified and NotFoundException: Invalid parameter name specified errors when making updates to request_parameters (#40124)
resource/aws_autoscaling_group: Handle eventual consistency issues that occur when using a launch_template that is updated causing ValidationError: You must use a valid fully-formed launch template. (#40088)
resource/aws_eip: Properly surface errors during deletion when ipam_pool_id is set (#40082)
resource/aws_elasticache_reserved_cache_node: Fix Provider returned invalid result object after apply errors (#40090)
resource/aws_iam_group_policies_exclusive: Add validation to prevent null values in policy_names (#40076)
resource/aws_iam_group_policy_attachments_exclusive: Add validation to prevent null values in policy_arns (#40076)
resource/aws_iam_instance_profile: Handle eventual consistency issues that occur when this resource is updated and has dependents (#40088)
resource/aws_iam_role_policies_exclusive: Add validation to prevent null values in policy_names (#40076)
resource/aws_iam_role_policy_attachments_exclusive: Add validation to prevent null values in policy_arns (#40076)
resource/aws_iam_user_policies_exclusive: Add validation to prevent null values in policy_names (#40076)
resource/aws_iam_user_policy_attachments_exclusive: Add validation to prevent null values in policy_arns (#40076)
resource/aws_launch_template: Handle eventual consistency issues that occur when this resource is updated and has dependents (#40088)

`v5.75.1`

Compare Source

ENHANCEMENTS:

data-source/aws_cloudwatch_event_bus: Add description attribute (#39980)
resource/aws_api_gateway_account: Add attribute reset_on_delete to properly reset CloudWatch Role ARN on deletion. (#40004)
resource/aws_cloudwatch_event_bus: Add description argument (#39980)

BUG FIXES:

resource/aws_api_gateway_deployment: Rolls back validation of canary_settings and stage_description when stage_name not set. (#40067)
resource/aws_dynamodb_table: Allow table TTL to be disabled by allowing ttl[0].attribute_name to be set when ttl[0].enabled is false (#40046)
resource/aws_sagemaker_domain: Fix issue causing a ValidationException on updates when RStudio is disabled on the domain (#40049)

`v5.75.0`

Compare Source

BREAKING CHANGES:

resource/aws_api_gateway_stage: Add canary_settings.deployment_id attribute as required (#39929)

NOTES:

provider: validation of arguments implementing the custom ARNType will properly surface validation errors (#40008)
resource/aws_api_gateway_stage: deployment_id was added to canary_settings as a required attribute. This breaking change was necessary to make canary_settings functional. Without this change all canary traffic was routed to the main deployment (#39929)

FEATURES:

New Data Source: aws_spot_datafeed_subscription (#39647)

ENHANCEMENTS:

data-source/aws_batch_job_definition: Add init_containers, share_process_namespace, and image_pull_secrets attributes (#40019)
resource/aws_batch_job_definition: Add init_containers and share_process_namespace arguments (#40019)
resource/aws_batch_job_definition: Increase maximum number of containers arguments to 10 (#40019)
resource/aws_eks_addon: Add pod_identity_association argument (#38357)
resource/aws_iam_user_login_profile: Mark the password argument as sensitive (#39991)

BUG FIXES:

resource/aws_api_gateway_deployment: Fix destroy error when canary stage still exists on resource (#39929)
resource/aws_codedeploy_deployment_group: Remove maximum items limit on the alarm_configuration.alarms argument (#39971)
resource/aws_eks_addon: Handle ResourceNotFound exceptions during resource destruction (#38357)
resource/aws_elasticache_reserved_cache_node: Fix Value Conversion Error during resource creation (#39945)
resource/aws_lb_listener: Fix errors when updating the tcp_idle_timeout_seconds argument for gateway load balancers (#40039)
resource/aws_lb_listener: Remove the default tcp_idle_timeout_seconds value, preventing ModifyListenerAttributes API calls when a value is not explicitly configured (#40039)
resource/aws_vpc_ipam_pool: Fix bug when public_ip_source = "amazon": The request can only contain PubliclyAdvertisable if the AddressFamily is IPv6 and PublicIpSource is byoip. (#40042)

`v5.74.0`

Compare Source

FEATURES:

New Data Source: aws_lb_listener_rule (#39865)
New Resource: aws_opensearch_authorize_vpc_endpoint_access (#39846)
New Resource: aws_ssmquicksetup_configuration_manager (#39931)

ENHANCEMENTS:

data-source/aws_imagebuilder_distribution_configuration: Add distribution.s3_export_configuration attribute (#35492)
data-source/aws_imagebuilder_image_recipe: Fix block_device_mapping.0.ebs.0.delete_on_termination: '' expected type 'bool', got unconvertible type 'string' errors (#39928)
resource/aws_codedeploy_deployment_group: Add termination_hook_enabled argument (#35482)
resource/aws_eks_cluster: Add zonal_shift_config argument (#39852)
resource/aws_imagebuilder_distribution_configuration: Add distribution.s3_export_configuration argument (#35492)
resource/aws_imagebuilder_image_pipeline: Allow container_recipe_arn and image_recipe_arn to be updated in-place (#39117)
resource/aws_keyspaces_keyspace: Add replication_specification argument (#36331)
resource/aws_launch_template: Add efa-only as a valid value for network_interfaces.interface_type (#39882)
resource/aws_transfer_server: Add TransferSecurityPolicy-Restricted-2024-06 as a valid value for security_policy_name (#39871)

BUG FIXES:

resource/aws_docdb_cluster: Use master_password on resource Create when snapshot_identifier is configured (#38193)
resource/aws_imagebuilder_container_recipe: Change component.parameter.name, component.parameter.value, target_repository.repository_name, and target_repository.service to ForceNew (#39117)
resource/aws_route53_record: Fix interface conversion: interface {} is nil, not map[string]interface {} panic when geolocation_routing_policy is empty (#39944)
resource/aws_ssm_patch_baseline: Update approval_rule.approve_after_days validation to allow a maximum value of 360 (#39949)
resource/aws_wafv2_web_acl: Fix decoding JSON: unexpected end of JSON input errors when updating from using rule_json to using rule (#39283)
resource/aws_wafv2_web_acl: Fix unmarshal error for incompatible types in rule_json (#39878)

`v5.73.0`

Compare Source

FEATURES:

New Data Source: aws_ssm_patch_baselines (#39779)
New Resource: aws_imagebuilder_lifecycle_policy (#35674)
New Resource: aws_resiliencehub_resiliency_policy (#38913)
New Resource: aws_sagemaker_hub (#39807)
New Resource: aws_sagemaker_mlflow_tracking_server (#39796)

ENHANCEMENTS:

data-source/aws_elasticache_reserved_cache_node_offering: Support valkey as valid value for product_description (#39745)
data-source/aws_lakeformation_data_lake_settings: Add parameters map attribute to read CROSS_ACCOUNT_VERSION (#39826)
data-source/aws_lb: Add enable_zonal_shift attribute (#39585)
resource/aws_apprunner_auto_scaling_configuration_version: Remove the upper limit on min_size and max_size (#39843)
resource/aws_batch_job_definition: Ensure that new revisions are created with tags (#39797)
resource/aws_codedeploy_deployment_config: Add zonal_config argument (#34850)
resource/aws_dynamodb_kinesis_streaming_destination: Add approximate_creation_date_time_precision argument (#38098)
resource/aws_elasticache_cluster: Support valkey as valid value for engine (#39745)
resource/aws_elasticache_global_replication_group: Support Valkey versions for engine_version (#39745)
resource/aws_elasticache_replication_group: Support Valkey versions for engine_version (#39745)
resource/aws_elasticache_replication_group: Support valkey as valid value for engine (#39745)
resource/aws_elasticache_serverless_cache: Support valkey as valid value for engine (#39745)
resource/aws_kinesis_firehose_delivery_stream: Add iceberg_configuration argument (#39844)
resource/aws_lakeformation_data_lake_settings: Add parameters map argument enabling CROSS_ACCOUNT_VERSION to be set (#39826)
resource/aws_lb: Add enable_zonal_shift argument (#39585)
resource/aws_lb_listener: Add tcp_idle_timeout_seconds argument (#39585)
resource/aws_route53profiles_association: Add regex and string length validation for name argument (#39798)
resource/aws_s3_bucket_object: Remove the call to kms:DescribeKey for the S3 default AWS managed key (alias/aws/s3) on Read (#39782)
resource/aws_s3_object: Remove the call to kms:DescribeKey for the S3 default AWS managed key (alias/aws/s3) on Read (#39782)
resource/aws_s3_object_copy: Remove the call to kms:DescribeKey for the S3 default AWS managed key (alias/aws/s3) on Read (#39782)
resource/aws_sagemaker_domain: Add default_user_settings.jupyter_lab_app_settings.app_lifecycle_management, default_user_settings.jupyter_lab_app_settings.built_in_lifecycle_config_arn, default_user_settings.jupyter_lab_app_settings.emr_settings, default_space_settings.jupyter_lab_app_settings.app_lifecycle_management, default_space_settings.jupyter_lab_app_settings.built_in_lifecycle_config_arn, default_space_settings.jupyter_lab_app_settings.emr_settings, default_user_settings.auto_mount_home_efs, default_user_settings.canvas_app_settings.emr_serverless_settings, default_user_settings.studio_web_portal_settings.hidden_instance_types, default_user_settings.code_editor_app_settings.app_lifecycle_management, default_user_settings.code_editor_app_settings.built_in_lifecycle_config_arn, and tag_propagation arguments (#39774)
resource/aws_sagemaker_domain: Allow app_network_access_type and app_security_group_management to be updated in-place (#39774)
resource/aws_sagemaker_feature_group: Add feature_definition.collection_config, feature_definition.collection_type, and throughput_config arguments (#39805)
resource/aws_sagemaker_space: Add space_settings.code_editor_app_settings.app_lifecycle_management and space_settings.jupyter_lab_app_settings.app_lifecycle_management arguments (#39800)
resource/aws_sagemaker_user_profile: Add user_settings.auto_mount_home_efs, user_settings.canvas_app_settings.emr_serverless_settings, user_settings.code_editor_app_settings.app_lifecycle_management, user_settings.code_editor_app_settings.built_in_lifecycle_config_arn, user_settings.jupyter_lab_app_settings.app_lifecycle_management, user_settings.jupyter_lab_app_settings.built_in_lifecycle_config_arn, user_settings.jupyter_lab_app_settings.emr_settings and user_settings.studio_web_portal_settings.hidden_instance_types arguments (#39774)

BUG FIXES:

data-source/aws_workspaces_bundle: Return the first matching bundle when searching by name. This fixes a regression introduced in v5.72.0 causing multiple WorkSpaces Bundles matched; use additional constraints to reduce matches to a single WorkSpaces Bundle errors (#39777)
resource/aws_dynamodb_table: Fix validation error when optional attribute in on_demand_throughput is excluded (#39784)
resource/aws_ecr_repository_policy: Fix persistent validation errors when malformed policy content is written to state (#39842)
resource/aws_elasticache_serverless_cache: Fix InvalidParameterValue: This API supports only cross-engine upgrades to Valkey engine currently errors on Update (#39745)
resource/aws_iam_policy: Fix persistent validation errors when malformed policy content is written to state (#39842)
resource/aws_iam_role_policy: Fix persistent validation errors when malformed policy content is written to state (#39842)
resource/aws_kms_key: Fix persistent validation errors when malformed policy content is written to state (#39842)
resource/aws_quicksight_data_set: Fix InvalidParameterValueException: Invalid RowLevelPermissionDataSet. Namespace parameter should not be specified for Version 2 errors on Create and Update (#39778)
resource/aws_route53_record: Allow creation of records with ttl=0 (#39728)
resource/aws_s3_bucket_policy: Fix persistent validation errors when malformed policy content is written to state (#39842)
resource/aws_secretsmanager_secret: Fix persistent validation errors when malformed policy content is written to state (#39842)
resource/aws_security_group_rule: Remove from state when rule not found. This fixes a regression introduced in v5.60.0 (#39834)

`v5.72.1`

Compare Source

FEATURES:

New Resource: aws_iam_group_policy_attachments_exclusive (#39732)
New Resource: aws_iam_user_policy_attachments_exclusive (#39731)

ENHANCEMENTS:

resource/aws_resourceexplorer2_view: Add scope argument (#39744)

BUG FIXES:

data-source/aws_batch_job_definition: Properly handles ignored tags. (#39734)
data-source/aws_cognito_user_pool: Properly handles ignored tags. (#39734)
resource/aws_cognito_user_pool: Properly handles ignored tags. (#39734)
resource/aws_dynamodb_table: Fix crash when billing_mode is set to PAY_PER_REQUEST without global_secondary_index updates (#39752)
resource/aws_dynamodb_table_replica: Properly handles default and ignored tags. (#39734)
resource/aws_resourceexplorer2_index: Correctly mark incomplete AGGREGATOR indexes as tainted on Create (#39744)

`v5.72.0`

Compare Source

NOTES:

This version contains all the features, enhancements, and bug fixes from the v5.71.0 release which was removed from the Terraform Registry (#39692)
resource/aws_iam_role: The managed_policy_arns argument is deprecated. Use the aws_iam_role_policy_attachments_exclusive resource instead. (#39718)

FEATURES:

New Resource: aws_iam_role_policy_attachments_exclusive (#39718)

ENHANCEMENTS:

data-source/aws_workspaces_directory: Add saml_properties attribute (#39060)
resource/aws_appflow_flow: Add source_flow_config.source_connector_properties.sapo_data.pagination_config and source_flow_config.source_connector_properties.sapo_data.parallelism_config attributes (#38932)
resource/aws_cloudwatch_event_rule: Add tags to AWS API request on Update to support ABAC aws:RequestTag conditions (#39648)
resource/aws_cloudwatch_event_target: Add appsync_target configuration block (#37773)
resource/aws_dynamodb_table: Add on_demand_throughput and global_secondary_index.on_demand_throughput arguments (#37799)
- resource/aws_lakeformation_permissions: Allow principal to be an AWS federated-user arn (#33298)
resource/aws_rds_cluster: Increase maximum value of serverlessv2_scaling_configuration.max_capacity and serverlessv2_scaling_configuration.min_capacity from 128 to 256 (#39697)
resource/aws_rds_cluster_instance: Treat storage-optimization status as success when creating or updating cluster DB instances (#39691)
resource/aws_workspaces_directory: Add saml_properties configuration block (#39060)

BUG FIXES:

data-source/aws_ssm_document: Correct arn for automation documents (#39705)
resource/aws_cognito_user_pool: Fixes error when schema has empty string_attribute_constraints or number_attribute_constraints (#20386)
resource/aws_ssm_document: Correct arn for automation documents (#39705)

`v5.70.0`

Compare Source

NOTES:

resource/aws_s3_bucket_lifecycle_configuration: Amazon S3 now applies a default minimum object size of 128 KB for S3 Lifecycle transition rules to any S3 storage class. This new default behavior will be applied to any new or modified S3 Lifecycle configuration. You can override this new default and customize the minimum object size for S3 Lifecycle transition rules to any value (#39578)
resource/aws_simpledb_domain: The aws_simpledb_domain resource has been deprecated and will be removed in a future version. Use Amazon DynamoDB instead (#39536)
resource/aws_worklink_fleet: The aws_worklink_fleet resource has been deprecated and will be removed in a future version. Use Amazon WorkSpaces Secure Browser instead (#39538)
resource/aws_worklink_website_certificate_authority_association: The aws_worklink_website_certificate_authority_association resource has been deprecated and will be removed in a future version. Use Amazon WorkSpaces Secure Browser instead (#39538)

FEATURES:

New Resource: aws_backup_logically_air_gapped_vault (#39098)
New Resource: aws_ec2_transit_gateway_default_route_table_association (#39496)
New Resource: aws_ec2_transit_gateway_default_route_table_propagation (#39517)
New Resource: aws_iam_group_policies_exclusive (#39554)
New Resource: aws_iam_user_policies_exclusive (#39544)
New Resource: aws_securityhub_standards_control_association (#39511)

ENHANCEMENTS:

data-source/aws_ebs_snapshot: Add start_time attribute (#39557)
resource/aws_bedrockagent_agent_action_group: Add prepare_agent argument (#39486)
resource/aws_bedrockagent_data_source: Add vector_ingestion_configuration.custom_transformation_configuration argument (#39556)
resource/aws_globalaccelerator_endpoint_group: Add endpoint_configuration.attachment_arn argument (#39507)
resource/aws_lambda_code_signing_config: Add tags argument and tags_all attribute (#39535)
resource/aws_lambda_event_source_mapping: Add arn attribute (#39535)
resource/aws_lambda_event_source_mapping: Add tags argument and tags_all attribute (#39535)
resource/aws_s3_bucket_lifecycle_configuration: Add transition_default_minimum_object_size argument (#39578)

BUG FIXES:

resource/aws_bedrockagent_agent: Fix "Provider produced inconsistent result after apply" error on update due to customer_encryption_key_arn not being passed during update (#39565)
resource/aws_bedrockagent_agent: Fix "Provider produced inconsistent result after apply" error on update due to prompt_override_configuration not being passed when not modified (#39565)
resource/aws_bedrockagent_knowledge_base: Change knowledge_base_configuration and storage_configuration to ForceNew (#39567)
resource/aws_ec2_transit_gateway_vpc_attachment: Remove default value for security_group_referencing_support argument and mark as Computed. This suppresses the diffs shown for resources created with v5.68.0 (or earlier) (#39519)
resource/aws_opensearchserverless_lifecycle_policy: Fix "Provider produced inconsistent result after apply" error on update due to policy_version computed attribute changing (#39528)
resource/aws_opensearchserverless_security_policy: Fix "Provider produced inconsistent result after apply" error on update due to policy_version computed attribute changing (#39528)
resource/aws_quicksight_dashboard: Fix mapping of sheets.filter_controls.list.cascading_control_configuration and sheets.parameter_controls.list.cascading_control_configuration attributes (#39453)

`v5.69.0`

Compare Source

NOTES:

provider: This release contains an upstream AWS SDK for Go v2 change to DynamoDB service endpoints. The Terraform AWS Provider will now connect to a DynamoDB endpoint in the format (account-id).ddb.(region).amazonaws.com instead of dynamodb.(region).amazonaws.com. If your network configuration blocks outgoing traffic to DynamoDB based on DNS names or endpoint URLs, you must adjust your configuration, because the service's DNS name will change. You may instead disable account-based endpoints for DynamoDB by setting account_id_endpoint_mode = disabled in a shared config file or setting the AWS_ACCOUNT_ID_ENDPOINT_MODE environment variable to disabled (#39505)
provider: Updates to Go 1.23.1. The issue with AWS Network Firewall dropping TLS handshake ClientHello messages after the v5.65.0 upgrade to Go 1.23.0, temporarily resolved by the v5.67.0 downgrade to Go 1.22.7, has been addressed by removing the X25519Kyber768Draft00 key exchange mechanism from the HTTP client used to make AWS API calls (#39432)
resource/aws_alb_listener: When importing a listener that has either a default action top-level target group ARN or a default action defining a forward action defining a target group with an ARN, include both in the configuration to avoid import differences (#39413)
resource/aws_lb_listener: When importing a listener that has either a default action top-level target group ARN or a default action defining a forward action defining a target group with an ARN, include both in the configuration to avoid import differences (#39413)

ENHANCEMENTS:

data-source/aws_connect_instance: Add tags attribute (#39402)
data-source/aws_ec2_transit_gateway: Add security_group_referencing_support attribute (#34542)
data-source/aws_ec2_transit_gateway_vpc_attachment: Add security_group_referencing_support attribute (#34542)
data-source/aws_opensearchserverless_collection: Add failure_code and failure_reason attributes (#38995)
resource/aws_bedrockagent_agent: Add guardrail_configuration argument (#39440)
resource/aws_connect_instance: Add tags argument and tags_all attribute (#39402)
resource/aws_ec2_transit_gateway: Add security_group_referencing_support argument (#34542)
resource/aws_ec2_transit_gateway_vpc_attachment: Add security_group_referencing_support argument (#34542)
resource/aws_ec2_transit_gateway_vpc_attachment_accepter: Add security_group_referencing_support argument (#34542)
resource/aws_ecs_service: Add volume_configuration.managed_ebs_volume.tag_specifications attribute (#38662)
resource/aws_identitystore_group: Allow display_name to be updated in-place (#39416)
resource/aws_kinesis_stream: Tag on Create to support attribute-based access control (ABAC) (#39504)
resource/aws_quicksight_data_source: Add credentials.secret_arn argument (#29034)

BUG FIXES:

data-source/aws_opensearchserverless_vpc_endpoint: Correctly set security_group_ids. This requires a call to the EC2 DescribeVpcEndpoints API (#39454)
data-source/aws_region: Fix lookups for the ap-southeast-5 Region (#39389)
resource/aws_alb_listener: Fix several of the arguments to avoiding setting zero-values in situations where they shouldn't causing warnings and import differences (#39413)
resource/aws_alb_listener: Remove the limitation preventing setting both default_action.0.target_group_arn and default_action.0.forward to align with the AWS API which allows you to specify both a target group list and a top-level target group ARN if the ARNs match (#39413)
resource/aws_db_instance: Allow replica database to be added to domain on create (#39448)
resource/aws_db_instance_role_association: Fix intermittent failure when instance is not in an available state (#39457)
resource/aws_dynamodb_tag: Fix propagation timeout when multiple tags exist (#39491)
resource/aws_ecs_cluster: Fix validation error with name attribute. (#38993)
resource/aws_ecs_cluster_capacity_providers: Fix validation error with name attribute. (#38993)
resource/aws_iam_role: Retry ConcurrentModificationExceptions during role creation (#39429)
resource/aws_inspector2_enabler: Fix AccessDeniedException: Lambda code scanning is not supported in ... errors (#38254)
resource/aws_inspector2_member_association: Improve handling of AccessDeniedException errors during creation (#38254)
resource/aws_lb_listener: Fix several of the arguments to avoiding setting zero-values in situations where they shouldn't causing warnings and import differences (#39413)
resource/aws_lb_listener: Remove the limitation preventing setting both default_action.0.target_group_arn and default_action.0.forward to align with the AWS API which allows you to specify both a target group list and a top-level target group ARN if the ARNs match (#39413)
resource/aws_lb_listener_rule: Fix several of the arguments to avoiding setting zero-values in situations where they shouldn't causing warnings and import differences (#39413)
resource/aws_lb_target_group: Fix several of the arguments to avoiding setting zero-values in situations where they shouldn't causing warnings and import differences (#39413)
resource/aws_medialive_multiplex: Fix to properly handle read failures during delete operations which were previously ignored (#39498)
resource/aws_opensearchserverless_vpc_endpoint: Change name and vpc_id to ForceNew (#39454)
resource/aws_opensearchserverless_vpc_endpoint: Correctly set security_group_ids. This requires a call to the EC2 DescribeVpcEndpoints API (#39454)
resource/aws_rds_cluster_role_association: Fix intermittent failure when cluster is not in an available state (#39457)
resource/aws_vpc_dhcp_options: Fix a bug causing a panic crash when an option is absent (#39427)

`v5.68.0`

Compare Source

NOTES:

resource/aws_iam_role: The inline_policy argument is deprecated. Use the aws_iam_role_policy resource instead. If Terraform should exclusively manage all inline policy associations (the current behavior of this argument), use the aws_iam_role_policies_exclusive resource as well. (#39203)
resource/aws_lexv2models_slot_type: Within the composite_slot_type_setting block, the subslots argument has been renamed sub_slots. See the linked pull request for additional justification on this change. The previous misnaming effectively made this argument unusable, therefore a breaking change in a minor version was deemed acceptable. (#39353)

FEATURES:

New Data Source: aws_elasticache_reserved_cache_node_offering (#29832)
New Data Source: aws_securityhub_standards_control_associations (#39334)
New Data Source: aws_synthetics_runtime_version (#39180)
New Data Source: aws_synthetics_runtime_versions (#39180)
New Resource: aws_appsync_source_api_association (#39323)
New Resource: aws_elasticache_reserved_cache_node (#29832)
New Resource: aws_iam_role_policies_exclusive (#39203)
New Resource: aws_pinpointsmsvoicev2_opt_out_list (#25036)
New Resource: aws_pinpointsmsvoicev2_phone_number (#25036)
New Resource: aws_sesv2_account_suppression_attributes (#39325)

ENHANCEMENTS:

resource/aws_s3_bucket_server_side_encryption_configuration: S3 directory buckets now support SSE-KMS (#39366)
resource/aws_ses_receipt_rule: Add iam_role_arn argument to s3_action configuration block (#39364)
resource/aws_synthetics_canary: Increase maximum name length to 255 characters (#39315)

BUG FIXES:

provider: Allows assume_role.role_arn to be an empty string when there is a single assume_role entry. (#39328)
resource/aws_amplify_app: Fix failure when unsetting the environment_variables argument (#39397)
resource/aws_dynamodb_table: Fix changing replicas to the default Managed by DynamoDB encryption setting (#31284)
resource/aws_dynamodb_table: Handle eventual consistency of tag creation and removal (#39326)
resource/aws_dynamodb_table_replica: Handle eventual consistency of tag creation and removal (#39326)
resource/aws_dynamodb_tag: Handle eventual consistency of tag creation and removal (#39326)
resource/aws_mq_broker: Fix engine_version mismatch with RabbitMQ 3.13 and ActiveMQ 5.18 and above (#39024)
resource/aws_mwaa_environment: Fix creating environments with endpoint_management = "CUSTOMER" (#39394)
resource/aws_opensearchserverless_access_policy: Fix incompatible type error when setting policy (#39322)

`v5.67.0`

Compare Source

BREAKING CHANGES:

resource/aws_lexv2models_slot_type: Within the value_selection_setting.advanced_recognition_setting block, the audio_recognition_setting argument has been renamed audio_recognition_strategy (#39254)

NOTES:

provider: Downgrades to Go 1.22.6. A small number of users have reported failed or hanging network connections using the version of the Terraform AWS provider which was first built with Go 1.23.0 (v5.65.0). At this point, maintainers have been unable to reproduce failures, but enough distinct users have reported issues that we are going to attempt downgrading to Go 1.22.6 for the next provider release. We will continue to coordinate with users and AWS in an attempt to identify the root cause, using this upcoming release with a reverted Go build version as a data point. (#39256)
resource/aws_lexv2models_slot_type: Within the value_selection_setting.advanced_recognition_setting block, the audio_recognition_setting argument has been renamed audio_recognition_strategy. See the linked pull request for additional justification on this change. The previous misnaming effectively made this argument unusable, therefore a breaking change in a minor version was deemed acceptable. (#39254)

FEATURES:

New Data Source: aws_codebuild_fleet (#39237)
New Resource: aws_cloudformation_stack_instances (#36794)
New Resource: aws_codebuild_fleet (#39237)
New Resource: aws_computeoptimizer_enrollment_status (#35349)
New Resource: aws_computeoptimizer_recommendation_preferences (#35349)
New Resource: aws_costoptimizationhub_enrollment_status (#36440)
New Resource: aws_costoptimizationhub_preferences (#36526)
New Resource: aws_datazone_asset_type (#38812)
New Resource: aws_datazone_environment_profile (#38581)
New Resource: aws_lambda_function_recursion_config (#39153)

ENHANCEMENTS:

data-source/aws_acm_certificate: Mark domain and tags as Optional. This enables certificates to be matched based on tags (#31453)
data-source/aws_kinesis_stream: Add encryption_type and kms_key_id attributes (#39212)
datasource/aws_cognito_user_pool: Deprecates user_pool_tags in favor of standard tags. (#39260)
provider: Adds support for IAM role chaining. The provider attribute assume_role now accepts multiple elements. (#39255)
resource/aws_amplify_app: Add cache_config argument (#39215)
resource/aws_cloudhsm_v2_cluster: Add mode argument (#39206)
resource/aws_cloudhsm_v2_cluster: Support hsm2m.medium as a valid value for hsm_type (#39206)
resource/aws_codebuild_project: Add fleet attribute in environment configuration block (#39237)
resource/aws_kinesis_firehose_delivery_stream: Add snowflake_configuration.buffering_internal and snowflake_configuration.buffering_size arguments (#39214)
resource/aws_quicksight_user: Add READER_PRO, AUTHOR_PRO, and ADMIN_PRO as valid values for the user_role argument (#39220)
resource/aws_sagemaker_domain: Add default_user_settings.domain_settings.docker_settings configuration block (#35416)
resource/aws_sagemaker_domain: Add default_user_settings.studio_web_portal_settings, default_space_settings.jupyter_lab_app_settings, default_space_settings.space_storage_settings, default_space_settings.custom_posix_user_config, and default_space_settings.custom_file_system_config configuration blocks (#38457)
resource/aws_sagemaker_endpoint_configuration: Add production_variants.managed_instance_scaling and shadow_production_variants.managed_instance_scaling configuration blocks (#35479)
resource/aws_sagemaker_model: Add primary_container.inference_specification_name and container.inference_specification_name arguments (#35873)
resource/aws_sagemaker_model: Add primary_container.model_data_source.s3_data_source.model_access_config, primary_container.multi_model_config, container.model_data_source.s3_data_source.model_access_config, and ``container.multi_model_config` configuration blocks (#35873)
resource/aws_sagemaker_user_profile: Add user_settings.studio_web_portal_settings configuration block (#38567)
resource/aws_sfn_state_machine: Add plan-time validation of definition using the AWS Step Functions Validation API (#39229)

BUG FIXES:

data-source/aws_eks_cluster: Return created_at as an RFC3339 formatted timestamp (#24183)
datasource/aws_cognito_user_pool: Fixes value conversion error. (#39260)
provider: Fix empty tags drift on fwprovider resources (#38636)
resource/aws_batch_job_queue: Fixes error in schema migration function. (#39257)
resource/aws_cognito_user_pool: Correctly unsets tags. (#39260)
resource/aws_ecr_repository_policy: Fix retry logic handling eventual consistency of newly created IAM roles (#39190)
resource/aws_eks_cluster: Return created_at as an RFC3339 formatted timestamp (#24183)
resource/aws_iam_role: Fix to reduce Terraform reporting differences when a role's ARN temporarily appears as the role's unique ID (#36794)
resource/aws_networkfirewall_tls_inspection_configuration: Fix issue where check_certificate_revovation_status is ignored due to bad autoflex field mapping (#39211)
resource/aws_networkmonitor_monitor: Fixes error when optional attribute aggregation_period not set. (#39279)
resource/aws_quicksight_data_set: Change permissions.actions MaxItems from 16 to 20. This fixes a regression introduced in v5.66.0 (#39226)
resource/aws_quicksight_vpc_connection: Remove vpc_connection_id regular expression validator. This fixes a regression introduced in v5.66.0 (#39231)
resource/aws_sagemaker_domain: Fix update for default_user_settings.domain_settings to include missing security_group_ids and r_studio_server_pro_domain_settings values (#35416)
resource/aws_sesv2_configuration_set: Allow suppression_options.suppressed_reasons to be an empty list ([]) in order to disable the suppression list (#29671)
resource/aws_sesv2_configuration_set_event_destination: Change event_destination.matching_event_types from TypeList to TypeSet as order is not significant (#36897)
resource/aws_verifiedaccess_endpoint: fix crash when updating load_balancer_options.subnet_ids (#39196)

`v5.66.0`

Compare Source

FEATURES:

New Data Source: aws_glue_registry (#37953)
New Data Source: aws_organizations_organizational_unit_descendant_organizational_units (#39120)
New Data Source: aws_quicksight_analysis (#31737)
New Resource: aws_datazone_environment (#38811)

ENHANCEMENTS:

data-source/aws_sns_topic: Add tags attribute (#38959)
data-source/aws_transfer_server: Add tags attribute (#39092)
resource/aws_appsync_graphql_api: Add api_type and merged_api_execution_role_arn arguments (#39159)
resource/aws_bedrockagent_data_source: Add vector_ingestion_configuration.chunking_configuration.semantic_chunking_configuration, vector_ingestion_configuration.chunking_configuration.hierarchical_chunking_configuration, and vector_ingestion_configuration.parsing_configuration configuration blocks (#39138)
resource/aws_datazone_domain: Add skip_deletion_protection attribute (#38811)
resource/aws_docdbelastic_cluster: Add backup_retention_period and preferred_backup_window attributes (#38452)
resource/aws_quicksight_data_source: Add parameters.databricks argument (#31737)
resource/aws_rolesanywhere_trust_anchor: Add notification_settings argument (#39108)
resource/aws_sagemaker_endpoint: Increase Create and Update InService timeouts to 60 minutes (#39090)
resource/aws_wafv2_rule_group: Reduce rate_based_statement.limit minimum from 100 to 10 (#39107)
resource/aws_wafv2_web_acl: Reduce rate_based_statement.limit minimum from 100 to 10 (#39107)

BUG FIXES:

data-source/aws_networkmanager_core_network_policy_document: Change segment_actions.via.with_edge_override.use_edge to be nested set of edges, matching JSON (#39142)
data-source/aws_networkmanager_core_network_policy_document: Deprecate segment_actions.via.with_edge_override.use_edge. Use segment_actions.via.with_edge_override.use_edge_location instead (#39142)
many resources: Fixes perpetual diff when tag has a null value. (#38869)
resource/aws_appconfig_extension: Mark role_arn as Optional (#38900)
resource/aws_lexv2models_slot_type: Fix slot_type_values validator which limited configurations to 1 element (#39126)
resource/aws_quicksight_analysis: Properly send theme_arn argument on create and update when configured (#31737)
resource/aws_rolesanywhere_profile: Mark role_arns as Optional and send an empty list if unconfigured (#39108)
resource/aws_synthetics_canary: Remove run_config.timeout_in_seconds default value to allow creation of resources with a frequency less than 14 minutes (#35177)

`v5.65.0`

Compare Source

NOTES:

provider: Updates to Go 1.23. We do not expect this change to impact most users. For macOS, Go 1.23 requires macOS 11 Big Sur or later; support for previous versions has been discontinued. (#38999)

FEATURES:

New Data Source: aws_shield_protection (#37524)
New Resource: aws_glue_catalog_table_optimizer (#38052)

ENHANCEMENTS:

data-source/aws_elb_hosted_zone_id: Add hosted zone ID for ap-southeast-5 AWS Region (#39052)
data-source/aws_lb_hosted_zone_id: Add hosted zone IDs for ap-southeast-5 AWS Region (#39052)
data-source/aws_s3_bucket: Add hosted zone ID for ap-southeast-5 AWS Region (#39052)
provider: Support ap-southeast-5 as a valid AWS Region (#39049)
resource/aws_cognito_user_pool: Add password_policy.password_history_size argument (#39043)
resource/aws_elastic_beanstalk_application_version: Add process argument (#25468)
resource/aws_elasticsearch_domain: Treat SUCCEEDED_WITH_ISSUES status as success when upgrading cluster (#38086)
resource/aws_emr_cluster: Support io2 as a valid value for ebs_config.type (#37740)
resource/aws_emr_instance_fleet: Support io2 as a valid value for instance_type_configs.ebs_config.type (#37740)
resource/aws_emr_instance_group: Support io2 as a valid value for instance_type_configs.ebs_config.type (#37740)
resource/aws_glue_job: Add job_run_queuing_enabled argument (#39027)
resource/aws_lambda_event_source_mapping: Add kms_key_arn argument (#39055)
resource/aws_verifiedaccess_endpoint: Set PolicyEnabled flag to false on update if policy_document is empty (#38675)

BUG FIXES:

resource/aws_amplify_app: Fix crash updating auto_branch_creation_config (#39041)
resource/aws_elasticsearch_domain_policy: Change domain_name to ForceNew (#38086)
resource/aws_elbv2_listener: Fix crash when reading forward actions not configured in state (#39039)
resource/aws_emr_instance_group: Properly send an instance_count value of 0 on create when configured (#37740)
resource/aws_gamelift_game_server_group: Fix crash while reading server group with a nil auto scaling group ARN (#39022)
resource/aws_guardduty_invite_accepter: Fix BadRequestException: The request is rejected because an invalid or out-of-range value is specified as an input parameter errors on resource Create (#39084)
resource/aws_lakeformation_permissions: Fix error when revoking data_cells_filter permissions (#39026)
resource/aws_neptune_cluster: Mark neptune_cluster_parameter_group_name as Computed (#38980)
resource/aws_neptune_cluster_instance: Mark neptune_parameter_group_name as Computed (#38980)
resource/aws_ssm_parameter: Fix ValidationException: Parameter ARN is not supported for this operation errors when deleting resources imported by ARN (#39067)

`v5.64.0`

Compare Source

ENHANCEMENTS:

data-source/aws_opensearch_domain: Add dashboard_endpoint_v2, domain_endpoint_v2_hosted_zone_id, and endpoint_v2 attributes (#38456)
resource/aws_appautoscaling_target: Add suspended_state configuration block (#38942)
resource/aws_dynamodb_table: Add restore_source_table_arn attribute (#38953)
resource/aws_opensearch_domain: Add dashboard_endpoint_v2, domain_endpoint_v2_hosted_zone_id, and endpoint_v2 attributes (#38456)

BUG FIXES:

resource/aws_bedrockagent_agent: Fixes consistency issues where only some prompts are overridden (#38944)
resource/aws_cloudformation_stack_set_instance: Fix crash during construction of the id attribute when deployment_targets does not include organizational unit IDs. (#38969)
resource/aws_glue_trigger: Fix crash when null action is configured (#38994)
resource/aws_rds_cluster: Allow Web Service Data API (enabled_http_endpoint) to be enabled and disabled for provisioned engine mode and serverlessv2 (#38997)

`v5.63.1`

Compare Source

FEATURES:

New Data Source: aws_route53_zones (#17457)
New Data Source: aws_ssoadmin_permission_sets (#38741)

ENHANCEMENTS:

data-source/aws_batch_job_queue: Add job_state_time_limit_action attribute (#38784)
resource/aws_batch_job_definition: Add ecs_properties argument (#37871)
resource/aws_batch_job_queue: Add job_state_time_limit_action argument (#38784)

BUG FIXES:

provider: Fix crash when flattening string pointer slices with nil items (#38886)
resource/aws_datazone_project: Properly surface import id parsing errors (#38924)
resource/aws_quicksight_data_set: Fix crash when setting logical_table_map.data_transforms.project_operation.projected_columns with null list elements (#38886)
resource/aws_ses_configuration_set: Fix crash when reputation_metrics_enabled is set to true (#38921)

`v5.63.0`

Compare Source

FEATURES:

New Data Source: aws_bedrockagent_agent_versions (#38792)
New Resource: aws_bedrock_guardrail (#38757)
New Resource: aws_cloudtrail_organization_delegated_admin_account (#38817)
New Resource: aws_datazone_environment_profile (#35603)
New Resource: aws_datazone_form_type (#38746)
New Resource: aws_datazone_glossary_term (#38706)
New Resource: aws_pinpoint_email_template (#33266)

ENHANCEMENTS:

resource/aws_networkfirewall_logging_configuration: Change logging_configuration.log_destination_config MaxItems from 2 to 3 (#38824)

BUG FIXES:

data-source/aws_acm_certificate: Fix unreturned sdkdiags.AppendErrorf function calls (#38854)
resource/aws_appstream_stack: Fix unreturned sdkdiags.AppendErrorf function calls (#38854)
resource/aws_bedrockagent_agent_knowledge_base_association: Prepare agent when associating a knowledge base so it can be used (#38799)
resource/aws_cloudwatch_event_connection: Fix various expander type assertions to prevent crashes (#38800)
resource/aws_controltower_landing_zone: Fix unreturned sdkdiags.AppendErrorf function calls (#38854)
resource/aws_db_event_subscription: Fix plan-time validation of name and name_prefix (#38194)
resource/aws_ecs_cluster_capacity_providers: Fix unreturned sdkdiags.AppendErrorf function calls (#38854)
resource/aws_ecs_service: Fix crash from nil service_registries item (#38883)
resource/aws_ecs_task_definition: Fix perpetual container_definitions diffs on healthCheck's default values (#38872)
resource/aws_ecs_task_definition: Prevent lowercasing of the first character of JSON keys in container_definitions.dockerLabels (#38804)
resource/aws_ecs_task_definition: Remove nulls from container_definition array fields (#38870)
resource/aws_elasticache_replication_group: Fix crash when setting replicas_per_node_group if node groups are empty (#38797)
resource/aws_fms_policy: Fix unreturned sdkdiags.AppendErrorf function calls (#38854)
resource/aws_grafana_workspace: Fix crash when empty network_access_control block is configured (#38775)
resource/aws_grafana_workspace: Fix crash when empty vpc_configuration block is configured (#38775)
resource/aws_iot_thing_group: Fix crash when empty attribute_payload block is configured (#38776)
resource/aws_lexv2models_slot_type: Fix slot_type_values to have sample_value attribute (#38856)
resource/aws_networkmanager_connect_peer: Set all configuration.bgp_configurations on Read (#38798)
resource/aws_redshift_cluster: Set encrypted on snapshot restore, when enabled (#38828)
resource/aws_rolesanywhere_profile: Fix unreturned sdkdiags.AppendErrorf function calls (#38854)
resource/aws_rolesanywhere_trust_anchor: Fix unreturned sdkdiags.AppendErrorf function calls (#38854)
resource/aws_s3_bucket_lifecycle_configuration: Fix unreturned sdkdiags.AppendErrorf function calls (#38854)

`v5.62.0`

Compare Source

FEATURES:

New Data Source: aws_rds_cluster_parameter_group (#38416)
New Data Source: aws_secretsmanager_secret_versions (#35411)
New Resource: aws_ebs_snapshot_block_public_access (#38641)
New Resource: aws_rds_integration (#35199)

ENHANCEMENTS:

data-source/aws_s3_bucket_object: Expand content types that can be read from S3 to include include application/x-sql (#38737)
data-source/aws_s3_object: Expand content types that can be read from S3 to include application/x-sql (#38737)
provider: Allow default_tags to be set by environment variables (#33339)
provider: Allow ignore_tags.keys and ignore_tags.key_prefixes to be set by environment variables (#35264)
resource/aws_db_option_group: Add skip_destroy argument (#29663)
resource/aws_db_parameter_group: Add skip_destroy argument (#29663)
resource/aws_dx_macsec_key_association: Add plan-time validation of secret_arn (#37213)
resource/aws_ecs_service: Add force_delete argument (#38707)
resource/aws_grafana_license_association: Add grafana_token argument (#38743)
resource/aws_lb_target_group: Add target_health_state.unhealthy_draining_interval argument (#38654)
resource/aws_lexv2models_slot: Add sub_slot_setting attribute (#38698)

BUG FIXES:

data-source/aws_ecr_repository_creation_template: Support ROOT as a valid value for prefix (#38685)
data-source/aws_msk_broker_nodes: Filter out nodes with no broker info (#38042)
resource/aws_appconfig_configuration_profile: Increase name max length validation to 128 (#37539)
resource/aws_batch_job_definition: Fix panic when checking eks_properties for job updates (#38716)
resource/aws_batch_job_definition: Fix panic when checking retry_strategy for job updates (#38716)
resource/aws_batch_job_definition: Fix panic when checking timeout for job updates (#38716)
resource/aws_ec2_capacity_block_reservation: Fix error during apply for missing created_date attribute (#38689)
resource/aws_ecr_repository_creation_template: Support ROOT as a valid value for prefix (#38685)
resource/aws_elbv2_trust_store_revocation: Fix to properly return errors during resource creation (#38756)
resource/aws_emr_cluster: Fix panic when reading an instance fleet with an empty launch_specifications argument (#38773)
resource/aws_lexv2models_bot: Handle PreconditionFailedException on delete for resources deleted out-of-band (#38661)
resource/aws_lexv2models_bot_locale: Handle PreconditionFailedException on delete for resources deleted out-of-band (#38661)
resource/aws_lexv2models_bot_version: Handle PreconditionFailedException on delete for resources deleted out-of-band (#38661)
resource/aws_networkmanager_core_network: Fix $.network-function-groups: null found, array expected errors when creating resource with create_base_policy argument (#38642)
resource/aws_quicksight_account_subscription: Fix panic when read returns nil account info (#38752)
resource/aws_sfn_state_machine: Mark revision_id and state_machine_version_arn as Computed on update if publish is true (#38657)

`v5.61.0`

Compare Source

NOTES:

resource/aws_chatbot_teams_channel_configuration: This resource is provided on a best-effort basis, and we welcome the community's help in testing it. (#38630)

FEATURES:

New Data Source: aws_ecr_repository_creation_template (#38597)
New Resource: aws_chatbot_slack_channel_configuration (#38124)
New Resource: aws_chatbot_teams_channel_configuration (#38630)
New Resource: aws_datazone_glossary (#38602)
New Resource: aws_ecr_repository_creation_template (#38597)
New Resource: aws_timestreaminfluxdb_db_instance (#37963)

ENHANCEMENTS:

data-source/aws_eks_cluster: Add upgrade_policy attribute (#38573)
data-source/aws_sagemaker_prebuilt_ecr_image: Support additional repository_name values. See documentation for details (#38575)
resource/aws_appsync_graphql_api: Add enhanced_metrics_config configuration block (#38570)
resource/aws_db_instance: Add upgrade_storage_config argument (#36904)
resource/aws_default_vpc: Support ipv6_cidr_block sizes between /44 and /60 in increments of /4 (#35614)
resource/aws_default_vpc: Support ipv6_netmask_length values between 44 and 60 in increments of 4 (#35614)
resource/aws_eks_cluster: Add upgrade_policy configuration block (#38573)
resource/aws_elasticache_user_group_association: Add configurable create and delete timeouts (#38559)
resource/aws_pipes_pipe: Add log_configuration.include_execution_data argument (#38569)
resource/aws_rds_cluster: Add performance_insights_enabled, performance_insights_kms_key_id, and performance_insights_retention_period arguments (#29415)
resource/aws_rds_cluster: Add restore_to_point_in_time.source_cluster_resource_id argument (#38540)
resource/aws_rds_cluster: Mark restore_to_point_in_time.source_cluster_identifier as Optional (#38540)
resource/aws_sfn_activity: Add encryption_configuration configuration block to support the use of Customer Managed Keys with AWS KMS to encrypt Step Functions Activity resources (#38574)
resource/aws_sfn_state_machine: Add encryption_configuration configuration block to support the use of Customer Managed Keys with AWS KMS to encrypt Step Functions State Machine resources (#38574)
resource/aws_ssm_patch_baseline: Remove empty fields from json attribute value (#35950)
resource/aws_storagegateway_file_system_association: Add configurable timeouts (#38554)
resource/aws_vpc: Support ipv6_cidr_block sizes between /44 and /60 in increments of /4 (#35614)
resource/aws_vpc: Support ipv6_netmask_length values between 44 and 60 in increments of 4 (#35614)
resource/aws_vpc_ipv6_cidr_block_association: Add assign_generated_ipv6_cidr_block and ipv6_pool arguments (#27274)
resource/aws_vpc_ipv6_cidr_block_association: Support ipv6_cidr_block sizes between /44 and /60 in increments of /4 (#35614)
resource/aws_vpc_ipv6_cidr_block_association: Support ipv6_netmask_length values between 44 and 60 in increments of 4 (#35614)
resource/aws_vpc_security_group_egress_rule: Add tags to the AuthorizeSecurityGroupEgress EC2 API call instead of making a separate CreateTags call (#35614)
resource/aws_vpc_security_group_ingress_rule: Add tags to the AuthorizeSecurityGroupIngress EC2 API call instead of making a separate CreateTags call (#35614)
resource/aws_wafv2_web_acl: Add rule_json attribute to allow raw JSON for rules. (#38309)

BUG FIXES:

data-source/aws_appstream_image: Fix issue where the most recent image is not returned (#38571)
datasource/aws_networkmanager_core_network_policy_document: Fix CoreNetworkPolicyException when putting policy with single wildcard in when_sent_to (#38595)
resource/aws_cloudsearch_domain: Fix index_name character length validation (#38509)
resource/aws_ecs_task_definition: Ensure that JSON keys in container_definitions start with a lowercase letter (#38622)
resource/aws_iot_provisioning_template: Properly send type argument on create when configured (#38640)
resource/aws_opensearchserverless_security_policy: Normalize policy content to prevent persistent differences (#38604)
resource/aws_pipes_pipe: Don't reset target_parameters if the configured value has not changed (#38598)
resource/aws_rds_instance: Allow domain_dns_ips to use single DNS server IP (#36500)
resource/aws_sagemaker_domain: Properly send domain_settings.r_studio_server_pro_domain_settings.r_studio_package_manager_url argument on create (#38547)
resource/aws_vpc_ipam_pool_cidr_allocation: Set description on Read (#38618)
resource/aws_vpc_ipam_pool_cidr_allocation: Set netmask_length on Read (#38618)

`v5.60.0`

Compare Source

NOTES:

resource/aws_shield_subscription: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#37637)

FEATURES:

New Data Source: aws_service_principal (#38307)
New Resource: aws_shield_subscription (#37637)

ENHANCEMENTS:

data-source/aws_cloudwatch_event_bus: Add kms_key_identifier attribute (#38492)
data-source/aws_cur_report_definition: Add tags attribute (#38483)
resource/aws_appflow_flow: Add metadata_catalog_config attribute (#37566)
resource/aws_appflow_flow: Add prefix_hierarchy attribute to destination_flow_config.s3.s3_output_format_config (#37566)
resource/aws_batch_job_definition: Add eks_properties.*.pod_properties.*.image_pull_secret argument (#38517)
resource/aws_cloudformation_stack_set_instance: Add operation_preferences.concurrency_mode argument (#38498)
resource/aws_cloudwatch_event_bus: Add kms_key_identifier argument (#38492)
resource/aws_cur_report_definition: Add tags argument and tags_all attribute (#38483)
resource/aws_db_cluster_snapshot: Add shared_accounts argument (#34885)
resource/aws_db_snapshot_copy: Add shared_accounts argument (#34843)
resource/aws_glue_connection: Add AZURECOSMOS, AZURESQL, BIGQUERY, OPENSEARCH, and SNOWFLAKE as valid values for the connection_type argument and SparkProperties as a valid value for the connection_properties argument (#37731)
resource/aws_iam_role: Change from partial resource creation to resource creation failed if an inline_policy fails to create (#38477)
resource/aws_rds_cluster: Add scaling_configuration.seconds_before_timeout argument (#38451)
resource/aws_sesv2_configuration_set_event_destination: Add event_destination.event_bridge_destination configuration block (#38458)
resource/aws_timestreamwrite_table: Fix runtime error: invalid memory address or nil pointer dereference panic when reading a non-existent table (#38512)

BUG FIXES:

data-source/aws_fsx_ontap_storage_virtual_machine: Correctly set tags on Read (#38343)
data-source/aws_fsx_openzfs_snapshot: Correctly set tags on Read (#38343)
resource/aws_ce_cost_category: Fix perpetual diff with the rule argument on update (#38449)
resource/aws_codebuild_webhook: Remove errant validation on scope_configuration.domain argument (#38513)
resource/aws_ecs_service: Fix error marshaling prior state: a number is required when upgrading from v5.58.0 to v5.59.0 (#38490)
resource/aws_ecs_task_definition: Fix Provider produced inconsistent final plan errors when container_definitions is unknown (#38471)
resource/aws_elasticache_replication_group: Fix error marshaling prior state when upgrading from v4.67.0 to v5.59.0 (#38476)
resource/aws_fsx_openzfs_volume: Correctly set tags on Read (#38343)
resource/aws_rds_cluster: Mark ca_certificate_identifier as Computed (#38437)
resource/aws_rds_cluster: Use the configured copy_tags_to_snapshot value when restore_to_point_in_time is set (#34044)
resource/aws_rds_cluster: Wait for no pending modified values on Update if apply_immediately is true. This fixes InvalidParameterCombination errors when updating engine_version (#38437)

`v5.59.0`

Compare Source

FEATURES:

resource/aws_kinesis_firehose_delivery_stream: Add secrets_manager_configuration to redshift_configuration, snowflake_configuration, and splunk_configuration (#38151)
New Data Source: aws_cloudfront_origin_access_control (#36301)
New Data Source: aws_timestreamwrite_database (#36368)
New Data Source: aws_timestreamwrite_table (#36599)
New Resource: aws_datazone_project (#38345)
New Resource: aws_grafana_workspace_service_account (#38101)
New Resource: aws_grafana_workspace_service_account_token (#38101)
New Resource: aws_rds_certificate (#35003)
New Resource: aws_rekognition_stream_processor (#37536)

ENHANCEMENTS:

data-source/aws_elasticache_replication_group: Add cluster_mode attribute (#38002)
data-source/aws_lakeformation_data_lake_settings: Add allow_full_table_external_data_access attribute (#34474)
data-source/aws_msk_cluster: Add broker_node_group_info attribute (#37705)
resource/aws_bedrockagent_agent : Add skip_resource_in_use_check argument (#37586)
resource/aws_bedrockagent_agent_action_group: Add action_group_executor.custom_control argument (#37484)
resource/aws_bedrockagent_agent_action_group: Add function_schema configuration block (#37484)
resource/aws_bedrockagent_agent_alias : Add routing_configuration.provisioned_throughput argument (#37520)
resource/aws_codebuild_webhook: Add scope_configuration argument (#38199)
resource/aws_codepipeline: Add timeout_in_minutes argument to the action configuration block (#36316)
resource/aws_db_instance: Add engine_lifecycle_support argument (#37708)
resource/aws_ecs_cluster: Add configuration.managed_storage_configuration argument (#37932)
resource/aws_elasticache_replication_group: Add cluster_mode argument (#38002)
resource/aws_emrserverless_application: Add interactive_configuration argument (#37889)
resource/aws_fis_experiment_template: Add experiment_options configuration block (#36900)
resource/aws_fsx_lustre_file_system: Add final_backup_tags and skip_final_backup arguments (#37717)
resource/aws_fsx_ontap_volume: Add final_backup_tags argument (#37717)
resource/aws_fsx_openzfs_file_system: Add delete_options and final_backup_tags arguments (#37717)
resource/aws_fsx_windows_file_system: Add final_backup_tags argument (#37717)
resource/aws_imagebuilder_image_pipeline: Add execution_role and workflow arguments (#37317)
resource/aws_kinesis_firehose_delivery_stream: Add secrets_manager_configuration to http_endpoint_configuration (#38245)
resource/aws_kinesisanalyticsv2_application: Support FLINK-1_19 as a valid value for runtime_environment (#38350)
resource/aws_lakeformation_data_lake_settings: Add allow_full_table_external_data_access attribute (#34474)
resource/aws_lb_target_group: Add target_group_health configuration block (#37082)
resource/aws_msk_replicator: Add starting_position argument (#36968)
resource/aws_rds_cluster: Add engine_lifecycle_support argument (#37708)
resource/aws_rds_global_cluster: Add engine_lifecycle_support argument (#37708)
resource/aws_redshift_cluster_snapshot: Set arn from DescribeClusterSnapshots API response (#37996)
resource/aws_vpclattice_listener: Support TLS_PASSTHROUGH as a valid value for protocol (#37964)
resource/aws_wafv2_web_acl: Add enable_machine_learning to aws_managed_rules_bot_control_rule_set configuration block (#37006)

BUG FIXES:

data-source/aws_efs_access_point: Set id the the access point ID, not the file system ID. This fixes a regression introduced in v5.58.0 (#38372)
data-source/aws_lb_listener: Correctly set default_action.target_group_arn (#37348)
resource/aws_chime_voice_connector_group: Properly handle voice connector groups deleted out of band (#36774)
resource/aws_codebuild_project: Fix unsetting concurrent_build_limit (#37748)
resource/aws_codepipeline: Mark trigger as Computed (#36316)
resource/aws_ecs_service: Change volume_configuration.managed_ebs_volume.throughput from TypeString to TypeInt (#38109)
resource/aws_elasticache_replication_group: Allows setting replicas_per_node_group to 0 and sets the maximum to 5. (#38396)
resource/aws_elasticache_replication_group: Requires description. (#38396)
resource/aws_elasticache_replication_group: When num_cache_clusters is set, prevents setting replicas_per_node_group. (#38396)
resource/aws_elasticache_replication_group: num_cache_clusters must be at least 2 when automatic_failover_enabled is true. (#38396)
resource/aws_elastictranscoder_pipeline: Properly handle NotFound exceptions during deletion (#38018)
resource/aws_elastictranscoder_preset: Properly handle NotFound exceptions during deletion (#38018)
resource/aws_lb_target_group: Use the configured ip_address_type value when target_type is instance (#36423)
resource/aws_lb_trust_store: Wait until trust store is ACTIVE on resource Create (#38332)
resource/aws_pinpoint_app: Fix interface conversion: interface {} is nil, not map[string]interface {} panic when campaign_hook is empty ({}) (#38323)
resource/aws_transfer_server: Add supported values TransferSecurityPolicy-FIPS-2024-05, TransferSecurityPolicy-Restricted-2018-11, and TransferSecurityPolicy-Restricted-2020-06 for the security_policy_name argument (#38425)

`v5.58.0`

Compare Source

FEATURES:

New Resource: aws_cloudwatch_log_account_policy (#38328)
New Resource: aws_verifiedpermissions_identity_source (#38181)

ENHANCEMENTS:

data-source/aws_launch_template: Add network_interfaces.primary_ipv6 attribute (#37142)
data-source/aws_mskconnect_connector: Add tags attribute (#38270)
data-source/aws_mskconnect_custom_plugin: Add tags attribute (#38270)
data-source/aws_mskconnect_worker_configuration: Add tags attribute (#38270)
data-source/aws_oam_link: Add link_configuration attribute (#38277)
resource/aws_cloudformation_stack_set_instance: Extend deployment_targets argument. (#37898)
resource/aws_cloudtrail_event_data_store: Add billing_mode argument (#38273)
resource/aws_db_instance: Fix InvalidParameterCombination: A parameter group can't be specified during Read Replica creation for the following DB engine: postgres errors (#38227)
resource/aws_ec2_capacity_reservation: Add configurable timeouts (#36754)
resource/aws_ec2_capacity_reservation: Retry InsufficientInstanceCapacity errors (#36754)
resource/aws_eks_cluster: Add bootstrap_self_managed_addons argument (#38162)
resource/aws_fms_policy: Add resource_set_ids attribute (#38161)
resource/aws_fsx_ontap_file_system: Add 384, 768, 1536, 3072, and 6144 as valid values for throughput_capacity (#38308)
resource/aws_fsx_ontap_file_system: Add 384, 768, and 1536 as valid values for throughput_capacity_per_ha_pair (#38308)
resource/aws_fsx_ontap_file_system: Add MULTI_AZ_2 as a valid value for deployment_type (#38308)
resource/aws_globalaccelerator_cross_account_attachment: Add cidr_block argument to resource configuration block (#38196)
resource/aws_iam_server_certificate: Add configurable delete timeout (#38212)
resource/aws_launch_template: Add network_interfaces.primary_ipv6 argument (#37142)
resource/aws_mskconnect_connector: Add tags argument and tags_all attribute (#38270)
resource/aws_mskconnect_custom_plugin: Add tags argument and tags_all attribute (#38270)
resource/aws_mskconnect_worker_configuration: Add tags argument and tags_all attribute (#38270)
resource/aws_mskconnect_worker_configuration: Add resource deletion logic (#38270)
resource/aws_oam_link: Add link_configuration argument (#38277)
resource/aws_rds_cluster: Add ca_certificate_identifier argument and ca_certificate_valid_till attribute (#37108)
resource/aws_ssm_association: Add tags argument and tags_all attribute (#38271)

BUG FIXES:

aws_dx_lag: Checks for errors other than NotFound when reading. (#38292)
aws_dynamodb_kinesis_streaming_destination: Checks for errors other than NotFound when reading. (#38292)
aws_ec2_capacity_block_reservation: Checks for errors other than NotFound when reading. (#38292)
aws_opensearchserverless_access_policy: Checks for errors other than NotFound when reading. (#38292)
aws_opensearchserverless_collection: Checks for errors other than NotFound when reading. (#38292)
aws_opensearchserverless_security_config: Checks for errors other than NotFound when reading. (#38292)
aws_opensearchserverless_security_policy: Checks for errors other than NotFound when reading. (#38292)
aws_opensearchserverless_vpc_endpoint: Checks for errors other than NotFound when reading. (#38292)
aws_ram_principal_association: Checks for errors other than NotFound when reading. (#38292)
aws_route_table: Checks for errors other than NotFound when reading. (#38292)
data-source/aws_ecr_repository: Fix issue where the tags attribute is not set (#38272)
data-source/aws_eks_cluster: Add access_config.bootstrap_cluster_creator_admin_permissions attribute (#38295)
resource/aws_appstream_fleet: Support 0 as a valid value for idle_disconnect_timeout_in_seconds (#38274)
resource/aws_cloudformation_stack_set_instance: Add ForceNew to deployment_targets attributes to ensure a new resource is recreated when the deployment_targets argument is changed, which was not the case previously. (#37898)
resource/aws_db_instance: Correctly mark incomplete instances as tainted during creation (#38252)
resource/aws_eks_cluster: Set access_config.bootstrap_cluster_creator_admin_permissions to true on Read for clusters with no access_config configured. This allows in-place updates of existing clusters when access_config is configured (#38295)
resource/aws_elasticache_serverless_cache: Allow cache_usage_limits.data_storage.maximum, cache_usage_limits.data_storage.minimum, cache_usage_limits.ecpu_per_second.maximum and cache_usage_limits.ecpu_per_second.minimum to be updated in-place (#38269)
resource/aws_mskconnect_connector: Fix interface conversion: interface {} is nil, not map[string]interface {} panic when log_delivery.worker_log_delivery is empty ({}) (#38270)

`v5.57.0`

Compare Source

FEATURES:

New Data Source: aws_appstream_image (#38225)
New Data Source: aws_cognito_user_pool (#37399)
New Data Source: aws_ec2_transit_gateway_peering_attachments (#25743)
New Data Source: aws_transfer_connector (#38213)

ENHANCEMENTS:

data-source/aws_backup_plan: Add rule attribute (#37890)
resource/aws_amplify_domain_association: Add certificate_settings argument (#37105)
resource/aws_ec2_transit_gateway_peering_attachment: Add options argument (#36902)
resource/aws_iot_authorizer: Add tags argument (#37152)
resource/aws_iot_topic_rule: Add cloudwatch_logs.batch_mode and error_action.cloudwatch_logs.batch_mode arguments (#36772)
resource/aws_sagemaker_endpoint_configuration: Add support for InputAndOutput in capture_mode (#37726)

BUG FIXES:

resource/aws_iot_provisioning_template: Fix pre_provisioning_hook update operation (#37152)
resource/aws_iot_topic_rule: Retry IAM eventual consistency errors on Update (#36286)

`v5.56.1`

Compare Source

BUG FIXES:

data-source/aws_cognito_user_pool_client: Fix InvalidParameterException: 2 validation errors detected errors on Read (#38168)
resource/aws_cognito_user: Fix a bug that caused resource recreation for resources imported with certain import ID formats (#38182)
resource/aws_cognito_user_pool: Fix runtime error: index out of range [0] with length 0 panic when adding lambda_config (#38184)

`v5.56.0`

Compare Source

FEATURES:

New Resource: aws_appfabric_app_authorization_connection (#38084)
New Resource: aws_appfabric_ingestion (#37291)
New Resource: aws_appfabric_ingestion_destination (#37627)
New Resource: aws_networkfirewall_tls_inspection_configuration (#35168)
New Resource: aws_networkmonitor_monitor (#35722)
New Resource: aws_networkmonitor_probe (#35722)

ENHANCEMENTS:

resource/aws_controltower_control: Add parameters argument and arn attribute (#38071)
resource/aws_networkfirewall_logging_configuration: Add plan-time validation of firewall_arn (#35168)
resource/aws_quicksight_account_subscription: Add iam_identity_center_instance_arn attribute (#36830)
resource/aws_route53_resolver_firewall_rule: Add firewall_domain_redirection_action argument (#37242)
resource/aws_route53_resolver_firewall_rule: Add q_type argument (#38074)
resource/aws_sagemaker_domain: Add default_user_settings.canvas_app_settings.generative_ai_settings configuration block (#37139)
resource/aws_sagemaker_domain: Add default_user_settings.code_editor_app_settings.custom_image configuration block (#37153)
resource/aws_sagemaker_endpoint_configuration: Add production_variants.inference_ami_version and shadow_production_variants.inference_ami_version arguments (#38085)
resource/aws_sagemaker_user_profile: Add user_settings.canvas_app_settings.generative_ai_settings configuration block (#37139)
resource/aws_sagemaker_user_profile: Add user_settings.code_editor_app_settings.custom_image configuration block (#37153)
resource/aws_sagemaker_workforce: add oidc_config.authentication_request_extra_params and oidc_config.scope arguments (#38078)
resource/aws_sagemaker_workteam: Add worker_access_configuration attribute (#38087)
resource/aws_wafv2_web_acl: Add sensitivity_level argument to sqli_match_statement configuration block (#38077)

BUG FIXES:

data-source/aws_ecs_service: Correctly set tags (#38067)
resource/aws_drs_replication_configuration_template: Fix issues preventing creation and deletion (#38143)

`v5.55.0`

Compare Source

FEATURES:

New Resource: aws_drs_replication_configuration_template (#26399)

ENHANCEMENTS:

data-source/aws_autoscaling_group: Add mixed_instances_policy.launch_template.override.instance_requirements.max_spot_price_as_percentage_of_optimal_on_demand_price attribute (#38003)
data-source/aws_glue_catalog_table: Add additional_locations argument in storage_descriptor (#37891)
data-source/aws_launch_template: Add instance_requirements.max_spot_price_as_percentage_of_optimal_on_demand_price attribute (#38003)
data-source/aws_networkmanager_core_network_policy_document: Add attachment_policies.action.add_to_network_function_group argument (#38013)
data-source/aws_networkmanager_core_network_policy_document: Add network_function_groups configuration block (#38013)
data-source/aws_networkmanager_core_network_policy_document: Add send-via and send-to as valid values for segment_actions.action (#38013)
data-source/aws_networkmanager_core_network_policy_document: Add single-hop and dual-hop as valid values for segment_actions.mode (#38013)
data-source/aws_networkmanager_core_network_policy_document: Add when_sent_to and via configuration blocks to segment_actions (#38013)
resource/aws_api_gateway_integration: Increase maximum value of timeout_milliseconds from 29000 (29 seconds) to 300000 (5 minutes) (#38010)
resource/aws_appsync_api_key: Add api_key_id attribute (#36568)
resource/aws_autoscaling_group: Add mixed_instances_policy.launch_template.override.instance_requirements.max_spot_price_as_percentage_of_optimal_on_demand_price argument (#38003)
resource/aws_autoscaling_group: Add plan-time validation of warm_pool.max_group_prepared_capacity and warm_pool.min_size (#37174)
resource/aws_docdb_cluster: Add restore_to_point_in_time argument (#37716)
resource/aws_dynamodb_table: Adds validation for ttl values. (#37991)
resource/aws_ec2_fleet: Add launch_template_config.override.instance_requirements.max_spot_price_as_percentage_of_optimal_on_demand_price argument (#38003)
resource/aws_glue_catalog_table: Add additional_locations argument in storage_descriptor (#37891)
resource/aws_glue_job: Add maintenance_window argument (#37760)
resource/aws_launch_template: Add instance_requirements.max_spot_price_as_percentage_of_optimal_on_demand_price argument (#38003)

BUG FIXES:

data-source/aws_ami: Fix interface conversion: interface {} is types.ProductCodeValues, not string panic (#37977)
data-source/aws_networkmanager_core_network_policy_document: Add correct except values to the returned JSON document when segment_actions.share_with_except is configured (#38013)
provider: Now falls back to non-FIPS endpoint if use_fips_endpoint is set and no FIPS endpoint is available (#38057)
resource/aws_autoscaling_group: Fix bug updating warm_pool.max_group_prepared_capacity to 0 (#37174)
resource/aws_dynamodb_table: Fixes perpetual diff when ttl.attribute_name is set when ttl.enabled is not set. (#37991)
resource/aws_ec2_network_insights_path: Mark destination as Optional (#36966)
resource/aws_lambda_event_source_mapping: Remove the upper limit on scaling_config.maximum_concurrency (#37980)
service/transitgateway: Fix resource Read pagination regression causing NotFound errors (#38011)

`v5.54.1`

Compare Source

BUG FIXES:

data-source/aws_ami: Fix interface conversion: interface {} is types.ProductCodeValues, not string panic (######)
resource/aws_codebuild_project: Increase maximum values of build_batch_config.timeout_in_mins and build_timeout from 480 (8 hours) to 2160 (36 hours) (#37970)

`v5.54.0`

Compare Source

NOTES:

resource/aws_ec2_capacity_block_reservation: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#37528)

FEATURES:

New Data Source: aws_ec2_capacity_block_offering (#37528)
New Resource: aws_appfabric_app_authorization (#37468)
New Resource: aws_appfabric_app_bundle (#37542)
New Resource: aws_ec2_capacity_block_reservation (#37528)
New Resource: aws_fms_resource_set (#37767)
New Resource: aws_guardduty_malware_protection_plan (#37919)

ENHANCEMENTS:

data-source/aws_opensearch_domain: Add ip_address_type argument (#37237)
resource/aws_ec2_traffic_mirror_session: Mark packet_length as Computed (#36962)
resource/aws_opensearch_domain: Add ip_address_type argument (#37237)
resource/aws_vpc_endpoint: Add subnet_configuration argument to support user defined IP addresses (#37226)

BUG FIXES:

data-source/aws_ami: Fix query returning no results (#37958)
provider: Fixes an error where some data sources were not returning tags (#37966)
resource/aws_applicationinsights_application: Change resource_group_name to ForceNew (#36962)
resource/aws_dynamodb_table: Fix UnknownOperationException: Tagging is not currently supported in DynamoDB Local errors on resource Read (#37924)
resource/aws_ec2_capacity_reservation: Fix InvalidCapacityReservationId.NotFound errors during Read and Delete when resource is manually deleted (#37127)
resource/aws_route53_zone: Fix InvalidInput: 1 validation error detected: Value '...' at 'resourceId' failed to satisfy constraint: Member must have length less than or equal to 32 errors for resources imported with a /hostedzone/ prefix (#37893)
service/apigatewayv2: Retry on ConflictException: Unable to complete operation due to concurrent modification errors (#37902)

`v5.53.0`

Compare Source

FEATURES:

New Resource: aws_paymentcryptography_key (#37017)
New Resource: aws_paymentcryptography_key_alias (#37020)

ENHANCEMENTS:

data-source/aws_customer_gateway: Add bgp_asn_extended argument (#37815)
data-source/aws_rds_engine_version: Add supports_limitless_database attribute (#37271)
provider: The use_fips_endpoint flag is now ignored for any service with a custom endpoint configured in endpoints. (#34233)
resource/aws_apigatewayv2_authorizer: Add configurable delete timeout (#37732)
resource/aws_customer_gateway: Add bgp_asn_extended argument (#37815)
resource/aws_fsx_lustre_file_system: Add metadata_configuration argument (#37868)
resource/aws_lb: Add support for IPv6-only Application Load Balancers (#37700)
resource/aws_mwaa_environment: Add max_webservers and min_webservers attributes (#37632)
resource/aws_pipes_pipe: Add log_configuration argument (#37135)
resource/aws_route53_record: Fix InvalidChangeBatch errors on resource Delete (#37850)
resource/aws_s3_bucket: Ignore UnsupportedOperation errors when reading acceleration_status, server_side_encryption_configuration and tags (#37801)
resource/aws_transfer_ssh_key: Add ssh_key_id attribute (#37548)

BUG FIXES:

resource/aws_apigatewayv2_authorizer: Fix ConflictException errors on resource Delete (#37732)
resource/aws_bedrockagent_agent: Increase instruction max length for validation to 4000 (#37758)
resource/aws_cloudwatch_log_group: Correctly handles tag updates with empty string tags (#37668)
resource/aws_kms_external_key: Fixes timeout error on creation when ignore_tags matches tag assigned to resource (#37818)
resource/aws_kms_key: Fixes timeout error on creation when ignore_tags matches tag assigned to resource (#37818)
resource/aws_kms_replica_external_key: Fixes timeout error on creation when ignore_tags matches tag assigned to resource (#37818)
resource/aws_kms_replica_key: Fixes timeout error on creation when ignore_tags matches tag assigned to resource (#37818)
resource/aws_mq_broker: Do not reboot on changes to maintenance_window_start_time or auto_minor_version_upgrade (#36506)
resource/aws_pipes_pipe: Mark source_parameters.self_managed_kafka_parameters.credentials.basic_auth as Optional (#34293)
resource/aws_secretsmanager_secret: Tags with empty values no longer remove all tags. (#37743)
resource/aws_ssm_parameter: Fix Cannot import non-existent remote object errors when importing resources with version (#37832)
resource/aws_vpc_endpoint: Restore pre-v5.51.0 default of false for private_dns_enabled (#37715)
service/chatbot: Correctly overrides region when using custom endpoint. (#37851)
service/costoptimizationhub: Correctly overrides region when using custom endpoint. (#37851)
service/cur: Correctly overrides region when using custom endpoint. (#37851)
service/globalaccelerator: Correctly overrides region when using custom endpoint. (#37851)
service/route53: Correctly overrides region when using custom endpoint. (#37851)
service/route53domains: Correctly overrides region when using custom endpoint. (#37851)
service/shield: Correctly overrides region when using custom endpoint. (#37851)

`v5.52.0`

Compare Source

ENHANCEMENTS:

resource/aws_kinesisanalyticsv2_application: Add application_mode argument (#37714)
resource/aws_lightsail_bucket: Add support to ListTags function for proper key-only tag handling (#37711)
resource/aws_lightsail_certificate: Add support to ListTags function for proper key-only tag handling (#37711)
resource/aws_lightsail_container_service: Add support to ListTags function for proper key-only tag handling (#37711)
resource/aws_lightsail_database: Add support to ListTags function for proper key-only tag handling (#37711)
resource/aws_lightsail_distribution: Add support to ListTags function for proper key-only tag handling (#37711)
resource/aws_lightsail_key_pair: Add support to ListTags function for proper key-only tag handling (#37711)
resource/aws_lightsail_lb: Add support to ListTags function for proper key-only tag handling (#37711)

BUG FIXES:

resource/aws_lightsail_database: Prevent destroy failure when resource is already deleted outside Terraform (#37711)
resource/aws_lightsail_instance: Fix crash when reading a resource that has a key-only tag (#37587)
resource/aws_lightsail_key_pair: Prevent destroy failure when resource is already deleted outside Terraform (#37711)
resource/aws_lightsail_lb: Prevent destroy failure when resource is already deleted outside Terraform (#37711)

`v5.51.1`

Compare Source

ENHANCEMENTS:

resource/aws_ecs_service: Add volume_configuration argument (#37019)
resource/aws_ecs_task_definition: Add configure_at_launch parameter in volume argument (#37019)

BUG FIXES:

data-source/aws_route53_zone: Fix incorrect name_servers values (#37685)
data-source/aws_route53_zone: Permit both name and zone_id arguments when one is an empty string (#37686)
resource/aws_route53_zone: Fix incorrect name_servers values (#37685)

`v5.51.0`

Compare Source

NOTES:

data-source/aws_lambda_function: source_code_hash attribute has been deprecated in favor of code_sha256. Will be removed in a future major version (#37669)
data-source/aws_lambda_layer_version: source_code_hash attribute has been deprecated in favor of code_sha256. Will be removed in a future major version (#37646)

FEATURES:

New Data Source: aws_chatbot_slack_workspace (#37218)
New Resource: aws_lambda_runtime_management_config (#37643)
New Resource: aws_vpc_endpoint_private_dns (#37628)
New Resource: aws_vpc_endpoint_service_private_dns_verification (#37176)

ENHANCEMENTS:

data-source/aws_lambda_function: Add code_sha256 attribute (#37669)
data-source/aws_lambda_layer_version: Add code_sha256 attribute (#37646)
data-source/aws_route53_traffic_policy_document: Add support for application-load-balancer, elastic-beanstalk and network-load-balancer endpoint.type values (#37618)
resource/aws_api_gateway_deployment: Add canary_settings attribute (#37573)
resource/aws_iam_openid_connect_provider: Allow client_id_list to be updated in-place (#37612)
resource/aws_lambda_function: Add code_sha256 attribute (#37669)
resource/aws_lambda_function: Remove replace_security_group_on_destroy and replacement_security_group_ids deprecations, re-implement with alternate workflow (#37624)
resource/aws_lambda_layer_version: Add code_sha256 attribute (#37646)
resource/aws_route53_health_check: Add plan-time validation of cloudwatch_alarm_region (#37510)
resource/aws_route53_record: Add plan-time validation of latency_routing_policy.region (#37510)
resource/aws_route53_vpc_association_authorization: Add plan-time validation of vpc_region (#37510)
resource/aws_route53_zone_association: Add plan-time validation of vpc_region (#37510)
resource/aws_wafv2_web_acl: Add api_gateway, app_runner_service, cognito_user_pool, and verified_access_instance configuration blocks to association_config.request_body (#37588)

BUG FIXES:

resource/aws_dynamodb_table_replica: Correctly set kms_key_arn on Read (#37570)
resource/aws_kms_grant: Change grant_token to Sensitive (#37593)
resource/aws_lambda_function: Fix issue when source_code_hash causes drift even if source code has not changed (#37669)
resource/aws_lambda_layer_version: Fix issue when source_code_hash forces a replacement even if source code has not changed (#37646)
resource/aws_m2_deployment: Fix state error on deployment_id during start/stop update (#37581)
resource/aws_storagegateway_smb_file_share: Fix crash when cache_attributes is removed on update (#37611)

`v5.50.0`

Compare Source

ENHANCEMENTS:

data-source/aws_budgets_budget: Add tags attribute (#37361)
data-source/aws_instance: Add launch_time attribute (#37002)
resource/aws_budgets_budget: Add tags argument (#37361)
resource/aws_budgets_budget_action: Add tags argument (#37361)
resource/aws_ecs_account_setting_default: Add support for fargateTaskRetirementWaitPeriod value in Name argument (#37018)
resource/aws_ssm_resource_data_sync: Add plan-time validation of s3_destination.kms_key_arn, s3_destination.region and s3_destination.sync_format (#37481)

BUG FIXES:

data-source/aws_bedrock_foundation_models: Fix validation regex for the by_provider argument (#37306)
resource/aws_dynamodb_table: Fix UnknownOperationException: Tagging is not currently supported in DynamoDB Local errors on resource Read (#37472)
resource/aws_glue_job: Fix interface conversion: interface {} is nil, not map[string]interface {} panic when notify_delay_after is empty (null) (#37347)
resource/aws_iam_server_certificate: Now correctly reads tags after update and on read. (#37483)
resource/aws_lakeformation_data_cells_filter: Fix inconsistent state error when using row_filter.all_rows_wildcard (#37433)
resource/aws_organizations_account: Allow import of accounts with IAM access to the AWS Billing and Cost Management console (#35662)
resource/aws_ram_principal_association: Correct plan-time validation of principal to fix panic: unexpected format for ID parts ([...]), the following id parts indexes are blank ([1]) (#37450)
resource/aws_route53_record: Change region default to us-east-1 (#37565)
resource/aws_vpc_endpoint_service: Fix destroy error when endpoint service is deleted out-of-band (#37534)

`v5.49.0`

Compare Source

FEATURES:

New Data Source: aws_datazone_environment_blueprint (#36600)
New Resource: aws_bedrockagent_data_source (#37158)
New Resource: aws_datazone_domain (#36600)
New Resource: aws_datazone_environment_blueprint_configuration (#36600)

ENHANCEMENTS:

data-source/aws_iam_policy_document: Add minified_json attribute (#35677)
resource/aws_dynamodb_table_export: Add plan-time validation of table_arn (#37288)
resource/aws_kms_key: Add rotation_period_in_days argument (#37140)
resource/aws_securitylake_subscriber_notification: Better handles importing resource (#37332)
resource/aws_securitylake_subscriber_notification: Deprecates endpoint_id in favor of subscriber_endpoint (#37332)
resource/aws_securitylake_subscriber_notification: Handles configuration.https_notification_configuration.authorization_api_key_value as sensitive value (#37332)

BUG FIXES:

data-source/aws_fsx_ontap_storage_virtual_machine: Correctly set tags on Read (#37353)
data-source/aws_rds_orderable_db_instance: Fix InvalidParameterValue: Invalid value 3412 for MaxRecords. Must be between 20 and 1000 errors (#37251)
data-source/aws_resourceexplorer2_search: Fix 401 unauthorized error due to missing view_arn in the AWS API request (#36778)
data-source/aws_resourceexplorer2_search: Fix panic caused by bad mappping between Terraform and AWS schemas (#36778)
data-source/aws_resourceexplorer2_search: Fix state persistence and data types (#36778)
resource/aws_bedrockagent_agent: Fix to use the configured prepare_agent value (or default value of true when omitted) for all create and update operations (#37405)
resource/aws_elasticsearch_domain: Fix handling of unset auto_tune_options.rollback_on_disable argument (#37394)
resource/aws_fsx_ontap_storage_virtual_machine: Correctly set tags and tags_all on resource Read (#37353)
resource/aws_fsx_openzfs_file_system: Correctly set tags and tags_all on resource Read (#37353)
resource/aws_kms_custom_key_store: Change trust_anchor_certificate to ForceNew (#37092)
resource/aws_opensearch_domain: Fix handling of unset auto_tune_options.rollback_on_disable argument (#37394)
resource/aws_opensearch_domain: Wait for auto_tune_options to be applied during creation (#37394)
resource/aws_securitylake_aws_log_source: Correctly handles unspecified source_version (#36268)
resource/aws_securitylake_aws_log_source: Prevents errors when creating multiple log sources concurrently (#36268)
resource/aws_securitylake_custom_log_source: Prevents errors when creating multiple log sources concurrently (#36268)
resource/aws_securitylake_custom_log_source: Validates length of source_name parameter (#36268)
resource/aws_securitylake_subscriber: Allow more than one log source (#36268)
resource/aws_securitylake_subscriber: Correctly handles unspecified access_type (#36268)
resource/aws_securitylake_subscriber: Correctly handles unspecified source_version parameter for aws_log_source_resource and custom_log_source_resource (#36268)
resource/aws_securitylake_subscriber: Correctly requires source_name parameter for aws_log_source_resource and custom_log_source_resource (#36268)
resource/aws_securitylake_subscriber_notification: No longer recreates resource when not needed (#37332)
resource/aws_securitylake_subscriber_notification: Requires value for configuration.https_notification_configuration.endpoint (#37332)
resource/provider: Change the AWS SDK for Go v2 API client BackoffDelayer to maintain behavioral compatibility with AWS SDK for Go v1 (#37404)

`v5.48.0`

Compare Source

FEATURES:

New Resource: aws_bedrockagent_agent_knowledge_base_association (#37185)

ENHANCEMENTS:

resource/aws_cloudwatch_event_target: Add force_destroy argument (#37130)
resource/aws_elasticache_replication_group: Increase default Delete timeout to 45 minutes (#37182)
resource/aws_elasticache_replication_group: Use the configured Delete timeout when detaching from any global replication group (#37182)
resource/aws_fsx_ontap_file_system: Add support for specifying 1 ha_pair with SINGLE_AZ_1 and MULTI_AZ_1 deployment types (#36511)
resource/aws_fsx_ontap_file_system: Increase storage_capacity maximum to 1PiB (#36511)
resource/aws_fsx_ontap_file_system: Support up to 12 ha_pairs (#36511)
resource/aws_fsx_ontap_file_system: Update throughput_capacity_per_ha_pair to support all values from throughput_capacity (#36511)
resource/aws_fsx_ontap_volume: Add aggregate_configuration configuration block (#36511)
resource/aws_fsx_ontap_volume: Add size_in_bytes and volume_style arguments (#36511)

BUG FIXES:

resource/aws_bcmdataexports_export: Fix table_configurations expand/flatten (#37205)
resource/aws_cloudwatch_event_connection: Add plan-time validation preventing empty auth_parameters.oauth.oauth_http_parameters or auth_parameters.invocation_http_parameters body, header and query_string configuration blocks (#26755)
resource/aws_elasticache_replication_group: Decrease replica count after other updates (#34819)
resource/aws_elasticache_replication_group: Fix unexpected state 'snapshotting' errors when increasing or decreasing replica count (#30493)

`v5.47.0`

Compare Source

NOTES:

provider: Updates to Go 1.22. This is the last Go release that will run on macOS 10.15 Catalina (#36996)
resource/aws_bedrockagent_knowledge_base: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#36783)

FEATURES:

New Data Source: aws_identitystore_groups (#36993)
New Resource: aws_bcmdataexports_export (#36847)
New Resource: aws_bedrockagent_agent (#36851)
New Resource: aws_bedrockagent_agent_action_group (#36935)
New Resource: aws_bedrockagent_agent_alias (#36905)
New Resource: aws_bedrockagent_knowledge_base (#36783)
New Resource: aws_globalaccelerator_cross_account_attachment (#35991)
New Resource: aws_verifiedpermissions_policy (#35413)

ENHANCEMENTS:

data-source/aws_eip: Add arn attribute (#35991)
resource/aws_api_gateway_rest_api: Correctly set root_resource_id on resource Read (#37040)
resource/aws_appmesh_mesh: Add spec.service_discovery argument (#37042)
resource/aws_cloudformation_stack_set: Adds guidance on permissions when using delegated administrator account (#37069)
resource/aws_db_instance: Add dedicated_log_volume argument (#36503)
resource/aws_eip: Add arn attribute (#35991)
resource/aws_elasticache_replication_group: Add transit_encryption_mode argument (#30403)
resource/aws_elasticache_replication_group: Changes to the transit_encryption_enabled argument can now be done in-place for engine versions > 7.0.5 (#30403)
resource/aws_kinesis_firehose_delivery_stream: Add snowflake_configuration argument (#36646)
resource/aws_memorydb_user: Support IAM authentication mode (#32027)
resource/aws_sagemaker_app_image_config: Add code_editor_app_image_config and jupyter_lab_image_config.jupyter_lab_image_config arguments (#37059)
resource/aws_sagemaker_app_image_config: Change kernel_gateway_image_config.kernel_spec MaxItems to 5 (#37059)
resource/aws_transfer_server: Add sftp_authentication_methods argument (#37015)

BUG FIXES:

resource/aws_batch_job_definition: Fix issues where changes causing a new revision do not trigger changes in dependent resources and/or cause an error, "Provider produced inconsistent final plan" (#37111)
resource/aws_ce_cost_category: Allow up to 3 levels of and, not and or operand nesting for the rule argument (#30862)
resource/aws_elasticache_replication_group: Fix excessive delay on read (#30403)
resource/aws_servicecatalog_portfolio: Fixes error where deletion fails if resource was deleted out of band. (#37066)
resource/aws_servicecatalog_provisioned_product: Fixes error where tag values are not applied to products when tag values don't change. (#37066)

`v5.46.0`

Compare Source

NOTES:

provider: When using YAML or JSON documents, such as in template_body of aws_cloudformation_stack, CRLF was previously treated as different from LF but these are now treated as equivalent in many situations (#14270)

FEATURES:

New Resource: aws_eip_domain_name (#36963)

ENHANCEMENTS:

data-source/aws_alb: Add client_keep_alive argument (#36969)
data-source/aws_eip: Add ptr_record attribute (#36963)
data-source/aws_iam_policy: Add attachment_count attribute (#36759)
data-source/aws_lb: Add client_keep_alive argument (#36969)
data-source/aws_organizations_organization: Add master_account_name attribute (#36797)
data-source/aws_vpc_dhcp_options: Add ipv6_address_preferred_lease_time attribute (#36934)
resource/aws_alb: Add client_keep_alive argument (#36969)
resource/aws_autoscaling_group: Add alarm_specification to the instance_refresh.preferences configuration block (#36954)
resource/aws_cloudformation_stack_set: Add retry when creating to potentially help with eventual consistency problems (#36982)
resource/aws_cloudfront_origin_access_control: Add lambda and mediapackagev2 as valid values for origin_access_control_origin_type (#34362)
resource/aws_cloudwatch_event_rule: Add force_destroy attribute (#34905)
resource/aws_codebuild_project: Add GitLab and GitLab Self Managed support to the report_build_status and build_status_config arguments (#36942)
resource/aws_default_vpc_dhcp_options: Add ipv6_address_preferred_lease_time as Computed attribute (#36934)
resource/aws_dms_replication_task: Add resource_identifier argument (#36901)
resource/aws_eip: Add ptr_record attribute (#36963)
resource/aws_elasticache_serverless_cache: Add minimum attribute in cache_usage_limits.data_storage and cache_usage_limits.ecpu_per_second (#36766)
resource/aws_fsx_openzfs_file_system: Add endpoint_ip_address attribute (#36767)
resource/aws_iam_policy: Add attachment_count attribute (#36759)
resource/aws_imagebuilder_image: Add execution_role and workflow arguments (#36953)
resource/aws_lb: Add client_keep_alive argument (#36969)
resource/aws_mwaa_environment: Add database_vpc_endpoint_service and webserver_vpc_endpoint_service attributes (#36903)
resource/aws_organizations_organization: Add master_account_name attribute (#36797)
resource/aws_transfer_connector: Add security_policy_name argument (#36893)
resource/aws_vpc_dhcp_options: Add ipv6_address_preferred_lease_time attribute (#36934)
resource/aws_vpc_ipam_pool: Add cascade argument (#36898)

BUG FIXES:

data-source/aws_iam_policy_document: When using multiple principals, sort them to avoid differences based only on order (#25967)
resource/aws_appconfig_deployment: Fix ConflictException errors on resource Create (#36980)
resource/aws_ce_anomaly_monitor: Change monitor_dimension to ForceNew (#36773)
resource/aws_ce_anomaly_subscription: Change account_id to ForceNew (#36773)
resource/aws_cloudformation_stack: CRLF line endings in template_body no longer cause erroneous diffs (#14270)
resource/aws_db_proxy: Fix interface conversion: interface {} is nil, not map[string]interface {} panic when auth is empty ({}) (#36967)
resource/aws_dms_replication_config: Adds validation to replication_settings to disallow Logging.CloudWatchLogGroup and Logging.CloudWatchLogStream. (#36936)
resource/aws_dms_replication_config: Suppresses differences in partial replication_settings JSON documents. (#36936)
resource/aws_dms_replication_task: Adds validation to replication_task_settings to disallow Logging.CloudWatchLogGroup and Logging.CloudWatchLogStream. (#36936)
resource/aws_dms_replication_task: Allows leaving replication_task_settings unset to use default settings. (#36936)
resource/aws_dms_replication_task: Suppresses differences in partial replication_task_settings JSON documents. (#36936)
resource/aws_fsx_windows_file_system: Fix error BadRequest: AuditLogDestination must not be provided when auditing is disabled when updating audit_log_configuration.0.file_access_audit_log_level and audit_log_configuration.0.file_share_access_audit_log_level to "DISABLED" (#36928)
resource/aws_glue_job: Mark number_of_workers and worker_type as optional/computed, preventing persistent differences when max_capacity is set. (#36770)
resource/aws_iam_user_login_profile: Fix forced re-creation when password_reset_required is true and initial password reset is completed (#36926)
resource/aws_lightsail_distribution: Fix to properly set certificate_name on create and update (#36888)
resource/aws_vpc_dhcp_options: Fix NotFound error handling on delete (#36933)

`v5.45.0`

Compare Source

NOTES:

resource/aws_redshift_cluster: The logging argument is now deprecated. Use the aws_redshift_logging resource instead. (#36862)
resource/aws_redshift_cluster: The snapshot_copy argument is now deprecated. Use the aws_redshift_snapshot_copy resource instead. (#36810)

FEATURES:

New Resource: aws_redshift_logging (#36862)
New Resource: aws_redshift_snapshot_copy (#36810)

ENHANCEMENTS:

data-source/aws_sagemaker_prebuilt_ecr_image: Add registry_id for af-south-1 AWS Region (#36803)
resource/aws_api_gateway_documentation_part: Add documentation_part_id attribute (#36445)
resource/aws_wafregional_web_acl_association: Add configurable timeouts (#36445)
resource/aws_wafregional_web_acl_association: Add plan-time validation of resource_arn (#36445)

BUG FIXES:

provider: Change the default AWS SDK for Go v2 API client MaxBackoff value to 300 seconds so that services migrated to AWS SDK for Go v2 maintain behavioral compatibility with AWS SDK for Go v1 (#36855)
resource/aws_datasync_location_object_storage: Allow update to agent_arns (#36819)
resource/aws_devopsguru_notification_channel: Fix persistent diff when filters.message_types or filters.severities contains multiple elements (#36804)
resource/aws_securityhub_configuration_policy: Mark configuration_policy.enabled_standard_arns as Optional, fixing InvalidInputException: Invalid semantics: Enabled standards and security control configurations must be configured when Security Hub is enabled errors (#36740)

`v5.44.0`

Compare Source

FEATURES:

New Data Source: aws_devopsguru_notification_channel (#36656)
New Data Source: aws_devopsguru_resource_collection (#36657)
New Data Source: aws_ecr_lifecycle_policy_document (#6133)
New Function: trim_iam_role_path (#36723)
New Resource: aws_devopsguru_service_integration (#36694)

ENHANCEMENTS:

data-source/aws_servicecatalogappregistry_application: Add application_tag attribute (#36647)
data/aws_glue_data_catalog_encryption_settings: Add data_catalog_encryption_settings.encryption_at_rest.catalog_encryption_service_role attribute (#35978)
resource/aws_appstream_fleet: Add desired_sessions argument to the compute_capacity block. (#34266)
resource/aws_appstream_fleet: Add max_sessions_per_instance argument. (#34266)
resource/aws_batch_job_definition: Add update functions instead of ForceNew. Add deregister_on_new_revision to allow keeping prior versions ACTIVE when a new revision is published. (#35149)
resource/aws_db_instance: Adds warning when setting character_set_name when replicate_source_db, restore_to_point_in_time, or snapshot_identifier is set (#36518)
resource/aws_emr_cluster: Add unhealthy_node_replacement argument (#36523)
resource/aws_glue_data_catalog_encryption_settings: Add data_catalog_encryption_settings.encryption_at_rest.catalog_encryption_service_role argument (#35978)
resource/aws_servicecatalogappregistry_application: Add application_tag attribute (#36647)
resource/aws_transfer_server: Add s3_storage_options configuration block (#36664)
resource/aws_wafv2_web_acl: Add address_fields and phone_number_fields to statement.managed_rule_group_statement.managed_rule_group_configs.aws_managed_rules_acfp_rule_set.request_inspection (#36685)

BUG FIXES:

Correctly handles user agents passed using TF_APPEND_USER_AGENT which contain /, (, ), or space. (#36738)
resource/aws_batch_scheduling_policy: Fixes error where tags could not be updated (#36517)
resource/aws_cloudfront_key_value_store: Serialize CloudFront KeyValueStore access (#36734)
resource/aws_cloudfrontkeyvaluestore_key: Serialize CloudFront KeyValueStore access (#36734)
resource/aws_cognito_user_pool: Correct plan-time validation of email_verification_message, email_verification_subject, admin_create_user_config.invite_message_template.email_message, admin_create_user_config.invite_message_template.email_subject, admin_create_user_config.invite_message_template.sms_message, sms_authentication_message, sms_verification_message, verification_message_template.email_message, verification_message_template.email_message_by_link, verification_message_template.email_subject, verification_message_template.email_subject_by_link, and verification_message_template.sms_message to count UTF-8 characters properly (#36661)
resource/aws_ecr_lifecycle_policy: Add missing tagPatternList change detection in policy JSON (#35231)
resource/aws_ecs_service: Correctly set alarms.rollback on resource Create and Update (#36691)
resource/aws_iam_user: When force_destroy is used and there are inline or attached policies, allow resource to be destroyed (#36640)
resource/aws_imagebuilder_distribution_configuration: Fix validation regex for ami_distribution_configuration.name (#36659)
resource/aws_redshift_cluster: Fix error preventing modification of a configured snapshot_copy block (#36655)
resource/aws_route53_record: Fix to correctly interpret alias names with wildcards (#36699)

`v5.43.0`

Compare Source

FEATURES:

New Data Source: aws_resourceexplorer2_search (#36560)
New Data Source: aws_servicecatalogappregistry_application (#36596)
New Resource: aws_cloudfrontkeyvaluestore_key (#36534)
New Resource: aws_devopsguru_notification_channel (#36557)
New Resource: aws_ec2_instance_metadata_defaults (#36589)
New Resource: aws_lakeformation_resource_lf_tag (#36537)
New Resource: aws_m2_application (#35399)
New Resource: aws_m2_deployment (#35408)
New Resource: aws_m2_environment (#35311)
New Resource: aws_redshiftserverless_custom_domain_association (#35865)
New Resource: aws_servicecatalogappregistry_application (#36277)

ENHANCEMENTS:

data-source/aws_cloudfront_function: Add key_value_store_associations attribute (#36585)
data-source/aws_db_snapshot: Add original_snapshot_create_time attribute (#36544)
resource/aws_cloudfront_function: Add key_value_store_associations argument (#36585)
resource/aws_ec2_host: Add user configurable timeouts (#36538)
resource/aws_glacier_vault_lock: Allow policy to have leading whitespace (#36597)
resource/aws_iam_group_policy: Allow policy to have leading whitespace (#36597)
resource/aws_iam_policy: Allow policy to have leading whitespace (#36597)
resource/aws_iam_role: Allow assume_role_policy and inline_policy.*.policy to have leading whitespace (#36597)
resource/aws_iam_role_policy: Allow policy to have leading whitespace (#36597)
resource/aws_iam_user_policy: Allow policy to have leading whitespace (#36597)
resource/aws_kinesisanalyticsv2_application: Add support for FLINK-1_18 runtime_environment value (#36562)
resource/aws_media_store_container_policy: Allow policy to have leading whitespace (#36597)
resource/aws_ssoadmin_permission_set_inline_policy: Allow inline_policy to have leading whitespace (#36597)
resource/aws_transfer_access: Allow policy to have leading whitespace (#36597)
resource/aws_transfer_user: Allow policy to have leading whitespace (#36597)
resource/aws_vpc_ipam: Add tier argument (#36504)

BUG FIXES:

data-source/aws_cur_report_definition: Direct all API calls to the us-east-1 endpoint as this is the only Region in which AWS Cost and Usage Reports is available (#36540)
resource/aws_applicationinsights_application: Make ACTIVE a valid create target status (#36615)
resource/aws_autoscaling_group: Don't attempt to remove scale-in protection from instances that don't have the feature enabled (#36586)
resource/aws_cur_report_definition: Direct all API calls to the us-east-1 endpoint as this is the only Region in which AWS Cost and Usage Reports is available (#36540)
resource/aws_elasticsearch_domain_policy: Handle delayed domain status propagation, preventing a ValidationException. (#36592)
resource/aws_iam_instance_profile: Detect when the associated role no longer exists (#34099)
resource/aws_instance: Replace an instance when an instance_type change also requires an architecture change, such as x86_64 to arm64 (#36590)
resource/aws_opensearch_domain_policy: Handle delayed domain status propagation, preventing a ValidationException. (#36592)
resource/aws_quicksight_dashboard: Fix failure when updating a dashboard takes a while (#34227)
resource/aws_quicksight_template: Fix "Invalid address to set" errors (#34227)
resource/aws_quicksight_template: Fix "a number is required" errors when state contains an empty string (#34227)
resource/aws_redshift_cluster: Fix InvalidParameterCombination errors when updating only skip_final_snapshot (#36635)
resource/aws_route53_zone: Prevent re-creation when name casing changes (#36563)
resource/aws_secretsmanager_secret_version: Fix to handle versions deleted out-of-band without raising an InvalidRequestException (#36609)
resource/aws_ssm_parameter: force create a new SSM parameter when data_type is updated. (#35960)

`v5.42.0`

Compare Source

FEATURES:

New Data Source: aws_redshift_producer_data_shares (#36481)
New Resource: aws_devopsguru_event_sources_config (#36485)
New Resource: aws_devopsguru_resource_collection (#36489)
New Resource: aws_dynamodb_table_export (#30399)

ENHANCEMENTS:

data-source/aws_vpc_peering_connection: Add ipv6_cidr_block_set and peer_ipv6_cidr_block_set attributes (#36391)
resource/aws_datasync_location_hdfs: Add kerberos_keytab_base64 and kerberos_krb5_conf_base64 arguments (#36072)
resource/aws_finspace_kx_dataview: Add read_write and segment_configuration.on_demand arguments (#36486)
resource/aws_rds_cluster: Add enable_local_write_forwarding argument to support Aurora MySQL local write forwarding (#34370)

BUG FIXES:

provider: Change the default AWS SDK for Go v2 API client RateLimiter to ratelimit.None so that services migrated to AWS SDK for Go v2 maintain behavioral compatibility with AWS SDK for Go v1 (#36467)
resource/aws_appautoscaling_policy: Fix errors when importing an MSK storage autoscaling policy (#34934)
resource/aws_appautoscaling_scheduled_action: Always send start_time and end_time values on update when configured (#33713)
resource/aws_appautoscaling_scheduled_action: Read correct resource by using scalable_dimension as an additional filter (#34382)
resource/aws_datasync_location_azure_blob: Fix missing container_url attribute value and bad subdirectory attribute value from state read/refresh (#36072)
resource/aws_datasync_location_efs: Fix missing efs_file_system_arn attribute value from state read/refresh (#36072)
resource/aws_datasync_location_hdfs: Mark qop_configuration as Computed (#36072)
resource/aws_datasync_location_nfs: Fix missing server_hostname attribute value from state read/refresh (#36072)
resource/aws_datasync_location_s3: Fix missing s3_bucket_arn attribute value from state read/refresh (#36072)
resource/aws_datasync_location_smb: Fix missing server_hostname attribute value from state read/refresh (#36072)
resource/aws_dms_replication_config: Fix persistent change in replication_settings (#35670)
resource/aws_dms_replication_task: Fix persistent change in replication_task_settings (#35670)
resource/aws_eks_access_entry: Always send kubernetes_groups and user_name values on update when configured (#36484)
resource/aws_glue_job: Adjust number_of_workers minimum value to 1 (#36458)
resource/aws_lexv2models_slot: Fix custom_payload typo (#36488)
resource/aws_route: Allow resource creation if a propagated route to the same destination exists (#36512)
resource/aws_vpn_connection: local_ipv6_network_cidr, remote_ipv6_network_cidr, tunnel1_inside_ipv6_cidr, and tunnel2_inside_ipv6_cidr no longer require transit_gateway_id to be specified (#36405)

`v5.41.0`

Compare Source

FEATURES:

New Data Source: aws_apprunner_hosted_zone_id (#36288)
New Data Source: aws_medialive_input (#36307)
New Resource: aws_lakeformation_data_cells_filter (#36264)
New Resource: aws_securityhub_configuration_policy (#35752)
New Resource: aws_securityhub_configuration_policy_association (#35752)
New Resource: aws_securitylake_subscriber_notification (#36323)

ENHANCEMENTS:

data-source/aws_ec2_transit_gateway_peering_attachment: Add state attribute (#36304)
data-source/aws_lakeformation_permissions: Add data_cells_filter attribute (#36264)
data-source/aws_ram_resource_share: name is Optional (#36062)
resource/aws_cognito_user_pool: Add pre_token_generation_config configuration block (#35236)
resource/aws_ec2_transit_gateway_peering_attachment: Add state attribute (#36304)
resource/aws_ecs_cluster: Add default value (DEFAULT) for configuration.execute_command_configuration.logging (#36341)
resource/aws_lakeformation_permissions: Add data_cells_filter attribute (#36264)
resource/aws_ram_resource_association: Add plan-time validation of resource_arn and resource_share_arn (#36062)
resource/aws_route53domains_registered_domain: Add billing_contact and billing_privacy arguments (#36285)
resource/aws_securityhub_organization_configuration: Add organization_configuration configuration block to support central configuration (#35752)
resource/aws_securityhub_organization_configuration: Set auto_enable to false, auto_enable_standards to NONE, and organization_configuration.configuration_type to LOCAL on resource Delete (#35752)

BUG FIXES:

data-source/aws_iam_policy_document: Fix Failed to marshal state to json: unsupported attribute "override_json" and Failed to marshal state to json: unsupported attribute "source_json" errors when running terraform show -json or terraform state rm (#36383)
data-source/aws_opensearch_domain : Add auto_tune_options.use_off_peak_window attribute. This fixes a regression introduced in v5.40.0 causing Invalid address to set errors (#36298)
resource/aws_cognito_identity_pool: Fix handling of resources deleted out of band (#36100)
resource/aws_cognito_identity_provider: Fix InvalidParameterException: ActiveEncryptionCertificate is not a valid key for SAML identity provider details errors on resource Update (#36311)
resource/aws_ec2_instance: Remove ForceNew from ipv6_address_count (#36308)
resource/aws_ecs_cluster: Fix panic: interface conversion: interface {} is nil, not map[string]interface {} when configuration, configuration.execute_command_configuration, or configuration.execute_command_configuration.log_configuration are empty (#36341)
resource/aws_ecs_service: Fix panic: interface conversion: interface {} is nil, not map[string]interface {} when service_connect_configuration.service.timeout is empty (#36309)
resource/aws_ecs_service: service_connect_configuration.service.tls.issuer_cert_authority.aws_pca_authority_arn is Required (#36309)
resource/aws_elasticache_replication_group: Fix bugs causing errors like InvalidReplicationGroupState: Cluster not in available state to perform tagging operations. (#36310)
resource/aws_finspace_kx_cluster: Prevent command_line_arguments and initialization_script updates from overwriting one another (#36361)
resource/aws_network_acl_rule: Fix InvalidNetworkAclID.NotFound errors on resource Delete (#36326)
resource/aws_network_acl_rule: Prevent creation of duplicate Terraform resources (#36326)
resource/aws_ram_principal_association: Prevent creation of duplicate Terraform resources (#36062)
resource/aws_ram_principal_association: Remove from state on resource Read if principal is disassociated outside of Terraform (#36062)
resource/aws_ram_resource_association: Prevent creation of duplicate Terraform resources (#36062)
resource/aws_route: Prevent creation of duplicate Terraform resources (#36326)
resource/aws_route_table: Fix couldn't find resource errors on resource Delete (#36326)
resource/aws_vpn_connection: Correct plan-time validation of tunnel1_inside_ipv6_cidr and tunnel2_inside_ipv6_cidr (#36236)

`v5.40.0`

Compare Source

FEATURES:

New Function: arn_build (#34952)
New Function: arn_parse (#34952)
New Resource: aws_account_region (#35739)
New Resource: aws_securitylake_subscriber (#35981)

ENHANCEMENTS:

data-source/aws_rds_engine_version: Add has_major_target and has_minor_target optional arguments and valid_major_targets and valid_minor_targets attributes (#36246)
resource/aws_batch_job_queue: added parameter compute_environment_order which conflicts with compute_environments but aligns with AWS API. compute_environments has been deprecated. (#34750)
resource/aws_cloudfront_distribution: Remove the upper limit on origin.custom_origin_config.origin_read_timeout (#36088)
resource/aws_db_instance: Add io2 as a valid value for storage_type (#36252)
resource/aws_elasticache_serverless_cache: Add plan-time validation of cache_usage_limits.ecpu_per_second.maximum (#35927)
resource/aws_iot_policy: Add tagging support (#36102)
resource/aws_iot_role_alias: Add tagging support (#36255)
resource/aws_opensearch_domain: Add use_off_peak_window argument to the auto_tune_options configuration block (#36067)
resource/aws_rds_cluster: Add io2 as a valid value for storage_type (#36252)
resource/aws_s3_bucket_object: Adds attribute arn. (#35710)
resource/aws_s3_object: Adds attribute arn. (#35710)
resource/aws_s3_object_copy: Adds attribute arn. (#35710)
resource/aws_wafv2_rule_group: Add evaluation_window_sec argument to the rate_based_statement configuration block (#36045)
resource/aws_wafv2_web_acl: Add evaluation_window_sec argument to the rate_based_statement configuration block (#36045)

BUG FIXES:

data-source/aws_rds_engine_version: Fix bugs that could limit engine version to a default version even when not appropriate (#36246)
resource/aws_db_instance: Correctly sets parameter_group_name when replicate_source_db is in different region. (#36080)
resource/aws_elastic_beanstalk_environment: Fix InvalidParameterValue: Environment named ... is in an invalid state for this operation. Must be Ready errors when tags are updated along with other attributes (#36074)
resource/aws_elasticache_serverless_cache: Change cache_usage_limits.data_storage.maximum and cache_usage_limits.ecpu_per_second.maximum to ForceNew (#35927)
resource/aws_medialive_channel: Fix handling of optional encoder_settings.audio_descriptions arguments (#36097)
resource/aws_rds_global_cluster: Fix bugs and delays that could occur when performing major or minor version upgrades (#36246)
resource/aws_s3_bucket: Tags with empty values no longer remove all tags. (#35710)
resource/aws_s3_bucket_object: Tags with empty values no longer remove all tags. (#35710)
resource/aws_s3_object: Tags with empty values no longer remove all tags. (#35710)
resource/aws_s3_object_copy: Tags with empty values no longer remove all tags. (#35710)
resource/aws_vpclattice_listener_rule: Remove action.forward.target_groups maximum item limit (#36095)

`v5.39.1`

Compare Source

BUG FIXES:

data-source/aws_instance: Fix panic: Invalid address to set related to root_block_device.0.tags_all (#36054)

`v5.39.0`

Compare Source

FEATURES:

New Data Source: aws_redshift_data_shares (#35937)
New Resource: aws_apprunner_deployment (#35758)
New Resource: aws_config_retention_configuration (#15136)
New Resource: aws_securityhub_automation_rule (#34781)
New Resource: aws_shield_proactive_engagement (#34667)

ENHANCEMENTS:

aws_kinesis_firehose_delivery_stream: Add custom_time_zone and file_extension arguments to the extended_S3_configuration configuration block (#35969)
resource/aws_appflow_flow: Allow task.source_fields to be a null value (#35993)
resource/aws_codepipeline: Add trigger configuration block (#35475)
resource/aws_config_configuration_recorder: Add plan-time validation of aws_config_organization_custom_rule.lambda_function_arn (#15136)
resource/aws_instance: Add configurable read timeout (#35955)
resource/aws_instance: Apply default tags to volumes/block devices managed through an aws_instance, add ebs_block_device.*.tags_all and root_block_device.*.tags_all attributes which include default tags (#33769)
resource/aws_mq_broker: Add data_replication_mode and data_replication_primary_broker_arn arguments, enabling support for cross-region data replication (#35990)
resource/aws_mwaa_environment: Add endpoint_management attribute (#35961)
resource/aws_redshiftserverless_namespace: Add attributes admin_password_secret_kms_key_id and manage_admin_password (#35965)
resource/aws_shield_drt_access_log_bucket_association: Support resource import (#34667)
resource/aws_shield_drt_access_role_arn_association: Support resource import (#34667)
resource/aws_spot_instance_request: Add configurable read timeout (#35955)
resource/aws_wafv2_web_acl: Add application_integration_url attribute (#35974)

BUG FIXES:

data/aws_redshiftserverless_namespace: Properly set iam_roles attribute on read (#35965)
resource/aws_appflow_flow: Fix perpetual diff when task.task_type is set to Map_all (#35993)
resource/aws_config_configuration_recorder: Fix panic: interface conversion: interface {} is nil, not map[string]interface {} when recording_group.exclusion_by_resource_types is empty (#15136)
resource/aws_config_rule: Change name to ForceNew (#15136)
resource/aws_config_rule: Fix InvalidParameterValueException: PolicyText is required when Owner is CUSTOM_POLICY errors on resource Update (#15136)
resource/aws_ecs_task_definition: Fix perpetual container_definitions diffs when Names are ordered differently (#36029)
resource/aws_msk_replicator: Fix incorrect detect_and_copy_new_topics attribute value from state read/refresh (#35966)
resource/aws_redshiftserverless_workgroup: Fix max_capacity removal (#36032)
resource/aws_redshiftserverless_workgroup: Fix updating both base_capacity and max_capacity (#36032)
resource/aws_shield_drt_access_log_bucket_association: Change log_bucket and role_arn_association_id to ForceNew (#34667)

`v5.38.0`

Compare Source

FEATURES:

New Data Source: aws_batch_job_definition (#34663)
New Data Source: aws_cognito_user_group (#34046)
New Data Source: aws_cognito_user_groups (#34046)

ENHANCEMENTS:

data-source/aws_alb_target_group: Add load_balancer_arns attribute (#34364)
data-source/aws_ec2_instance_type: Add maximum_network_cards attribute (#35840)
data-source/aws_elasticache_subnet_group: Add vpc_id attribute (#35887)
data-source/aws_lb_target_group: Add load_balancer_arns attribute (#34364)
provider: Add token_bucket_rate_limiter_capacity parameter (#35926)
resource/aws_alb_target_group: Add load_balancer_arns attribute (#34364)
resource/aws_codedeploy_deployment_config: Add arn attribute (#35888)
resource/aws_codepipeline: Add execution_mode argument (#35875)
resource/aws_config_configuration_recorder: Add recording_mode configuration block (#35527)
resource/aws_db_instance: Add plan-time validation of performance_insights_retention_period (#35870)
resource/aws_elasticache_subnet_group: Add vpc_id attribute (#35887)
resource/aws_lb_target_group: Add load_balancer_arns attribute (#34364)
resource/aws_redshiftserverless_workgroup: Add max_capacity argument (#35720)
resource/aws_transfer_server: Add TransferSecurityPolicy-2024-01 and TransferSecurityPolicy-FIPS-2024-01 as valid values for security_policy_name (#35879)

BUG FIXES:

data-source/aws_caller_identity: Fix authentication signature error when alternate sts_region is specified (#35860)
data-source/aws_eks_access_entry: Fix cluster_name plan-time validation, allowing single-character names (#35874)
data-source/aws_eks_addon: Fix cluster_name plan-time validation, allowing single-character names (#35874)
data-source/aws_eks_cluster: Fix name plan-time validation, allowing single-character names (#35874)
resource/aws_cloudsearch_domain: Prevent panic when reading nil index_field options response values (#35900)
resource/aws_eks_access_entry: Fix cluster_name plan-time validation, allowing single-character names (#35874)
resource/aws_eks_access_policy_association: Fix cluster_name plan-time validation, allowing single-character names (#35874)
resource/aws_eks_addon: Fix cluster_name plan-time validation, allowing single-character names (#35874)
resource/aws_eks_cluster: Fix name plan-time validation, allowing single-character names (#35874)
resource/aws_eks_fargate_profile: Fix cluster_name plan-time validation, allowing single-character names (#35874)
resource/aws_eks_node_group: Fix cluster_name plan-time validation, allowing single-character names (#35874)
resource/aws_prometheus_scraper: Fixes invalid result after apply error. (#35844)
resource/aws_sqs_queue_policy: Retry IAM eventual consistency errors (#35861)

`v5.37.0`

Compare Source

NOTES:

provider: Updates to Go 1.21 (used by Terraform starting with v1.6.0), which, for Windows, requires at least Windows 10 or Windows Server 2016--support for previous versions has been discontinued--and, for macOS, requires macOS 10.15 Catalina or later--support for previous versions has been discontinued. (#35832)
resource/aws_bedrock_provisioned_model_throughput: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#35689)

FEATURES:

New Data Source: aws_db_parameter_group (#35698)
New Resource: aws_bedrock_provisioned_model_throughput (#35689)
New Resource: aws_cloudfront_key_value_store (#35663)
New Resource: aws_redshift_data_share_consumer_association (#35771)

ENHANCEMENTS:

data-source/aws_ecr_pull_through_cache_rule: Add credential_arn attribute (#34475)
data-source/aws_ecs_task_execution: Add client_token argument (#34402)
data-source/aws_neptune_cluster_instance: Add skip_final_snapshot argument (#35698)
data-source/aws_rds_engine_version: Improve search functionality and options by adding latest, preferred_major_targets, and preferred_upgrade_targets. Add version_actual attribute (#35698)
data-source/aws_rds_orderable_db_instance: Improve search functionality and options by adding engine_latest_version and supports_clusters arguments and converting read_replica_capable, supported_engine_modes, supported_network_types, and supports_multi_az to arguments for use as search criteria (#35698)
resource/aws_appsync_graphql_api: Add introspection_config, query_depth_limit, and resolver_count_limit arguments (#35631)
resource/aws_codeartifact_domain: Add s3_bucket_arn attribute (#35760)
resource/aws_ecr_pull_through_cache_rule: Add credential_arn argument (#34475)
resource/aws_ecs_service: Add service_connect_configuration.service.timeout and service_connect_configuration.service.tls configuration blocks (#35684)
resource/aws_ecs_task_definition: Add track_latest argument (#30154)
resource/aws_glue_catalog_database: Add federated_database argument (#35799)
resource/aws_glue_trigger: Add configurable timeouts (#35542)
resource/aws_rds_cluster: Add domain and domain_iam_role_name arguments to support Kerberos authentication (#35753)
resource/aws_route53_record: Add geoproximity_routing_policy configuration block to support geoproximity routing (#35565)
resource/aws_route53_resolver_rule: Add target_ip.protocol argument (#35744)
resource/aws_sagemaker_endpoint_configuration: Add routing_config argument. Enables the specification of a routing_strategy. (#34777)
resource/aws_sagemaker_space: Add ownership_settings, space_sharing_settings, space_settings.app_type, space_settings.code_editor_app_settings, space_settings.custom_file_system, space_settings.jupyter_lab_app_settings, and space_settings.space_storage_settings arguments (#35116)

BUG FIXES:

provider: Fix failed to get rate limit token, retry quota exceeded errors (#35817)
resource/aws_apigateway_domain_name: Properly send changes to ownership_verification_certificate_arn on update (#35777)
resource/aws_apigatewayv2_route: Fix BadRequestException: Unable to update route. Authorizer type is invalid or null errors when updating authorizer_id (#35821)
resource/aws_autoscaling_group: Fix version to computed for inconsistent final plan issue (#35774)
resource/aws_datasync_task: Fix crash when reading empty report_override values (#35778)
resource/aws_datasync_task: Prevent ValidationErrors when empty values are sent with report_override arguments (#35778)
resource/aws_db_proxy: Change auth from TypeList to TypeSet as order is not significant (#35819)
resource/aws_ecs_account_setting_default: Remove plan-time validation of value (#33393)
resource/aws_ecs_task_definition: Fix perpetual container_definitions diffs when Secrets are ordered differently (#35792)
resource/aws_eks_access_policy_association: Retry IAM eventual consistency errors on create (#35736)
resource/aws_instance: Fix ReservationCapacityExceeded errors when updating instance_type and capacity_reservation_specification.capacity_reservation_target.capacity_reservation_id (#33412)
resource/aws_lakeformation_resource: Properly handle configured false values for use_service_linked_role (#35799)
resource/aws_medialive_channel: Added client_cache to hls_group_settings. (#35738)
resource/aws_ram_resource_share_accepter: Fix handling of out-of-band resource share deletion (#35800)
resource/aws_redshift_data_share_authorization: Fix read operation to properly handle shares in ACTIVE status (#35771)
resource/aws_s3_bucket_acl: Correctly updates access_control_policy when switching configuration to acl. (#35775)
resource/resource_share_acceptor: Wait until RAM resource share available after accepting the invitation (#34753)

`v5.36.0`

Compare Source

NOTES:

data-source/aws_media_convert_queue: The AWS Elemental MediaConvert service has been converted to use standard Regional endpoints instead of deprecated per-account endpoints (#35615)
resource/aws_controltower_landing_zone: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#34595)
resource/aws_media_convert_queue: The AWS Elemental MediaConvert service has been converted to use standard Regional endpoints instead of deprecated per-account endpoints (#35615)

FEATURES:

New Resource: aws_controltower_landing_zone (#34595)
New Resource: aws_osis_pipeline (#35582)
New Resource: aws_redshift_data_share_authorization (#35703)
New Resource: aws_securitylake_custom_log_source (#35354)

ENHANCEMENTS:

resource/aws_cloudwatch_metric_stream: Add plan-time validation of output_format (#35569)
resource/aws_db_instance: Add diag.log and notify.log as valid values for enabled_cloudwatch_logs_exports (#35626)
resource/aws_db_instance: Add domain_auth_secret_arn, domain_dns_ips, domain_fqdn, and domain_ou arguments to support self-managed Active Directory (#35500)
resource/aws_s3_bucket_metric: Add filter.access_point argument (#35590)
resource/aws_verifiedaccess_group: Add sse_configuration argument (#34055)

BUG FIXES:

resource/aws_db_instance: Creating resource from point-in-time recovery now handles password attribute correctly (#35589)
resource/aws_dynamodb_table: Ensure that replicas are always set on Read (#35630)
resource/aws_emr_cluster: Properly normalize launch_specifications.on_demand_specification.allocation_strategy and launch_specifications.spot_specification.allocation_strategy values to fix perpetual state differences (#34367)
resource/aws_kinesis_firehose_delivery_stream: Change extended_s3_configuration.processing_configuration.processors.parameters from TypeList to TypeSet as order is not significant (#35672)
resource/aws_lambda_function: Resolve consecutive diff issue in logging_config when values for application_log_level or system_log_level are not specified (#35694)
resource/aws_lb_listener: Fixes unexpected diff when using default_action parameters which don't match the type. (#35678)
resource/aws_lb_listener: Was incorrectly reporting conflicting default_action[].target_group_arn when ignore_changes was set. (#35671)
resource/aws_lb_listener: Was not storing default_action[].forward in state if only a single target_group was set. (#35671)
resource/aws_lb_listener_rule: Fixes unexpected diff when using action parameters which don't match the type. (#35678)
resource/aws_lb_listener_rule: Was incorrectly reporting conflicting action[].target_group_arn when ignore_changes was set. (#35671)
resource/aws_lb_listener_rule: Was not storing action[].forward in state if only a single target_group was set. (#35671)
resource/aws_ssm_patch_baseline: Mark json as Computed if there are content changes (#35606)

`v5.35.0`

Compare Source

FEATURES:

New Data Source: aws_bedrock_custom_model (#34310)
New Data Source: aws_bedrock_custom_models (#34310)
New Data Source: aws_ssmcontacts_rotation (#32710)
New Resource: aws_bedrock_custom_model (#34310)
New Resource: aws_lexv2models_slot (#34617)
New Resource: aws_lexv2models_slot_type (#35555)
New Resource: aws_rekognition_collection (#35407)
New Resource: aws_sesv2_email_identity_policy (#35486)
New Resource: aws_ssmcontacts_rotation (#32710)

ENHANCEMENTS:

data-source/aws_redshift_cluster: Add multi_az attribute (#35508)
resource/aws_lakeformation_resource: Add hybrid_access_enabled argument (#35571)
resource/aws_lakeformation_resource: Add with_federation argument (#35154)
resource/aws_redshift_cluster: Add multi_az argument (#35508)
resource/aws_redshiftserverless_endpoint_access: Add owner_account argument (#35509)
resource/aws_wafv2_rule_group: Add header_order to field_to_match configuration blocks (#35521)
resource/aws_wafv2_web_acl: Add header_orderto field_to_match configuration blocks (#35521)

BUG FIXES:

data-source/aws_networkmanager_core_network_policy_document: Remove core_network_configuration.edge_locations maximum item limit (#35585)
resource/aws_backup_plan: Fix InvalidParameterValueException: Invalid lifecycle. EBS Cold Tier is not yet supported errors on resource Create in AWS GovCloud (US) (#35560)
resource/aws_cognito_user_group: Allow import of user groups with names containing / (#35501)
resource/aws_dms_event_subscription: Mark source_ids as Optional. This fixes a regression introduced in v5.31.0 (#35541)
resource/aws_efs_file_system: Increase lifecycle_policy maximum item limit to 3 (#35522)
resource/aws_eks_access_entry: Retry IAM eventual consistency errors on create (#35535)
resource/aws_finspace_kx_cluster: Increase command_line_arguments max length restriction from 50 to 1024. (#35581)

`v5.34.0`

Compare Source

FEATURES:

New Resource: aws_rekognition_project (#35429)
New Resource: aws_route53domains_delegation_signer_record (#33596)

ENHANCEMENTS:

data-source/aws_codecommit_repository: Add kms_key_id attribute (#35095)
data-source/aws_imagebuilder_components: Add support for ThirdParty owner value (#35286)
data-source/aws_imagebuilder_container_recipes: Add support for ThirdParty owner value (#35286)
data-source/aws_imagebuilder_image_recipes: Add support for ThirdParty owner value (#35286)
data-source/aws_ssm_patch_baseline: Add json attribute to facilitate use with S3 buckets (#33402)
resource/aws_accessanalyzer_analyzer: Add configuration configuration block (#35310)
resource/aws_appflow_flow: Add flow_status attribute (#34948)
resource/aws_codecommit_repository: Add kms_key_id argument (#35095)
resource/aws_codecommit_trigger: Add plan-time validation of trigger.destination_arn and trigger.events (#35095)
resource/aws_ecs_capacity_provider: Add auto_scaling_group_provider.managed_draining argument (#35421)
resource/aws_fis_experiment_template: Add support for AutoScalingGroups, Buckets, ReplicationGroups, Tables and TransitGateways to action.*.target (#35300)
resource/aws_fsx_openzfs_file_system: Add skip_final_backup argument (#35320)
resource/aws_network_interface_sg_attachment: Increase default timeouts to 3 minutes and allow them to be configured (#35435)
resource/aws_prometheus_scraper: Add role_arn attribute (#35453)
resource/aws_route53domains_registered_domain: Support resource import (#33596)
resource/aws_ssm_patch_baseline: Add json attribute to facilitate use with S3 buckets (#33402)
resource/aws_wafv2_web_acl: Add challenge_config argument (#35367)

BUG FIXES:

resource/aws_codebuild_project: Allow build_batch_config to be removed on Update (#34121)
resource/aws_eks_access_entry: Mark kubernetes_groups as Computed (#35391)
resource/aws_eks_access_entry: Mark type and user_name as Optional, allowing values to be configured (#35391)
resource/aws_grafana_license_association: Fix missing workspace_id attribute after import (#35290)
resource/aws_security_group_rule: Fix UnsupportedOperation: The functionality you requested is not available in this region errors on Read in certain partitions (#33484)

`v5.33.0`

Compare Source

FEATURES:

New Data Source: aws_eks_access_entry (#35037)
New Resource: aws_eks_access_entry (#35037)
New Resource: aws_eks_access_policy_association (#35037)
New Resource: aws_lexv2models_intent (#34891)

ENHANCEMENTS:

data-source/aws_eks_cluster: Add access_config attribute (#35037)
data-source/aws_secretsmanager_secret: Add created_date and last_changed_date attributes (#35117)
data-source/aws_secretsmanager_secret_version: Add created_date attribute (#35117)
resource/aws_backup_plan: Add rule.lifecycle.opt_in_to_archive_for_supported_resources and rule.copy_action.lifecycle.opt_in_to_archive_for_supported_resources and arguments (#34994)
resource/aws_eks_cluster: Add access_config configuration block (#35037)
resource/aws_lakeformation_resource: Add use_service_linked_role argument (#35284)
resource/aws_secretsmanager_secret_rotation: Add rotate_immediately argument (#35105)

BUG FIXES:

resource/aws_datasync_task: Allow schedule to be removed successfully (#35282)
resource/aws_fis_experiment_template: Fix validation error when not using target.resource_arns or target.resource_tag attributes. (#35254)
resource/aws_lb_listener: Fix ValidationError: Mutual Authentication mode passthrough does not support ignoring certificate expiry errors when mutual_authentication.mode is set to passthrough (#35289)
resource/aws_secretsmanager_secret_version: Fix InvalidParameterException: The parameter RemoveFromVersionId can't be empty. Staging label AWSCURRENT is currently attached to version ..., so you must explicitly reference that version in RemoveFromVersionId errors when a secret is updated outside Terraform (#19943)

`v5.32.1`

Compare Source

BUG FIXES:

data-source/aws_ecr_image: Fix error when most_recent is not also latest (#35269)
resource/aws_iot_ca_certificate: Change registration_config.role_arn from TypeBool to TypeString, fixing Inappropriate value for attribute "role_arn": a bool is required errors (#35234)
resource/aws_mq_broker: Fix interface conversion: interface {} is *schema.Set, not []string panic (#35265)

`v5.32.0`

Compare Source

FEATURES:

New Data Source: aws_mq_broker_engine_types (#34232)
New Data Source: aws_msk_bootstrap_brokers (#32484)
New Data Source: aws_verifiedpermissions_policy_store (#32204)
New Resource: aws_ebs_fast_snapshot_restore (#35211)
New Resource: aws_elasticache_serverless_cache (#34951)
New Resource: aws_imagebuilder_workflow (#35097)
New Resource: aws_kinesis_resource_policy (#35167)
New Resource: aws_prometheus_scraper (#34749)
New Resource: aws_securitylake_aws_log_source (#34974)
New Resource: aws_ssoadmin_application_access_scope (#34811)
New Resource: aws_verifiedpermissions_policy_store (#32204)
New Resource: aws_verifiedpermissions_policy_template (#32205)
New Resource: aws_verifiedpermissions_schema (#32204)

ENHANCEMENTS:

data-source/aws_batch_compute_environment: Add update_policy attribute (#34353)
data-source/aws_ecr_image: Add image_uri attribute (#24526)
data-source/aws_efs_file_system: Add lifecycle_policy.transition_to_archive attribute (#35096)
data-source/aws_efs_file_system: Add protection attribute (#35029)
data-source/aws_elastic_beanstalk_hosted_zone: Add hosted zone ID for il-central-1 AWS Region (#35131)
data-source/aws_elb_hosted_zone_id: Add hosted zone ID for ca-west-1 AWS Region (#35131)
data-source/aws_fsx_ontap_file_system: Add ha_pairs and throughput_capacity_per_ha_pair attributes (#34993)
data-source/aws_glue_catalog_table: Add region attribute to target_table block. (#34817)
data-source/aws_lambda_function: Add logging_config attribute (#35050)
data-source/aws_lb_hosted_zone_id: Add hosted zone IDs for ca-west-1 AWS Region (#35131)
data-source/aws_lb_target_group: Add load_balancing_anomaly_mitigation attribute (#35083)
data-source/aws_msk_configuration: Remove name length validation (#34399)
data-source/aws_networkfirewall_firewall_policy: Add firewall_policy.tls_inspection_configuration_arn attribute (#35094)
data-source/aws_prometheus_workspace: Add kms_key_arn attribute (#35062)
data-source/aws_route53_resolver_endpoint: Add protocols attribute (#35098)
data-source/aws_route53_resolver_endpoint: Add resolver_endpoint_type attribute (#34798)
data-source/aws_s3_bucket: Add hosted zone ID for ca-west-1 AWS Region (#35131)
provider: Support ca-west-1 as a valid AWS Region (#35131)
resource/aws_appflow_flow: Add destination_connector_properties.s3.s3_output_format_config.target_file_size argument (#35215)
resource/aws_appstream_fleet: Increase idle_disconnect_timeout_in_seconds max value for validation to 360000 (#35173)
resource/aws_autoscaling_group: Add instance_refresh.preferences.max_healthy_percentage attribute (#34929)
resource/aws_autoscaling_group: Fix ValidationError: The instance ... is not part of Auto Scaling group ... errors on resource Delete when disabling scale-in protection for instances that are already fully terminated (#35071)
resource/aws_batch_compute_environment: Add update_policy parameter (#34353)
resource/aws_batch_job_definition: Add scheduling_priority argument and arn_prefix attribute (#34997)
resource/aws_cloud9_environment_ec2: Add amazonlinux-2023-x86_64 and resolve:ssm:/aws/service/cloud9/amis/amazonlinux-2023-x86_64 as valid values for image_id (#35020)
resource/aws_codepipeline: Add pipeline_type argument and variable configuration block (#34841)
resource/aws_dms_replication_task: Allow cdc_start_time to use RFC3339 formatted dates in addition to UNIX timestamps (#31917)
resource/aws_dms_replication_task: Remove ForceNew from replication_instance_arn, allowing in-place migration between DMS instances (#30721)
resource/aws_efs_file_system: Add lifecycle_policy.transition_to_archive argument (#35096)
resource/aws_efs_file_system: Add protection configuration block (#35029)
resource/aws_efs_replication_configuration: Increase Create timeout to 20 minutes (#34955)
resource/aws_efs_replication_configuration: Mark destination.file_system_id as Optional, enabling EFS replication fallback (#34955)
resource/aws_finspace_kx_dataview: Increase default create, update, and delete timeouts to 4 hours (#35207)
resource/aws_finspace_kx_scaling_group: Increase default create, delete timeouts to 4 hours (#35206)
resource/aws_fsx_lustre_file_system: Allow per_unit_storage_throughput to be updated in-place (#34932)
resource/aws_fsx_ontap_file_system: Add ha_pairs and throughput_capacity_per_ha_pair arguments (#34993)
resource/aws_fsx_ontap_file_system: Increase maximum value of disk_iops_configuration.iops to 2400000 (#34993)
resource/aws_fsx_ontap_file_system: throughput_capacity is Optional (#34993)
resource/aws_glue_catalog_table: Add region attribute to target_table block. (#34817)
resource/aws_glue_classifier: Add csv_classifier.serde argument (#34251)
resource/aws_kinesis_firehose_delivery_stream: Add opensearch_configuration.document_id_options configuration block (#35137)
resource/aws_kinesis_firehose_delivery_stream: Add splunk_configuration.buffering_interval and splunk_configuration.buffering_size arguments (#35137)
resource/aws_kinesis_firehose_delivery_stream: Adjust elasticsearch_configuration.buffering_interval, http_endpoint_configuration.buffering_interval, opensearch_configuration.buffering_interval, opensearchserverless_configuration.buffering_interval, redshift_configuration.s3_backup_configuration.buffering_interval,extended_s3_configuration.s3_backup_configuration.buffering_interval, elasticsearch_configuration.s3_configuration.buffering_interval, http_endpoint_configuration.s3_configuration.buffering_interval, opensearch_configuration.s3_configuration.buffering_interval, opensearchserverless_configuration.s3_configuration.buffering_interval, redshift_configuration.s3_configuration.buffering_interval and splunk_configuration.s3_configuration.buffering_interval minimum values to 0 to support zero buffering (#35137)
resource/aws_kms_key: Add xks_key_id attribute (#31216)
resource/aws_lambda_function: Add logging_config configuration block in support of advanced logging controls (#35050)
resource/aws_lambda_function: Add support for python3.12 runtime value (#35049)
resource/aws_lambda_layer_version: Add support for python3.12 compatible_runtimes value (#35049)
resource/aws_lb_target_group: Add load_balancing_anomaly_mitigation argument (#35083)
resource/aws_lb_target_group: Add weighted_random as a valid value for load_balancing_algorithm_type (#35083)
resource/aws_neptune_cluster: Add storage_type argument (#34985)
resource/aws_neptune_cluster_instance: Add storage_type attribute (#34985)
resource/aws_networkfirewall_firewall: Add configurable timeouts (#34918)
resource/aws_networkfirewall_firewall_policy: Add firewall_policy.tls_inspection_configuration_arn argument (#35094)
resource/aws_prometheus_workspace: Add kms_key_arn argument, enabling encryption at-rest using AWS KMS Customer Managed Keys (CMK) (#35062)
resource/aws_redshiftserverless_workgroup: Add port argument (#34925)
resource/aws_route53_resolver_endpoint: Add protocols argument (#35098)
resource/aws_route53_resolver_endpoint: Add resolver_endpoint_type argument (#34798)
resource/aws_s3_bucket: Modify resource Read to support third-party S3 API implementations. Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#35035)
resource/aws_s3_bucket: Modify server-side encryption configuration error handling, enabling support for NetApp StorageGRID (#34890)
resource/aws_transfer_server: Add TransferSecurityPolicy-PQ-SSH-Experimental-2023-04 and TransferSecurityPolicy-PQ-SSH-FIPS-Experimental-2023-04 as valid values for security_policy_name (#35129)
resource/aws_verifiedaccess_endpoint: Add policy_document argument (#34264)

BUG FIXES:

data-source/aws_lb_target_group: Change deregistration_delay from TypeInt to TypeString (#31436)
data-source/aws_s3_bucket_object: Remove any leading ./ from key to maintain AWS SDK for Go v1 (pre-v5.17.0) compatibility (#35223)
data-source/aws_s3_object: Remove any leading ./ from key to maintain AWS SDK for Go v1 (pre-v5.17.0) compatibility (#35223)
resource/aws_cloud9_environment_ec2: image_id is Required (#35020)
resource/aws_codebuild_project: Prevent erroneous diffs on build_timeout and queued_timeout for Lambda compute types (#35043)
resource/aws_datasync_agent: Fix import of agents created with activation_key by removing requirement for one of ip_address or activation_key to be set (#35150)
resource/aws_dms_replication_config: Prevent erroneous diffs on replication_settings (#34356)
resource/aws_dms_replication_task: Prevent erroneous diffs on replication_task_settings (#34356)
resource/aws_dynamodb_table: Fix error when waiting for snapshot to be created (#34848)
resource/aws_finspace_kx_dataview: Properly set arn attribute on read, resolving persistent differences when tags are configured (#34998)
resource/aws_glue_catalog_database: Properly handle out-of-band resource deletion (#35195)
resource/aws_iot_indexing_configuration: Correct plan-time validation of thing_indexing_configuration.filter.named_shadow_names (#35225)
resource/aws_kinesis_firehose_delivery_stream: Fix InvalidArgumentException: Both BufferSizeInMBs and BufferIntervalInSeconds are required to configure buffering for lambda processor errors on resource Update (#26964)
resource/aws_kinesis_firehose_delivery_stream: Fix perpetual extended_s3_configuration.processing_configuration.processors.parameters diffs when processor type is Lambda (#35137)
resource/aws_lambda_function: Ensure lambda does not get deployed if source_code_hash does not change. (#29921)
resource/aws_lb: Fix ValidationError: Attributes cannot be empty errors (#35228)
resource/aws_lb_target_group: Fix diff on stickiness.cookie_name when stickiness.type is lb_cookie (#31436)
resource/aws_memorydb_cluster: Treat snapshotting status as pending when creating cluster (#31077)
resource/aws_ram_principal_association: Fix reading RAM Resource Share (...) Principal Association (...): couldn't find resource (21 retries) errors when a high number of principals are associated with a resource share (#34738)
resource/aws_s3_bucket_object: Remove any leading ./ from key to maintain AWS SDK for Go v1 (pre-v5.17.0) compatibility (#35223)
resource/aws_s3_object: Remove any leading ./ from key to maintain AWS SDK for Go v1 (pre-v5.17.0) compatibility (#35223)
resource/aws_s3_object_copy: Remove any leading ./ from key to maintain AWS SDK for Go v1 (pre-v5.17.0) compatibility (#35223)
resource/aws_secretsmanager_secret_rotation: No longer ignores changes to rotation_rules.automatically_after_days when rotation_rules.schedule_expression is set. (#35024)
resource/aws_ses_configuration_set: Fix tracking_options being omitted from state and resulting in persistent diff (#35056)
resource/aws_ssoadmin_application: Fix portal_options.sign_in_options.application_url triggering ValidationError when unset (#34967)

`v5.31.0`

Compare Source

FEATURES:

New Data Source: aws_polly_voices (#34916)
New Data Source: aws_ssoadmin_application_assignments (#34796)
New Data Source: aws_ssoadmin_principal_application_assignments (#34815)
New Resource: aws_finspace_kx_dataview (#34828)
New Resource: aws_finspace_kx_scaling_group (#34832)
New Resource: aws_finspace_kx_volume (#34833)
New Resource: aws_ssoadmin_trusted_token_issuer (#34839)

ENHANCEMENTS:

data-source/aws_cloudwatch_log_group: Add log_group_class attribute (#34812)
data-source/aws_dms_endpoint: Add postgres_settings attribute (#34724)
data-source/aws_lb: Add connection_logs attribute (#34864)
data-source/aws_lb: Add dns_record_client_routing_policy attribute (#34135)
data-source/aws_opensearchserverless_collection: Add standby_replicas attribute (#34677)
resource/aws_db_instance: Add support for IBM Db2 databases (#34834)
resource/aws_dms_endpoint: Add elasticsearch_settings.use_new_mapping_type argument (#29470)
resource/aws_dms_endpoint: Add postgres_settings configuration block (#34724)
resource/aws_finspace_kx_cluster: Add database.dataview_name, scaling_group_configuration, and tickerplant_log_configuration arguments. (#34831)
resource/aws_finspace_kx_cluster: The capacity_configuration argument is now optional. (#34831)
resource/aws_lb: Add connection_logs configuration block (#34864)
resource/aws_lb: Add plan-time validation that exactly one of either subnets or subnet_mapping is configured (#33205)
resource/aws_lb: Allow the number of subnet_mappings for Application Load Balancers to be changed without recreating the resource (#33205)
resource/aws_lb: Allow the number of subnet_mappings for Network Load Balancers to be increased without recreating the resource (#33205)
resource/aws_lb: Allow the number of subnets for Network Load Balancers to be increased without recreating the resource (#33205)
resource/aws_opensearchserverless_collection: Add standby_replicas attribute (#34677)

BUG FIXES:

data-source/aws_ecr_pull_through_cache_rule: Fix plan time validation for ecr_repository_prefix (#34716)
provider: Always use the S3 regional endpoint in us-east-1 for S3 directory bucket operations. This fixes no such host errors (#34893)
resource/aws_appmesh_virtual_node: Remove limit of 50 backends per virtual node (#34774)
resource/aws_cloudwatch_log_group: Fix invalid new value for .skip_destroy: was cty.False, but now null errors (#30354)
resource/aws_cloudwatch_log_group: Remove default value (STANDARD) for log_group_class argument and mark as Computed. This fixes InvalidParameterException: Only Standard log class is supported errors in AWS Regions other than AWS Commercial (#34812)
resource/aws_db_instance: Fix error where Terraform loses track of resource if Blue/Green Deployment is applied outside of Terraform (#34728)
resource/aws_dms_event_subscription: source_ids and source_type are Required (#33731)
resource/aws_ecr_pull_through_cache_rule: Fix plan time validation for ecr_repository_prefix (#34716)
resource/aws_lb: Correct in-place update of security_groups for Network Load Balancers when the new value is Computed (#33205)
resource/aws_lb: Fix InvalidConfigurationRequest: Load balancer attribute key 'dns_record.client_routing_policy' is not supported on load balancers with type 'network' errors on resource Create in AWS GovCloud (US) (#34135)
resource/aws_medialive_channel: Fixed errors related to setting the failover_condition argument (#33410)
resource/aws_securitylake_data_lake: Fix reflect.Set: value of type basetypes.StringValue is not assignable to type types.ARN panic when importing resources with nil ARN fields (#34820)
resource/aws_vpc: Increase IPAM pool allocation deletion timeout from 20 minutes to 35 minutes (#34859)

`v5.30.0`

Compare Source

FEATURES:

New Data Source: aws_codeguruprofiler_profiling_group (#34672)
New Data Source: aws_ecr_repositories (#34446)
New Data Source: aws_lb_trust_store (#34584)
New Data Source: aws_ssoadmin_application (#34773)
New Data Source: aws_ssoadmin_application_providers (#34670)
New Resource: aws_codeguruprofiler_profiling_group (#34672)
New Resource: aws_customerprofiles_domain (#34622)
New Resource: aws_customerprofiles_profile (#34622)
New Resource: aws_lb_trust_store (#34584)
New Resource: aws_lb_trust_store_revocation (#34584)
New Resource: aws_securitylake_data_lake (#34521)
New Resource: aws_ssoadmin_application (#34723)
New Resource: aws_ssoadmin_application_assignment (#34741)
New Resource: aws_ssoadmin_application_assignment_configuration (#34752)

ENHANCEMENTS:

data-source/aws_appconfig_configuration_profile: Add kms_key_identifier attribute (#34725)
data-source/aws_lb: Add enforce_security_group_inbound_rules_on_private_link_traffic attribute (#33767)
data-source/aws_lb_listener: Add mutual_authentication attribute (#34584)
resource/aws_appconfig_configuration_profile: Add kms_key_identifier attribute (#34725)
resource/aws_appconfig_deployment: Add kms_key_identifier attribute (#34739)
resource/aws_cloudwatch_log_group: Add log_group_class argument (#34679)
resource/aws_lb: Add enforce_security_group_inbound_rules_on_private_link_traffic argument (#33767)
resource/aws_lb_listener: Add mutual_authentication configuration block (#34584)
resource/aws_s3_bucket: Fix stack overflow fatal errors on resource Delete when force_destroy is true and the bucket contains delete markers (#34712)
resource/aws_sagemaker_app: Add resource_spec.sagemaker_image_version_alias argument (#34729)
resource/aws_sagemaker_app_image_config: Add jupyter_lab_image_config configuration block (#34696)
resource/aws_sagemaker_domain: Add default_user_settings.code_editor_app_settings, default_user_settings.custom_file_system_config, default_user_settings.custom_posix_user_config, default_user_settings.default_landing_uri, default_user_settings.jupyter_lab_app_settings, default_user_settings.space_storage_settings, default_user_settings.studio_web_portal arguments (#34729)
resource/aws_sagemaker_domain: Add sagemaker_image_version_alias argument under all default_resource_spec blocks (#34729)
resource/aws_sagemaker_domain: Add single_sign_on_application_arn attribute (#34729)
resource/aws_sagemaker_space: Add sagemaker_image_version_alias argument under all default_resource_spec blocks (#34729)
resource/aws_sagemaker_space: Add space_display_name argument (#34729)
resource/aws_sagemaker_space: Add url attribute (#34729)
resource/aws_sagemaker_user_profile: Add sagemaker_image_version_alias argument under all default_resource_spec blocks (#34729)
resource/aws_sagemaker_user_profile: Add user_settings.code_editor_app_settings, user_settings.custom_file_system_config, user_settings.custom_posix_user_config, user_settings.default_landing_uri, user_settings.jupyter_lab_app_settings, user_settings.space_storage_settings, user_settings.studio_web_portal arguments (#34729)
resource/aws_transfer_server: Add support for TransferSecurityPolicy-FIPS-2023-05 security_policy_name value (#34709)

BUG FIXES:

resource/aws_ami: Correctly sets deprecation_time on creation and update due to eventual consistency (#34691)
resource/aws_ami: Correctly sets description on update due to eventual consistency (#34691)
resource/aws_ami: Now allows removing deprecation_time (#34691)
resource/aws_appflow_flow: Fix perpetual diff on destination_flow_config (#34770)
resource/aws_backup_vault_policy: Fix eventual consistency error when waiting for IAM (#34671)
resource/aws_eks_pod_identity_association: Retry IAM eventual consistency errors on create and update (#34717)
resource/aws_glue_connection: Fix crash while creating resource with empty physical_connection_requirements configuration block (#34737)

`v5.29.0`

Compare Source

FEATURES:

New Resource: aws_docdbelastic_cluster (#31033)
New Resource: aws_eks_pod_identity_association (#34566)

ENHANCEMENTS:

resource/aws_docdb_cluster: Add storage_type argument (#34637)
resource/aws_neptune_parameter_group: Add name_prefix argument (#34500)

BUG FIXES:

resource/aws_networkmanager_attachment_accepter: Now revokes attachment on deletion for VPC Attachments (#34547)
resource/aws_networkmanager_vpc_attachment: Fixes error when modifying options fields while waiting for acceptance (#34547)
resource/aws_networkmanager_vpc_attachment: Fixes error where VPC Attachments waiting for acceptance could not be deleted (#34547)
resource/aws_s3_directory_bucket: Fix NotImplemented: This bucket does not support Object Versioning errors on resource Delete when force_destroy is true (#34647)

`v5.28.0`

Compare Source

FEATURES:

New Data Source: aws_s3_directory_buckets (#34612)
New Resource: aws_s3_directory_bucket (#34612)

ENHANCEMENTS:

resource/aws_s3control_access_grants_instance: Add identity_center_arn argument and identity_center_application_arn attribute (#34582)

BUG FIXES:

resource/aws_elaticache_replication_group: Fix regression caused by the introduction of the auth_token_update_strategy argument with a default value (#34600)

`v5.27.0`

Compare Source

NOTES:

provider: This release includes an update to the AWS SDK for Go v2 with breaking type changes to several services: internetmonitor, ivschat, pipes, and s3. These changes primarily affect how arguments with default values are serialized for outbound requests, changing scalar types to pointers. See this AWS SDK for Go V2 issue for additional context. The corresponding provider changes should make this breakfix transparent to users, but as with any breaking change there is the potential for missed edge cases. If errors are observed in the impacted resources, please link to this dependency update pull request in the bug report (#34476)

FEATURES:

New Data Source: aws_emr_supported_instance_types (#34481)
New Resource: aws_apprunner_default_auto_scaling_configuration_version (#34292)
New Resource: aws_lexv2models_bot_version (#33858)
New Resource: aws_s3control_access_grant (#34564)
New Resource: aws_s3control_access_grants_instance (#34564)
New Resource: aws_s3control_access_grants_instance_resource_policy (#34564)
New Resource: aws_s3control_access_grants_location (#34564)

ENHANCEMENTS:

resource/aws_apprunner_auto_scaling_configuration_version: Add has_associated_service and is_default attributes (#34292)
resource/aws_apprunner_service: Add network_configuration.ip_address_type argument (#34292)
resource/aws_apprunner_service: Add source_configuration.code_repository.source_directory argument to support monorepos (#34292)
resource/aws_apprunner_service: Allow health_check_configuration to be updated in-place (#34292)
resource/aws_cloudwatch_event_rule: Add state parameter and deprecate is_enabled parameter (#34510)
resource/aws_elaticache_replication_group: Add auth_token_update_strategy argument (#34460)
resource/aws_lambda_function: Add support for java21 runtime value (#34476)
resource/aws_lambda_function: Add support for python3.12 runtime value (#34533)
resource/aws_lambda_layer_version: Add support for java21 compatible_runtimes value (#34476)
resource/aws_lambda_layer_version: Add support for python3.12 compatible_runtimes value (#34533)
resource/aws_s3_bucket_logging: Add target_object_key_format configuration block to support automatic date-based partitioning (#34504)

BUG FIXES:

resource/aws_appflow_flow: Fix InvalidParameter: 2 validation error(s) found error when destination_flow_config or task is updated (#34456)
resource/aws_appflow_flow: Fix interface conversion: interface {} is nil, not map[string]interface {} panic (#34456)
resource/aws_apprunner_service: Correctly set service_url for private services (#34292)
resource/aws_glue_trigger: Fix ConcurrentModificationException: Workflow <workflowName> was modified while adding trigger <triggerName> errors (#34530)
resource/aws_lb_target_group: Adds plan- and apply-time validation for invalid parameter combinations (#34488)
resource/aws_lexv2_bot_locale: Fix voice_settings.engine validation, value conversion errors (#34532)
resource/aws_lexv2models_bot: Properly send type argument on create and update when configured (#34524)
resource/aws_pipes_pipe: Fix error when zero value is sent to source_parameters on update (#34487)

`v5.26.0`

Compare Source

FEATURES:

New Data Source: aws_iot_registration_code (#15098)
New Resource: aws_iot_billing_group (#31237)
New Resource: aws_iot_ca_certificate (#15098)
New Resource: aws_iot_event_configurations (#31237)

ENHANCEMENTS:

data-source/aws_autoscaling_group: Add instance_maintenance_policy attribute (#34430)
provider: Adds https_proxy and no_proxy parameters. (#34243)
resource/aws_autoscaling_group: Add instance_maintenance_policy configuration block (#34430)
resource/aws_finspace_kx_cluster: Increase default create and update timeouts to 4 hours to allow for increased startup times with large volumes of cached data (#34398)
resource/aws_finspace_kx_environment: Increase default delete timeout to 75 minutes (#34398)
resource/aws_iam_group_policy_attachment: Add plan-time validation of policy_arn (#34378)
resource/aws_iam_policy_attachment: Add plan-time validation of policy_arn (#34378)
resource/aws_iam_role_policy_attachment: Add plan-time validation of policy_arn (#34378)
resource/aws_iam_user_policy_attachment: Add plan-time validation of policy_arn (#34378)
resource/aws_iot_ca_certificate: Add ca_certificate_id attribute (#15098)
resource/aws_iot_policy: Add configurable timeouts (#34329)
resource/aws_iot_policy: When updating the resource, delete the oldest non-default version of the policy if creating a new version would exceed the maximum number of versions (5) (#34329)
resource/aws_lambda_function: Add support for nodejs20.x and provided.al2023 runtime values (#34401)
resource/aws_lambda_layer_version: Add support for nodejs20.x and provided.al2023 compatible_runtimes values (#34401)
resource/aws_quicksight_analysis: Add definition.sheets.visuals.kpi_visual.chart_configuration.kpi_options.sparkline attribute (#33931)
resource/aws_quicksight_analysis: Add definition.sheets.visuals.kpi_visual.chart_configuration.kpi_options.visual_layout_options attribute (#33931)
resource/aws_quicksight_analysis: Add number_display_format_configuration and percentage_display_format_configuration to nested numeric_format_configuration argument (#33931)
resource/aws_quicksight_dashboard: Add definition.sheets.visuals.kpi_visual.chart_configuration.kpi_options.sparkline attribute (#33931)
resource/aws_quicksight_dashboard: Add definition.sheets.visuals.kpi_visual.chart_configuration.kpi_options.visual_layout_options attribute (#33931)
resource/aws_quicksight_dashboard: Add number_display_format_configuration and percentage_display_format_configuration to nested numeric_format_configuration argument (#33931)
resource/aws_quicksight_template: Add definition.sheets.visuals.kpi_visual.chart_configuration.kpi_options.sparkline attribute (#33931)
resource/aws_quicksight_template: Add definition.sheets.visuals.kpi_visual.chart_configuration.kpi_options.visual_layout_options attribute (#33931)
resource/aws_quicksight_template: Add number_display_format_configuration and percentage_display_format_configuration to nested numeric_format_configuration argument (#33931)
resource/aws_rds_cluster: Add delete_automated_backups argument (#34309)

BUG FIXES:

resource/aws_chime_voice_connector: Fix read error when resource is not created in us-east-1 (#34334)
resource/aws_chime_voice_connector_group: Fix read error when resource is not created in us-east-1 (#34334)
resource/aws_chime_voice_connector_logging: Fix read error when resource is not created in us-east-1 (#34334)
resource/aws_chime_voice_connector_origination: Fix read error when resource is not created in us-east-1 (#34334)
resource/aws_chime_voice_connector_termination: Fix read error when resource is not created in us-east-1 (#34334)
resource/aws_chime_voice_connector_termination_credentials: Fix read error when resource is not created in us-east-1 (#34334)
resource/aws_chimesdkmediapipelines_media_insights_pipeline_configuration: Fix eventual consistency error when resource is not created in us-east-1 (#34334)
resource/aws_chimesdkvoice_sip_media_application: Fix eventual consistency errors when not using us-east-1 (#34426)
resource/aws_chimesdkvoice_sip_rule: Fix eventual consistency errors when not using us-east-1 (#34426)
resource/aws_elasticache_user: Fix UserNotFound: ... is not available for tagging errors on resource Read when there is a concurrent update to the user (#34396)
resource/aws_grafana_workspace_api_key: Change key to Sensitive (#34105)
resource/aws_iam_group_policy_attachment: Retry ConcurrentModificationException errors on create and delete (#34378)
resource/aws_iam_policy_attachment: Retry ConcurrentModificationException errors on create and delete (#34378)
resource/aws_iam_role_policy_attachment: Retry ConcurrentModificationException errors on create and delete (#34378)
resource/aws_iam_user_policy_attachment: Retry ConcurrentModificationException errors on create and delete (#34378)
resource/aws_inspector2_delegated_admin_account: Fix errors: *target must be interface or implement error panic (#34424)
resource/aws_inspector2_enabler: Fix interface conversion: interface {} is nil, not map[string]inspector2.AccountResourceStatus panic (#34424)
resource/aws_iot_ca_certificate: Change ca_pem and certificate_pem to ForceNew (#15098)
resource/aws_iot_policy: Retry DeleteConflictException errors on delete (#34329)
resource/aws_quicksight_analysis: Fix handling of the nested number_scale, prefix, and suffix integer arguments (#33931)
resource/aws_quicksight_analysis: Fix handling of the nested rolling_date argument (#33931)
resource/aws_quicksight_analysis: Fix handling of the nested select_all_options argument (#33931)
resource/aws_quicksight_analysis: Fix handling of the nested visual_ids argument (#33931)
resource/aws_quicksight_analysis: Fixes to various optional blocks utilizing the shared column schema definition (#33931)
resource/aws_quicksight_analysis: Nested column_index and row_index arguments now properly handle zero values (#33931)
resource/aws_quicksight_dashboard: Fix handling of the nested number_scale, prefix, and suffix integer arguments (#33931)
resource/aws_quicksight_dashboard: Fix handling of the nested rolling_date argument (#33931)
resource/aws_quicksight_dashboard: Fix handling of the nested select_all_options argument (#33931)
resource/aws_quicksight_dashboard: Fix handling of the nested visual_ids argument (#33931)
resource/aws_quicksight_dashboard: Fixes to various optional blocks utilizing the shared column schema definition (#33931)
resource/aws_quicksight_dashboard: Nested column_index and row_index arguments now properly handle zero values (#33931)
resource/aws_quicksight_data_set: Increase permissions.actions maximum item limit to 20, aligning with the AWS API limits (#33931)
resource/aws_quicksight_data_source: Set all parameters to update aws_quicksight_data_source (#33061)
resource/aws_quicksight_template: Fix handling of the nested number_scale, prefix, and suffix integer arguments (#33931)
resource/aws_quicksight_template: Fix handling of the nested rolling_date argument (#33931)
resource/aws_quicksight_template: Fix handling of the nested select_all_options argument (#33931)
resource/aws_quicksight_template: Fix handling of the nested visual_ids argument (#33931)
resource/aws_quicksight_template: Fixes to various optional blocks utilizing the shared column schema definition (#33931)
resource/aws_quicksight_template: Nested column_index and row_index arguments now properly handle zero values (#33931)
resource/aws_sagemaker_user_profile: Change default_user_settings.canvas_app_settings.identity_provider_oauth_settings from TypeSet to TypeList, preventing interface conversion: interface {} is *schema.Set, not []interface {} panics (#34418)
resource/aws_synthetics_canary: Fix to properly suppress differences when expression is rate(0 minutes) (#34084)
resource/aws_vpn_connection: Fix UnsupportedOperation: The tunnel inside ip version parameter is not currently supported in this region error when creating connections in certain partitions and Regions (#34420)

`v5.25.0`

Compare Source

NOTES:

resource/aws_cloudtrail: The resource's import ID has changed from name to arn (#30758)

FEATURES:

New Data Source: aws_apigatewayv2_vpc_link (#33974)
New Data Source: aws_athena_named_query (#24815)
New Data Source: aws_bedrock_foundation_model (#34148)
New Data Source: aws_bedrock_foundation_models (#34148)
New Resource: aws_athena_prepared_statement (#33417)
New Resource: aws_lexv2models_bot_locale (#33949)

ENHANCEMENTS:

provider: Adds SSO API endpoint override parameter endpoints.sso (#34302)
resource/aws_appflow_connector_profile: Add jwt_token and oauth2_grant_type arguments to the connector_profile_config.connector_profile_credentials.salesforce block. (#34248)
resource/aws_autoscaling_group: Add plan-time validation of initial_lifecycle_hook.default_result, initial_lifecycle_hook.heartbeat_timeout, initial_lifecycle_hook.lifecycle_transition, initial_lifecycle_hook.name, initial_lifecycle_hook.notification_target_arn and initial_lifecycle_hook.role_arn (#12145)
resource/aws_autoscaling_lifecycle_hook: Add plan-time validation of default_result, heartbeat_timeout, lifecycle_transition, name, notification_target_arn and role_arn (#12145)
resource/aws_datasync_task: Add task_report_config argument (#33861)
resource/aws_db_instance: Add postgres as a valid engine value for blue/green deployments (#34216)
resource/aws_dms_endpoint: Add pause_replication_tasks, which when set to true, pauses associated running replication tasks, regardless if they are managed by Terraform, prior to modifying the endpoint (only tasks paused by the resource will be restarted after the modification completes) (#34316)
resource/aws_eks_cluster: Allow vpc_config.security_group_ids and vpc_config.subnet_ids to be updated in-place (#32409)
resource/aws_inspector2_organization_configuration: Add lambda_code argument to the auto_enable configuration block (#34261)
resource/aws_route53_record: Allow import of records with an empty record name. (#34212)
resource/aws_sagemaker_domain: Add default_user_settings.canvas_app_settings.direct_deploy_settings, default_user_settings.canvas_app_settings.identity_provider_oauth_settings and default_user_settings.canvas_app_settings.kendra_settings arguments (#34265)
resource/aws_sagemaker_domain: Change default_space_settings.kernel_gateway_app_settings.custom_image, default_user_settings.kernel_gateway_app_settings.custom_image and default_user_settings.r_session_app_settings.custom_image MaxItems from 30 to 200 (#34265)
resource/aws_sagemaker_feature_group: Add offline_store_config.s3_storage_config.resolved_output_s3_uri, online_store_config.storage_type and online_store_config.ttl_duration arguments (#34283)
resource/aws_sagemaker_feature_group: Allow online_store_config.ttl_duration to be updated in-place (#34283)
resource/aws_sagemaker_model: Add container.model_data_source and primary_container.model_data_source configuration blocks (#34158)
resource/aws_sagemaker_space: Change space_settings.kernel_gateway_app_settings.custom_image MaxItems from 30 to 200 (#34265)
resource/aws_sagemaker_user_profile: Add default_user_settings.canvas_app_settings.direct_deploy_settings, default_user_settings.canvas_app_settings.identity_provider_oauth_settings and default_user_settings.canvas_app_settings.kendra_settings arguments (#34265)
resource/aws_sns_topic: Add archive_policy argument and beginning_archive_time attribute to support message archiving (#34252)
resource/aws_sns_topic: Add replay_policy argument (#34252)

BUG FIXES:

provider: Fix Value Conversion Error panic for certain resources when null tag values are specified (#34319)
provider: Fixes parsing error in AWS shared config files with extra whitespace (#34300)
provider: Fixes poor performance when parsing AWS shared config files (#34300)
resource/aws_autoscaling_group: Change all initial_lifecycle_hook configuration block attributes to ForceNew (#34260)
resource/aws_cloudtrail: Change the id attribute from the trail's name to its ARN to support organization trails (#30758)
resource/aws_cloudwatch_event_rule: Increase event_pattern max length for validation to 4096 (#34270)
resource/aws_sagemaker_domain: Fix updating default_space_settings.r_studio_server_pro_app_settings.access_status from ENABLED to DISABLED (#34265)

`v5.24.0`

Compare Source

NOTES:

resource/aws_detective_organization_admin_account: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#25237)
resource/aws_detective_organization_configuration: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#25237)

FEATURES:

New Data Source: aws_opensearchserverless_lifecycle_policy (#34144)
New Resource: aws_detective_organization_admin_account (#25237)
New Resource: aws_detective_organization_configuration (#25237)
New Resource: aws_opensearchserverless_lifecycle_policy (#34144)
New Resource: aws_redshift_resource_policy (#34149)
New Resource: aws_verifiedaccess_endpoint (#30763)

ENHANCEMENTS:

resource/aws_amplify_app: Add custom_headers argument (#31561)
resource/aws_batch_job_definition: Add node_properties argument (#34153)
resource/aws_finspace_kx_cluster: In-place updates are now supported for the code, database, and initialization_script arguments. The update timeout has been increased to 30 minutes. (#34220)
resource/aws_iot_topic_rule: Add kafka.header and error_action.kafka.header arguments (#34191)
resource/aws_networkmanager_connect_attachment: Add NO_ENCAP as a valid options.protocol value (#34109)
resource/aws_networkmanager_connect_peer: Add subnet_arn argument to support Tunnel-less Connect attachments (#34109)
resource/aws_networkmanager_connect_peer: inside_cidr_blocks is Optional (#34109)
resource/aws_rds_cluster: Remove the provider default (previously, "1") and use the AWS default for backup_retention_period (also, "1") to allow integration with AWS Backup (#34187)
resource/aws_redshift_cluster: Add snapshot_arn argument (#34181)
resource/aws_redshift_cluster: Add the manage_master_password and master_password_secret_kms_key_id arguments to support managed admin credentials (#34182)
resource/aws_s3_object: Add override_provider configuration block, allowing tags inherited from the provider default_tags configuration block to be ignored (#33262)
resource/aws_secretsmanager_secret_rotation: The rotation_lambda_arn argument is now optional to support modifying the rotation schedule of AWS-managed secrets. (#34180)

BUG FIXES:

data-source/aws_vpc_ipam_pools: Add id attribute for individual IPAM pools (#32133)
resource/aws_alb_listener_rule: Fixed the action.forward.target_group argument minimum item requirement. Previously this was set to 2, but the AWS API allows specifying a single target group. (#33727)
resource/aws_amplify_branch: Remove ForceNew from enable_performance_mode (#34141)
resource/aws_lb_listener_rule: Fixed the action.forward.target_group argument minimum item requirement. Previously this was set to 2, but the AWS API allows specifying a single target group. (#33727)
resource/aws_quicksight_analysis: Fix "expected type to be integer" errors in window_options.bounds.* argument validatation functions (#34230)
resource/aws_quicksight_dashboard: Fix "expected type to be integer" errors in window_options.bounds.* argument validatation functions (#34230)
resource/aws_quicksight_template: Fix "expected type to be integer" errors in window_options.bounds.* argument validatation functions (#34230)
resource/aws_rds_cluster: Avoid an error on delete related to unexpected state 'scaling-compute' (#34187)

`v5.23.1`

Compare Source

BUG FIXES:

data-source/aws_lambda_function: Add vpc_config.ipv6_allowed_for_dual_stack attribute, fixing Invalid address to set: []string{"vpc_config", "0", "ipv6_allowed_for_dual_stack"} errors (#34134)

`v5.23.0`

Compare Source

NOTES:

provider: This release includes an update to the AWS SDK for Go v2 with breaking type changes to several services: finspace, kafka, medialive, rds, s3control, timestreamwrite, and xray. These changes primarily affect how arguments with default values are serialized for outbound requests, changing scalar types to pointers. See this AWS SDK for Go V2 issue for additional context. The corresponding provider changes should make this breakfix transparent to users, but as with any breaking change there is the potential for missed edge cases. If errors are observed in the impacted resources, please link to this dependency update pull request in the bug report. (#34096)

FEATURES:

New Resource: aws_iot_domain_configuration (#24765)

ENHANCEMENTS:

data-source/aws_imagebuilder_image: Add image_scanning_configuration attribute (#34049)
resource/aws_config_config_rule: Add evaluation_mode attribute (#34033)
resource/aws_elasticache_replication_group: Add ip_discovery and network_type arguments (#34019)
resource/aws_imagebuilder_image: Add image_scanning_configuration configuration block (#34049)
resource/aws_kms_key: Add configurable timeouts (#34112)
resource/aws_lambda_function: Add vpc_config.ipv6_allowed_for_dual_stack argument (#34045)
resource/aws_lb: Add dns_record_client_routing_policy attribute to configure Availability Zonal DNS affinity on Network Load Balancer (NLB) (#33992)
resource/aws_lb_target_group: Add target_health_state configuration block (#34070)
resource/aws_lb_target_group: Remove default value (false) for connection_termination argument and mark as Computed, to support new default behavior for UDP/TCP_UDP target groups (#34070)
resource/aws_neptune_cluster: Add slowquery as a valid enable_cloudwatch_logs_exports value (#34053)

BUG FIXES:

provider/tags: Prevent crash when tags_all is null (#34073)
resource/aws_autoscaling_group: Fix error when launch_template name is updated. (#34086)
resource/aws_dms_s3_endpoint: Don't send the default value of false for add_trailing_padding_character, maintaining compatibility with older (pre-3.4.7) DMS engine versions (#34048)
resource/aws_ecs_task_definition: Add 0 as a valid value for volume.efs_volume_configuration.transit_encryption_port, preventing unexpected drift (#34020)
resource/aws_identitystore_group: Fix updating description attribute when it is changed (#34037)
resource/aws_iot_indexing_configuration: Add thing_indexing_configuration.filter attribute, resolving InvalidRequestException: NamedShadowNames Filter must not be empty for enabling NamedShadowIndexingMode errors (#26859)
resource/aws_storagegateway_gateway: Support the value 0 (representing Sunday) for maintenance_start_time.day_of_week (#34015)
resource/aws_verifiedaccess_group: Fix InvalidParameterValue: Policy Document cannot be provided when Policy Enabled is false or missing errors when updating policy_document (#34054)

`v5.22.0`

Compare Source

FEATURES:

New Data Source: aws_media_convert_queue (#27075)
New Resource: aws_elasticsearch_vpc_endpoint (#33925)
New Resource: aws_msk_replicator (#33973)

ENHANCEMENTS:

data-source/aws_ec2_client_vpn_endpoint: Add self_service_portal_url attribute (#34007)
resource/aws_alb: Support import of name_prefix argument (#33852)
resource/aws_alb_target_group: Support import of name_prefix argument (#33852)
resource/aws_cloudfront_public_key: Support import of name_prefix argument (#33852)
resource/aws_db_option_group: Support import of name_prefix argument (#33852)
resource/aws_docdb_cluster: Support import of cluster_identifier_prefix argument (#33852)
resource/aws_docdb_cluster_instance: Support import of identifier_prefix argument (#33852)
resource/aws_docdb_cluster_parameter_group: Support import of name_prefix argument (#33852)
resource/aws_docdb_subnet_group: Support import of name_prefix argument (#33852)
resource/aws_ec2_client_vpn_endpoint: Add self_service_portal_url attribute (#34007)
resource/aws_elb: Support import of name_prefix argument (#33852)
resource/aws_emr_security_configuration: Support import of name_prefix argument (#33852)
resource/aws_iam_group_policy: Support import of name_prefix argument (#33852)
resource/aws_iam_role_policy: Support import of name_prefix argument (#33852)
resource/aws_iam_user_policy: Support import of name_prefix argument (#33852)
resource/aws_iot_provisioning_template: Add type attribute (#33950)
resource/aws_lb: Support import of name_prefix argument (#33852)
resource/aws_lb_target_group: Support import of name_prefix argument (#33852)
resource/aws_neptune_cluster: Support import of cluster_identifier_prefix argument (#33852)
resource/aws_neptune_cluster_instance: Support import of identifier_prefix argument (#33852)
resource/aws_neptune_cluster_parameter_group: Support import of name_prefix argument (#33852)
resource/aws_neptune_event_subscription: Support import of name_prefix argument (#33852)
resource/aws_pinpoint_app: Support import of name_prefix argument (#33852)
resource/aws_rds_cluster: Support import of cluster_identifier_prefix argument (#33852)
resource/aws_rds_cluster_instance: Support import of identifier_prefix argument (#33852)
resource/aws_signer_signing_profile: Support import of name_prefix argument (#33852)
resource/aws_signer_signing_profile_permission: Add signer:SignPayload as a valid action value (#33852)
resource/aws_signer_signing_profile_permission: Support import of statement_id_prefix argument (#33852)
resource/aws_transfer_server: Change pre_authentication_login_banner and post_authentication_login_banner length limits to 4096 (#33937)
resource/aws_wafv2_web_acl: Add ja3_fingerprint to field_to_match configuration blocks (#33933)

BUG FIXES:

data-source/aws_dms_certificate: Fix crash when certificate not found (#34012)
resource/aws_cloudformation_stack: Fix error when computed values are not set when there is no update (#33969)
resource/aws_codecommit_repository: Doesn't force replacement when renaming (#32207)
resource/aws_db_instance: Creating resource from snapshot or point-in-time recovery now handles manage_master_user_password and master_user_secret_kms_key_id attributes correctly (#33699)
resource/aws_elasticache_replication_group: Fix error when switching engine_version from 6.x to a specific 6.<digit> version number (#33954)
resource/aws_iam_role: Fix refreshing permission_boundary when deleted outside of Terraform (#33963)
resource/aws_iam_user: Fix refreshing permission_boundary when deleted outside of Terraform (#33963)
resource/aws_inspector2_enabler: Fix Value at 'resourceTypes' failed to satisfy constraint errors (#33348)
resource/aws_neptune_cluster_instance: Remove ForceNew from engine_version (#33487)
resource/aws_neptune_cluster_parameter_group: Fix condition where defined cluster parameters with system default values are seen as updates (#33487)
resource/aws_s3_bucket_object_lock_configuration: Fix found resource errors on Delete (#33966)

`v5.21.0`

Compare Source

FEATURES:

New Data Source: aws_servicequotas_templates (#33871)
New Resource: aws_ec2_image_block_public_access (#33810)
New Resource: aws_guardduty_organization_configuration_feature (#33913)
New Resource: aws_servicequotas_template_association (#33725)
New Resource: aws_verifiedaccess_group (#33297)
New Resource: aws_verifiedaccess_instance_logging_configuration (#33864)

ENHANCEMENTS:

data-source/aws_dms_endpoint: Add s3_settings.glue_catalog_generation attribute (#33778)
data-source/aws_msk_cluster: Add cluster_uuid attribute (#33805)
resource/aws_codedeploy_deployment_group: Add outdated_instances_strategy argument (#33844)
resource/aws_dms_endpoint: Add s3_settings.glue_catalog_generation attribute (#33778)
resource/aws_dms_s3_endpoint: Add glue_catalog_generation attribute (#33778)
resource/aws_docdb_cluster: Add allow_major_version_upgrade argument (#33790)
resource/aws_docdb_cluster_instance: Add copy_tags_to_snapshot argument (#31022)
resource/aws_dynamodb_table: Add import_table configuration block (#33802)
resource/aws_msk_cluster: Add cluster_uuid attribute (#33805)
resource/aws_msk_serverless_cluster: Add cluster_uuid attribute (#33805)
resource/aws_networkmanager_core_network: Add base_policy_document argument (#33712)
resource/aws_redshiftserverless_workgroup: Allow require_ssl and use_fips_ssl config_parameters keys (#33916)
resource/aws_s3_bucket: Use configurable timeout for resource Delete (#33845)
resource/aws_verifiedaccess_instance: Add fips_enabled argument (#33880)
resource/aws_vpclattice_target_group: Add config.lambda_event_structure_version argument (#33804)
resource/aws_vpclattice_target_group: Make config.port, config.protocol and config.vpc_identifier optional (#33804)
resource/aws_wafv2_web_acl: Add aws_managed_rules_acfp_rule_set to managed_rule_group_configs configuration block (#33915)

BUG FIXES:

provider: Respect valid values for the AWS_S3_US_EAST_1_REGIONAL_ENDPOINT environment variable when configuring the S3 API client (#33874)
resource/aws_appflow_connector_profile: Fix various crashes (#33856)
resource/aws_db_parameter_group: Group names containing periods (.) no longer fail validation (#33704)
resource/aws_opensearchserverless_collection: Fix crash when error is returned (#33918)
resource/aws_rds_cluster_parameter_group: Group names containing periods (.) no longer fail validation (#33704)

`v5.20.1`

Compare Source

NOTES:

provider: Build with Terraform Plugin Framework v1.4.1, fixing potential initialization errors when using v1.6 of the Terraform CLI.

`v5.20.0`

Compare Source

FEATURES:

New Resource: aws_guardduty_detector_feature (#31463)
New Resource: aws_servicequotas_template (#33688)
New Resource: aws_sesv2_account_vdm_attributes (#33705)
New Resource: aws_verifiedaccess_instance_trust_provider_attachment (#33734)

ENHANCEMENTS:

data-source/aws_guardduty_detector: Add features attribute (#31463)
resource/aws_finspace_kx_cluster: Increase default creation timeout to 45 minutes, default deletion timeout to 60 minutes (#33745)
resource/aws_finspace_kx_environment: Increase default deletion timeout to 45 minutes (#33745)
resource/aws_guardduty_filter: Add plan-time validation of name (#21030)
resource/aws_kinesis_firehose_delivery_stream: Add opensearchserverless_configuration and msk_source_configuration configuration blocks (#33101)
resource/aws_kinesis_firehose_delivery_stream: Add opensearchserverless as a valid destination value (#33101)

BUG FIXES:

data-source/aws_fsx_ontap_storage_virtual_machine: Fix crash when active_directory_configuration.self_managed_active_directory_configuration.file_system_administrators_group is not configured (#33800)
resource/aws_ec2_transit_gateway_route : Fix TGW route search filter to avoid routes being missed when more than 1,000 static routes are in a TGW route table (#33765)
resource/aws_fsx_ontap_storage_virtual_machine: Fix crash when active_directory_configuration.self_managed_active_directory_configuration.file_system_administrators_group is not configured (#33800)
resource/aws_medialive_channel: Fix VPC settings flatten/expand/docs. (#33558)
resource/aws_vpc_endpoint: Set dns_options.dns_record_ip_type to Computed to prevent diffs (#33743)

`v5.19.0`

Compare Source

BREAKING CHANGES:

data-source/aws_s3_bucket_object: Following migration to AWS SDK for Go v2, the metadata attribute's keys are always returned in lowercase (#33660)
data-source/aws_s3_object: Following migration to AWS SDK for Go v2, the metadata attribute's keys are always returned in lowercase (#33660)

NOTES:

data-source/aws_s3_bucket_object: The metadata attribute's keys are now always returned in lowercase. Please modify configurations as necessary (#33660)
data-source/aws_s3_object: The metadata attribute's keys are now always returned in lowercase. Please modify configurations as necessary (#33660)
resource/aws_iam_*: This release introduces additional validation of IAM policy JSON arguments to detect duplicate keys. Previously, arguments with duplicated keys resulted in all but one of the key values being overwritten. Since this results in unexpected IAM policies being submitted to AWS, we have updated the validation logic to error in these cases. This may cause existing IAM policy arguments to fail validation, however, those policies are likely not what was originally intended. (#33570)

FEATURES:

New Resource: aws_cleanrooms_configured_table (#33602)
New Resource: aws_dms_replication_config (#32908)
New Resource: aws_lexv2models_bot (#33475)
New Resource: aws_rds_custom_db_engine_version (#33285)
New Resource: aws_vpclattice_service_network (#30482)

ENHANCEMENTS:

data-source/aws_opensearch_domain: Add off_peak_window_options attribute (#30965)
resource/aws_cloud9_environment_ec2: Add ubuntu-22.04-x86_64 and resolve:ssm:/aws/service/cloud9/amis/ubuntu-22.04-x86_64 as valid values for image_id (#33662)
resource/aws_fsx_ontap_volume: Add bypass_snaplock_enterprise_retention argument and snaplock_configuration configuration block to support SnapLock (#32530)
resource/aws_fsx_ontap_volume: Add copy_tags_to_backups and snapshot_policy arguments (#32530)
resource/aws_fsx_openzfs_volume: Add delete_volume_options argument (#32530)
resource/aws_lightsail_bucket: Add force_delete argument (#33586)
resource/aws_opensearch_domain: Add off_peak_window_options configuration block (#30965)
resource/aws_opensearch_outbound_connection: Add connection_properties, connection_mode and accept_connection arguments (#32990)
resource/aws_schemas_schema: Add JSONSchemaDraft4 schema type support (#33442)
resource/aws_wafv2_rule_group: Add rate_based_statement.custom_key configuration block (#33594)
resource/aws_wafv2_web_acl: Add rate_based_statement.custom_key configuration block (#33594)

BUG FIXES:

resource/aws_batch_job_queue: Correctly validates elements of compute_environments as ARNs (#33577)
resource/aws_cloudfront_continuous_deployment_policy: Fix IllegalUpdate errors when updating a staging aws_cloudfront_distribution that is part of continuous deployment (#33578)
resource/aws_cloudfront_distribution: Fix IllegalUpdate errors when updating a staging distribution associated with an aws_cloudfront_continuous_deployment_policy (#33578)
resource/aws_cloudfront_distribution: Fix PreconditionFailed errors when destroying a distribution associated with an aws_cloudfront_continuous_deployment_policy (#33578)
resource/aws_cloudfront_distribution: Fix StagingDistributionInUse errors when destroying a distribution associated with an aws_cloudfront_continuous_deployment_policy (#33578)
resource/aws_datasync_location_fsx_ontap_file_system: Correct handling of protocol.smb.domain, protocol.smb.user and protocol.smb.password (#33641)
resource/aws_glacier_vault_lock: Fail validation if duplicated keys are found in policy (#33570)
resource/aws_iam_group_policy: Fail validation if duplicated keys are found in policy (#33570)
resource/aws_iam_policy: Fail validation if duplicated keys are found in policy (#33570)
resource/aws_iam_role: Fail validation if duplicated keys are found in assume_role_policy (#33570)
resource/aws_iam_role_policy: Fail validation if duplicated keys are found in policy (#33570)
resource/aws_iam_user_policy: Fail validation if duplicated keys are found in policy (#33570)
resource/aws_mediastore_container_policy: Fail validation if duplicated keys are found in policy (#33570)
resource/aws_s3_bucket_policy: Fix intermittent couldn't find resource errors on resource Create (#33537)
resource/aws_ssoadmin_permission_set_inline_policy: Fail validation if duplicated keys are found in inline_policy (#33570)
resource/aws_transfer_access: Fail validation if duplicated keys are found in policy (#33570)
resource/aws_transfer_user: Fail validation if duplicated keys are found in policy (#33570)

`v5.18.1`

Compare Source

NOTES:

documentation: Duplicate CDKTF guides with differing file extensions have been removed to resolve failures in the provider release workflow. (#33630)

`v5.18.0`

Compare Source

FEATURES:

New Data Source: aws_fsx_ontap_file_system (#32503)
New Data Source: aws_fsx_ontap_storage_virtual_machine (#32621)
New Data Source: aws_fsx_ontap_storage_virtual_machines (#32624)
New Data Source: aws_organizations_organizational_unit (#33408)
New Resource: aws_opensearch_package (#33227)
New Resource: aws_opensearch_package_association (#33227)

ENHANCEMENTS:

resource/aws_fsx_ontap_storage_virtual_machine: Remove ForceNew from active_directory_configuration.self_managed_active_directory_configuration.domain_name, active_directory_configuration.self_managed_active_directory_configuration.file_system_administrators_group and active_directory_configuration.self_managed_active_directory_configuration.organizational_unit_distinguished_name allowing an SVM to join AD after creation (#33466)

BUG FIXES:

data-source/aws_sesv2_email_identity: Mark dkim_signing_attributes.domain_signing_private_key as sensitive (#33477)
resource/aws_db_instance: Fix so that storage_throughput can be changed when iops and allocated_storage are not changed (#33529)
resource/aws_db_option_group: Avoid erroneous differences being reported when an option port and/or version is not set (#33511)
resource/aws_fsx_ontap_storage_virtual_machine: Avoid recreating resource when active_directory_configuration.self_managed_active_directory_configuration.file_system_administrators_group is configured (#33466)
resource/aws_fsx_ontap_storage_virtual_machine: Change file_system_id to ForceNew (#32621)
resource/aws_s3_bucket_accelerate_configuration: Retry resource Delete on OperationAborted: A conflicting conditional operation is currently in progress against this resource errors (#33531)
resource/aws_s3_bucket_policy: Retry resource Delete on OperationAborted: A conflicting conditional operation is currently in progress against this resource errors (#33531)
resource/aws_s3_bucket_versioning: Retry resource Delete on OperationAborted: A conflicting conditional operation is currently in progress against this resource errors (#33531)
resource/aws_sesv2_email_identity: Mark dkim_signing_attributes.domain_signing_private_key as sensitive (#33477)

`v5.17.0`

Compare Source

NOTES:

data-source/aws_s3_object: Migration to AWS SDK for Go v2 means that the edge case of specifying a single / as the value for key is no longer supported (#33358)

FEATURES:

New Resource: aws_shield_application_layer_automatic_response (#33432)
New Resource: aws_verifiedaccess_instance (#33459)

ENHANCEMENTS:

data-source/aws_s3_object: Add checksum_mode argument and checksum_crc32, checksum_crc32c, checksum_sha1 and checksum_sha256 attributes (#33358)
data-source/aws_s3control_multi_region_access_point: Add details.region.bucket_account_id attribute (#33416)
resource/aws_s3_object: Add checksum_algorithm argument and checksum_crc32, checksum_crc32c, checksum_sha1 and checksum_sha256 attributes (#33358)
resource/aws_s3_object_copy: Add checksum_algorithm argument and checksum_crc32, checksum_crc32c, checksum_sha1 and checksum_sha256 attributes (#33358)
resource/aws_s3control_multi_region_access_point: Add details.region.bucket_account_id argument to support cross-account Multi-Region Access Points (#33416)
resource/aws_s3control_multi_region_access_point: Add details.region.region attribute (#33416)
resource/aws_schemas_schema: Add JSONSchemaDraft4 schema type support (#35971)
resource/aws_transfer_connector: Add sftp_config argument and make as2_config optional (#32741)
resource/aws_wafv2_web_acl: Retry resource Update on WAFOptimisticLockException errors (#33432)

BUG FIXES:

resource/aws_dms_replication_task: Fix error when replication_task_settings is nil (#33456)
resource/aws_elasticache_cluster: Fix regression for redis engine types caused by the new transit_encryption_enabled argument (#33451)
resource/aws_neptune_cluster: Fix ignored kms_key_arn on restore from DB cluster snapshot (#33413)
resource/aws_servicecatalog_product: Allow import on provisioning_artifact_parameters attribute (#33448)
resource/aws_subnet: Fix destroy error when there is a lingering ENI for DMS (#33375)

`v5.16.2`

Compare Source

FEATURES:

New Data Source: aws_cognito_identity_pool (#33053)
New Resource: aws_verifiedaccess_trust_provider (#33195)

ENHANCEMENTS:

resource/aws_autoscaling_group: Change the default values of instance_refresh.preferences.scale_in_protected_instances and instance_refresh.preferences.standby_instances from Wait to the Amazon EC2 Auto Scaling console recommended value of Ignore (#33382)
resource/aws_s3control_object_lambda_access_point: Add alias attribute (#33388)

BUG FIXES:

resource/aws_autoscaling_group: Fix ValidationError errors when starting Auto Scaling group instance refresh (#33382)
resource/aws_iot_topic_rule: Fix InvalidParameter errors on Update with Kafka destinations (#33360)
resource/aws_lightsail_certificate: Fix validation of name (#33405)
resource/aws_lightsail_database: Fix validation of name (#33405)
resource/aws_lightsail_disk: Fix validation of name (#33405)
resource/aws_lightsail_instance: Fix validation of name (#33405)
resource/aws_lightsail_lb: Fix validation of lb_name (#33405)
resource/aws_lightsail_lb_attachment: Fix validation of lb_name (#33405)
resource/aws_lightsail_lb_certificate: Fix validation of lb_name (#33405)
resource/aws_lightsail_lb_certificate_attachment: Fix validation of lb_name (#33405)
resource/aws_lightsail_lb_https_redirection_policy: Fix validation of lb_name (#33405)
resource/aws_lightsail_lb_stickiness_policy: Fix validation of lb_name (#33405)

`v5.16.1`

Compare Source

BUG FIXES:

data-source/aws_efs_file_system: Fix Search returned 0 results errors when there are more than 101 file systems in the configured Region (#33336)
resource/aws_db_instance_automated_backups_replication: Fix unexpected state errors on resource Create (#33369)
resource/aws_glue_catalog_table: Fix removal of metadata_location and table_type parameters when updating Iceberg tables (#33374)
resource/aws_service_discovery_instance: Fix validation error "expected to match regular expression" (#33371)

`v5.16.0`

Compare Source

NOTES:

provider: Performance regression introduced in v5.14.0 should be largely mitigated (#33317)

FEATURES:

New Resource: aws_shield_drt_access_log_bucket_association (#33328)
New Resource: aws_shield_drt_access_role_arn_association (#33328)

ENHANCEMENTS:

data-source/aws_api_gateway_api_key: Add customer_id attribute (#33281)
data-source/aws_fsx_windows_file_system: Add disk_iops_configuration attribute (#33303)
data-source/aws_opensearch_domain: Add software_update_options attribute (#32234)
data-source/aws_s3_objects: Add request_payer argument and request_charged attribute (#33304)
data-source/aws_s3_objects: Add plan-time validation of encoding_type (#33304)
resource/aws_api_gateway_account: Add api_key_version and features attributes (#33279)
resource/aws_api_gateway_api_key: Add customer_id argument (#33281)
resource/aws_api_gateway_api_key: Allow updating name (#33281)
resource/aws_autoscaling_group: Add scale_in_protected_instances and standby_instances attributes to instance_refresh.preferences configuration block (#33310)
resource/aws_dms_endpoint: Add redshift-serverless as valid value for engine_name (#33316)
resource/aws_elasticache_cluster: Add transit_encryption_enabled argument, enabling in-transit encryption for Memcached clusters inside a VPC (#26987)
resource/aws_fsx_windows_file_system: Add disk_iops_configuration configuration block (#33303)
resource/aws_glue_catalog_table: Add open_table_format_input configuration block to support open table formats such as Apache Iceberg (#33274)
resource/aws_medialive_channel: Implement expand/flatten functions for automatic_input_failover_settings in input_attachments (#33129)
resource/aws_opensearch_domain: Add software_update_options attribute (#32234)
resource/aws_ssm_association: Add sync_compliance attribute (#23515)

BUG FIXES:

data-source/aws_identitystore_group: Restore filter argument to prevent UnknownOperationException errors in certain Regions (#33311)
data-source/aws_identitystore_user: Restore filter argument to prevent UnknownOperationException errors in certain Regions (#33311)
data-source/aws_s3_objects: Respect configured max_keys value if it's greater than 1000 (#33304)
resource/aws_api_gateway_account: Allow setting cloudwatch_role_arn to an empty value and set it correctly on Read, allowing its value to be determined on import (#33279)
resource/aws_fsx_ontap_file_system: Increase maximum value of disk_iops_configuration.iops to 160000 (#33263)
resource/aws_servicecatalog_principal_portfolio_association: Fix ResourceNotFoundException errors on resource Delete when configured principal_type is IAM_PATTERN (#32243)

`v5.15.0`

Compare Source

ENHANCEMENTS:

data-source/aws_efs_file_system: Add name attribute (#33243)
data-source/aws_lakeformation_data_lake_settings: Add read_only_admins attribute (#33189)
data-source/aws_opensearch_domain: Add cluster_config.multi_az_with_standby_enabled attribute (#33031)
resource/aws_cloudformation_stack_set: Support resource import with call_as = "DELEGATED_ADMIN" via StackSetName,CallAs syntax for import block or terraform import command (#19092)
resource/aws_cloudformation_stack_set_instance: Support resource import with call_as = "DELEGATED_ADMIN" via StackSetName,AccountID,Region,CallAs syntax for import block or terraform import command (#19092)
resource/aws_datasync_location_fsx_openzfs_file_system: Fix setting protocol: Invalid address to set errors (#33225)
resource/aws_efs_file_system: Add name attribute (#33243)
resource/aws_fsx_openzfs_file_system: Add endpoint_ip_address_range, preferred_subnet_id and route_table_ids arguments to support the Multi-AZ deployment type (#33245)
resource/aws_lakeformation_data_lake_settings: Add read_only_admins argument (#33189)
resource/aws_opensearch_domain: Add cluster_config.multi_az_with_standby_enabled argument (#33031)
resource/aws_wafv2_rule_group: Add name_prefix argument (#33206)
resource/aws_wafv2_web_acl: Add statement.managed_rule_group_statement.managed_rule_group_configs.aws_managed_rules_atp_rule_set.enable_regex_in_path argument (#33217)

BUG FIXES:

provider: Correctly use old and new tag values when updating tags that are computed (#33226)
resource/aws_appflow_connector_profile: Fix validation on oauth2 in custom_connector_profile (#33192)
resource/aws_cloudformation_stack_set: Fix Can only set RetainStacksOnAccountRemoval if AutoDeployment is enabled errors (#19092)
resource/aws_cloudwatch_event_bus_policy: Fix error during plan when the associated aws_cloudwatch_event_bus resource is manually deleted (#33203)
resource/aws_codeartifact_domain: Change the type of asset_size_bytes to TypeString instead of TypeInt to prevent value out of range panic (#33220)
resource/aws_efs_file_system_policy: Retry IAM eventual consistency errors (#21734)
resource/aws_fsx_openzfs_file_system: Wait for administrative action completion when updating root volume (#33245)
resource/aws_iot_thing_type: Fix error during plan when resource is manually deleted (#33203)
resource/aws_kms_key: Fix tag propagation: timeout while waiting for state to become 'TRUE' errors when any tag value is empty ("") (#33226)
resource/aws_wafv2_web_acl: Prevent deletion of the AWS-managed ShieldMitigationRuleGroup rule on resource Update (#33216)

`v5.14.0`

Compare Source

NOTES:

data-source/aws_iam_policy_document: In some cases, statement.*.condition blocks with the same test and variable arguments were incorrectly handled by the provider. Since this results in unexpected IAM Policies being submitted to AWS, we have updated the logic to merge values lists in this case. This may cause existing IAM Policy documents to report a difference. However, those policies are likely not what was originally intended. (#33093)

FEATURES:

New Resource: aws_datasync_location_azure_blob (#32632)
New Resource: aws_datasync_location_fsx_ontap_file_system (#32632)

ENHANCEMENTS:

data-source/aws_dms_endpoint: Fix crash when specified endpoint not found (#33158)
data-source/aws_dms_replication_instance: Add network_type attribute (#33158)
data-source/aws_ec2_network_insights_path: Add destination_arn and source_arn attributes (#33168)
resource/aws_dms_replication_instance: Add network_type argument (#33158)
resource/aws_ec2_network_insights_path: Add destination_arn and source_arn attributes (#33168)
resource/aws_finspace_kx_environment: Add transit_gateway_configuration.*.attachment_network_acl_configuration argument. (#33123)
resource/aws_medialive_channel: Updates schemas for selector_settings for audio_selector and selector_settings for caption_selector (#32714)
resource/aws_ssoadmin_account_assignment: Add configurable timeouts (#33121)
resource/aws_ssoadmin_customer_managed_policy_attachment: Add configurable timeouts (#33121)
resource/aws_ssoadmin_managed_policy_attachment: Add configurable timeouts (#33121)
resource/aws_ssoadmin_permission_set: Add configurable timeouts (#33121)
resource/aws_ssoadmin_permission_set_inline_policy: Add configurable timeouts (#33121)
resource/aws_ssoadmin_permissions_boundary_attachment: Add configurable timeouts (#33121)

BUG FIXES:

data-source/aws_iam_policy_document: Fix inconsistent handling of condition blocks with duplicated test and variable arguments (#33093)
resource/aws_ec2_host: Fixed a bug that caused resource recreation when specifying an outpost_arn without an asset_id (#33142)
resource/aws_ec2_network_insights_analysis: Fix setting forward_path_components: Invalid address to set errors (#33168)
resource/aws_ec2_network_insights_path: Avoid recreating resource when passing an ARN as source or destination (#33168)
resource/aws_ec2_network_insights_path: Retry AnalysisExistsForNetworkInsightsPath errors on resource Delete (#33168)
resource/aws_kms_key: Fix tag propagation: timeout while waiting for state to become 'TRUE' errors when ignore_tags has been configured (#33167)
resource/aws_licensemanager_license_configuration: Surface InvalidParameterValueException errors during resource Delete (#32845)
resource/aws_msk_cluster_policy: Fix Current cluster policy version needed for Update errors (#33118)
resource/aws_quicksight_analysis: Change definition.*.parameter_declarations to a set type, preventing persistent differences (#33120)
resource/aws_quicksight_analysis: Fixed a bug that caused errors related to the word_orientation argument when using word cloud visuals. (#33122)
resource/aws_quicksight_analysis: Skip setting definition.*.parameter_declarations.*.*_parameter_declaration.static_values when empty, preventing persistent differences. (#33161)
resource/aws_quicksight_dashboard: Change definition.*.parameter_declarations to a set type, preventing persistent differences (#33120)
resource/aws_quicksight_dashboard: Fixed a bug that caused errors related to the word_orientation argument when using word cloud visuals. (#33122)
resource/aws_quicksight_dashboard: Skip setting definition.*.parameter_declarations.*.*_parameter_declaration.static_values when empty, preventing persistent differences. (#33161)
resource/aws_quicksight_template: Change definition.*.parameter_declarations to a set type, preventing persistent differences (#33120)
resource/aws_quicksight_template: Fixed a bug that caused errors related to the word_orientation argument when using word cloud visuals. (#33122)
resource/aws_quicksight_template: Skip setting definition.*.parameter_declarations.*.*_parameter_declaration.static_values when empty, preventing persistent differences. (#33161)
resource/aws_route53_zone: Skip disabling DNS SEC in unsupported partitions (#33103)
resource/aws_s3_object: Mark acl as Computed. This suppresses the diffs shown when migrating resources with no configured acl attribute value from v4.67.0 (or earlier) (#33138)
resource/aws_s3_object_copy: Mark acl as Computed. This suppresses the diffs shown when migrating resources with no configured acl attribute value from v4.67.0 (or earlier) (#33138)
resource/aws_securityhub_account: Remove default value (SECURITY_CONTROL) for control_finding_generator argument and mark as Computed (#33095)

`v5.13.1`

Compare Source

BUG FIXES:

resource/aws_lambda_layer_version: Change source_code_hash back to ForceNew. This fixes doesn't support update errors (#33097)
resource/aws_organizations_organization: Fix current Organization ID (o-xxxxxxxxxx) does not match errors on resource Read (#33091)

`v5.13.0`

Compare Source

FEATURES:

New Resource: aws_msk_cluster_policy (#32848)
New Resource: aws_opensearch_vpc_endpoint (#32435)
New Resource: aws_ram_sharing_with_organization (#25433)

ENHANCEMENTS:

data-source/aws_imagebuilder_image_pipeline: Add image_scanning_configuration attribute (#33005)
data-source/aws_ram_resource_share: Add resource_arns attribute (#22591)
provider: Adds the s3_us_east_1_regional_endpoint attribute to support using the regional S3 API endpoint in us-east-1. (#33024)
resource/aws_appstream_fleet: Retry ConcurrentModificationException errors during creation (#32958)
resource/aws_dms_endpoint: Add babelfish as an engine_name option (#32975)
resource/aws_imagebuilder_image_pipeline: Add image_scanning_configuration configuration block (#33005)
resource/aws_lb: Changes to security_groups for Network Load Balancers force a new resource if either the old or new set of security group IDs is empty (#32987)
resource/aws_rds_global_cluster: Add plan-time validation of global_cluster_identifier (#30996)

BUG FIXES:

data-source/aws_ecr_repository: Correctly set most_recent_image_tags when only a single image is found (#31757)
resource/aws_budgets_budget_action: No longer times out when creating a non-triggered action (#33015)
resource/aws_cloudformation_stack: Marks outputs as Computed when there are potential changes. (#33059)
resource/aws_cloudwatch_event_rule: Fix ARN-based partner event bus rule ID parsing error (#30293)
resource/aws_ecr_registry_scanning_configuration: Correctly delete rules on resource Update (#31449)
resource/aws_lambda_layer_version: Fix bug causing new version to be created on every apply when source_code_hash is used but not changed (#32535)
resource/aws_lb_listener_certificate: Remove from state when listener not found (#32412)
resource/aws_organizations_organization: Ensure that the Organization ID specified in terraform import is the current Organization (#31796)
resource/aws_quicksight_analysis: Adjust max length of definition.*.calculated_fields.*.expression to 32000 characters (#33012)
resource/aws_quicksight_analysis: Convert definition.*.calculated_fields to a set type, preventing persistent differences (#33040)
resource/aws_quicksight_analysis: Convert permissions argument to TypeSet, preventing persistent differences (#33023)
resource/aws_quicksight_analysis: Enable font_configuration to be set for table header styles (#33018)
resource/aws_quicksight_analysis: Enable font_configuration to be set for table header styles (#33018)
resource/aws_quicksight_analysis: Enable font_configuration to be set for table header styles (#33018)
resource/aws_quicksight_analysis: Raise limit for maximum allowed visuals blocks per sheet to 50 (#32856)
resource/aws_quicksight_dashboard: Adjust max length of definition.*.calculated_fields.*.expression to 32000 characters (#33012)
resource/aws_quicksight_dashboard: Convert definition.*.calculated_fields to a set type, preventing persistent differences (#33040)
resource/aws_quicksight_dashboard: Convert permissions argument to TypeSet, preventing persistent differences (#33023)
resource/aws_quicksight_data_set: Change permission attribute type from TypeList to TypeSet (#32984)
resource/aws_quicksight_template: Adjust max items of definition.*.calculated_fields to 500 (#33012)
resource/aws_quicksight_template: Adjust max length of definition.*.calculated_fields.*.expression to 32000 characters (#33012)
resource/aws_quicksight_template: Convert definition.*.calculated_fields to a set type, preventing persistent differences (#33040)
resource/aws_quicksight_template: Convert permissions argument to TypeSet, preventing persistent differences (#33023)
resource/aws_s3_bucket_logging: Fix perpetual drift when expected_bucket_owner is configured (#32989)
resource/aws_sagemaker_domain: Fix validation on s3_kms_key_id in sharing_settings and kms_key_id (#32661)
resource/aws_subnet: Fix allowing IPv6 to be enabled in an update after initial creation with IPv4 only (#32896)
resource/aws_wafv2_web_acl: Adds rule_group_reference_statement.rule_action_override.action_to_use.challenge argument (#31127)

`v5.12.0`

Compare Source

NOTES:

data-source/aws_codecatalyst_dev_environment: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#32886)
resource/aws_codecatalyst_dev_environment: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#32366)
resource/aws_codecatalyst_project: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#32883)
resource/aws_codecatalyst_source_repository: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#32899)

FEATURES:

New Data Source: aws_codecatalyst_dev_environment (#32886)
New Data Source: aws_ec2_transit_gateway_route_table_routes (#30771)
New Data Source: aws_msk_vpc_connection (#31062)
New Resource: aws_cloudfront_continuous_deployment_policy (#32936)
New Resource: aws_codecatalyst_dev_environment (#32366)
New Resource: aws_codecatalyst_project (#32883)
New Resource: aws_codecatalyst_source_repository (#32899)
New Resource: aws_msk_vpc_connection (#31062)

ENHANCEMENTS:

data-source/aws_instance: Add metadata_options.http_protocol_ipv6 attribute (#32759)
data-source/aws_rds_cluster: Add db_system_id attribute (#32846)
provider: Support il-central-1 as a valid AWS Region (#32878)
resource/aws_autoscaling_group: Add ignore_failed_scaling_activities argument (#32914)
resource/aws_cloudfront_distribution: Add continuous_deployment_policy_id and staging arguments to support continuous deployments (#32936)
resource/aws_cloudwatch_composite_alarm: Add actions_suppressor configuration block (#32751)
resource/aws_cloudwatch_events_target: Add sagemaker_pipeline_target argument (#32882)
resource/aws_fms_admin_account: Add configurable timeouts (#32860)
resource/aws_glue_crawler: Add hudi_target argument (#32898)
resource/aws_instance: Add http_protocol_ipv6 attribute to metadata_options configuration block (#32759)
resource/aws_lambda_event_source_mapping: Increased the maximum number of filters to 10 (#32890)
resource/aws_msk_broker: Add bootstrap_brokers_vpc_connectivity_sasl_iam, bootstrap_brokers_vpc_connectivity_sasl_scram and bootstrap_brokers_vpc_connectivity_tls attributes (#31062)
resource/aws_msk_broker: Add vpc_connectivity attribute to the broker_node_group_info.connectivity_info configuration block (#31062)
resource/aws_rds_cluster: Add db_system_id argument to support RDS Custom engine types (#32846)
resource/aws_rds_cluster_instance: Add custom_iam_instance_profile argument to allow RDS Custom users to specify an IAM Instance Profile for the RDS Cluster Instance (#32846)
resource/aws_rds_cluster_instance: Update engine plan-time validation to allow for RDS Custom engine types (#32846)

BUG FIXES:

data-source/aws_vpclattice_service: Avoid listing tags when the service has been shared to the current account via AWS Resource Access Manager (RAM) (#32939)
data-source/aws_vpclattice_service_network: Avoid listing tags when the service network has been shared to the current account via AWS Resource Access Manager (RAM) (#32939)
resource/aws_appstream_fleet: Increased upper limit of max_user_duration_in_seconds to 432000 (#32933)
resource/aws_cloudfront_distribution: Don't call UpdateDistribution API if only tags are updated (#32865)
resource/aws_db_instance: Fix crash creating resource with empty restore_to_point_in_time configuration block (#32928)
resource/aws_emr_cluster: Fix to allow empty args for bootstrap_action (#32956)
resource/aws_emr_instance_fleet: Fix fleet deletion failing for terminated clusters (#32866)
resource/aws_fms_policy: Prevent erroneous diffs on security_service_policy_data.managed_service_data (#32860)
resource/aws_instance: Fix InvalidParameterCombination: Network interfaces and an instance-level security groups may not be specified on the same request errors creating Instances with subnet_id configured and launch_template referencing an aws_launch_template with configured vpc_security_group_ids (#32854)
resource/aws_lb: Fix to avoid creating a load balancer with same name as an existing load balancer (#32941)

`v5.11.0`

Compare Source

FEATURES:

New Resource: aws_sagemaker_pipeline (#32527)

ENHANCEMENTS:

data-source/aws_cloudtrail_service_account: Add service account ID for il-central-1 AWS Region (#32840)
data-source/aws_db_cluster_snapshot: Add tags argument (#31602)
data-source/aws_db_instance: Add ability to filter by tags (#32740)
data-source/aws_db_instances: Add ability to filter by tags (#32740)
data-source/aws_db_snapshot: Add tags argument (#31600)
data-source/aws_elb_hosted_zone_id: Add hosted zone ID for il-central-1 AWS Region (#32840)
data-source/aws_lb_hosted_zone_id: Add hosted zone IDs for il-central-1 AWS Region (#32840)
data-source/aws_s3_bucket: Add hosted zone ID for il-central-1 AWS Region (#32840)
data-source/aws_vpclattice_service: Add ability to find by name (#32177)
resource/aws_finspace_kx_cluster: Adjusted savedown_storage_configuration.size minimum value to 10 GB. (#32800)
resource/aws_lambda_function: Add support for python3.11 runtime value (#32729)
resource/aws_lambda_layer_version: Add support for python3.11 compatible_runtimes value (#32729)
resource/aws_networkfirewall_rule_group: Add support for REJECT action in stateful rule actions (#32746)
resource/aws_route_table: Allow an existing local route to be adopted or imported and the target to be updated (#32794)
resource/aws_sagemaker_endpoint: Add deployment_config.rolling_update_policy argument (#32418)
resource/aws_sagemaker_endpoint: Make deployment_config.blue_green_update_policy optional (#32418)

BUG FIXES:

data-source/aws_ecs_task_execution: Fixed bug that incorrectly mapped the value of container_overrides.memory to container_overrides.memory_reservation (#32793)
resource/aws_db_instance_automated_backups_replication: Fix unexpected state 'Pending' errors on resource Create (#31600)
resource/aws_ec2_transit_gateway_vpc_attachment: Change transit_gateway_default_route_table_association and transit_gateway_default_route_table_propagation to Computed (#32821)
resource/aws_emr_studio_session_mapping: Fix InvalidRequestException: IdentityId is invalid errors reading resources created with identity_name (#32416)
resource/aws_quicksight_analysis: Fix an error related to setting the value for definition.sheets.visuals.insight_visual.insight_configuration.computation (#32791)
resource/aws_quicksight_analysis: Fixed a bug that incorrectly determined the valid select_all_options values for custom_filter_configuration, custom_filter_list_configuration, filter_list_configuration, numeric_equality_filter, and numeric_range_filter (#32822)
resource/aws_quicksight_dashboard: Fix an error related to setting the value for definition.sheets.visuals.insight_visual.insight_configuration.computation (#32791)
resource/aws_quicksight_template: Fix an error related to setting the value for definition.sheets.visuals.insight_visual.insight_configuration.computation (#32791)
resource/aws_quicksight_template: Fixed a bug that incorrectly determined the valid select_all_options values for custom_filter_configuration, custom_filter_list_configuration, filter_list_configuration, numeric_equality_filter, and numeric_range_filter (#32822)
resource/aws_sfn_state_machine: Fix Provider produced inconsistent final plan errors for publish (#32844)

`v5.10.0`

Compare Source

FEATURES:

New Resource: aws_iam_security_token_service_preferences (#32091)

ENHANCEMENTS:

data-source/aws_nat_gateway: Add secondary_allocation_ids, secondary_private_ip_addresses and secondary_private_ip_address_count attributes (#31778)
data-source/aws_transfer_server: Add structured_log_destinations attribute (#32654)
resource/aws_batch_compute_environment: compute_resources.allocation_strategy, compute_resources.bid_percentage, compute_resources.ec2_configuration.image_id_override, compute_resources.ec2_configuration.image_type, compute_resources.ec2_key_pair, compute_resources.image_id, compute_resources.instance_role, compute_resources.launch_template.launch_template_id , compute_resources.launch_template.launch_template_name, compute_resources.tags and compute_resources.type can now be updated in-place (#30438)
resource/aws_glue_job: Add command.runtime attribute (#32528)
resource/aws_grafana_workspace: Allow grafana_version to be updated in-place (#32679)
resource/aws_kms_grant: Allow usage of service principal as grantee and revoker (#32595)
resource/aws_medialive_channel: Adds schemas for caption_descriptions, global_configuration, motion_graphics_configuration, and nielsen_configuration support to encoder settings (#32233)
resource/aws_nat_gateway: Add secondary_allocation_ids, secondary_private_ip_addresses and secondary_private_ip_address_count arguments (#31778)
resource/aws_nat_gateway: Add configurable timeouts (#31778)
resource/aws_networkfirewall_firewall_policy: Add firewall_policy.policy_variables configuration block to support Suricata HOME_NET variable override (#32400)
resource/aws_sagemaker_domain: Add default_user_settings.canvas_app_settings.workspace_settings attribute (#32526)
resource/aws_sagemaker_user_profile: Add user_settings.canvas_app_settings.workspace_settings attribute (#32526)
resource/aws_transfer_server: Add structured_log_destinations argument (#32654)

BUG FIXES:

resource/aws_account_primary_contact: Correct plan-time validation of phone_number (#32715)
resource/aws_apigatewayv2_authorizer: Skip setting authorizer TTL when there are no identity sources (#32629)
resource/aws_elasticache_parameter_group: Remove from state on resource Read if deleted outside of Terraform (#32669)
resource/aws_elasticsearch_domain: Omit ebs_options.throughput and ebs_options.iops for unsupported volume types (#32659)
resource/aws_finspace_kx_cluster: database.cache_configurations.db_paths argument is now optional (#32579)
resource/aws_finspace_kx_cluster: database.cache_configurations argument is now optional (#32579)
resource/aws_lambda_invocation: Fix plan failing with deferred input values (#32706)
resource/aws_lightsail_domain_entry: Add support for AAAA type value (#32664)
resource/aws_opensearch_domain: Correctly handle off_peak_window_options.off_peak_window.window_start_time value of 00:00 (#32716)
resource/aws_quicksight_analysis: Fix exception thrown when setting the value for definition.sheets.visuals.pie_chart_visual.chart_configuration.data_labels.measure_label_visibility (#32668)
resource/aws_quicksight_analysis: Grid layout optimized_view_port_width argument changed to Optional (#32644)
resource/aws_quicksight_dashboard: Fix exception thrown when setting the value for definition.sheets.visuals.pie_chart_visual.chart_configuration.data_labels.measure_label_visibility (#32668)
resource/aws_quicksight_dashboard: Grid layout optimized_view_port_width argument changed to Optional (#32644)
resource/aws_quicksight_template: Fix exception thrown when setting the value for definition.sheets.visuals.pie_chart_visual.chart_configuration.data_labels.measure_label_visibility (#32668)
resource/aws_quicksight_template: Grid layout optimized_view_port_width argument changed to Optional (#32644)
resource/aws_vpclattice_access_log_subscription: Avoid recreating resource when passing a non-wildcard CloudWatch Logs log group ARN as destination_arn (#32186)
resource/aws_vpclattice_access_log_subscription: Avoid recreating resource when passing an ARN as resource_identifier (#32186)
resource/aws_vpclattice_service_network_service_association: Avoid recreating resource when passing an ARN as service_identifier or service_network_identifier (#32658)
resource/aws_vpclattice_service_network_vpc_association: Avoid recreating resource when passing an ARN as service_network_identifier (#32658)

`v5.9.0`

Compare Source

FEATURES:

New Resource: aws_workspaces_connection_alias (#32482)

ENHANCEMENTS:

data-source/aws_appmesh_gateway_route: Add path to the spec.http_route.action.rewrite and spec.http2_route.action.rewrite configuration blocks (#32449)
data-source/aws_db_instance: Add max_allocated_storage attribute (#32477)
data-source/aws_ec2_host: Add asset_id attribute (#32388)
resource/aws_appmesh_gateway_route: Add path to the spec.http_route.action.rewrite and spec.http2_route.action.rewrite configuration blocks (#32449)
resource/aws_cloudformation_stack_set_instance: Added the stack_instance_summaries attribute to track all account and stack IDs for deployments to organizational units. (#24523)
resource/aws_cloudformation_stack_set_instance: Changes to deployment_targets now force a new resource. (#24523)
resource/aws_connect_queue: add delete function (#32538)
resource/aws_connect_routing_profile: add delete function (#32540)
resource/aws_db_instance: Add backup_target attribute (#32609)
resource/aws_ec2_host: Add asset_id argument (#32388)
resource/aws_ec2_traffic_mirror_filter_rule: Fix crash when updating rule_number (#32594)
resource/aws_lightsail_key_pair: Add tags attribute (#32606)
resource/aws_signer_signing_profile: Add signing_material attribute. (#32414)
resource/aws_signer_signing_profile: Update platform_id validation. (#32414)
resource/aws_wafv2_web_acl: Add association_config argument (#31668)

BUG FIXES:

data-source/aws_dms_replication_instance: Fixed bug that caused replication_instance_private_ips, replication_instance_public_ips, and vpc_security_group_ids to always return null (#32551)
data-source/aws_mq_broker: Fix setting user: Invalid address to set errors (#32593)
data-source/aws_vpc_endpoint: Add dns_options.private_dns_only_for_inbound_resolver_endpoint (#32517)
resource/aws_appflow_flow: Fix tasks not updating properly due to empty task being processed (#26614)
resource/aws_cloudformation_stack_set_instance: Fix error when deploying to organizational units with no accounts. (#24523)
resource/aws_cognito_user_pool: Suppress diff when schema.string_attribute_constraints is omitted for String attribute types (#32445)
resource/aws_config_config_rule: Prevent crash from unhandled read error (#32520)
resource/aws_datasync_agent: Prevent persistent diffs when private_link_endpoint is not explicitly configured. (#32546)
resource/aws_globalaccelerator_custom_routing_endpoint_group: Respect configured endpoint_group_region value on resource Create (#32393)
resource/aws_pipes_pipe: Fix Error: setting target_parameters: Invalid address to set errors when creating pipes with ecs task targets (#32432)
resource/aws_pipes_pipe: Fix ValidationException errors when updating pipe (#32622)
resource/aws_quicksight_analysis: Correctly expand comparison method (#32285)
resource/aws_quicksight_group_membership: Allow non default value for namespace (#32494)
resource/aws_route53_cidr_location: Fix Value Conversion Error errors (#32596)
resource/aws_wafv2_web_acl: Fixed error handling response_inspection parameters (#31111)

`v5.8.0`

Compare Source

ENHANCEMENTS:

data-source/aws_ssm_parameter: Add insecure_value attribute (#30817)
resource/aws_fms_policy: Add policy_option attribute for security_service_policy_data block (#25362)
resource/aws_iam_virtual_mfa_device: Add enable_date and user_name attributes (#32462)

BUG FIXES:

resource/aws_config_config_rule: Prevent crash on nil describe output (#32439)
resource/aws_mq_broker: default replication_user to false (#32454)
resource/aws_quicksight_analysis: Fix exception thrown when specifying definition.sheets.visuals.bar_chart_visual.chart_configuration.category_axis.scrollbar_options.visible_range (#32464)
resource/aws_quicksight_analysis: Fix exception thrown when specifying definition.sheets.visuals.pivot_table_visual.chart_configuration.field_options.selected_field_options.visibility (#32464)
resource/aws_quicksight_analysis: Fix exception thrown when specifying definition.sheets.visuals.pivot_table_visual.chart_configuration.field_wells.pivot_table_aggregated_field_wells.rows (#32464)
resource/aws_quicksight_dashboard: Fix exception thrown when specifying definition.sheets.visuals.bar_chart_visual.chart_configuration.category_axis.scrollbar_options.visible_range (#32464)
resource/aws_quicksight_dashboard: Fix exception thrown when specifying definition.sheets.visuals.pivot_table_visual.chart_configuration.field_options.selected_field_options.visibility (#32464)
resource/aws_quicksight_dashboard: Fix exception thrown when specifying definition.sheets.visuals.pivot_table_visual.chart_configuration.field_wells.pivot_table_aggregated_field_wells.rows (#32464)
resource/aws_quicksight_template: Fix exception thrown when specifying definition.sheets.visuals.bar_chart_visual.chart_configuration.category_axis.scrollbar_options.visible_range (#32464)
resource/aws_quicksight_template: Fix exception thrown when specifying definition.sheets.visuals.pivot_table_visual.chart_configuration.field_options.selected_field_options.visibility (#32464)
resource/aws_quicksight_template: Fix exception thrown when specifying definition.sheets.visuals.pivot_table_visual.chart_configuration.field_wells.pivot_table_aggregated_field_wells.rows (#32464)

`v5.7.0`

Compare Source

FEATURES:

New Data Source: aws_opensearchserverless_security_config (#32321)
New Data Source: aws_opensearchserverless_security_policy (#32226)
New Data Source: aws_opensearchserverless_vpc_endpoint (#32276)
New Resource: aws_cleanrooms_collaboration (#31680)

ENHANCEMENTS:

resource/aws_aws_keyspaces_table: Add client_side_timestamps configuration block (#32339)
resource/aws_glue_catalog_database: Add target_database.region argument (#32283)
resource/aws_glue_crawler: Add iceberg_target configuration block (#32332)
resource/aws_internetmonitor_monitor: Add health_events_config configuration block (#32343)
resource/aws_lambda_function: Support code_signing_config_arn in the ap-east-1 AWS Region (#32327)
resource/aws_qldb_stream: Add configurable Create and Delete timeouts (#32345)
resource/aws_service_discovery_private_dns_namespace: Allow description to be updated in-place (#32342)
resource/aws_service_discovery_public_dns_namespace: Allow description to be updated in-place (#32342)
resource/aws_timestreamwrite_table: Add schema configuration block (#32354)

BUG FIXES:

provider: Correctly handle forbidden_account_ids (#32352)
resource/aws_kms_external_key: Correctly remove all tags (#32371)
resource/aws_kms_key: Correctly remove all tags (#32371)
resource/aws_kms_replica_external_key: Correctly remove all tags (#32371)
resource/aws_kms_replica_key: Correctly remove all tags (#32371)
resource/aws_secretsmanager_secret_rotation: Fix InvalidParameterException: You cannot specify both rotation frequency and schedule expression together errors on resource Update (#31915)
resource/aws_ssm_parameter: Skip Update if only overwrite parameter changes (#32372)
resource/aws_vpc_endpoint: Fix InvalidParameter: PrivateDnsOnlyForInboundResolverEndpoint not supported for this service errors creating S3 Interface VPC endpoints (#32355)

`v5.6.2`

Compare Source

BUG FIXES:

resource/aws_s3_bucket: Fix InvalidArgument: Invalid attribute name specified errors when listing S3 Bucket objects, caused by an AWS SDK for Go regression (#32317)

`v5.6.1`

Compare Source

BUG FIXES:

provider: Prevent resource recreation if tags or tags_all are updated (#32297)

`v5.6.0`

Compare Source

FEATURES:

New Data Source: aws_opensearchserverless_access_policy (#32231)
New Data Source: aws_opensearchserverless_collection (#32247)
New Data Source: aws_sfn_alias (#32176)
New Data Source: aws_sfn_state_machine_versions (#32176)
New Resource: aws_ec2_instance_connect_endpoint (#31858)
New Resource: aws_sfn_alias (#32176)
New Resource: aws_transfer_agreement (#32203)
New Resource: aws_transfer_certificate (#32203)
New Resource: aws_transfer_connector (#32203)
New Resource: aws_transfer_profile (#32203)

ENHANCEMENTS:

resource/aws_batch_compute_environment: Add placement_group attribute to the compute_resources configuration block (#32200)
resource/aws_emrserverless_application: Do not recreate the resource if release_label changes (#32278)
resource/aws_fis_experiment_template: Add log_configuration configuration block (#32102)
resource/aws_fis_experiment_template: Add parameters attribute to the target configuration block (#32160)
resource/aws_fis_experiment_template: Add support for Pods and Tasks to action.*.target (#32152)
resource/aws_lambda_event_source_mapping: The queues argument has changed from a set to a list with a maximum of one element. (#31931)
resource/aws_pipes_pipe: Add activemq_broker_parameters, dynamodb_stream_parameters, kinesis_stream_parameters, managed_streaming_kafka_parameters, rabbitmq_broker_parameters, self_managed_kafka_parameters and sqs_queue_parameters attributes to the source_parameters configuration block. NOTE: Because we cannot easily test all this functionality, it is best effort and we ask for community help in testing (#31607)
resource/aws_pipes_pipe: Add batch_job_parameters, cloudwatch_logs_parameters, ecs_task_parameters, eventbridge_event_bus_parameters, http_parameters, kinesis_stream_parameters, lambda_function_parameters, redshift_data_parameters, sagemaker_pipeline_parameters, sqs_queue_parameters and step_function_state_machine_parameters attributes to the target_parameters configuration block. NOTE: Because we cannot easily test all this functionality, it is best effort and we ask for community help in testing (#31607)
resource/aws_pipes_pipe: Add enrichment_parameters argument (#31607)
resource/aws_resourcegroups_group: resource_query no longer conflicts with configuration (#30242)
resource/aws_s3_bucket_logging: Retry on empty read of logging config (#30916)
resource/aws_sfn_state_machine: Add description, publish, revision_id, state_machine_version_arn and version_description attributes (#32176)

BUG FIXES:

resource/aws_db_instance: Fix resource Create returning instances not in the available state when identifier_prefix is specified (#32287)
resource/aws_resourcegroups_resource: Fix crash when resource Create fails (#30242)
resource/aws_route: Fix reading Route in Route Table (rtb-1234abcd) with destination (1.2.3.4/5): couldn't find resource errors when reading new resource (#32196)
resource/aws_vpc_security_group_egress_rule: security_group_id is Required (#32148)
resource/aws_vpc_security_group_ingress_rule: security_group_id is Required (#32148)

`v5.5.0`

Compare Source

NOTES:

provider: Updates to Go 1.20, the last release that will run on any release of Windows 7, 8, Server 2008 and Server 2012. A future release will update to Go 1.21, and these platforms will no longer be supported. (#32108)
provider: Updates to Go 1.20, the last release that will run on macOS 10.13 High Sierra or 10.14 Mojave. A future release will update to Go 1.21, and these platforms will no longer be supported. (#32108)
provider: Updates to Go 1.20. The provider will now notice the trust-ad option in /etc/resolv.conf and, if set, will set the "authentic data" option in outgoing DNS requests in order to better match the behavior of the GNU libc resolver. (#32108)

FEATURES:

New Data Source: aws_sesv2_email_identity (#32026)
New Data Source: aws_sesv2_email_identity_mail_from_attributes (#32026)
New Resource: aws_chimesdkvoice_sip_rule (#32070)
New Resource: aws_organizations_resource_policy (#32056)

ENHANCEMENTS:

data-source/aws_organizations_organization: Return the full set of attributes when running as a delegated administrator for AWS Organizations (#32056)
provider: Mask all sensitive values that appear when TF_LOG level is TRACE (#32174)
resource/aws_config_configuration_recorder: Add exclusion_by_resource_types and recording_strategy attributes to the recording_group configuration block (#32007)
resource/aws_datasync_task: Add object_tags attribute to options configuration block (#27811)
resource/aws_networkmanager_attachment_accepter: Added support for Transit Gateway route table attachments (#32023)
resource/aws_ses_active_receipt_rule_set: Support import (#27604)

BUG FIXES:

resource/aws_api_gateway_rest_api: Fix crash when binary_media_types is null (#32169)
resource/aws_datasync_location_object_storage: Don't ignore server_certificate argument (#27811)
resource/aws_eip: Fix reading EC2 EIP (eipalloc-abcd1234): couldn't find resource errors when reading new resource (#32016)
resource/aws_quicksight_analysis: Fix schema mapping for string set elements (#31903)
resource/aws_redshiftserverless_workgroup: Fix waiting for completion: unexpected state 'AVAILABLE' errors when deleting resource (#32067)
resource/aws_route_table: Fix reading Route Table (rtb-abcd1234): couldn't find resource errors when reading new resource (#30999)
resource/aws_storagegateway_smb_file_share: Fix update error when kms_encrypted is true but kms_key_arn is not sent in the request (#32171)

`v5.4.0`

Compare Source

FEATURES:

New Data Source: aws_organizations_policies (#31545)
New Data Source: aws_organizations_policies_for_target (#31682)
New Resource: aws_chimesdkvoice_sip_media_application (#31937)
New Resource: aws_opensearchserverless_collection (#31091)
New Resource: aws_opensearchserverless_security_config (#28776)
New Resource: aws_opensearchserverless_vpc_endpoint (#28651)

ENHANCEMENTS:

resource/aws_elb: Add configurable Create and Update timeouts (#31976)
resource/aws_glue_data_quality_ruleset: Add catalog_id argument to target_table block (#31926)

BUG FIXES:

provider: Fix index out of range [0] with length 0 panic (#32004)
resource/aws_elb: Recreate the resource if subnets is updated to an empty list (#31976)
resource/aws_lambda_provisioned_concurrency_config: The function_name argument now properly handles ARN values (#31933)
resource/aws_quicksight_data_set: Allow physical table map to be optional (#31863)
resource/aws_ssm_default_patch_baseline: Fix *conns.AWSClient is not ssm.ssmClient: missing method SSMClient panic (#31928)

`v5.3.0`

Compare Source

NOTES:

resource/aws_instance: The metadata_options.http_endpoint argument now correctly defaults to enabled. (#24774)
resource/aws_lambda_function: The replace_security_groups_on_destroy and replacement_security_group_ids attributes are being deprecated as AWS no longer supports this operation. These attributes now have no effect, and will be removed in a future major version. (#31904)

FEATURES:

New Data Source: aws_quicksight_theme (#31900)
New Resource: aws_opensearchserverless_access_policy (#28518)
New Resource: aws_opensearchserverless_security_policy (#28470)
New Resource: aws_quicksight_theme (#31900)

ENHANCEMENTS:

data-source/aws_redshift_cluster: Add cluster_namespace_arn attribute (#31884)
resource/aws_redshift_cluster: Add cluster_namespace_arn attribute (#31884)
resource/aws_vpc_endpoint: Add private_dns_only_for_inbound_resolver_endpoint attribute to the dns_options configuration block (#31873)

BUG FIXES:

resource/aws_ecs_task_definition: Fix to prevent persistent diff when efs_volume_configuration has both root_volume and authorization_config set. (#26880)
resource/aws_instance: Fix default for metadata_options.http_endpoint argument. (#24774)
resource/aws_keyspaces_keyspace: Correct plan time validation for name (#31352)
resource/aws_keyspaces_table: Correct plan time validation for keyspace_name, table_name and column names (#31352)
resource/aws_quicksight_analysis: Fix assignment of KPI visual field well target values (#31901)
resource/aws_redshift_cluster: Allow availability_zone_relocation_enabled to be true when publicly_accessible is true (#31886)
resource/aws_vpc: Fix reading EC2 VPC (vpc-abcd1234) Attribute (enableDnsSupport): couldn't find resource errors when reading new resource (#31877)

`v5.2.0`

Compare Source

NOTES:

resource/aws_mwaa_environment: Upgrading your environment to a new major version of Apache Airflow forces replacement of the resource (#31833)

FEATURES:

New Data Source: aws_budgets_budget (#31691)
New Data Source: aws_ecr_pull_through_cache_rule (#31696)
New Data Source: aws_guardduty_finding_ids (#31711)
New Data Source: aws_iam_principal_policy_simulation (#25569)
New Resource: aws_chimesdkvoice_global_settings (#31365)
New Resource: aws_finspace_kx_cluster (#31806)
New Resource: aws_finspace_kx_database (#31803)
New Resource: aws_finspace_kx_environment (#31802)
New Resource: aws_finspace_kx_user (#31804)

ENHANCEMENTS:

data/aws_ec2_transit_gateway_connect_peer: Add bgp_peer_address and bgp_transit_gateway_addresses attributes (#31752)
provider: Adds retry_mode parameter (#31745)
resource/aws_chime_voice_connector: Add tagging support (#31746)
resource/aws_ec2_transit_gateway_connect_peer: Add bgp_peer_address and bgp_transit_gateway_addresses attributes (#31752)
resource/aws_ec2_transit_gateway_route_table_association: Add replace_existing_association argument (#31452)
resource/aws_fis_experiment_template: Add support for Volumes to actions.*.target (#31499)
resource/aws_instance: Add instance_market_options configuration block and instance_lifecycle and spot_instance_request_id attributes (#31495)
resource/aws_lambda_function: Add support for ruby3.2 runtime value (#31842)
resource/aws_lambda_layer_version: Add support for ruby3.2 compatible_runtimes value (#31842)
resource/aws_mwaa_environment: Consider CREATING_SNAPSHOT a valid pending state for resource update (#31833)
resource/aws_networkfirewall_firewall_policy: Add stream_exception_policy option to firewall_policy.stateful_engine_options (#31541)
resource/aws_redshiftserverless_workgroup: Additional supported values for config_parameter.parameter_key (#31747)
resource/aws_sagemaker_model: Add container.model_package_name and primary_container.model_package_name arguments (#31755)

BUG FIXES:

data-source/aws_redshift_cluster: Fix crash reading clusters in modifying state (#31772)
provider/default_tags: Fix perpetual diff when identical tags are moved from default_tags to resource tags, and vice versa (#31826)
resource/aws_autoscaling_group: Ignore any Failed scaling activities due to IAM eventual consistency (#31282)
resource/aws_dx_connection: Convert vlan_id from TypeString to TypeInt in Terraform state for existing resources. This fixes a regression introduced in v5.1.0 causing a number is required errors (#31735)
resource/aws_globalaccelerator_endpoint_group: Fix bug updating endpoint_configuration.weight to 0 (#31767)
resource/aws_medialive_channel: Fix spelling in hls_cdn_settings expander. (#31844)
resource/aws_redshiftserverless_namespace: Fix perpetual iam_roles diffs when the namespace contains a workgroup (#31749)
resource/aws_redshiftserverless_workgroup: Change config_parameter from TypeList to TypeSet as order is not significant (#31747)
resource/aws_redshiftserverless_workgroup: Fix ValidationException: Can't update multiple configurations at the same time errors (#31747)
resource/aws_vpc_endpoint: Fix tagging error preventing use in ISO partitions (#31801)

`v5.1.0`

Compare Source

BREAKING CHANGES:

resource/aws_iam_role: The role_last_used attribute has been removed. Use the aws_iam_role data source instead. (#31656)

NOTES:

resource/aws_autoscaling_group: The load_balancers and target_group_arns attributes have been changed to Computed. This means that omitting this argument is interpreted as ignoring any existing load balancer or target group attachments. To remove all load balancer or target group attachments an empty list should be specified. (#31527)
resource/aws_iam_role: The role_last_used attribute has been removed. Use the aws_iam_role data source instead. See the community feedback provided in the linked issue for additional justification on this change. As the attribute is read-only, unlikely to be used as an input to another resource, and available in the corresponding data source, a breaking change in a minor version was deemed preferable to a long deprecation/removal cycle in this circumstance. (#31656)
resource/aws_redshift_cluster: Ignores the parameter aqua_configuration_status, since the AWS API ignores it. Now always returns auto. (#31612)

FEATURES:

New Data Source: aws_vpclattice_resource_policy (#31372)
New Resource: aws_autoscaling_traffic_source_attachment (#31527)
New Resource: aws_emrcontainers_job_template (#31399)
New Resource: aws_glue_data_quality_ruleset (#31604)
New Resource: aws_quicksight_analysis (#31542)
New Resource: aws_quicksight_dashboard (#31448)
New Resource: aws_resourcegroups_resource (#31430)

ENHANCEMENTS:

data-source/aws_autoscaling_group: Add traffic_source attribute (#31527)
data-source/aws_opensearch_domain: Add off_peak_window_options attribute (#35970)
provider: Increases size of HTTP request bodies in logs to 1 KB (#31718)
resource/aws_appsync_graphql_api: Add visibility argument (#31369)
resource/aws_appsync_graphql_api: Add plan time validation for log_config.cloudwatch_logs_role_arn (#31369)
resource/aws_autoscaling_group: Add traffic_source configuration block (#31527)
resource/aws_cloudformation_stack_set: Add managed_execution argument (#25210)
resource/aws_fsx_ontap_volume: Add skip_final_backup argument (#31544)
resource/aws_fsx_ontap_volume: Remove default value for security_style argument and mark as Computed (#31544)
resource/aws_fsx_ontap_volume: Update ontap_volume_type attribute to be configurable (#31544)
resource/aws_fsx_ontap_volume: junction_path is Optional (#31544)
resource/aws_fsx_ontap_volume: storage_efficiency_enabled is Optional (#31544)
resource/aws_grafana_workspace: Increase default Create and Update timeouts to 30 minutes (#31422)
resource/aws_lambda_invocation: Add lifecycle_scope CRUD to invoke on each resource state transition (#29367)
resource/aws_lambda_layer_version_permission: Add skip_destroy attribute (#29571)
resource/aws_lambda_provisioned_concurrency_configuration: Add skip_destroy argument (#31646)
resource/aws_opensearch_domain: Add off_peak_window_options configuration block (#35970)
resource/aws_sagemaker_endpoint_configuration: Add and shadow_production_variants.serverless_config.provisioned_concurrency arguments (#31398)
resource/aws_transfer_server: Add support for TransferSecurityPolicy-2023-05 security_policy_name value (#31536)

BUG FIXES:

data-source/aws_dx_connection: Fix the vlan_id being returned as null (#31480)
provider/tags: Fix crash when some tags are null and others are computed (#31687)
provider: Limits size of HTTP response bodies in logs to 4 KB (#31718)
resource/aws_autoscaling_group: Fix The AutoRollback parameter cannot be set to true when the DesiredConfiguration parameter is empty errors when refreshing instances (#31715)
resource/aws_autoscaling_group: Now ignores previous failed scaling activities (#31551)
resource/aws_cloudfront_distribution: Remove the upper limit on origin_keepalive_timeout (#31608)
resource/aws_connect_instance: Fix crash when reading instances with CREATION_FAILED status (#31689)
resource/aws_connect_security_profile: Set correct tags in state (#31716)
resource/aws_dx_connection: Fix the vlan_id being returned as null (#31480)
resource/aws_ecs_service: Fix crash when just alarms is updated (#31683)
resource/aws_fsx_ontap_volume: Change storage_virtual_machine_id to ForceNew (#31544)
resource/aws_fsx_ontap_volume: Change volume_type to ForceNew (#31544)
resource/aws_kendra_index: Persist user_group_resolution_mode value to state after creation (#31669)
resource/aws_medialive_channel: Fix attribute spelling in hls_cdn_settings expand (#31647)
resource/aws_quicksight_data_set: Fix join_instruction not applied when creating dataset (#31424)
resource/aws_quicksight_data_set: Ignore failure to read refresh properties for non-SPICE datasets (#31488)
resource/aws_rbin_rule: Fix crash when multiple resource_tags blocks are configured (#31393)
resource/aws_rds_cluster: Correctly update db_cluster_instance_class (#31709)
resource/aws_redshift_cluster: No longer errors on deletion when status is Maintenance (#31612)
resource/aws_route53_vpc_association_authorization: Fix ConcurrentModification error (#31588)
resource/aws_s3_bucket_replication_configuration: Replication configs sometimes need more than a second or two. This resolves a race condition and adds retry logic when reading them. (#30995)

`v5.0.1`

Compare Source

BUG FIXES:

provider/tags: Fix crash when tags are null (#31587)

`v5.0.0`

Compare Source

BREAKING CHANGES:

data-source/aws_api_gateway_rest_api: minimum_compression_size is now a string type to allow values set via the body attribute to be properly computed. (#30969)
data-source/aws_connect_hours_of_operation: The hours_of_operation_arn attribute has been removed (#31484)
data-source/aws_db_instance: With the retirement of EC2-Classic the db_security_groups attribute has been removed (#30966)
data-source/aws_elasticache_cluster: With the retirement of EC2-Classic the security_group_names attribute has been removed (#30966)
data-source/aws_elasticache_replication_group: Remove number_cache_clusters, replication_group_description arguments -- use num_cache_clusters, and description, respectively, instead (#31008)
data-source/aws_iam_policy_document: Don't add empty statement.sid values to json attribute value (#28539)
data-source/aws_iam_policy_document: source_json and override_json have been removed -- use source_policy_documents and override_policy_documents, respectively, instead (#30829)
data-source/aws_identitystore_group: The filter argument has been removed (#31312)
data-source/aws_identitystore_user: The filter argument has been removed (#31312)
data-source/aws_launch_configuration: With the retirement of EC2-Classic the vpc_classic_link_id and vpc_classic_link_security_groups attributes have been removed (#30966)
data-source/aws_redshift_cluster: With the retirement of EC2-Classic the cluster_security_groups attribute has been removed (#30966)
data-source/aws_secretsmanager_secret: The rotation_enabled, rotation_lambda_arn and rotation_rules attributes have been removed (#31487)
data-source/aws_vpc_peering_connection: With the retirement of EC2-Classic the allow_classic_link_to_remote_vpc and allow_vpc_to_remote_classic_link attributes have been removed (#30966)
provider: The assume_role.duration_seconds, assume_role_with_web_identity.duration_seconds, s3_force_path_style, shared_credentials_file and skip_get_ec2_platforms attributes have been removed (#31155)
provider: The aws_subnet_ids data source has been removed (#31140)
provider: With the retirement of EC2-Classic the aws_db_security_group resource has been removed (#30966)
provider: With the retirement of EC2-Classic the aws_elasticache_security_group resource has been removed (#30966)
provider: With the retirement of EC2-Classic the aws_redshift_security_group resource has been removed (#30966)
provider: With the retirement of Macie Classic the aws_macie_member_account_association resource has been removed (#31058)
provider: With the retirement of Macie Classic the aws_macie_s3_bucket_association resource has been removed (#31058)
resource/aws_acmpca_certificate_authority: The status attribute has been removed (#31084)
resource/aws_api_gateway_rest_api: minimum_compression_size is now a string type to allow values set via the body attribute to be properly computed. (#30969)
resource/aws_autoscaling_attachment: alb_target_group_arn has been removed -- use lb_target_group_arn instead (#30828)
resource/aws_autoscaling_group: Remove deprecated tags attribute (#30842)
resource/aws_budgets_budget: The cost_filters attribute has been removed (#31395)
resource/aws_ce_anomaly_subscription: The threshold attribute has been removed (#30374)
resource/aws_cloudwatch_event_target: The ecs_target.propagate_tags attribute now has no default value (#25233)
resource/aws_codebuild_project: The secondary_sources.auth and source.auth attributes have been removed (#31483)
resource/aws_connect_hours_of_operation: The hours_of_operation_arn attribute has been removed (#31484)
resource/aws_connect_queue: The quick_connect_ids_associated attribute has been removed (#31376)
resource/aws_connect_routing_profile: The queue_configs_associated attribute has been removed (#31376)
resource/aws_db_instance: Remove name - use db_name instead (#31232)
resource/aws_db_instance: With the retirement of EC2-Classic the security_group_names attribute has been removed (#30966)
resource/aws_db_instance: id is no longer the AWS database identifier - id is now the dbi-resource-id. Refer to identifier instead of id to use the database's identifier (#31232)
resource/aws_default_vpc: With the retirement of EC2-Classic the enable_classiclink and enable_classiclink_dns_support attributes have been removed (#30966)
resource/aws_dms_endpoint: s3_settings.ignore_headers_row has been removed (#30452)
resource/aws_docdb_cluster: snapshot_identifier change now properly forces replacement (#29409)
resource/aws_ec2_client_vpn_endpoint: The status attribute has been removed (#31223)
resource/aws_ec2_client_vpn_network_association: The security_groups attribute has been removed (#31396)
resource/aws_ec2_client_vpn_network_association: The status attribute has been removed (#31223)
resource/aws_ecs_cluster: The capacity_providers and default_capacity_provider_strategy attributes have been removed (#31346)
resource/aws_eip: With the retirement of EC2-Classic the standard domain is no longer supported (#30966)
resource/aws_eip_association: With the retirement of EC2-Classic the standard domain is no longer supported (#30966)
resource/aws_elasticache_cluster: With the retirement of EC2-Classic the security_group_names attribute has been removed (#30966)
resource/aws_elasticache_replication_group: Remove availability_zones, number_cache_clusters, replication_group_description arguments -- use preferred_cache_cluster_azs, num_cache_clusters, and description, respectively, instead (#31008)
resource/aws_elasticache_replication_group: Remove cluster_mode configuration block -- use top-level num_node_groups and replicas_per_node_group instead (#31008)
resource/aws_kinesis_firehose_delivery_stream: Remove s3_configuration attribute from the root of the resource. s3_configuration is now a part of the following blocks: elasticsearch_configuration, opensearch_configuration, redshift_configuration, splunk_configuration, and http_endpoint_configuration (#31138)
resource/aws_kinesis_firehose_delivery_stream: Remove s3 as an option for destination. Use extended_s3 instead (#31138)
resource/aws_kinesis_firehose_delivery_stream: Rename extended_s3_configuration.0.s3_backup_configuration.0.buffer_size and extended_s3_configuration.0.s3_backup_configuration.0.buffer_interval to extended_s3_configuration.0.s3_backup_configuration.0.buffering_size and extended_s3_configuration.0.s3_backup_configuration.0.buffering_interval, respectively (#31141)
resource/aws_kinesis_firehose_delivery_stream: Rename redshift_configuration.0.s3_backup_configuration.0.buffer_size and redshift_configuration.0.s3_backup_configuration.0.buffer_interval to redshift_configuration.0.s3_backup_configuration.0.buffering_size and redshift_configuration.0.s3_backup_configuration.0.buffering_interval, respectively (#31141)
resource/aws_kinesis_firehose_delivery_stream: Rename s3_configuration.0.buffer_size and s3_configuration.0.buffer_internval to s3_configuration.0.buffering_size and s3_configuration.0.buffering_internval, respectively (#31141)
resource/aws_launch_configuration: With the retirement of EC2-Classic the vpc_classic_link_id and vpc_classic_link_security_groups attributes have been removed (#30966)
resource/aws_lightsail_instance: The ipv6_address attribute has been removed (#31489)
resource/aws_medialive_multiplex_program: The statemux_settings attribute has been removed. Use statmux_settings argument instead (#31034)
resource/aws_msk_cluster: The broker_node_group_info.ebs_volume_size attribute has been removed (#31324)
resource/aws_neptune_cluster: snapshot_identifier change now properly forces replacement (#29409)
resource/aws_networkmanager_core_network: Removed policy_document argument -- use aws_networkmanager_core_network_policy_attachment resource instead (#30875)
resource/aws_rds_cluster: The engine argument is now required and has no default (#31112)
resource/aws_rds_cluster: snapshot_identifier change now properly forces replacement (#29409)
resource/aws_rds_cluster_instance: The engine argument is now required and has no default (#31112)
resource/aws_redshift_cluster: With the retirement of EC2-Classic the cluster_security_groups attribute has been removed (#30966)
resource/aws_route: instance_id can no longer be set in configurations. Use network_interface_id instead, for example, setting network_interface_id to aws_instance.test.primary_network_interface_id. (#30804)
resource/aws_route_table: route.*.instance_id can no longer be set in configurations. Use route.*.network_interface_id instead, for example, setting network_interface_id to aws_instance.test.primary_network_interface_id. (#30804)
resource/aws_secretsmanager_secret: The rotation_enabled, rotation_lambda_arn and rotation_rules attributes have been removed (#31487)
resource/aws_security_group: With the retirement of EC2-Classic non-VPC security groups are no longer supported (#30966)
resource/aws_security_group_rule: With the retirement of EC2-Classic non-VPC security groups are no longer supported (#30966)
resource/aws_servicecatalog_product: Changes to any provisioning_artifact_parameters arguments now properly trigger a replacement. This fixes incorrect behavior, but may technically be breaking for configurations expecting non-functional in-place updates. (#31061)
resource/aws_vpc: With the retirement of EC2-Classic the enable_classiclink and enable_classiclink_dns_support attributes have been removed (#30966)
resource/aws_vpc_peering_connection: With the retirement of EC2-Classic the allow_classic_link_to_remote_vpc and allow_vpc_to_remote_classic_link attributes have been removed (#30966)
resource/aws_vpc_peering_connection_accepter: With the retirement of EC2-Classic the allow_classic_link_to_remote_vpc and allow_vpc_to_remote_classic_link attributes have been removed (#30966)
resource/aws_vpc_peering_connection_options: With the retirement of EC2-Classic the allow_classic_link_to_remote_vpc and allow_vpc_to_remote_classic_link attributes have been removed (#30966)
resource/aws_wafv2_web_acl: The statement.managed_rule_group_statement.excluded_rule and statement.rule_group_reference_statement.excluded_rule attributes have been removed (#31374)
resource/aws_wafv2_web_acl_logging_configuration: The redacted_fields.all_query_arguments, redacted_fields.body and redacted_fields.single_query_argument attributes have been removed (#31486)

NOTES:

data-source/aws_elasticache_replication_group: Update configurations to use description instead of the replication_group_description argument (#31008)
data-source/aws_elasticache_replication_group: Update configurations to use num_cache_clusters instead of the number_cache_clusters argument (#31008)
data-source/aws_opensearch_domain: The kibana_endpoint attribute has been deprecated. All configurations using kibana_endpoint should be updated to use the dashboard_endpoint attribute instead (#31490)
data-source/aws_quicksight_data_set: The tags_all attribute has been deprecated and will be removed in a future version (#31162)
data-source/aws_redshift_service_account: The aws_redshift_service_account data source has been deprecated and will be removed in a future version. AWS documentation states that a service principal name should be used instead of an AWS account ID in any relevant IAM policy (#31006)
data-source/aws_service_discovery_service: The tags_all attribute has been deprecated and will be removed in a future version (#31162)
resource/aws_api_gateway_rest_api: Update configurations with minimum_compression_size set to pass the value as a string. Valid values remain the same. (#30969)
resource/aws_autoscaling_attachment: Update configurations to use lb_target_group_arn instead of alb_target_group_arn which has been removed (#30828)
resource/aws_db_event_subscription: Configurations that define source_ids using the id attribute of aws_db_instance must be updated to use identifier instead - for example, source_ids = [aws_db_instance.example.id] must be updated to source_ids = [aws_db_instance.example.identifier] (#31232)
resource/aws_db_instance: Configurations that define replicate_source_db using the id attribute of aws_db_instance must be updated to use identifier instead - for example, replicate_source_db = aws_db_instance.example.id must be updated to replicate_source_db = aws_db_instance.example.identifier (#31232)
resource/aws_db_instance: The change of what id is, namely, a DBI Resource ID now versus DB Identifier previously, has far-reaching consequences. Configurations that refer to, for example, aws_db_instance.example.id will now have errors and must be changed to use identifier instead, for example, aws_db_instance.example.identifier (#31232)
resource/aws_db_instance_role_association: Configurations that define db_instance_identifier using the id attribute of aws_db_instance must be updated to use identifier instead - for example, db_instance_identifier = aws_db_instance.example.id must be updated to db_instance_identifier = aws_db_instance.example.identifier (#31232)
resource/aws_db_proxy_target: Configurations that define db_instance_identifier using the id attribute of aws_db_instance must be updated to use identifier instead - for example, db_instance_identifier = aws_db_instance.example.id must be updated to db_instance_identifier = aws_db_instance.example.identifier (#31232)
resource/aws_db_snapshot: Configurations that define db_instance_identifier using the id attribute of aws_db_instance must be updated to use identifier instead - for example, db_instance_identifier = aws_db_instance.example.id must be updated to db_instance_identifier = aws_db_instance.example.identifier (#31232)
resource/aws_docdb_cluster: Changes to the snapshot_identifier attribute will now trigger a replacement, rather than an in-place update. This corrects the previous behavior which resulted in a successful apply, but did not actually restore the cluster from the designated snapshot. (#29409)
resource/aws_dx_gateway_association: The vpn_gateway_id attribute has been deprecated. All configurations using vpn_gateway_id should be updated to use the associated_gateway_id attribute instead (#31384)
resource/aws_elasticache_replication_group: Update configurations to use description instead of the replication_group_description argument (#31008)
resource/aws_elasticache_replication_group: Update configurations to use num_cache_clusters instead of the number_cache_clusters argument (#31008)
resource/aws_elasticache_replication_group: Update configurations to use preferred_cache_cluster_azs instead of the availability_zones argument (#31008)
resource/aws_elasticache_replication_group: Update configurations to use top-level num_node_groups and replicas_per_node_group instead of cluster_mode.0.num_node_groups and cluster_mode.0.replicas_per_node_group, respectively (#31008)
resource/aws_flow_log: The log_group_name attribute has been deprecated. All configurations using log_group_name should be updated to use the log_destination attribute instead (#31382)
resource/aws_guardduty_organization_configuration: The auto_enable argument has been deprecated. Use the auto_enable_organization_members argument instead. (#30736)
resource/aws_neptune_cluster: Changes to the snapshot_identifier attribute will now trigger a replacement, rather than an in-place update. This corrects the previous behavior which resulted in a successful apply, but did not actually restore the cluster from the designated snapshot. (#29409)
resource/aws_networkmanager_core_network: Update configurations to use the aws_networkmanager_core_network_policy_attachment resource instead of the policy_document argument (#30875)
resource/aws_opensearch_domain: The engine_version attribute no longer has a default value. When omitted, the underlying AWS API will use the latest OpenSearch engine version. (#31568)
resource/aws_opensearch_domain: The kibana_endpoint attribute has been deprecated. All configurations using kibana_endpoint should be updated to use the dashboard_endpoint attribute instead (#31490)
resource/aws_rds_cluster: Changes to the snapshot_identifier attribute will now trigger a replacement, rather than an in-place update. This corrects the previous behavior which resulted in a successful apply, but did not actually restore the cluster from the designated snapshot. (#29409)
resource/aws_rds_cluster: Configurations not including the engine argument must be updated to include engine as it is now required. Previously, not including engine was equivalent to engine = "aurora" and created a MySQL-5.6-compatible cluster (#31112)
resource/aws_rds_cluster_instance: Configurations not including the engine argument must be updated to include engine as it is now required. Previously, not including engine was equivalent to engine = "aurora" and created a MySQL-5.6-compatible cluster instance (#31112)
resource/aws_route: Since instance_id can no longer be set in configurations, use network_interface_id instead. For example, set network_interface_id to aws_instance.test.primary_network_interface_id. (#30804)
resource/aws_route_table: Since route.*.instance_id can no longer be set in configurations, use route.*.network_interface_id instead. For example, set network_interface_id to aws_instance.test.primary_network_interface_id. (#30804)
resource/aws_ssm_association: The instance_id attribute has been deprecated. All configurations using instance_id should be updated to use the targets attribute instead (#31380)

ENHANCEMENTS:

provider: Allow computed tags on resources (#30793)
provider: Allow default_tags and resource tags to include zero values "" (#30793)
provider: Duplicate default_tags can now be included and will be overwritten by resource tags (#30793)
resource/aws_db_instance: Updates to identifier and identifier_prefix will no longer cause the database instance to be destroyed and recreated (#31232)
resource/aws_eip: Deprecate vpc attribute. Use domain instead (#31567)
resource/aws_guardduty_organization_configuration: Add auto_enable_organization_members attribute (#30736)
resource/aws_kinesis_firehose_delivery_stream: Add s3_configuration to elasticsearch_configuration, opensearch_configuration, redshift_configuration, splunk_configuration, and http_endpoint_configuration (#31138)
resource/aws_opensearch_domain: Removed engine_version default value (#31568)
resource/aws_wafv2_web_acl: Support rule_action_override on rule_group_reference_statement (#31374)

BUG FIXES:

resource/aws_ecs_capacity_provider: Allow an instance_warmup_period of 0 in the auto_scaling_group_provider.managed_scaling configuration block (#24005)
resource/aws_launch_template: Remove default values in metadata_options to allow default condition (#30545)
resource/aws_s3_bucket: Fix bucket_regional_domain_name not including region for buckets in us-east-1 (#25724)
resource/aws_s3_object: Remove acl default in order to work with S3 buckets that have ACL disabled (#27197)
resource/aws_s3_object_copy: Remove acl default in order to work with S3 buckets that have ACL disabled (#27197)
resource/aws_servicecatalog_product: Changes to provisioning_artifact_parameters arguments now properly trigger a replacement (#31061)
resource/aws_vpc_peering_connection: Fix crash in vpcPeeringConnectionOptionsEqual (#30966)

`v4.67.0`

Compare Source

NOTES:

resource/aws_lightsail_domain_entry: The id attribute is now comma-delimited (#30820)

FEATURES:

New Data Source: aws_connect_user (#26156)
New Data Source: aws_connect_vocabulary (#26158)
New Data Source: aws_organizations_policy (#30920)
New Data Source: aws_redshiftserverless_namespace (#31250)
New Resource: aws_quicksight_template (#30453)
New Resource: aws_quicksight_template_alias (#31310)
New Resource: aws_quicksight_vpc_connection (#31309)

ENHANCEMENTS:

aws_quicksight_data_set: Add support for configuring refresh properties (#30744)
data-source/aws_acmpca_certificate_authority: Add key_storage_security_standard attribute (#31280)
data-source/aws_elastic_beanstalk_hosted_zone: Add hosted zone ID for ap-southeast-3 AWS Region (#31248)
data-source/aws_s3_bucket: Set hosted_zone_id for cn-north-1 AWS China Region (#31247)
resource/aws_acmpca_certificate_authority: Add key_storage_security_standard argument (#31280)
resource/aws_cloudwatch_metric_stream: Add metric_names to include_filter and exclude_filter configuration blocks (#31288)
resource/aws_dms_endpoint: Add ability to use the db2-zos IBM DB2 for z/OS engine (#31291)
resource/aws_fsx_ontap_file_system: Allow in-place update of route_table_ids (#31251)
resource/aws_fsx_ontap_file_system: Support setting throughput_capacity to 4096 (#31251)
resource/aws_rds_cluster: Add ability to specify Aurora IO Optimized storage_type (#31336)
resource/aws_s3_bucket: Set hosted_zone_id for cn-north-1 AWS China Region (#31247)

BUG FIXES:

resource/aws_appintegrations_data_integration: Correctly read tags into state (#31241)
resource/aws_config_remediation_configuration: Change parameter attribute to TypeList for better diff calculation (#31315)
resource/aws_iam_openid_connect_provider: Change client_id_list from TypeList to TypeSet as order is not significant (#31253)
resource/aws_servicecatalog_provisioned_product: Fix to properly send stack_set_provisioned_preferences.0.accounts on create and update (#31293)
resource/aws_servicecatalog_provisioned_product: Fix to properly set stack_set_provisioned_preferences integer types failure_tolerance_count, failure_tolerance_percentage, max_concurrency_count, max_concurrency_percentage (#31289)
resource/aws_ssm_activation: Fix various ValidationException errors on resource Create (#31340)

`v4.66.1`

Compare Source

BUG FIXES:

resource/aws_appautoscaling_target: Fix InvalidParameter: 1 validation error(s) found. minimum field size of 1, ListTagsForResourceInput.ResourceARN. related to Application Auto Scaling resource tagging introduced in v4.66.0 (#31214)

`v4.66.0`

Compare Source

NOTES:

resource/aws_instance: The cpu_core_count argument is deprecated in favor of the cpu_options block. The cpu_options block can set core_count (#31035)
resource/aws_instance: The cpu_threads_per_core argument is deprecated in favor of the cpu_options block. The cpu_options block can set threads_per_core (#31035)

FEATURES:

New Data Source: aws_appintegrations_event_integration (#24965)
New Data Source: aws_dms_replication_instance (#15406)
New Data Source: aws_vpclattice_auth_policy (#30898)
New Data Source: aws_vpclattice_service_network (#30904)
New Resource: aws_account_primary_contact (#26123)
New Resource: aws_appintegrations_data_integration (#24941)
New Resource: aws_chimesdkvoice_voice_profile_domain (#30977)
New Resource: aws_directory_service_trust (#31037)
New Resource: aws_vpclattice_access_log_subscription (#30896)
New Resource: aws_vpclattice_auth_policy (#30891)
New Resource: aws_vpclattice_resource_policy (#30900)
New Resource: aws_vpclattice_target_group_attachment (#31039)

ENHANCEMENTS:

data-source/aws_autoscaling_group: Add max_instance_lifetime attribute (#31067)
data-source/aws_autoscaling_group: Add mixed_instances_policy attribute (#31067)
data-source/aws_autoscaling_group: Add predicted_capacity attribute (#31067)
data-source/aws_autoscaling_group: Add suspended_processes attribute (#31067)
data-source/aws_autoscaling_group: Add tag attribute (#31067)
data-source/aws_autoscaling_group: Add warm_pool_size attribute (#31067)
data-source/aws_autoscaling_group: Add warm_pool attribute (#31067)
datasource/aws_launch_template: Add amd_sev_snp attribute (#31035)
resource/aws_appautoscaling_policy: Add metrics to the target_tracking_scaling_policy_configuration.customized_metric_specification configuration block in support of metric math (#30172)
resource/aws_appautoscaling_target: Add arn attribute (#30172)
resource/aws_appautoscaling_target: Add tags argument and tags_all attribute to support resource tagging (#30172)
resource/aws_autoscaling_group: Add predicted_capacity attribute (#31067)
resource/aws_autoscaling_group: Add warm_pool_size attribute (#31067)
resource/aws_directory_service_conditional_forwarder: Add plan time validation for remote_domain_name (#31037)
resource/aws_directory_service_directory: Correct plan time validation for remote_domain_name (#31037)
resource/aws_elasticache_user: Add support for defining custom timeouts (#31076)
resource/aws_fsx_lustre_file_system: Add root_squash_configuration argument (#31073)
resource/aws_glue_catalog_database: Add tagging support (#31071)
resource/aws_grafana_workspace: Make grafana_version optional so that its value can be specified in configuration (#31083)
resource/aws_instance: Add amd_sev_snp argument (#31035)
resource/aws_instance: Add cpu_options argument (#31035)
resource/aws_lambda_function: Add support for java17 runtime value (#31027)
resource/aws_lambda_layer_version: Add support for java17 compatible_runtimes value (#31028)
resource/aws_launch_template: Add amd_sev_snp argument (#31035)
resource/aws_medialive_channel: Added H265 support. (#30908)
resource/aws_rds_cluster_role_association: Add configurable Create and Delete timeouts (#31015)
resource/aws_redshift_scheduled_action: Add plan time validation for name argument (#31020)
resource/aws_redshiftserverless_workgroup: Add support for defining custom timeouts (#31054)
resource/aws_sagemaker_domain: Add domain_settings.r_studio_server_pro_domain_settings, default_user_settings.canvas_app_settings.model_register_settings, and default_user_settings.r_studio_server_pro_app_settings arguments (#31031)
resource/aws_sagemaker_endpoint_configuration: Add async_inference_config.output_config.notification_config.include_inference_response_in and async_inference_config.output_config.s3_failure_path arguments (#31070)
resource/aws_sagemaker_user_profile: Add user_settings.canvas_app_settings.model_register_settings and user_settings.r_studio_server_pro_app_settings arguments (#31072)
resource/aws_servicecatalog_provisioning_artifact: Add provisioning_artifact_id attribute (#31086)
resource/aws_sfn_state_machine: Add configurable timeouts (#31097)
resource/aws_spot_fleet_request: Add 'aws_spot_fleet_request.context' argument (#30918)
resource/aws_vpn_connection: Add tunnel1_enable_tunnel_lifecycle_control and tunnel2_enable_tunnel_lifecycle_control arguments (#31064)

BUG FIXES:

data-source/aws_nat_gateway: Guarantee that all attributes are set when the NAT Gateway is associated with a single address (#31118)
data-source/aws_networkfirewall_firewall_policy: Add firewall_policy.stateful_rule_group_reference.override attribute, fixing setting firewall_policy: Invalid address to set error (#31089)
resource/aws_connect_routing_profile: Remove the limit on the maximum number of queues that can be associated with a routing profile. Batch processing is now done when there are more than 10 queues associated or disassociated at a time. (#30895)
resource/aws_db_instance: Consider delete-precheck a valid pending state for resource deletion (#31047)
resource/aws_inspector2_enabler: Correctly supports LAMBDA resource scanning (#31038)
resource/aws_inspector2_enabler: Correctly supports multiple accounts (#31038)
resource/aws_inspector2_enabler: No longer calls Disable API for status checking (#31038)
resource/aws_nat_gateway: Guarantee that all attributes are set when the NAT Gateway is associated with a single address (#31118)
resource/aws_rds_cluster_instance: Consider delete-precheck a valid pending state for resource deletion (#31047)
resource/aws_servicecatalog_provisioned_product: Changes in the provisioning_artifact_name attribute are now reflected correctly in AWS (#26371)
resource/aws_servicecatalog_provisioned_product: Fix product_name update handling (#31094)

`v4.65.0`

Compare Source

NOTES:

data-source/aws_db_instance: With the retirement of EC2-Classic thedb_security_groups attribute has been deprecated and will be removed in a future version (#30919)
data-source/aws_elasticache_cluster: With the retirement of EC2-Classic thesecurity_group_names attribute has been deprecated and will be removed in a future version (#30919)
data-source/aws_launch_configuration: With the retirement of EC2-Classic thevpc_classic_link_id and vpc_classic_link_security_groups attributes have been deprecated and will be removed in a future version (#30919)
data-source/aws_redshift_cluster: With the retirement of EC2-Classic the cluster_security_groups attribute has been deprecated and will be removed in a future version (#30919)
resource/aws_config_organization_custom_policy_rule: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#21373)

FEATURES:

New Data Source: aws_api_gateway_authorizer (#28148)
New Data Source: aws_api_gateway_authorizers (#28148)
New Data Source: aws_dms_replication_subnet_group (#30832)
New Data Source: aws_dms_replication_task (#30967)
New Data Source: aws_ssmcontacts_contact (#30667)
New Data Source: aws_ssmcontacts_contact_channel (#30667)
New Data Source: aws_ssmcontacts_plan (#30667)
New Data Source: aws_ssmincidents_response_plan (#30665)
New Resource: aws_config_organization_custom_policy_rule (#21373)
New Resource: aws_quicksight_folder_membership (#30871)
New Resource: aws_quicksight_refresh_schedule (#30788)
New Resource: aws_ssmcontacts_contact (#30667)
New Resource: aws_ssmcontacts_contact_channel (#30667)
New Resource: aws_ssmcontacts_plan (#30667)
New Resource: aws_ssmincidents_response_plan (#30665)
New Resource: aws_synthetics_group (#30678)
New Resource: aws_synthetics_group_association (#30678)

ENHANCEMENTS:

data-source/aws_ami_ids: Add include_deprecated argument (#30294)
data-source/aws_backup_report_plan: Add accounts, organization_units and regions attributes to the report_setting block (#28309)
data-source/aws_imagebuilder_image: Add containers attribute to the output_resources block (#30899)
resource/aws_appstream_stack: Add streaming_experience_settings attribute (#28512)
resource/aws_backup_report_plan: Add accounts, organization_units and regions attributes to the report_setting block (#28309)
resource/aws_chime_voice_connector_streaming: Add media_insights_configuration argument (#30713)
resource/aws_db_subnet_group: Add vpc_id attribute (#30775)
resource/aws_fis_experiment_template: Add support for Cluster Network Actions to actions.*.target (#27337)
resource/aws_gamelift_game_session_queue: Add custom_event_data argument (#26206)
resource/aws_imagebuilder_image: Add containers attribute to the output_resources block (#30899)
resource/aws_networkfirewall_rule_group: Add limit for reference_sets (#30759)
resource/aws_networkmanager_core_network: Wait for the network policy to be in the READY_TO_EXECUTE state before executing any changes (#30879)
resource/aws_s3outposts_endpoint: Add access_type and customer_owned_ipv4_pool arguments (#23839)
resource/aws_wafv2_web_acl: Add token_domains argument (#30340)
various IAM resource types: more detailed error messages for invalid policy document JSON (#27502)

BUG FIXES:

resource/aws_api_gateway_api_key: Fix value minimum length verification when specified. (#30894)
resource/aws_apprunner_service: Allow additional instance_configuration.cpu and instance_configuration.memory values (#30889)
resource/aws_dms_replication_task: Fix perpetual diff on dms replication_task settings (#30885)
resource/aws_ds_shared_directory: Properly handle paged response objects on read (#30914)
resource/aws_ecs_service: Fix removal of service_registries configuration block (#30852)
resource/aws_redshiftdata_statement: Fix ValidationException errors reading expired statements (#26343)
resource/aws_vpc_endpoint_route_table_association: Retry resource Create for EC2 eventual consistency (#30994)
resource/aws_vpc_endpoint_service_allowed_principal: Fix too many results error (#30974)

`v4.64.0`

Compare Source

FEATURES:

New Data Source: aws_dms_endpoint (#30717)
New Data Source: aws_fsx_windows_file_system (#28622)
New Data Source: aws_networkfirewall_resource_policy (#25474)
New Data Source: aws_prometheus_workspaces (#28574)
New Data Source: aws_redshiftserverless_workgroup (#29208)
New Data Source: aws_route53_resolver_query_log_config (#29111)
New Data Source: aws_sesv2_configuration_set (#30108)
New Data Source: aws_vpclattice_listener (#30843)
New Resource: aws_cloudwatch_event_endpoint (#25846)
New Resource: aws_vpclattice_listener (#30711)
New Resource: aws_vpclattice_listener_rule (#30784)

ENHANCEMENTS:

data-source/aws_cloudfront_response_headers_policy: Add remove_headers_config attribute (#28940)
data-source/aws_ecs_task_definition: Add execution_role_arn attribute (#28662)
data-source/aws_eks_node_group: Add launch_template attribute (#30780)
data-source/aws_iam_role: Add role_last_used attribute (#30750)
data-source/aws_kms_key: Add cloud_hsm_cluster_id, custom_key_store_id, key_spec, pending_deletion_window_in_days, and xks_key_configuration attributes (#29250)
data-source/aws_lakeformation_data_lake_settings: Add allow_external_data_filtering, external_data_filtering_allow_list and authorized_session_tag_value_list attributes (#30207)
data-source/aws_outposts_outpost: Add lifecycle_status, site_arn, supported_hardware_type and tags attributes (#30754)
data-source/aws_servicequotas_service_quota: Add usage_metric attribute (#29499)
data-source/aws_subnet: Add enable_lni_at_device_index attribute (#30798)
resource/aws_appsync_datasource: Add opensearchservice_config argument (#29578)
resource/aws_cloudfront_response_headers_policy: Add remove_headers_config argument (#28940)
resource/aws_cloudwatch_event_target: Add ecs_target.ordered_placement_strategy argument (#28384)
resource/aws_cloudwatch_metric_stream: Add include_linked_accounts_metrics argument (#29281)
resource/aws_dms_replication_instance: Increase default timeout for create (#29905)
resource/aws_eks_node_group: Add plan time validation to node_group_name and node_group_name_prefix arguments (#29975)
resource/aws_elastic_beanstalk_application: Add plan time validation to appversion_lifecycle.service_role and name arguments (#17727)
resource/aws_emr_cluster: Add placement_group_config argument (#30121)
resource/aws_fis_experiment_template: Add support for Subnets Network Actions to actions.*.target (#30211)
resource/aws_iam_role: Add role_last_used attribute (#30750)
resource/aws_iot_topic_rule: Add error_action.firehose.batch_mode, error_action.iot_analytics.batch_mode, error_action.iot_events.batch_mode, firehose.batch_mode, iot_analytics.batch_mode and iot_events.batch_mode arguments (#28568)
resource/aws_kinesis_firehose_delivery_stream: Add opensearch_configuration block (#29112)
resource/aws_kinesis_firehose_delivery_stream: Add opensearch as a valid destination value (#29112)
resource/aws_lakeformation_data_lake_settings: Add allow_external_data_filtering, external_data_filtering_allow_list and authorized_session_tag_value_list arguments (#30207)
resource/aws_lambda_event_source_mapping: Add document_db_event_source_config configuration block (#28586)
resource/aws_lambda_function: Add support for python3.10 runtime value (#30781)
resource/aws_lambda_layer_version: Add support for python3.10 compatible_runtimes value (#30781)
resource/aws_main_route_table_association: Add configurable timeouts (#30755)
resource/aws_route: Allow gateway_id value of local when updating a Route (#24507)
resource/aws_route_table_association: Add configurable timeouts (#30755)
resource/aws_s3_bucket: Correct S3 Object Lock error handling for third-party S3-compatible API implementations (#26317)
resource/aws_s3_bucket_object_lock_configuration: Correct error handling for third-party S3-compatible API implementations (#26317)
resource/aws_securityhub_account: Add control_finding_generator, auto_enable_controls and arn attributes (#30692)
resource/aws_servicequotas_service_quota: Add usage_metric attribute (#29499)
resource/aws_ssoadmin_account_assignment: Extend timeout delay and min timeout (#25849)
resource/aws_ssoadmin_permission_set: Extend timeout delay and min timeout (#25849)
resource/aws_subnet: Add enable_lni_at_device_index attribute (#30798)
resource/aws_vpc_endpoint_service_allowed_principal: Changed id to use ServicePermissionId (#27640)
resource/aws_wafv2_rule_group: Add rule.action.challenge argument (#29690)
resource/aws_wafv2_rule_group: Add rule.captcha_config argument (#29608)
resource/aws_wafv2_web_acl: Add captcha_config and rule.captcha_config arguments (#29608)

BUG FIXES:

data-source/aws_lakeformation_permissions: Change lf_tag_policy.expression from TypeList to TypeSet as order is not significant (#26643)
data-source/aws_lakeformation_permissions: Remove limit on number of lf_tag_policy.expression blocks (#26643)
resource/aws_cloudwatch_event_rule: Add retry to read step, resolving couldn't find resource error (#25846)
resource/aws_default_vpc: Fix adoption of default VPC with generated IPv6 (#29083)
resource/aws_dx_gateway: Remove plan time validation from name argument (#30739)
resource/aws_ecs_service: Fix error importing service with an IAM role with a path (#30170)
resource/aws_fsx_windows_file_system: Increase throughput_capacity first to avoid BadRequest errors (#28622)
resource/aws_lakeformation_permissions: Change lf_tag_policy.expression from TypeList to TypeSet as order is not significant (#26643)
resource/aws_lakeformation_permissions: Change lf_tag, lf_tag.values, lf_tag_policy, lf_tag_policy.expression.key, lf_tag_policy.expression.values and lf_tag_policy.resource_type to ForceNew (#26643)
resource/aws_lakeformation_permissions: Remove limit on number of lf_tag_policy.expression blocks (#26643)
resource/aws_lambda_event_source_mapping: Fix IAM eventual consistency errors on resource Update (#28586)
resource/aws_medialive_channel: Fix to properly expand destinations.media_package_settings field (#30660)
resource/aws_networkfirewall_firewall_policy: Fix unexpected encryption_configuration.type updates from Customer_KMS to AWS_KMS (#30821)
resource/aws_networkfirewall_rule_group: Fix unexpected encryption_configuration.type updates from Customer_KMS to AWS_KMS (#30821)
resource/aws_quicksight_data_set: Correct custom_sql documentation (#30742)
resource/aws_quicksight_data_set: Correctly persist create_columns_operation.expression field (#30708)
resource/aws_quicksight_data_set: Fix to properly expand project_operation.projected_columns field (#30699)
resource/aws_quicksight_data_set: Fix to properly flatten cast_column_type_operation.format field (#30701)
resource/aws_sagemaker_app: Fix crash when app is not found (#30786)
resource/aws_sns_topic: Fix IAM eventual consistency error creating SNS topics with ABAC-controlled permissions (#30432)
resource/aws_vpc: Don't overwrite any configured value for ipv6_ipam_pool_id with IPAM Managed (#30795)

`v4.63.0`

Compare Source

FEATURES:

New Data Source: aws_dms_certificate (#30498)
New Data Source: aws_quicksight_group (#12311)
New Data Source: aws_quicksight_user (#12310)
New Resource: aws_chimesdkmediapipelines_media_insights_pipeline_configuration (#30603)
New Resource: aws_pipes_pipe (#30538)
New Resource: aws_quicksight_iam_policy_assignment (#30653)
New Resource: aws_quicksight_ingestion (#30487)
New Resource: aws_quicksight_namespace (#30681)
New Resource: aws_sagemaker_data_quality_job_definition (#30301)
New Resource: aws_sagemaker_monitoring_schedule (#30684)
New Resource: aws_vpclattice_service_network_service_association (#30410)
New Resource: aws_vpclattice_service_network_vpc_association (#30411)
New Resource: aws_vpclattice_target_group (#30455)

ENHANCEMENTS:

data-source/aws_dx_connection: Add partner_name attribute (#30385)
data-source/aws_lambda_function_url: Add invoke_mode attribute (#30547)
data-source/aws_nat_gateway: Add association_id attribute (#30546)
data-source/aws_sagemaker_prebuilt_ecr_image: Added sagemaker-model-monitor-analyzer images (#30301)
resource/aws_acmpca_certificate: Add api_passthrough argument (#28142)
resource/aws_api_gateway_rest_api: Added fail_on_warnings attribute (#22300)
resource/aws_dx_connection: Add partner_name attribute (#30385)
resource/aws_dx_gateway: Add plan time validation to name argument (#30375)
resource/aws_dx_gateway: Allow updates to name without forcing resource replacement (#30375)
resource/aws_ec2_client_vpn_route: Increase Create and Delete timeouts to 4 minutes (#30552)
resource/aws_lambda_function_url: Add invoke_mode attribute (#30547)
resource/aws_mwaa_environment: Add startup_script_s3_path and startup_script_s3_object_version attributes (#30549)
resource/aws_nat_gateway: Add association_id attribute (#30546)
resource/aws_servicecatalog_provisioned_product: Surfaces more clear error message when resource fails to apply (#30663)
resource/aws_wafv2_web_acl: Add aws_managed_rules_atp_rule_set to managed_rule_group_configs configuration block (#30518)

BUG FIXES:

resource/aws_batch_compute_environment: Fix crash when compute_resources.launch_template is empty (#30537)
resource/aws_cognito_managed_user_pool_client: Allow removing token_validity_units (#30662)
resource/aws_cognito_user_pool_client: Allow removing token_validity_units (#30662)
resource/aws_db_instance: Allow engine and engine_version to be set when replicate_source_db is set (#30703)
resource/aws_db_instance: Fixes panic when updating replica_mode (#30714)
resource/aws_dynamodb_table_item: Would report spurious diffs when List and Map attributes were changed out-of-band (#30712)
resource/aws_elasticache_user_group: Change user_group_id to ForceNew (#30533)
resource/aws_launch_template: Fix crash when instance_market_options.spot_options is empty (#30539)
resource/aws_msk_serverless_cluster: Change vpc_config.security_group_ids to Computed (#30535)
resource/aws_quicksight_data_set: Fix to properly send physical_table_map.*.relational_table.catalog when set (#30704)
resource/aws_quicksight_data_set: Fix to properly send physical_table_map.*.relational_table.schema when set (#30704)
resource/aws_rds_cluster: Prevent db_instance_parameter_group_name from causing errors on minor upgrades (#30679)
resource/aws_rds_cluster_parameter_group: Fixes differences being reported on every apply when setting system-source parameters (#30536)

`v4.62.0`

Compare Source

FEATURES:

New Data Source: aws_ec2_transit_gateway_attachments (#29644)
New Data Source: aws_ec2_transit_gateway_route_table_associations (#29642)
New Data Source: aws_ec2_transit_gateway_route_table_propagations (#29640)
New Data Source: aws_oam_link (#30401)
New Data Source: aws_oam_links (#30401)
New Data Source: aws_quicksight_data_set (#30422)
New Data Source: aws_vpclattice_service (#30490)
New Resource: aws_inspector2_member_association (#28921)
New Resource: aws_lightsail_distribution (#30124)
New Resource: aws_quicksight_account_subscription (#30359)
New Resource: aws_quicksight_data_set (#30349)
New Resource: aws_quicksight_folder (#30400)
New Resource: aws_vpclattice_service (#30429)
New Resource: aws_vpclattice_service_network (#35969)

ENHANCEMENTS:

data-source/aws_route_table: Ignore routes managed by VPC Lattice (#30515)
data-source/aws_secretsmanager_secret: Add rotation_rules.duration and rotation_rules.schedule_expression attributes (#30425)
data-source/aws_secretsmanager_secret_rotation: Add rotation_rules.duration and rotation_rules.schedule_expression attributes (#30425)
resource/aws_default_route_table: Ignore routes managed by VPC Lattice (#30515)
resource/aws_emrserverless_application: Add image_configuration field (#30398)
resource/aws_imagebuilder_container_recipe: Add platform_override field (#30398)
resource/aws_route_table: Ignore routes managed by VPC Lattice (#30515)
resource/aws_s3_bucket: Enable S3-compatible providers with no support for bucket tagging (#30151)
resource/aws_sagemaker_endpoint_configuration: Add name_prefix argument (#28785)
resource/aws_sagemaker_feature_group: Add table_format to the offline_store_config configuration block (#30118)
resource/aws_secretsmanager_secret: Add duration and schedule_expression attributes to rotation_rules configuration block (#30425)
resource/aws_secretsmanager_secret_rotation: Add duration and schedule_expression attributes to rotation_rules configuration block (#30425)

BUG FIXES:

resource/aws_ce_cost_category: Fixed effective_start being reset on any changes despite effective_start having the same value (#30369)
resource/aws_db_instance: Fix crash when updating password (#30379)
resource/aws_glue_crawler: Fix InvalidInputException error string matching (#30370)
resource/aws_glue_trigger: Fix InvalidInputException error string matching (#30370)
resource/aws_medialive_channel: Fix attribute certificate_mode spelling in rtmp_output_settings (#30224)
resource/aws_rds_cluster: Fix crash when updating master_password (#30379)
resource/aws_rds_cluster: Fix inconsistent final plan errors when engine_version updates are not applied immediately (#30247)
resource/aws_rds_cluster: Send db_instance_parameter_group_name on all modify requests when set (#30247)
resource/aws_rds_cluster_instance: Fix inconsistent final plan errors when engine_version updates are not applied immediately (#30247)
resource/aws_rds_instance: Fix inconsistent final plan errors when engine_version updates are not applied immediately (#30247)
resource/aws_s3_bucket_lifecycle_configuration: Allow rule.filter.object_size_greater_than = 0 (#29857)
resource/aws_scheduler_schedule: Mark arn property of dead_letter_config as a required property (#30360)

`v4.61.0`

Compare Source

FEATURES:

New Data Source: aws_appmesh_gateway_route (#29064)
New Data Source: aws_appmesh_virtual_node (#27545)
New Data Source: aws_appmesh_virtual_router (#26908)
New Data Source: aws_globalaccelerator_custom_routing_accelerator (#28922)
New Data Source: aws_oam_sink (#30258)
New Data Source: aws_oam_sinks (#30258)
New Data Source: aws_ssmincidents_replication_set (#29769)
New Resource: aws_globalaccelerator_custom_routing_accelerator (#28922)
New Resource: aws_globalaccelerator_custom_routing_endpoint_group (#28922)
New Resource: aws_globalaccelerator_custom_routing_listener (#28922)
New Resource: aws_rbin_rule (#25926)
New Resource: aws_sns_topic_data_protection_policy (#30008)
New Resource: aws_ssmincidents_replication_set (#29769)

ENHANCEMENTS:

data-source/aws_db_instance: Add master_user_secret attribute (#28848)
data-source/aws_globalaccelerator_accelerator: Add dual_stack_dns_name attribute (#28922)
data-source/aws_rds_cluster: Add master_user_secret attribute (#28848)
resource/aws_appmesh_gateway_route: Add header, path and query_parameter to the spec.http_route.match and spec.http2_route.match configuration blocks (#29064)
resource/aws_appmesh_gateway_route: Add port to the spec.grpc_route.action.target, spec.http_route.action.target and spec.http2_route.action.target configuration blocks to support Virtual Services with multiple listeners (#29064)
resource/aws_appmesh_gateway_route: Add priority to the spec configuration block (#29064)
resource/aws_appmesh_route: Add path and query_parameter to the spec.http_route.match and spec.http2_route.match configuration blocks (#29064)
resource/aws_appmesh_route: spec.http_route.match.prefix and spec.http2_route.match.prefix are Optional (#29064)
resource/aws_appmesh_virtual_node: Add ip_preference and response_type to the spec.service_discovery.dns configuration block (#29064)
resource/aws_db_instance: Add manage_master_user_password, master_user_secret and master_user_secret_kms_key_id arguments to support RDS managed master password in Secrets Manager (#28848)
resource/aws_globalaccelerator_accelerator: Add dual_stack_dns_name attribute (#28922)
resource/aws_lakeformation_lf_tag: Increase values MaxItem up to 1000 to match with AWS real limit (#26546)
resource/aws_rds_cluster: Add manage_master_user_password, master_user_secret and master_user_secret_kms_key_id arguments to support RDS managed master password in Secrets Manager (#28848)
resource/aws_sagemaker_endpoint_configuration: Add production_variants.enable_ssm_access and shadow_production_variants.enable_ssm_access arguments (#30267)

BUG FIXES:

datasource/aws_ecs_task_execution: Fix type assertion panic on overrides.0.container_overrides.*.environment attribute (#30214)
datasource/aws_ecs_task_execution: Fix type assertion panic on overrides.0.container_overrides.*.resource_requirements attribute (#30214)
datasource/aws_ecs_task_execution: Fix type assertion panic on overrides.0.inference_accelerator_overrides attribute (#30214)
resource/aws_appmesh_virtual_router: spec.listener is Optional (#29064)
resource/aws_fsx_openzfs_file_system: Fix iops validation in disk_iops_configuration to allow values for SINGLE_AZ_1 and SINGLE_AZ_2 (#30299)
resource/aws_lakeformation_lf_tag: Fix support for lf-tag keys with colons in the name (#28258)
resource/aws_launch_template: Allow metadata_options to be applied when http_endpoint is not configured (#30107)
resource/aws_ssm_activation: Fix IAM eventual consistency errors on resource Create (#30280)
resource/aws_ssm_document: Correctly set default_version, document_version, hash, latest_version and parameter as Computed when content changes (#28489)
resource/aws_wafv2_ip_set: Fix DiffSuppress on addresses to detect changes for unknown values (#30352)

`v4.60.0`

Compare Source

FEATURES:

New Data Source: aws_appmesh_route (#26695)
New Data Source: aws_appmesh_virtual_gateway (#27057)
New Resource: aws_cognito_managed_user_pool_client (#30140)
New Resource: aws_oam_link (#30125)
New Resource: aws_sesv2_contact_list (#30094)

ENHANCEMENTS:

data-source/aws_ecs_cluster: Add tags attribute (#30073)
resource/aws_appmesh_virtual_gateway: Add logging.access_log.file.format configuration block (#29315)
resource/aws_appmesh_virtual_node: Add logging.access_log.file.format configuration block (#29315)
resource/aws_rds_cluster: Conflict snapshot_identifier and global_cluster_identifier attributes, preventing misleading results on restore (#30158)
resource/aws_securityhub_account: Add enable_default_standards argument (#13477)
resource/aws_securityhub_member: email is Optional (#19065)

BUG FIXES:

data-source/aws_appmesh_mesh: Don't attempt to list tags if the current AWS account is not the mesh owner (#26695)
data-source/aws_appmesh_virtual_service: Don't attempt to list tags if the current AWS account is not the mesh owner (#26695)
resource/aws_apigateway_domain_name: Add ability to update mutual_tls_authentication.truststore_uri in place (#30081)
resource/aws_apigatewayv2_domain_name: Add ability to update mutual_tls_authentication.truststore_uri in place (#30081)
resource/aws_appmesh_gateway_route: Use configured mesh_owner when deleting shared gateway route (#29362)
resource/aws_appmesh_route: Use configured mesh_owner value when deleting shared route (#29362)
resource/aws_appmesh_virtual_gateway: Use configured mesh_owner value when deleting shared virtual gateway (#29362)
resource/aws_appmesh_virtual_node: Use configured mesh_owner value when deleting shared virtual node (#29362)
resource/aws_appmesh_virtual_router: Use configured mesh_owner value when deleting shared virtual router (#29362)
resource/aws_appmesh_virtual_service: Use configured mesh_owner value when deleting shared virtual service (#29362)
resource/aws_cognito_risk_configuration: Adds validation to risk_exception_configuration and requires at least one of account_takeover_risk_configuration, compromised_credentials_risk_configuration, or risk_exception_configuration. (#30074)
resource/aws_medialive_channel: Change TypeSet to TypeList on video_description, to get more precise actions from plan output (#30064)
resource/aws_medialive_channel: Fix type casting for h264_settings in video_descriptions (#30063)
resource/aws_medialive_channel: Fix type casting of program_num, segmentation_time and fragment_time for m2ts_settings (#30025)
resource/aws_opsworks_application: Don't return an error like deleting OpsWorks Application (...): %!s() after successful Delete (#30101)
resource/aws_pinpoint_app: Don't return an error like deleting Pinpoint Application (...): %!s() after successful Delete (#30101)
resource/aws_placement_group: Change spread_level to Computed (#28596)
resource/aws_security_group: Improve respect for delete timeout set by user and retry of certain errors (#30114)
resource/aws_transfer_server: Fix error refreshing protocol_details.as2_transports value (#30115)

`v4.59.0`

Compare Source

NOTES:

resource/aws_connect_queue: The quick_connect_ids_associated attribute is being deprecated in favor of quick_connect_ids (#26151)
resource/aws_connect_routing_profile: The queue_configs_associated attribute is being deprecated in favor of queue_configs (#26151)

FEATURES:

New Data Source: aws_ec2_public_ipv4_pool (#28245)
New Data Source: aws_ec2_public_ipv4_pools (#28245)
New Data Source: aws_servicecatalog_provisioning_artifacts (#25535)
New Resource: aws_codegurureviewer_repository_association (#29656)
New Resource: aws_emr_block_public_access_configuration (#29968)
New Resource: aws_kms_key_policy (#29923)
New Resource: aws_oam_sink (#29670)
New Resource: aws_oam_sink_policy (#30020)

ENHANCEMENTS:

aws_cognito_user_pool_domain: Add ability to update certificate_arn in place (#25275)
data-source/aws_aws_lb: Add enable_xff_client_port, xff_header_processing_mode and enable_tls_version_and_cipher_suite_headers attributes (#29792)
data-source/aws_ce_cost_category: Add default_value attribute (#29291)
data-source/aws_dynamodb_table: Add deletion_protection_enabled attribute (#29924)
data-source/aws_opensearch_domain: Add dashboard_endpoint attribute (#29867)
resource/aws_amplify_domain_association: Add enable_auto_sub_domain argument (#29814)
resource/aws_appflow_flow: Add attribute preserve_source_data_typing to s3_output_format_config in s3 (#27616)
resource/aws_appsync_datasource: Add event_bridge_config argument to support AppSync EventBridge data sources (#30042)
resource/aws_aws_lb: Add enable_xff_client_port, xff_header_processing_mode and enable_tls_version_and_cipher_suite_headers arguments (#29792)
resource/aws_batch_compute_environment: Allow a maximum of 2 compute_resources.ec2_configurations (#27207)
resource/aws_cloudwatch_metric_alarm: Add period parameter to metric_query (#29896)
resource/aws_cloudwatch_metric_alarm: Add validation to period parameter of metric_query.metric (#29896)
resource/aws_cognito_user_pool_domain: Add cloudfront_distribution and cloudfront_distribution_zone_id attributes (#27790)
resource/aws_dynamodb_table: Add deletion_protection_enabled argument (#29924)
resource/aws_ecs_task_definition: Add arn_without_revision attribute (#27351)
resource/aws_elasticache_user: Add authentication_mode argument (#28928)
resource/aws_fms_policy: Add description argument (#29926)
resource/aws_fsx_openzfs_file_system: Add support for SINGLE_AZ_2 deployment_type (#28583)
resource/aws_glue_crawler: Add create_native_delta_table attribute to the delta_target configuration block (#29566)
resource/aws_inspector2_organization_configuration: Add lambda attribute to auto_enable configuration block (#28961)
resource/aws_instance: Add ability to update private_dns_name_options in place (#26305)
resource/aws_lb_target_group: Add load_balancing_cross_zone_enabled argument (#29920)
resource/aws_opensearch_domain: Add dashboard_endpoint attribute (#29867)
resource/aws_qldb_ledger: Add configurable timeouts (#29635)
resource/aws_s3_bucket: Add error handling for XNotImplemented errors when reading acceleration_status, request_payer, lifecycle_rule, logging, or replication_configuration into terraform state. (#29632)
resource/aws_securityhub_organization_configuration: Add auto_enable_standards attribute (#29773)
resource/aws_wafv2_web_acl_association: Add configurable timeout for Create (#30002)

BUG FIXES:

data-source/aws_opensearch_domain: Add missing advanced_security_options.anonymous_auth_enabled attribute (#26746)
resource/aws_api_gateway_integration: Fix bug that cleared unchanged cache_key_parameters values on Update (#29991)
resource/aws_apigatewayv2_integration: Retry errors like ConflictException: Unable to complete operation due to concurrent modification. Please try again later. (#29735)
resource/aws_budgets_action: Extend and add configurable timeouts for create and update (#29976)
resource/aws_cognito_user_pool: Remove Computed from lambda_config.custom_email_sender and lambda_config.custom_sms_sender allowing their values to be removed (#29047)
resource/aws_cognito_user_pool: account_recovery_setting.recovery_mechanism is Optional+Computed (#22302)
resource/aws_ecr_repository: Fix unhandled errors and nil output on read (#30067)
resource/aws_elasticache_user: Change user_id to ForceNew (#28928)
resource/aws_elasticsearch_domain: Remove upper bound validation for ebs_options.throughput as the 1,000 MB/s limit can be raised (#27598)
resource/aws_lambda_function: Fix empty environment variable update (#29839)
resource/aws_lightsail_domain_entry: Allow for the domain entry to begin with an underscore. (#30056)
resource/aws_lightsail_domain_entry: Moved the error handling of an improperly formatted ID to be before attempting to access the id_parts. This will cause a proper empty resource message instead of a panic when ID is not properly formed. (#30056)
resource/aws_lightsail_instance: Added a check to ensure that the availability_zone value is within the current region of the provider. (#30056)
resource/aws_lightsail_instance: Fix name validation to allow instances to start with a numeric character (#29903)
resource/aws_medialive_channel: Fix setting of bitrate and sample_rate for aac_settings. (#29807)
resource/aws_medialive_channel: Fix setting of bitrate for eac3_settings. (#29809)
resource/aws_medialive_channel: Fix spelling for attribute audio_only_timecode_control and correct type for event_id in ms_smooth_group_settings (#29917)
resource/aws_medialive_channel: Removed Compute flag from audio_normalization_settings and remix_settings in audio_descriptions (#29859)
resource/aws_medialive_channel: Removed Computed flag from aac_settings, ´ac3_settings, eac3_atmos_settings, eac3_settings, mp2_settings, pass_through_settingsandwav_settingsincodec_settings`. (#29825)
resource/aws_neptune_cluster: Change lower bound validation for serverless_v2_scaling_configuration.min_capacity to 1 Neptune Capacity Unit (NCU) (#29999)
resource/aws_network_acl_association: Add retry to read step, resolving empty result error (#26838)
resource/aws_opensearch_domain: Remove upper bound validation for ebs_options.throughput as the 1,000 MB/s limit can be raised (#27598)
resource/aws_route: Allow destination_ipv6_cidr_block to be specified for a vpc_endpoint_id target (#29994)
resource/aws_sagemaker_endpoint_configuration: Fix variant_name generation when unset (#29915)

`v4.58.0`

Compare Source

FEATURES:

New Data Source: aws_ecs_task_execution (#29783)
New Data Source: aws_licensemanager_grants (#29741)
New Data Source: aws_licensemanager_received_license (#29741)
New Data Source: aws_licensemanager_received_licenses (#29741)
New Resource: aws_licensemanager_grant (#29741)
New Resource: aws_licensemanager_grant_accepter (#29741)

ENHANCEMENTS:

data-source/aws_ec2_transit_gateway_attachment: Add association_state and association_transit_gateway_route_table_id attributes (#29648)
data-source/aws_instances: Add ipv6_addresses attribute (#29794)
resource/aws_acm_certificate: Change options to Computed (#29763)
resource/aws_amplify_domain_association: Add enable_auto_sub_domain argument (#92814)
resource/aws_cloudhsm_v2_hsm: Enforce ExactlyOneOf for availability_zone and subnet_id arguments (#20891)
resource/aws_db_instance: Add listener_endpoint attribute (#28434)
resource/aws_db_instance: Add plan time validations for backup_retention_period, monitoring_interval, and monitoring_role_arn (#28434)
resource/aws_flow_log: Add deliver_cross_account_role argument (#29254)
resource/aws_grafana_workspace: Add network_access_control argument (#29793)
resource/aws_sesv2_configuration_set: Add vdm_options argument (#28812)
resource/aws_transfer_server: Add protocol_details argument (#28621)
resource/aws_transfer_workflow: Add decrypt_step_details to the on_exception_steps and steps configuration blocks (#29692)
resource/db_snapshot: Add shared_accounts argument (#28424)

BUG FIXES:

resource/aws_acm_certificate: Update options.certificate_transparency_logging_preference in place rather than replacing the resource (#29763)
resource/aws_batch_job_definition: Prevents perpetual diff when container properties environment variable has empty value. (#29820)
resource/aws_elastic_beanstalk_configuration_template: Map errors like InvalidParameterValue: No Platform named '...' found. to resource.NotFoundError so terraform refesh correctly removes the resource from state (#29863)
resource/aws_flow_log: Fix IAM eventual consistency errors on resource Create (#29254)
resource/aws_grafana_workspace: Allow removing vpc_configuration (#29793)
resource/aws_medialive_channel: Fix setting of the include_fec attribute in fec_output_settings (#29808)
resource/aws_medialive_channel: Fix setting of the video_pid attribute in m2ts_settings (#29824)

`v4.57.1`

Compare Source

BUG FIXES:

resource/aws_lambda_function: Prevent Provider produced inconsistent final plan errors produced by null skip_destroy attribute value. NOTE: Because the maintainers have been unable to reproduce the reported problem, the fix is best effort and we ask for community support in verifying the fix. (#29812)

`v4.57.0`

Compare Source

NOTES:

resource/aws_dms_endpoint: The s3_settings argument has been deprecated. All configurations using aws_dms_endpoint.*.s3_settings should be updated to use the aws_dms_s3_endpoint resource instead (#29728)
resource/aws_networkmanager_core_network: The base_policy_region argument is being deprecated in favor of the new base_policy_regions argument. (#29623)

FEATURES:

New Resource: aws_lightsail_bucket_resource_access (#29460)

ENHANCEMENTS:

data-source/aws_launch_template: Add instance_requirements.allowed_instance_types and instance_requirements.network_bandwidth_gbps attributes (#29140)
resource/aws_autoscaling_group: Add auto_rollback to the instance_refresh.preferences configuration block (#29513)
resource/aws_autoscaling_group: Add mixed_instances_policy.launch_template.override.instance_requirements.allowed_instance_types and mixed_instances_policy.launch_template.override.instance_requirements.network_bandwidth_gbps arguments (#29140)
resource/aws_autoscaling_policy: Add metrics to the target_tracking_configuration.customized_metric_specification configuration block in support of metric math (#28560)
resource/aws_cloudtrail_event_data_store: Add kms_key_id argument (#29224)
resource/aws_dms_endpoint: Add ability to use AWS Secrets Manager with the db2 engine (#29380)
resource/aws_dms_endpoint: Add support for azure-sql-managed-instance engine_name value (#28960)
resource/aws_dms_s3_endpoint: Add detach_target_on_lob_lookup_failure_parquet argument (#29772)
resource/aws_ec2_fleet: Add fleet_instance_set, fleet_state, fulfilled_capacity, and fulfilled_on_demand_capacity attributes (#29181)
resource/aws_ec2_fleet: Add launch_template_config.override.instance_requirements.allowed_instance_types and launch_template_config.override.instance_requirements.network_bandwidth_gbps arguments (#29140)
resource/aws_ec2_fleet: Add on_demand_options.capacity_reservation_options,on_demand_options.max_total_price, on_demand_options.min_target_capacity, on_demand_options.single_availability_zone and on_demand_options.single_instance_type arguments (#29181)
resource/aws_ec2_fleet: Add spot_options.maintenance_strategies.capacity_rebalance.termination_delay argument (#29181)
resource/aws_ec2_fleet: Add valid_from and valid_until arguments (#29181)
resource/aws_lambda_function: Add skip_destroy argument (#29646)
resource/aws_lambda_function: Add configurable timeout for Delete (#29646)
resource/aws_lambda_function: Add plan time validators for memory_size, role, and timeout (#29721)
resource/aws_lambda_function: Retry (up to the configurable timeout) deletion of replicated Lambda@Edge functions (#29646)
resource/aws_launch_template: Add instance_requirements.allowed_instance_types and instance_requirements.network_bandwidth_gbps arguments (#29140)
resource/aws_networkmanager_core_network: Add base_policy_regions argument (#29623)
resource/aws_spot_fleet_request: Add launch_template_config.overrides.instance_requirements.allowed_instance_types and launch_template_config.overrides.instance_requirements.network_bandwidth_gbps arguments (#29140)
resource/aws_transfer_server: Add support for on_partial_upload block on the workflow_details attribute. (#27730)
resource/aws_transfer_user: Add configurable timeout for Delete (#27563)

BUG FIXES:

resource/aws_dms_endpoint: Trigger updates based on adding new extra_connection_attributes (#29772)
resource/aws_instance: When encountering InsufficientInstanceCapacity errors, do not retry in order to fail faster, as this error is typically not resolvable in the near future (#21293)
resource/aws_transfer_server: Allow the removal of workflow_details attribute. (#27730)
resource/aws_transfer_user: Fix bug preventing removal of all home_directory_mappings due to empty list validation error (#27563)

`v4.56.0`

Compare Source

NOTES:

resource/aws_lambda_function: Updated to AWS SDK V2 (#29615)

FEATURES:

New Data Source: aws_vpc_security_group_rule (#29484)
New Data Source: aws_vpc_security_group_rules (#29484)
New Resource: aws_networkmanager_connect_peer (#29296)
New Resource: aws_vpc_security_group_egress_rule (#29484)
New Resource: aws_vpc_security_group_ingress_rule (#29484)

ENHANCEMENTS:

data-source/aws_ecr_image: Add most_recent argument to return the most recently pushed image (#26857)
data-source/aws_ecr_repository: Add most_recent_image_tags attribute containing the most recently pushed image tag(s) in an ECR repository (#26857)
resource/aws_lb_ssl_negotiation_policy: Add triggers attribute to force resource updates (#29482)
resource/aws_load_balancer_listener_policy: Add triggers attribute to force resource updates (#29482)
resource/aws_organizations_policy: Add skip_destroy attribute (#29382)
resource/aws_organizations_policy_attachment: Add skip_destroy attribute (#29382)
resource/aws_sns_topic: Add signature_version and tracing_config arguments (#29462)

BUG FIXES:

resource/aws_acmpca_certificate_authority: revocation_configuration.crl_configuration.expiration_in_days is Optional (#29613)
resource/aws_default_vpc: Change enable_network_address_usage_metrics to Optional+Computed, matching the aws_vpc resource (#29607)
resource/aws_lambda_function: Fix missing ValidationException message body (#29615)
resource/aws_medialive_channel: Fix setting of m2ts_settings arib_captions_pid and arib_captions_pid_control attributes (#29467)
resource/aws_resourceexplorer2_view: Fix Unexpected Planned Resource State on Destroy errors when using Terraform CLI v1.3 and above (#29550)
resource/aws_servicecatalog_provisioned_product: Fix to allow outputs to be Computed when the resource changes (#29559)
resource/aws_sns_topic_subscription: Fix filter_policy_scope update from MessageAttributes to MessageBody with nested objects in filter_policy (#28572)
resource/aws_wafv2_web_acl: Prevent erroneous diffs and attempts to remove AWS-added rule when applying to CF distribution using AWS Shield to automatically mitigate DDoS (#29575)

`v4.55.0`

Compare Source

FEATURES:

New Data Source: aws_organizations_organizational_unit_child_accounts (#24350)
New Data Source: aws_organizations_organizational_unit_descendant_accounts (#24350)
New Resource: aws_route53_cidr_collection (#29407)
New Resource: aws_route53_cidr_location (#29407)
New Resource: aws_vpc_ipam_resource_discovery (#29216)
New Resource: aws_vpc_ipam_resource_discovery_association (#29216)

ENHANCEMENTS:

data-source/aws_s3_bucket_object: Expand content types that can be read from S3 to include some human-readable application types (e.g., application/xml, application/atom+xml) (#27704)
data-source/aws_s3_object: Expand content types that can be read from S3 to include some human-readable application types (e.g., application/xml, application/atom+xml) (#27704)
resource/aws_autoscaling_policy: Make resource_label optional in predefined_load_metric_specification, predefined_metric_pair_specification, and predefined_scaling_metric_specification (#29277)
resource/aws_cloudwatch_log_group: Allow retention_in_days attribute to accept a three year retention period (1096 days) (#29426)
resource/aws_db_proxy: Add auth.client_password_auth_type attribute (#28432)
resource/aws_firehose_delivery_stream: Add ForceNew to dynamic_partitioning_configuration attribute (#29093)
resource/aws_firehose_delivery_stream: Add configurable timeouts for create, update, and delete (#28469)
resource/aws_neptune_cluster: Add neptune_instance_parameter_group_name argument, used only when upgrading major version (#28051)
resource/aws_neptune_global_cluster: Increase Update timeout to 120 minutes (per global cluster member) (#28051)
resource/aws_route53_cidr_location: Add cidr_routing_policy argument (#29407)
resource/aws_s3_bucket: Accept 'NoSuchTagSetError' responses from S3-compatible services (#28530)
resource/aws_s3_bucket: Add error handling for NotImplemented errors when reading lifecycle_rule or replication_configuration into terraform state. (#28790)
resource/aws_s3_object: Accept 'NoSuchTagSetError' responses from S3-compatible services (#28530)

BUG FIXES:

data-source/aws_elb: Fix errors caused by multiple security groups with the same name but different owners (#29202)
resource/aws_appflow_connector_profile: Fix bug in connector_profile_config.0.connector_profile_properties.0.sapo_data.0.logon_language validation regex (#28550)
resource/aws_appflow_flow: Fix misspelled source_connector_properties.0.sapo_data.0.object, which never worked, to be object_path (#28600)
resource/aws_appmesh_route: Fix RequiredWith setting for spec.0.grpc_route.0.match.0.method_name attribute (#29217)
resource/aws_autoscaling_policy: Fix type of target_value for predictive scaling (#28444)
resource/aws_cloudfront_response_headers_policy: Allow server_timing_headers_config.0.sampling_rate to be 0 (#27778)
resource/aws_codebuild_project: Fix err check on delete (#29042)
resource/aws_ecs_service: Allow multiple service blocks within service_connect_configuration (#28813)
resource/aws_ecs_service: Mark service_connect_configuration.service.client_alias as optional and ensure that only 1 such block can be provided (#28813)
resource/aws_ecs_service: Require service_connect_configuration.log_configuration.log_driver to be provided (#28813)
resource/aws_elb: Fix errors caused by multiple security groups with the same name but different owners (#29202)
resource/aws_emr_cluster: Fix errors caused by multiple security groups with the same name but different owners (#29202)
resource/aws_globalaccelerator_endpoint_group: Fix errors caused by multiple security groups with the same name but different owners (#29202)
resource/aws_kms_key: Increase policy propagation eventual consistency timeouts from 5 minutes to 10 minutes (#28636)
resource/aws_medialive_channel: Fix issue causing dbv_sub_pids attribute to be configured incorrectly in m2ts_settings (#29371)
resource/aws_medialive_channel: Fix issue preventing audio_pids attribute from being configured in m2ts_settings (#29371)
resource/aws_neptune_cluster: Fix restore-from-snapshot functionality using the snapshot_identifier argument on resource Create (#28051)
resource/aws_neptune_cluster: Fix major version upgrade (#28051)
resource/aws_sagemaker_user_profile: Change user_settings.0.jupyter_server_app_settings.0.default_resource_spec to be optional (#28581)

`v4.54.0`

Compare Source

NOTES:

provider: Resolves provider crashes reporting Error: Plugin did not respond and fatal error: concurrent map writes with updated upstream package (terraform-plugin-log) (#29269)
resource/aws_networkmanager_core_network: The policy_document attribute is being deprecated in favor of the new aws_networkmanager_core_network_policy_attachment resource. (#29097)

FEATURES:

New Resource: aws_evidently_launch (#28752)
New Resource: aws_lightsail_bucket_access_key (#28699)
New Resource: aws_networkmanager_core_network_policy_attachment (#29097)

ENHANCEMENTS:

data-source/aws_cloudtrail_service_account: Add service account ID for ap-southeast-4 AWS Region (#29103)
data-source/aws_elb_hosted_zone_id: Add hosted zone ID for ap-southeast-4 AWS Region (#29103)
data-source/aws_lb_hosted_zone_id: Add hosted zone IDs for ap-southeast-4 AWS Region (#29103)
data-source/aws_s3_bucket: Add hosted zone ID for ap-south-2 AWS Region (#29103)
data-source/aws_s3_bucket: Add hosted zone ID for ap-southeast-4 AWS Region (#29103)
provider: Support ap-southeast-4 as a valid AWS region (#29329)
resource/aws_dynamodb_table: Add arn, stream_arn, and stream_label attributes to replica to obtain this information for replicas (#29269)
resource/aws_efs_mount_target: Add configurable timeouts for Create and Delete (#27991)
resource/aws_lambda_function: Add replace_security_groups_on_destroy and replacement_security_group_ids attributes (#29289)
resource/aws_networkfirewall_firewall: Add ip_address_type attribute to the subnet_mapping configuration block (#29010)
resource/aws_networkmanager_core_network: Add base_policy_region and create_base_policy arguments (#29097)

BUG FIXES:

data-source/aws_kms_key: Reinstate support for KMS multi-Region key ID or ARN values for the key_id argument (#29266)
resource/aws_cloudwatch_log_group: Fix IAM eventual consistency error when setting a retention policy (#29325)
resource/aws_dynamodb_table: Avoid recreating table replicas when enabling PITR on them (#29269)
resource/aws_ec2_client_vpn_endpoint: Change authentication_options from TypeList to TypeSet as order is not significant (#29294)
resource/aws_kms_grant: Retries until valid principal ARNs are returned instead of not updating state (#29245)
resource/aws_opsworks_permission: stack_id and user_arn are both Required and ForceNew (#27991)
resource/aws_prometheus_workspace: Create a logging configuration on resource update if none existed previously (#27472)
resource/aws_s3_bucket: Fix crash when logging is empty (#29243)
resource/aws_sns_topic: Fixes potential race condition when reading policy document. (#29226)
resource/aws_sns_topic_policy: Fixes potential race condition when reading policy document. (#29226)

`v4.53.0`

Compare Source

ENHANCEMENTS:

provider: Adds structured fields in logging (#29223)
provider: Masks authentication fields in HTTP header logging (#29223)

`v4.52.0`

Compare Source

NOTES:

resource/aws_dynamodb_table: In the past, in certain situations, kms_key_arn could be populated with the default DynamoDB key alias/aws/dynamodb. This was an error because it would then be sent back to AWS and should not be. (#29102)
resource/aws_dynamodb_table: In the past, in certain situations, server_side_encryption.0.kms_key_arn or replica.*.kms_key_arn could be populated with the default DynamoDB key alias/aws/dynamodb. This was an error because it would then be sent back to AWS and should not be. (#29102)
resource/aws_dynamodb_table: Updating replica.*.kms_key_arn or replica.*.point_in_time_recovery, when the replica's kms_key_arn is set, requires recreating the replica. (#29102)
resource/aws_dynamodb_table_replica: Updating kms_key_arn forces replacement of the replica now as required to re-encrypt the replica (#29102)

FEATURES:

New Data Source: aws_auditmanager_framework (#28989)
New Resource: aws_auditmanager_assessment_delegation (#29099)
New Resource: aws_auditmanager_framework_share (#29049)
New Resource: aws_auditmanager_organization_admin_account_registration (#29018)

ENHANCEMENTS:

resource/aws_wafv2_rule_group: Add oversize_handling argument to body block of the field_to_match block (#29082)

BUG FIXES:

resource/aws_api_gateway_integration: Prevent drift of connection_type attribute when aws_api_gateway_deployment triggers are used (#29016)
resource/aws_dynamodb_table: Fix perpetual diffs when using default AWS-managed keys (#29102)
resource/aws_dynamodb_table: Fix to allow updating of replica.*.kms_key_arn (#29102)
resource/aws_dynamodb_table: Fix to allow updating of replica.*.point_in_time_recovery when a replica has kms_key_arn set (#29102)
resource/aws_dynamodb_table: Fix unexpected state 'DISABLED' error when waiting for PITR to update (#29086)
resource/aws_dynamodb_table_replica: Fix to allow creation of the replica without errors when kms_key_arn is set (#29102)
resource/aws_dynamodb_table_replica: Fix to allow updating of kms_key_arn (#29102)
resource/aws_medialive_channel: Add missing rate_control_mode in acc_settings for audio_descriptions (#29051)
resource/aws_medialive_input: Fix eventual consistency error when updating (#29051)
resource/aws_vpc_ipam_pool_cidr_allocation: Added support for eventual consistency on read operations after create. (#29022)
resource/aws_wafv2_web_acl: Fix error when setting aws_managed_rules_bot_control_rule_set in manage_rule_group_config (#28810)

`v4.51.0`

Compare Source

NOTES:

resource/aws_ce_anomaly_subscription: Deprecate threshold argument in favour of threshold_expression (#28573)

FEATURES:

New Data Source: aws_auditmanager_control (#28967)
New Resource: aws_datasync_location_object_storage (#23154)
New Resource: aws_rds_export_task (#28831)
New Resource: aws_resourceexplorer2_view (#28841)

ENHANCEMENTS:

resource/aws_appmesh_gateway_route: Add port on the match attribute for routes (#27799)
resource/aws_appmesh_route: Add port on the weighted_target attribute (#27799)
resource/aws_appmesh_virtual_gateway: Add the functionality to be able specify multi listeners (#27799)
resource/aws_appmesh_virtual_node: Add the functionality to be able specify multi listeners (#27799)
resource/aws_appmesh_virtual_router: Add the functionality to be able specify multi listeners (#27799)
resource/aws_apprunner_service: Add source_configuration.code_repository.code_configuration.runtime_environment_secrets and source_configuration.image_repository.image_configuration.runtime_environment_secrets argument (#28871)
resource/aws_ce_anomaly_subscription: Add threshold_expression argument (#28573)
resource/aws_grafana_workspace: Add configuration argument (#28569)
resource/aws_imagbuilder_component: Add skip_destroy argument (#28905)
resource/aws_lambda_event_source_mapping: Add scaling_config argument (#28876)
resource/aws_lambda_function: Add configurable timeout for Update (#28963)
resource/aws_rum_app_monitor: Add custom_events argument (#28431)
resource/aws_servicecatalog_portfolio_share: Add share_principals argument (#28619)

BUG FIXES:

data-source/aws_eks_cluster: Add outpost_config.control_plane_placement attribute (#28924)
data-source/aws_identitystore_group: Restore use of ListGroups API when filter is specified (#28937)
data-source/aws_identitystore_user: Restore use of ListUsers API when filter is specified (#28937)
data-source/aws_lambda_function: Fix AccessDeniedException errors in AWS Regions where AWS Signer is not supported (#28963)
data-source/aws_lambda_function: Remove any qualifier from invoke_arn (#28963)
resource/aws_appstream_image_builder: Fix IAM eventual consistency error for optional role (#26677)
resource/aws_appstream_image_builder: Fix refresh error when domain_join_info and vpc_config are not empty (#26677)
resource/aws_elasticsearch_domain: Prevent persistent iops diff (#28901)
resource/aws_grafana_workspace: Fix updating vpc_configuration (#28569)
resource/aws_iam_server_certificate: Avoid errors on delete when no error occurred (#28968)
resource/aws_lambda_function: Don't persist invalid filename, s3_bucket, s3_key or s3_object_version values on resource Update (#28963)
resource/aws_lambda_function: Retry ResourceNotFoundException errors on resource Create (#28963)
resource/aws_lb_listener_certificate: Show errors in certain cases where they were previously only logged and resource was removed from state (#28968)
resource/aws_opensearch_domain: Omit throughput and iops for unsupported volume types (#28862)
resource/aws_sagemaker_app: Correctly list all apps so as not to lose track in an environment where there are many apps (#28561)

`v4.50.0`

Compare Source

FEATURES:

New Data Source: aws_lbs (#27161)
New Resource: aws_sesv2_configuration_set_event_destination (#27565)

ENHANCEMENTS:

data-source/aws_lb_target_group: Support querying by tags (#27261)
resource/aws_redshiftdata_statement: Add workgroup_name argument (#28751)
resource/aws_service_discovery_service: Add type argument (#28778)

BUG FIXES:

resource/aws_acmpca_policy: Improve refresh to avoid unnecessary diffs in policy (#28788)
resource/aws_api_gateway_rest_api: Improve refresh to avoid unnecessary diffs in policy (#28789)
resource/aws_api_gateway_rest_api_policy: Improve refresh to avoid unnecessary diffs in policy (#28789)
resource/aws_apprunner_service: observability_configuration_arn is optional (#28620)
resource/aws_apprunner_vpc_connector: Fix default_tags not handled correctly (#28736)
resource/aws_appstream_stack: Fix panic on user_settings update (#28766)
resource/aws_appstream_stack: Prevent unnecessary replacements on update (#28766)
resource/aws_backup_vault_policy: Improve refresh to avoid unnecessary diffs in policy (#28791)
resource/aws_cloudsearch_domain_service_access_policy: Improve refresh to avoid unnecessary diffs in access_policy (#28792)
resource/aws_cloudwatch_event_bus_policy: Improve refresh to avoid unnecessary diffs in policy (#28802)
resource/aws_codeartifact_domain_permissions_policy: Improve refresh to avoid unnecessary diffs in policy_document (#28794)
resource/aws_codeartifact_repository_permissions_policy: Improve refresh to avoid unnecessary diffs in policy_document (#28794)
resource/aws_codebuild_resource_policy: Improve refresh to avoid unnecessary diffs in policy (#28796)
resource/aws_dms_replication_subnet_group: Fix error ("Provider produced inconsistent result") when an error is encountered during creation (#28748)
resource/aws_dms_replication_task: Allow updates to aws_dms_replication_task even when migration_type and table_mappings have not changed (#28047)
resource/aws_dms_replication_task: Fix error with cdc_path when used with aws_dms_s3_endpoint (#28704)
resource/aws_dms_s3_endpoint: Fix error with cdc_path when used with aws_dms_replication_task (#28704)
resource/aws_ecr_registry_policy: Improve refresh to avoid unnecessary diffs in policy (#28799)
resource/aws_ecr_repository_policy: Improve refresh to avoid unnecessary diffs in policy (#28799)
resource/aws_ecrpublic_repository_policy: Improve refresh to avoid unnecessary diffs in policy (#28799)
resource/aws_efs_file_system_policy: Improve refresh to avoid unnecessary diffs in policy (#28800)
resource/aws_elasticsearch_domain: Improve refresh to avoid unnecessary diffs in access_policies (#28801)
resource/aws_elasticsearch_domain_policy: Improve refresh to avoid unnecessary diffs in access_policies (#28801)
resource/aws_glacier_vault: Improve refresh to avoid unnecessary diffs in access_policy (#28804)
resource/aws_glacier_vault_lock: Improve refresh to avoid unnecessary diffs in policy (#28804)
resource/aws_glue_resource_policy: Improve refresh to avoid unnecessary diffs in policy (#28807)
resource/aws_iam_group_policy: Fixed issue that could result in "inconsistent final plan" errors (#28868)
resource/aws_iam_group_policy: Improve refresh to avoid unnecessary diffs in policy (#28777)
resource/aws_iam_group_policy: Improve refresh to avoid unnecessary diffs in policy (#28836)
resource/aws_iam_policy: Improve refresh to avoid unnecessary diffs in policy (#28777)
resource/aws_iam_policy: Improve refresh to avoid unnecessary diffs in policy, tags (#28836)
resource/aws_iam_role: Fixed issue that could result in "inconsistent final plan" errors (#28868)
resource/aws_iam_role: Improve refresh to avoid unnecessary diffs in assume_role_policy and inline_policy policy (#28777)
resource/aws_iam_role: Improve refresh to avoid unnecessary diffs in inline_policy.*.policy, tags (#28836)
resource/aws_iam_role_policy: Fixed issue that could result in "inconsistent final plan" errors (#28868)
resource/aws_iam_role_policy: Improve refresh to avoid unnecessary diffs in policy (#28777)
resource/aws_iam_role_policy: Improve refresh to avoid unnecessary diffs in policy (#28836)
resource/aws_iam_user_policy: Fixed issue that could result in "inconsistent final plan" errors (#28868)
resource/aws_iam_user_policy: Improve refresh to avoid unnecessary diffs in policy (#28777)
resource/aws_iam_user_policy: Improve refresh to avoid unnecessary diffs in policy (#28836)
resource/aws_iot_policy: Improve refresh to avoid unnecessary diffs in policy (#28838)
resource/aws_kms_external_key: Improve refresh to avoid unnecessary diffs in policy (#28853)
resource/aws_kms_key: Improve refresh to avoid unnecessary diffs in policy (#28853)
resource/aws_lb_target_group: Change protocol_version to ForceNew (#17845)
resource/aws_lb_target_group: When creating a new target group, return an error if there is an existing target group with the same name. Use terraform import for existing target groups (#26977)
resource/aws_mq_configuration: Improve refresh to avoid unnecessary diffs in data (#28837)
resource/aws_s3_access_point: Improve refresh to avoid unnecessary diffs in policy (#28866)
resource/aws_s3_bucket: Improve refresh to avoid unnecessary diffs in policy (#28855)
resource/aws_s3_bucket_policy: Improve refresh to avoid unnecessary diffs in policy (#28855)
resource/aws_s3control_access_point_policy: Improve refresh to avoid unnecessary diffs in policy (#28866)
resource/aws_s3control_bucket_policy: Improve refresh to avoid unnecessary diffs in policy (#28866)
resource/aws_s3control_multi_region_access_point_policy: Improve refresh to avoid unnecessary diffs in details policy (#28866)
resource/aws_s3control_object_lambda_access_point_policy: Improve refresh to avoid unnecessary diffs in policy (#28866)
resource/aws_sagemaker_model_package_group_policy: Improve refresh to avoid unnecessary diffs in resource_policy (#28865)
resource/aws_schemas_registry_policy: Improve refresh to avoid unnecessary diffs in policy (#28864)
resource/aws_secretsmanager_secret: Improve refresh to avoid unnecessary diffs in policy (#28863)
resource/aws_secretsmanager_secret_policy: Improve refresh to avoid unnecessary diffs in policy (#28863)
resource/aws_ses_identity_policy: Improve refresh to avoid unnecessary diffs in policy (#28861)
resource/aws_sns_topic: Improve refresh to avoid unnecessary diffs in policy (#28860)
resource/aws_sns_topic_policy: Improve refresh to avoid unnecessary diffs in policy (#28860)
resource/aws_sqs_queue: Improve refresh to avoid unnecessary diffs in policy (#28840)
resource/aws_sqs_queue_policy: Improve refresh to avoid unnecessary diffs in policy (#28840)
resource/aws_transfer_access: Improve refresh to avoid unnecessary diffs in policy (#28859)
resource/aws_transfer_user: Improve refresh to avoid unnecessary diffs in policy (#28859)
resource/aws_vpc_endpoint: Improve refresh to avoid unnecessary diffs in policy (#28798)
resource/aws_vpc_endpoint_policy: Improve refresh to avoid unnecessary diffs in policy (#28798)

`v4.49.0`

Compare Source

NOTES:

resource/aws_dms_endpoint: For s3_settings cdc_min_file_size, AWS changed the multiplier to kilobytes instead of megabytes. In other words, prior to the change, a value of 32 represented 32 MiB. After the change, a value of 32 represents 32 KB. Change your configuration accordingly. (#28578)
resource/aws_fsx_ontap_storage_virtual_machine: The subtype attribute is no longer deprecated (#28567)

FEATURES:

New Data Source: aws_s3control_multi_region_access_point (#28373)
New Resource: aws_appsync_type (#28437)
New Resource: aws_auditmanager_assessment (#28643)
New Resource: aws_auditmanager_assessment_report (#28663)
New Resource: aws_ec2_instance_state (#28639)
New Resource: aws_lightsail_bucket (#28585)
New Resource: aws_ssoadmin_instance_access_control_attributes (#23317)

ENHANCEMENTS:

data-source/aws_autoscaling_group: Add desired_capacity_type attribute (#28658)
data-source/aws_kms_secrets: Add encryption_algorithm and key_id arguments in support of asymmetric keys (#21054)
resource/aws_appflow_connector_profile: Add support for connector_type CustomConnector. Add cluster_identifier, database_name, and data_api_role_arn attributes for redshift connection_profile_properties (#26766)
resource/aws_appsync_resolver: Add runtime and code arguments (#28436)
resource/aws_appsync_resolver: Add plan time validation for caching_config.ttl (#28436)
resource/aws_athena_workgroup: Add configuration.execution_role argument (#28420)
resource/aws_autoscaling_group: Add desired_capacity_type argument (#28658)
resource/aws_dms_endpoint: Change s3_settings cdc_min_file_size default to 32000 in order to align with AWS's change from megabytes to kilobytes for this setting (#28578)
resource/aws_ecs_service: Add alarms argument (#28521)
resource/aws_lightsail_instance: Add add_on configuration block. (#28602)
resource/aws_lightsail_instance_public_ports: Add cidr_list_aliases argument (#28376)
resource/aws_s3_access_point: Add bucket_account_id argument (#28564)
resource/aws_s3control_storage_lens_configuration: Add advanced_cost_optimization_metrics, advanced_data_protection_metrics, and detailed_status_code_metrics arguments to the storage_lens_configuration.account_level and storage_lens_configuration.account_level.bucket_level configuration blocks (#28564)
resource/aws_wafv2_rule_group: Add rule.action.captcha argument (#28435)
resource/aws_wafv2_web_acl: Add rule.action.challenge argument (#28305)
resource/aws_wafv2_web_acl: Add support for ManagedRuleGroupConfig (#28594)

BUG FIXES:

data-source/aws_cloudwatch_log_group: Restore use of ListTagsLogGroup API (#28492)
resource/aws_cloudwatch_log_group: Restore use of ListTagsLogGroup, TagLogGroup and UntagLogGroup APIs (#28492)
resource/aws_dms_endpoint: Add s3 setting ignore_header_rows and deprecate misspelled ignore_headers_row. (#28579)
resource/aws_elasticache_user_group_association: Retry on InvalidUserGroupState errors to handle concurrent updates (#28689)
resource/aws_lambda_function_url: Fix removal of cors configuration block (#28439)
resource/aws_lightsail_database: The availability_zone attribute is now optional/computed to support HA bundle_ids (#28590)
resource/aws_lightsail_disk_attachment: Resolves a panic when an attachment fails and attempts to display the error returned by AWS. (#28593)

`v4.48.0`

Compare Source

FEATURES:

New Resource: aws_dx_macsec_key_association (#26274)

ENHANCEMENTS:

resource/aws_dx_connection: Add encryption_mode and request_macsec arguments and macsec_capable and port_encryption_status attributes in support of MACsec (#26274)
resource/aws_dx_connection: Add skip_destroy argument (#26274)
resource/aws_eks_node_group: Add support for WINDOWS_CORE_2019_x86_64, WINDOWS_FULL_2019_x86_64, WINDOWS_CORE_2022_x86_64, and WINDOWS_FULL_2022_x86_64 ami_type values (#28445)
resource/aws_networkfirewall_rule_group: Add reference_sets configuration block (#28335)
resource/aws_networkmanager_vpc_attachment: Add options.appliance_mode_support argument (#28450)

BUG FIXES:

resource/aws_networkfirewall_rule_group: Change rule_group.rules_source.stateful_rule from TypeSet to TypeList to preserve rule order (#27102)

`v4.47.0`

Compare Source

FEATURES:

New Data Source: aws_cloudwatch_log_data_protection_policy_document (#28272)
New Data Source: aws_db_instances (#28303)
New Resource: aws_auditmanager_account_registration (#28314)
New Resource: aws_auditmanager_framework (#28257)
New Resource: aws_lambda_functions (#28254)
New Resource: aws_sagemaker_space (#28154)
New Resource: aws_ssoadmin_permissions_boundary_attachment (#28241)

ENHANCEMENTS:

data-source/aws_cloudwatch_log_group: Use resource tagging APIs that are not on a path to deprecation (#28359)
data-source/aws_eks_addon: Add configuration_values attribute (#28295)
resource/aws_appsync_function: Add runtime and code arguments (#28057)
resource/aws_appsync_function: Make request_mapping_template and response_mapping_template Optional (#28057)
resource/aws_cloudwatch_log_destination: Add tags argument and tags_all attribute to support resource tagging (#28359)
resource/aws_cloudwatch_log_group: Use resource tagging APIs that are not on a path to deprecation (#28359)
resource/aws_eks_addon: Add configuration_values argument (#28295)
resource/aws_grafana_workspace: Add vpc_configuration argument. (#28308)
resource/aws_networkmanager_core_network: Increase Create, Update, and Delete timeouts to 30 minutes (#28363)
resource/aws_sagemaker_app: Add space_name argument (#28154)
resource/aws_sagemaker_app: Make user_profile_name optional (#28154)
resource/aws_sagemaker_domain: Add default_space_settings and default_user_settings.jupyter_server_app_settings.code_repository arguments (#28154)
resource/aws_sagemaker_endpoint_configuration: Add shadow_production_variants, production_variants.container_startup_health_check_timeout_in_seconds, production_variants.core_dump_config, production_variants.model_data_download_timeout_in_seconds, and production_variants.volume_size_in_gb arguments (#28159)
resource/aws_sagemaker_user_profile: Add user_settings.jupyter_server_app_settings.code_repository argument (#28154)

BUG FIXES:

resource/aws_cloudwatch_metric_stream: Correctly update tags (#28310)
resource/aws_db_instance: Ensure that apply_immediately default value is applied (#25768)
resource/aws_ecs_service: Fix missing required field, UpdateServiceInput.ServiceConnectConfiguration.Enabled error when removing service_connect_configuration configuration block (#28338)
resource/aws_ecs_service: Fix service_connect_configuration.service.ingress_port_override being set to 0 (InvalidParameterException: IngressPortOverride cannot use ports <= 1024 error) when not configured (#28338)

`v4.46.0`

Compare Source

FEATURES:

New Data Source: aws_glue_catalog_table (#23256)
New Resource: aws_auditmanager_control (#27857)
New Resource: aws_networkmanager_core_network (#28155)
New Resource: aws_resourceexplorer2_index (#28144)
New Resource: aws_rum_metrics_destination (#28143)
New Resource: aws_vpc_network_performance_metric_subscription (#28150)

ENHANCEMENTS:

resource/aws_glue_crawler: Add catalog_target.dlq_event_queue_arn, catalog_target.event_queue_arn, catalog_target.connection_name, lake_formation_configuration, and jdbc_target.enable_additional_metadata arguments (#28156)
resource/aws_glue_crawler: Make delta_target.connection_name optional (#28156)
resource/aws_networkfirewall_firewall: Add encryption_configuration attribute (#28242)
resource/aws_networkfirewall_firewall_policy: Add encryption_configuration attribute (#28242)
resource/aws_networkfirewall_rule_group: Add encryption_configuration attribute (#28242)

BUG FIXES:

resource/aws_db_instance: Fix error modifying allocated_storage when storage_type is "gp3" (#28243)
resource/aws_dms_s3_endpoint: Fix disparate handling of endpoint attributes in different regions (#28220)
resource/aws_evidently_feature: Fix description attribute to accept strings between 0 and 160 in length (#27948)
resource/aws_lb_target_group: Allow healthy_threshold and unhealthy_threshold to be set to different values for TCP health checks. (#28018)
resource/aws_lb_target_group: Allow interval to be updated for TCP health checks (#28018)
resource/aws_lb_target_group: Allow timeout to be set for TCP health checks (#28018)
resource/aws_lb_target_group: Don't force recreation on health_check attribute changes (#28018)
resource/aws_sns_topic_subscription: Fix unsupported FilterPolicyScope attribute error in the aws-cn partition (#28253)

`v4.45.0`

Compare Source

NOTES:

provider: With AWS's retirement of EC2-Classic the skip_get_ec2_platforms attribute has been deprecated and will be removed in a future version (#28084)
resource/aws_fsx_ontap_storage_virtual_machine: The subtype attribute has been deprecated and will be removed in a future version (#28127)

FEATURES:

New Resource: aws_dms_s3_endpoint (#28130)

ENHANCEMENTS:

data-source/aws_db_instance: Add storage_throughput attribute (#27670)
data-source/aws_eks_cluster: Add cluster_id attribute (#28112)
resource/aws_db_instance: Add storage_throughput argument (#27670)
resource/aws_db_instance: Add support for gp3 storage_type value (#27670)
resource/aws_db_instance: Change iops to Computed (#27670)
resource/aws_eks_cluster: Add cluster_id attribute and outpost_config.control_plane_placement argument (#28112)
resource/aws_redshiftserverless_workgroup: Wait on MODIFYING status on resource Delete (#28114)

BUG FIXES:

resource/aws_redshiftserverless_namespace: Fix updating admin_username and admin_user_password (#28125)

`v4.44.0`

Compare Source

NOTES:

resource/aws_fsx_ontap_storage_virtual_machine: The subtype attribute will always have the value "DEFAULT" (#28085)
resource/aws_wafv2_web_acl: excluded_rule on managed_rule_group_statement has been deprecated. All configurations using excluded_rule should be updated to use the new rule_action_override attribute instead (#27954)

ENHANCEMENTS:

resource/aws_api_gateway_deployment: Add import support (#28030)
resource/aws_kinesisanalyticsv2_application: Add support for FLINK-1_15 runtime_environment value (#28099)
resource/aws_lambda_function: Add snap_start attribute (#28097)
resource/aws_wafv2_web_acl: Support rule_action_override on managed_rule_group_statement (#27954)

BUG FIXES:

resource/aws_instance: Change iam_instance_profile to Computed as the value may be configured via a launch template (#27972)

`v4.43.0`

Compare Source

FEATURES:

New Resource: aws_neptune_global_cluster (#26133)

ENHANCEMENTS:

data-source/aws_ecs_cluster: Add service_connect_defaults attribute (#28052)
resource/aws_ce_cost_category: Allow configuration of effective_start value (#28055)
resource/aws_ecs_cluster: Add service_connect_defaults argument (#28052)
resource/aws_ecs_service: Add service_connect_configuration argument in support of ECS Service Connect (#28052)
resource/aws_glue_classifier: Add custom_datatypes and custom_datatype_configured arguments (#28048)
resource/aws_neptune_cluster: Add global_cluster_identifier argument (#26133)

`v4.42.0`

Compare Source

FEATURES:

New Data Source: aws_redshiftserverless_credentials (#28026)
New Resource: aws_cloudwatch_log_data_protection_policy (#28049)

ENHANCEMENTS:

data-source/aws_memorydb_cluster: Add data_tiering attribute (#28022)
resource/aws_db_instance: Add blue_green_update argument in support of RDS Blue/Green Deployments (#28046)
resource/aws_efs_file_system: Add support for AFTER_1_DAY lifecycle_policy.transition_to_ia argument (#28054)
resource/aws_efs_file_system: Add support for elastic throughput_mode argument (#28054)
resource/aws_emrserverless_application: Add architecture argument (#28027)
resource/aws_emrserverless_application: Mark maximum_capacity and maximum_capacity.disk as Computed, preventing spurious resource diffs (#28027)
resource/aws_memorydb_cluster: Add data_tiering attribute (#28022)
resource/aws_sns_topic_subscription: Add filter_policy_scope argument in support of SNS message filtering (#28004)

BUG FIXES:

resource/aws_lambda_function: Don't fail resource Create if AWS Signer service is not available in the configured Region (#28008)
resource/aws_memorydb_cluster: Allow more than one element in snapshot_arns (#28022)
resource/aws_sagemaker_user_profile: user_settings.jupyter_server_app_settings, user_settings.kernel_gateway_app_settings, and user_settings.tensor_board_app_settings are updateable (#28025)

`v4.41.0`

Compare Source

FEATURES:

New Data Source: aws_sqs_queues (#27890)
New Resource: aws_ivschat_logging_configuration (#27924)
New Resource: aws_ivschat_room (#27974)
New Resource: aws_rds_clusters (#27891)
New Resource: aws_redshiftserverless_resource_policy (#27920)
New Resource: aws_scheduler_schedule (#27975)

ENHANCEMENTS:

data-source/aws_cloudtrail_service_account: Add service account ID for ap-south-2 AWS Region (#27983)
data-source/aws_elasticache_cluster: Add cache_nodes.outpost_arn and preferred_outpost_arn attributes (#27934)
data-source/aws_elasticache_cluster: Add ip_discovery and network_type attributes (#27856)
data-source/aws_elb_hosted_zone_id: Add hosted zone ID for ap-south-2 AWS Region (#27983)
data-source/aws_lb_hosted_zone_id: Add hosted zone IDs for ap-south-2 AWS Region (#27983)
data-source/aws_rds_cluster: Add engine_mode attribute (#27892)
provider: Support ap-south-2 as a valid AWS Region (#27950)
resource/aws_amplify_app: Add support for WEB_COMPUTE platform value in support of Next.js web apps (#27925)
resource/aws_elasticache_cluster: Add ip_discovery and network_type arguments in support of IPv6 clusters (#27856)
resource/aws_elasticache_cluster: Add outpost_mode and preferred_outpost_arn arguments and cache_nodes.outpost_arn attribute. NOTE: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#27934)
resource/aws_lambda_function: Add support for nodejs18.x runtime value (#27923)
resource/aws_lambda_layer_version: Add support for nodejs18.x compatible_runtimes value (#27923)
resource/aws_medialive_channel: Add start_channel attribute (#27882)
resource/aws_nat_gateway: Update private_ip attribute to be configurable (#27953)

BUG FIXES:

resource/aws_cloudcontrolapi_resource: Remove invalid regular expressions from CloudFormation resource schema (#27935)
resource/aws_dms_endpoint: Add ability to use AWS Secrets Manager with the sybase engine (#27949)
resource/aws_resourcegroups_group: Properly set configuration.parameters as optional (#27985)

`v4.40.0`

Compare Source

NOTES:

data-source/aws_identitystore_group: The filter argument has been deprecated. Use the alternate_identifier argument instead (#27762)

FEATURES:

New Data Source: aws_controltower_controls (#26978)
New Data Source: aws_ivs_stream_key (#27789)
New Resource: aws_appconfig_extension (#27860)
New Resource: aws_appconfig_extension_association (#27860)
New Resource: aws_controltower_control (#26990)
New Resource: aws_evidently_feature (#27395)
New Resource: aws_ivs_channel (#27726)
New Resource: aws_networkmanager_connect_attachment (#27787)
New Resource: aws_opensearch_inbound_connection_accepter (#22988)
New Resource: aws_opensearch_outbound_connection (#22988)
New Resource: aws_scheduler_schedule_group (#27800)
New Resource: aws_schemas_registry_policy (#27705)
New Resource: aws_sesv2_email_identity_mail_from_attributes (#27672)

ENHANCEMENTS:

data-source/aws_cloudtrail_service_account: Add service account ID for eu-central-2 AWS Region (#27814)
data-source/aws_cloudtrail_service_account: Add service account ID for eu-south-2 AWS Region (#27855)
data-source/aws_connect_instance: Add multi_party_conference_enabled attribute (#27734)
data-source/aws_elb_hosted_zone_id: Add hosted zone ID for eu-central-2 AWS Region (#27814)
data-source/aws_elb_hosted_zone_id: Add hosted zone ID for eu-south-2 AWS Region (#27855)
data-source/aws_identitystore_group: Add alternate_identifier argument and description attribute (#27762)
data-source/aws_lb_hosted_zone_id: Add hosted zone IDs for eu-central-2 AWS Region (#27814)
data-source/aws_lb_hosted_zone_id: Add hosted zone IDs for eu-south-2 AWS Region (#27855)
data-source/aws_s3_bucket: Add hosted zone ID for eu-central-2 AWS Region (#27814)
data-source/aws_s3_bucket: Add hosted zone ID for eu-south-2 AWS Region (#27855)
provider: Support eu-central-2 as a valid AWS Region (#27812)
resource/aws_acm_certificate: Add key_algorithm argument in support of ECDSA TLS certificates (#27781)
resource/aws_autoscaling_group: Add support for price-capacity-optimized spot_allocation_strategy value (#27795)
resource/aws_cloudwatch_logs_group: Add skip_destroy argument (#26775)
resource/aws_cognito_user_pool: Add sns_region attribute to sms_configuration block (#26684)
resource/aws_connect_instance: Add multi_party_conference_enabled argument (#27734)
resource/aws_customer_gateway: Make ip_address optional (#26673)
resource/aws_docdb_cluster_instance: Add enable_performance_insights and performance_insights_kms_key_id arguments (#27769)
resource/aws_dynamodb_table_item: Allow the creation of items with the same hash key but different range keys (#27517)
resource/aws_ec2_fleet: Add support for price-capacity-optimized spot_options.allocation_strategy value (#27795)
resource/aws_ecs_service: Add triggers argument to enable in-place updates (redeployments) on each apply, when used with force_new_deployment = true (#25840)
resource/aws_medialive_channel: Add support for more output, output_groups, audio_descriptions and video_descriptions in encoder_settings. Add support for input_settings in input_attachments (#27823)
resource/aws_msk_cluster: Add storage_mode argument (#27546)
resource/aws_neptune_cluster: Add serverless_v2_scaling_configuration block in support of Neptune Serverless (#27763)
resource/aws_network_interface_sg_attachment: Add import support (#27785)
resource/aws_security_group_rule: Add security_group_rule_id attribute (#27828)
resource/aws_spot_fleet_request: Add support for priceCapacityOptimized allocation_strategy value (#27795)

BUG FIXES:

resource/aws_appstream_stack: Fix redirect_url max character length (#27744)
resource/aws_dynamodb_table: Allow changing KMS keys on tables with replicas. (#23156)
resource/aws_route53_resolver_endpoint: Fix deduplication with multiple IPs on the same subnet (#25708)
resource/aws_sesv2_email_identity_feedback_attributes: Fix invalid resource ID in error messages when creating the resource (#27784)

`v4.39.0`

Compare Source

BREAKING CHANGES:

resource/aws_secretsmanager_secret_rotation: Remove unused tags attribute (#27656)

NOTES:

provider: Add OpenBSD to list of OSes which the provider is built on (#27663)

FEATURES:

New Data Source: aws_dynamodb_table_item (#27504)
New Data Source: aws_route53_resolver_firewall_config (#25496)
New Data Source: aws_route53_resolver_firewall_domain_list (#25509)
New Data Source: aws_route53_resolver_firewall_rule_group (#25511)
New Data Source: aws_route53_resolver_firewall_rule_group_association (#25512)
New Data Source: aws_route53_resolver_firewall_rules (#25536)
New Resource: aws_ivs_playback_key_pair (#27678)
New Resource: aws_ivs_recording_configuration (#27718)
New Resource: aws_lightsail_lb_https_redirection_policy (#27679)
New Resource: aws_medialive_channel (#26810)
New Resource: aws_networkmanager_site_to_site_vpn_attachment (#27387)
New Resource: aws_redshift_endpoint_authorization (#27654)
New Resource: aws_redshift_partner (#27665)
New Resource: aws_redshiftserverless_snapshot (#27741)

ENHANCEMENTS:

data-source/aws_rds_engine_version: Support default_only, include_all, and filter (#26923)
resource/aws_lightsail_instance: Add ip_address_type argument (#27699)
resource/aws_security_group: Do not pass from_port or to_port values to the AWS API if a rule's protocol value is -1 or all (#27642)
resource/aws_wafv2_rule_group: Correct maximum nesting level for and_statement, not_statement, or_statement and rate_based_statement (#27682)

BUG FIXES:

resource/aws_cognito_identity_pool: Fix deletion of identity pool on tags-only update (#27669)
resource/aws_dynamodb_table: Correctly set stream_arn as Computed when stream_enabled changes (#27664)
resource/aws_lightsail_instance_public_ports: Resource will now be removed from state properly when parent instance is removed (#27699)
resource/aws_s3_bucket: Attributes arn and hosted_zone_id were incorrectly settable but ignored (#27597)
resource/aws_security_group: Return an error if a rule's protocol value is all and from_port or to_port are not 0 (#27642)
resource/aws_vpn_connection: Configuring exactly one of transit_gateway_id or vpn_gateway_id is not required (#27693)

`v4.38.0`

Compare Source

FEATURES:

New Data Source: aws_connect_instance_storage_config (#27308)
New Resource: aws_apprunner_vpc_ingress_connection (#27600)
New Resource: aws_connect_phone_number (#26364)
New Resource: aws_evidently_segment (#27159)
New Resource: aws_fsx_file_cache (#27384)
New Resource: aws_lightsail_disk (#27537)
New Resource: aws_lightsail_disk_attachment (#27537)
New Resource: aws_lightsail_lb_stickiness_policy (#27514)
New Resource: aws_sagemaker_servicecatalog_portfolio_status (#27548)
New Resource: aws_sesv2_email_identity_feedback_attributes (#27433)
New Resource: aws_ssm_default_patch_baseline (#27610)

ENHANCEMENTS:

data-source/aws_networkmanager_core_network_policy_document: Add plan-time validation for core_network_configuration.edge_locations.asn (#27305)
resource/aws_ami_copy: Add imds_support attribute (#27561)
resource/aws_ami_from_instance: Add imds_support attribute (#27561)
resource/aws_apprunner_service: Add ingress_configuration argument block. (#27600)
resource/aws_batch_compute_environment: Add eks_configuration configuration block (#27499)
resource/aws_batch_compute_environment: Allow deletion of AWS Batch compute environments in INVALID state (#26931)
resource/aws_budgets_budget: Add auto_adjust_data configuration block (#27474)
resource/aws_budgets_budget: Add planned_limit configuration block (#25766)
resource/aws_cognito_user_pool: Add deletion_protection argument (#27612)
resource/aws_cognito_user_pool_client: Add auth_session_validity argument (#27620)
resource/aws_lb_target_group: Add support for target_failover and stickiness attributes for GENEVE protocol target groups (#27334)
resource/aws_sagemaker_domain: Add domain_settings, app_security_group_management, default_user_settings.r_session_app_settings, and default_user_settings.canvas_app_settings arguments. (#27542)
resource/aws_sagemaker_user_profile: Add user_settings.r_session_app_settings and user_settings.canvas_app_settings arguments. (#27542)
resource/aws_sagemaker_workforce: Add workforce_vpc_config argument (#27538)
resource/aws_sfn_state_machine: Add name_prefix argument (#27574)

BUG FIXES:

data-source/aws_ip_ranges: Fix regression causing filtering on regions and services to become case-sensitive (#27558)
resource/aws_batch_compute_environment: Update compute_resources.security_group_ids to be optional (#26172)
resource/aws_dynamodb_table: Fix bug causing spurious diffs with and preventing proper updating of stream_enabled and stream_view_type (#27566)
resource/aws_instance: Use EC2 API idempotency to ensure that only a single Instance is created (#27561)

`v4.37.0`

Compare Source

NOTES:

resource/aws_medialive_multiplex_program: The statemux_settings argument has been deprecated. Use the statmux_settings argument instead (#27223)

FEATURES:

New Data Source: aws_dx_router_configuration (#27341)
New Resource: aws_inspector2_enabler (#27505)
New Resource: aws_lightsail_lb_certificate (#27462)
New Resource: aws_lightsail_lb_certificate_attachment (#27462)
New Resource: aws_route53_resolver_config (#27487)
New Resource: aws_sesv2_dedicated_ip_assignment (#27361)
New Resource: aws_sesv2_email_identity (#27260)

ENHANCEMENTS:

data-source/aws_acmpca_certificate_authority: Add usage_mode attribute (#27496)
data-source/aws_outposts_assets: Add host_id_filter and status_id_filter arguments (#27303)
resource/aws_acmpca_certificate_authority: Add usage_mode argument to support short-lived certificates (#27496)
resource/aws_apprunner_vpc_connector: Add ability to update tags (#27345)
resource/aws_datasync_task: Add security_descriptor_copy_flags to options configuration block (#26992)
resource/aws_ec2_capacity_reservation: Add placement_group_arn argument (#27458)
resource/aws_ec2_transit_gateway: Add support to modify amazon_side_asn argument (#27306)
resource/aws_elasticache_global_replication_group: Add global_node_groups and num_node_groups arguments (#27500)
resource/aws_elasticache_global_replication_group: Add timeouts. (#27500)
resource/aws_evidently_project: Support configurable timeouts for create, update, and delete (#27336)
resource/aws_flow_log: Amazon VPC Flow Logs supports Kinesis Data Firehose as destination (#27340)
resource/aws_medialive_multiplex_program: Add ability to update multiplex_program_settings in place (#27223)
resource/aws_network_interface_attachment: Added import capabilities for the resource (#27364)
resource/aws_sesv2_dedicated_ip_pool: Add scaling_mode attribute (#27388)
resource/aws_ssm_parameter: Support aws:ssm:integration as a valid value for data_type (#27329)

BUG FIXES:

data-source/aws_route53_traffic_policy_document: Fixed incorrect capitalization for GeoproximityLocations (#27473)
resource/aws_connect_contact_flow: Change type to ForceNew (#27347)
resource/aws_ecs_service: Correctly handle unconfigured task_definition, making EXTERNAL deployments possible (#27390)
resource/aws_lb_target_group: Fix import issues on aws_lb_target_group when specifying ip_address_type of ipv4 (#27464)
resource/aws_rds_proxy_endpoint: Respect configured provider default_tags value on resource Update (#27367)
resource/aws_vpc_ipam_pool_cidr: Fix crash when IPAM Pool CIDR not found (#27512)

`v4.36.1`

Compare Source

BUG FIXES:

data-source/aws_default_tags: Fix regression setting tags to null instead of an empty map ({}) when no default_tags are defined (#27377)

`v4.36.0`

Compare Source

FEATURES:

New Data Source: aws_elasticache_subnet_group (#27233)
New Data Source: aws_sesv2_dedicated_ip_pool (#27278)
New Resource: aws_lightsail_certificate (#25283)
New Resource: aws_lightsail_domain_entry (#27309)
New Resource: aws_lightsail_lb (#27339)
New Resource: aws_lightsail_lb_attachment (#27339)
New Resource: aws_sesv2_dedicated_ip_pool (#27278)

ENHANCEMENTS:

data-source/aws_route53_zone: Add primary_name_server attribute (#27293)
resource/aws_appstream_stack: Add validation for application_settings. (#27257)
resource/aws_lightsail_container_service: Add private_registry_access argument (#27236)
resource/aws_mq_broker: Add configurable timeouts (#27035)
resource/aws_resourcegroups_group: Add configuration argument (#26934)
resource/aws_route53_zone: Add primary_name_server attribute (#27293)
resource/aws_rum_app_monitor: Add app_monitor_id attribute (#26994)
resource/aws_sns_platform_application: Add apple_platform_bundle_id and apple_platform_team_id arguments. NOTE: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#23147)

BUG FIXES:

resource/aws_appstream_stack: Fix panic with application_settings. (#27257)
resource/aws_sqs_queue: Change sqs_managed_sse_enabled to Computed as newly created SQS queues use SSE-SQS encryption by default. This means that Terraform will only perform drift detection of the attribute's value when present in a configuration (#26843)
resource/aws_sqs_queue: Respect configured sqs_managed_sse_enabled value on resource Create. In particular a configured false value is sent to the AWS API, which overrides the new service default value of true (#27335)

`v4.35.0`

Compare Source

FEATURES:

New Data Source: aws_rds_reserved_instance_offering (#26025)
New Data Source: aws_vpc_ipam_pools (#27101)
New Resource: aws_codepipeline_custom_action_type (#8123)
New Resource: aws_comprehend_document_classifier (#26951)
New Resource: aws_inspector2_delegated_admin_account (#27229)
New Resource: aws_rds_reserved_instance (#26025)
New Resource: aws_s3control_storage_lens_configuration (#27097)
New Resource: aws_sesv2_configuration_set (#27056)
New Resource: aws_transfer_tag (#27131)

ENHANCEMENTS:

data-source/aws_dx_connection: Add vlan_id attribute (#27148)
data-source/aws_vpc: Add enable_network_address_usage_metrics attribute (#27165)
resource/aws_cognito_user_pool: Add user_attribute_update_settings attribute (#27129)
resource/aws_default_vpc: Add enable_network_address_usage_metrics argument (#27165)
resource/aws_dx_connection: Add vlan_id attribute (#27148)
resource/aws_elasticache_global_replication_group: Add support for updating cache_node_type and automatic_failover_enabled. (#27134)
resource/aws_globalaccelerator_accelerator: Add ip_addresses argument in support of BYOIP addresses (#27181)
resource/aws_opsworks_custom_layer: Add load_based_auto_scaling argument (#10962)
resource/aws_prometheus_workspace: Add logging_configuration argument (#27213)
resource/aws_vpc: Add enable_network_address_usage_metrics argument (#27165)

BUG FIXES:

data-source/aws_identitystore_user: Change the type of external_ids to a string instead of a bool. (#27184)
resource/aws_ecs_task_definition: Prevent panic when supplying a null value in container_definitions (#27263)
resource/aws_identitystore_user: Change the type of external_ids to a string instead of a bool. (#27184)
resource/aws_organizations_policy_attachment: Handle missing policy when reading policy attachment (#27238)
resource/aws_ssm_service_setting: Prevent panic during status read (#27232)

`v4.34.0`

Compare Source

NOTES:

data-source/aws_identitystore_user: The filter argument has been deprecated. Use the alternate_identifier argument instead (#27053)

FEATURES:

New Data Source: aws_appconfig_configuration_profile (#27054)
New Data Source: aws_appconfig_configuration_profiles (#27054)
New Data Source: aws_appconfig_environment (#27054)
New Data Source: aws_appconfig_environments (#27054)
New Data Source: aws_vpc_ipam_pool_cidrs (#27051)
New Resource: aws_evidently_project (#24263)

ENHANCEMENTS:

data-source/aws_ami: Add imds_support attribute (#27084)
data-source/aws_identitystore_user: Add alternate_identifier argument and addresses, display_name, emails, external_ids, locale, name, nickname, phone_numbers, preferred_language, profile_url, timezone, title and user_type attributes (#27053)
datasource/aws_eks_cluster: Add service_ipv6_cidr attribute to kubernetes_network_config block (#26980)
resource/aws_ami: Add imds_support argument (#27084)
resource/aws_ami_copy: Add imds_support argument (#27084)
resource/aws_ami_from_instance: Add imds_support argument (#27084)
resource/aws_cloudwatch_event_target: Add capacity_provider_strategy configuration block to the ecs_target configuration block (#27068)
resource/aws_eks_addon: Add PRESERVE option to resolve_conflicts argument. (#27038)
resource/aws_eks_cluster: Add service_ipv6_cidr attribute to kubernetes_network_config block (#26980)
resource/aws_mwaa_environment: Add custom timeouts (#27031)
resource/aws_networkfirewall_firewall_policy: Add firewall_policy.stateful_rule_group_reference.override argument (#25135)
resource/aws_wafv2_rule_group: Add headers attribute to the field_to_match block (#26506)
resource/aws_wafv2_rule_group: Add rate_based_statement (#27113)
resource/aws_wafv2_rule_group: Add support for regex_match_statement (#22452)
resource/aws_wafv2_web_acl: Add headers attribute to the field_to_match block (#26506)
resource/aws_wafv2_web_acl: Add support for regex_match_statement (#22452)

BUG FIXES:

data-source/aws_iam_policy_document: Better handling when invalid JSON passed to override_policy_documents (#27055)
data-source/aws_ses_active_receipt_rule_set: Prevent crash when no receipt rule set is active (#27073)
resource/aws_keyspaces_table: Change schema_definition.clustering_key and schema_definition.partition_key to lists in order to respect configured orderings (#26812)
resource/aws_rolesanywhere_profile: Correctly handle updates to enabled and session_policy (#26858)
resource/aws_rolesanywhere_trust_anchor: Correctly handle updates to enabled (#26858)

`v4.33.0`

Compare Source

FEATURES:

New Data Source: aws_kms_custom_key_store (#24787)
New Resource: aws_identitystore_group (#26674)
New Resource: aws_identitystore_group_membership (#26944)
New Resource: aws_identitystore_user (#26948)
New Resource: aws_inspector2_organization_configuration (#27000)
New Resource: aws_kms_custom_key_store (#26997)

ENHANCEMENTS:

resource/aws_acm_certificate: Add early_renewal_duration, pending_renewal, renewal_eligibility, renewal_summary and type attributes (#26784)
resource/aws_appautoscaling_policy: Add alarm_arns attribute (#27011)
resource/aws_dms_endpoint: Add s3_settings.use_task_start_time_for_full_load_timestamp argument (#27004)
resource/aws_ec2_traffic_mirror_target: Add gateway_load_balancer_endpoint_id argument (#26767)
resource/aws_kms_key: Add custom_key_store_id attribute (#24787)

BUG FIXES:

resource/aws_rds_cluster: Support upgrade as a valid value in enabled_cloudwatch_logs_exports (#26792)
resource/aws_ssm_parameter: Allow parameter overwrite on create (#26785)

`v4.32.0`

Compare Source

ENHANCEMENTS:

resource/aws_eks_cluster: Add outpost_config argument to support EKS local clusers on Outposts (#26866)

BUG FIXES:

resource/aws_ec2_managed_prefix_list: MaxEntries and Entry(s) can now be changed in the same apply (#26845)

`v4.31.0`

Compare Source

FEATURES:

New Data Source: aws_ec2_managed_prefix_lists (#26727)
New Resource: aws_sqs_queue_redrive_allow_policy (#26733)
New Resource: aws_sqs_queue_redrive_policy (#26733)

ENHANCEMENTS:

data-source/aws_lambda_function: Add qualified_invoke_arn attribute (#26439)
resource/aws_db_instance: Add custom_iam_instance_profile attribute (#26765)
resource/aws_lambda_function: Add qualified_invoke_arn attribute (#26439)

BUG FIXES:

resource/aws_autoscaling_attachment: Retry errors like ValidationError: Trying to update too many Load Balancers/Target Groups at once. The limit is 10 when creating or deleting resource (#26654)
resource/aws_dynamodb_table: No longer returns error for an ARCHIVED table (#26744)
resource/aws_instance: Prevents errors in ISO regions when not using DisableApiStop attribute (#26745)
resource/aws_replication_subnet_group: Add retry to create step, resolving AccessDeniedFault error (#26768)

`v4.30.0`

Compare Source

FEATURES:

New Resource: aws_medialive_multiplex (#26608)
New Resource: aws_medialive_multiplex_program (#26694)
New Resource: aws_redshiftserverless_usage_limit (#26636)
New Resource: aws_ssoadmin_customer_managed_policy_attachment (#25915)

ENHANCEMENTS:

data-source/aws_rds_cluster: Add network_type attribute (#26489)
resource/aws_eks_addon: Support configurable timeouts for addon create, update, and delete (#26629)
resource/aws_rds_cluster: Add network_type argument (#26489)
resource/aws_rds_cluster_instance: Add network_type attribute (#26489)
resource/aws_s3_bucket_object_lock_configuration: Update rule argument to be Optional (#26520)
resource/aws_vpn_connection: Add tunnel1_log_options and tunnel2_log_options arguments (#26637)

BUG FIXES:

data-source/aws_ec2_managed_prefix_list: Fixes bug where an error is returned for regions with more than 100 managed prefix lists (#26683)
data-source/aws_iam_policy_document: Correctly handle unquoted Boolean values in Condition (#26657)
data-source/aws_iam_policy_document: Prevent crash when source_policy_documents contains empty or invalid JSON documents (#26640)
resource/aws_eip: Defaults to default regional domain when vpc not set (#26716)
resource/aws_instance: No longer fails when setting metadata_options.instance_metadata_tags (#26631)
resource/aws_lambda_function: Update the environment variables if the kms_key_arn has changed (#26696)
resource/aws_opsworks_stack: Defaults to default VPC when not supplied (#26711)
resource/aws_security_group: Defaults to default VPC when not supplied (#26697)

`v4.29.0`

Compare Source

NOTES:

resource/aws_db_instance: With AWS's retirement of EC2-Classic no new RDS DB Instances can be created referencing RDS DB Security Groups (#26525)
resource/aws_db_security_group: With AWS's retirement of EC2-Classic no new RDS DB Security Groups can be created (#26525)
resource/aws_default_vpc: With AWS's retirement of EC2-Classic theenable_classiclink and enable_classiclink_dns_support attributes have been deprecated and will be removed in a future version (#26525)
resource/aws_eip: With AWS's retirement of EC2-Classic no new non-VPC EC2 EIPs can be created (#26525)
resource/aws_elasticache_cluster: With AWS's retirement of EC2-Classic no new ElastiCache Clusters can be created referencing ElastiCache Security Groups (#26525)
resource/aws_elasticache_security_group: With AWS's retirement of EC2-Classic no new ElastiCache Security Groups can be created (#26525)
resource/aws_instance: With the retirement of EC2-Classic, aws_instance has been updated to remove support for EC2-Classic (#26532)
resource/aws_launch_configuration: With AWS's retirement of EC2-Classic no new Auto Scaling Launch Configurations can be created referencing ClassicLink (#26525)
resource/aws_opsworks_stack: With AWS's retirement of EC2-Classic no new OpsWorks Stacks can be created without referencing a VPC (#26525)
resource/aws_redshift_cluster: With AWS's retirement of EC2-Classic no new Redshift Clusters can be created referencing Redshift Security Groups (#26525)
resource/aws_redshift_security_group: With AWS's retirement of EC2-Classic no new Redshift Security Groups can be created (#26525)
resource/aws_security_group: With AWS's retirement of EC2-Classic no new Security Groups can be created without referencing a VPC (#26525)
resource/aws_vpc: With AWS's retirement of EC2-Classic no new VPCs can be created with ClassicLink enabled (#26525)
resource/aws_vpc_peering_connection: With AWS's retirement of EC2-Classic no new VPC Peering Connections can be created with ClassicLink options enabled (#26525)
resource/aws_vpc_peering_connection_accepter: With AWS's retirement of EC2-Classic no VPC Peering Connections can be accepted with ClassicLink options enabled (#26525)
resource/aws_vpc_peering_connection_options: With AWS's retirement of EC2-Classic no new VPC Peering Connection Options can be created with ClassicLink options enabled (#26525)

FEATURES:

New Data Source: aws_location_tracker_associations (#26472)
New Resource: aws_cloudfront_origin_access_control (#26508)
New Resource: aws_medialive_input (#26550)
New Resource: aws_medialive_input_security_group (#26550)
New Resource: aws_redshiftserverless_endpoint_access (#26555)

ENHANCEMENTS:

data-source/aws_cloudtrail_service_account: Add service account ID for me-central-1 AWS Region (#26572)
data-source/aws_eks_node_group: Add capacity_type attribute (#26521)
data-source/aws_elb_hosted_zone_id: Add hosted zone ID for me-central-1 AWS Region (#26572)
data-source/aws_instance: Add host_resource_group_arn attribute (#26532)
data-source/aws_lambda_function: Return most recent published version when qualifier is not set (#11195)
data-source/aws_lb_hosted_zone_id: Add hosted zone IDs for me-central-1 AWS Region (#26572)
data-source/aws_s3_bucket: Add hosted zone ID for me-central-1 AWS Region (#26572)
provider: Support me-central-1 as a valid AWS Region (#26590)
provider: Add source_identity argument to assume_role block (#25368)
resource/aws_cloudfront_distribution: Add origin_access_control_id to the origin configuration block (#26510)
resource/aws_dms_endpoint: Add redis_settings configuration block (#26411)
resource/aws_ec2_fleet: Add target_capacity_unit_type attribute to the target_capacity_specification configuration block (#26493)
resource/aws_instance: Add host_resource_group_arn attribute; improve compatibility with launching instances in a host resource group using an AMI registered with License Manager. NOTE: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing. (#26532)
resource/aws_lambda_event_source_mapping: Add amazon_managed_kafka_event_source_config and self_managed_kafka_event_source_config configuration blocks (#26560)
resource/aws_lambda_function: Add validation for function_name attribute (#25259)
resource/aws_opensearch_domain: Add support for enabling fine-grained access control on existing domains with advanced_security_options anonymous_auth_enabled (#26503)
resource/aws_redshiftserverless_endpoint_workgroup: Add endpoint attribute (#26555)
resource/aws_spot_fleet_request: Add target_capacity_unit_type argument (#26493)
resource/aws_wafv2_rule_group: Add cookies attribute to the field_to_match block (#25845)
resource/aws_wafv2_rule_group: Add json_body attribute to the field_to_match block (#24772)
resource/aws_wafv2_web_acl: Add cookies attribute to the field_to_match block (#25845)
resource/aws_wafv2_web_acl: Add json_body attribute to the field_to_match block (#24772)

BUG FIXES:

provider: No longer silently ignores assume_role block when role_arn has unknown value. (#26590)
resource/aws_security_group: Fix complex dependency violations such as using a security group with an EMR cluster (#26553)

`v4.28.0`

Compare Source

NOTES:

resource/aws_db_instance: With the retirement of EC2-Classic thesecurity_group_names attribute has been deprecated and will be removed in a future version (#26427)
resource/aws_db_security_group: With the retirement of EC2-Classic theaws_db_security_group resource has been deprecated and will be removed in a future version (#26427)
resource/aws_elasticache_cluster: With the retirement of EC2-Classic thesecurity_group_names attribute has been deprecated and will be removed in a future version (#26427)
resource/aws_elasticache_security_group: With the retirement of EC2-Classic theaws_elasticache_security_group resource has been deprecated and will be removed in a future version (#26427)
resource/aws_launch_configuration: With the retirement of EC2-Classic thevpc_classic_link_id and vpc_classic_link_security_groups attributes have been deprecated and will be removed in a future version (#26427)
resource/aws_redshift_cluster: With the retirement of EC2-Classic thecluster_security_groups attribute has been deprecated and will be removed in a future version (#26427)
resource/aws_redshift_security_group: With the retirement of EC2-Classic theaws_redshift_security_group resource has been deprecated and will be removed in a future version (#26427)
resource/aws_vpc: With the retirement of EC2-Classic theenable_classiclink and enable_classiclink_dns_support attributes have been deprecated and will be removed in a future version (#26427)
resource/aws_vpc_peering_connection: With the retirement of EC2-Classic theallow_classic_link_to_remote_vpc and allow_vpc_to_remote_classic_link attributes have been deprecated and will be removed in a future version (#26427)
resource/aws_vpc_peering_connection_accepter: With the retirement of EC2-Classic theallow_classic_link_to_remote_vpc and allow_vpc_to_remote_classic_link attributes have been deprecated and will be removed in a future version (#26427)
resource/aws_vpc_peering_connection_options: With the retirement of EC2-Classic theallow_classic_link_to_remote_vpc and allow_vpc_to_remote_classic_link attributes have been deprecated and will be removed in a future version (#26427)

FEATURES:

New Data Source: aws_ec2_network_insights_analysis (#23532)
New Data Source: aws_ec2_network_insights_path (#23532)
New Data Source: aws_ec2_transit_gateway_attachment (#26264)
New Data Source: aws_location_tracker_association (#26404)
New Resource: aws_ec2_network_insights_analysis (#23532)
New Resource: aws_ec2_transit_gateway_policy_table (#26264)
New Resource: aws_ec2_transit_gateway_policy_table_association (#26264)
New Resource: aws_grafana_workspace_api_key (#25286)
New Resource: aws_networkmanager_transit_gateway_peering (#26264)
New Resource: aws_networkmanager_transit_gateway_route_table_attachment (#26264)
New Resource: aws_redshiftserverless_workgroup (#26467)

ENHANCEMENTS:

data-source/aws_db_instance: Add network_type attribute (#26185)
data-source/aws_db_subnet_group: Add supported_network_types attribute (#26185)
data-source/aws_rds_orderable_db_instance: Add supported_network_types attribute (#26185)
resource/aws_db_instance: Add network_type argument (#26185)
resource/aws_db_subnet_group: Add supported_network_types argument (#26185)
resource/aws_glue_job: Add support for 3.9 as valid python_version value (#26407)
resource/aws_kendra_index: The document_metadata_configuration_updates argument can now be updated. Refer to the documentation for more details. (#20294)

BUG FIXES:

resource/aws_appstream_fleet: Fix crash when providing empty domain_join_info (e.g., directory_name = "") (#26454)
resource/aws_eip: Include any provider-level configured default_tags on resource Create (#26308)
resource/aws_kinesis_firehose_delivery_stream: Updating tags no longer causes an unnecessary update (#26451)
resource/aws_organizations_policy: Prevent InvalidParameter errors by handling content as generic JSON, not an IAM policy (#26279)

`v4.27.0`

Compare Source

FEATURES:

New Resource: aws_msk_serverless_cluster (#25684)
New Resource: aws_networkmanager_attachment_accepter (#26227)
New Resource: aws_networkmanager_vpc_attachment (#26227)

ENHANCEMENTS:

data-source/aws_networkfirewall_firewall: Add capacity_usage_summary, configuration_sync_state_summary, and status attributes to the firewall_status block (#26284)
resource/aws_acm_certificate: Add not_after argument (#26281)
resource/aws_acm_certificate: Add not_before argument (#26281)
resource/aws_chime_voice_connector_logging: Add enable_media_metric_logs argument (#26283)
resource/aws_cloudfront_distribution: Support http3 and http2and3 as valid values for the http_version argument (#26313)
resource/aws_inspector_assessment_template: Add event_subscription configuration block (#26334)
resource/aws_lb_target_group: Add ip_address_type argument (#26320)
resource/aws_opsworks_stack: Add plan-time validation for custom_cookbooks_source.type (#26278)

BUG FIXES:

resource/aws_appflow_flow: Correctly specify trigger_config.trigger_properties.scheduled.schedule_start_time during create and update (#26289)
resource/aws_db_instance: Prevent InvalidParameterCombination: No modifications were requested errors when only delete_automated_backups, final_snapshot_identifier and/or skip_final_snapshot change (#26286)
resource/aws_opsworks_custom_layer: Correctly apply tags during create if the stack's region is not equal to the configured AWS Region (#26278)
resource/aws_opsworks_ecs_cluster_layer: Correctly apply tags during create if the stack's region is not equal to the configured AWS Region (#26278)
resource/aws_opsworks_ganglia_layer: Correctly apply tags during create if the stack's region is not equal to the configured AWS Region (#26278)
resource/aws_opsworks_haproxy_layer: Correctly apply tags during create if the stack's region is not equal to the configured AWS Region (#26278)
resource/aws_opsworks_java_app_layer: Correctly apply tags during create if the stack's region is not equal to the configured AWS Region (#26278)
resource/aws_opsworks_memcached_layer: Correctly apply tags during create if the stack's region is not equal to the configured AWS Region (#26278)
resource/aws_opsworks_mysql_layer: Correctly apply tags during create if the stack's region is not equal to the configured AWS Region (#26278)
resource/aws_opsworks_nodejs_app_layer: Correctly apply tags during create if the stack's region is not equal to the configured AWS Region (#26278)
resource/aws_opsworks_php_app_layer: Correctly apply tags during create if the stack's region is not equal to the configured AWS Region (#26278)
resource/aws_opsworks_rails_app_layer: Correctly apply tags during create if the stack's region is not equal to the configured AWS Region (#26278)
resource/aws_opsworks_stack: Correctly apply tags during create if region is not equal to the configured AWS Region (#26278)
resource/aws_opsworks_static_web_layer: Correctly apply tags during create if the stack's region is not equal to the configured AWS Region (#26278)

`v4.26.0`

Compare Source

FEATURES:

New Data Source: aws_fsx_openzfs_snapshot (#26184)
New Data Source: aws_networkfirewall_firewall (#25495)
New Data Source: aws_prometheus_workspace (#26120)
New Resource: aws_comprehend_entity_recognizer (#26244)
New Resource: aws_connect_instance_storage_config (#26152)
New Resource: aws_directory_service_radius_settings (#14045)
New Resource: aws_directory_service_region (#25755)
New Resource: aws_dynamodb_table_replica (#26250)
New Resource: aws_location_tracker_association (#26061)

ENHANCEMENTS:

data-source/aws_directory_service_directory: Add radius_settings attribute (#14045)
data-source/aws_directory_service_directory: Set dns_ip_addresses to the owner directory's DNS IP addresses for SharedMicrosoftAD directories (#20819)
data-source/aws_elasticsearch_domain: Add throughput attribute to the ebs_options configuration block (#26045)
data-source/aws_opensearch_domain: Add throughput attribute to the ebs_options configuration block (#26045)
resource/aws_autoscaling_group: Better error handling when attempting to create Auto Scaling groups with incompatible options (#25987)
resource/aws_backup_vault: Add force_destroy argument (#26199)
resource/aws_directory_service_directory: Add desired_number_of_domain_controllers argument (#25755)
resource/aws_directory_service_directory: Add configurable timeouts for Create, Update and Delete (#25755)
resource/aws_directory_service_shared_directory: Add configurable timeouts for Delete (#25755)
resource/aws_directory_service_shared_directory_accepter: Add configurable timeouts for Create and Delete (#25755)
resource/aws_elasticsearch_domain: Add throughput attribute to the ebs_options configuration block (#26045)
resource/aws_glue_job: Add execution_class argument (#26188)
resource/aws_macie2_classification_job: Add bucket_criteria attribute to the s3_job_definition configuration block (#19837)
resource/aws_opensearch_domain: Add throughput attribute to the ebs_options configuration block (#26045)

BUG FIXES:

resource/aws_appflow_flow: Fix trigger_properties.schedule being set to trigger_properties.trigger_properties during resource read (#26240)
resource/aws_db_instance: Add retries (for handling IAM eventual consistency) when creating database replicas that use enhanced monitoring (#20926)
resource/aws_db_instance: Apply monitoring_interval and monitoring_role_arn when creating via restore_to_point_in_time (#20926)
resource/aws_dynamodb_table: Fix replica.*.propagate_tags not propagating tags to newly added replicas (#26257)
resource/aws_emr_instance_group: Handle deleted instance groups during resource read (#26154)
resource/aws_emr_instance_group: Mark instance_count as Computed to prevent diff when autoscaling is active (#26154)
resource/aws_lb_listener: Fix ValidationError when tags are added on create (#26194)
resource/aws_lb_target_group: Fix ValidationError when tags are added on create (#26194)
resource/aws_macie2_classification_job: Fix incorrect plan diff for TagScopeTerm() when updating resources (#19837)
resource/aws_security_group_rule: Disallow empty strings in prefix_list_ids (#26220)

`v4.25.0`

Compare Source

FEATURES:

New Data Source: aws_waf_subscribed_rule_group (#10563)
New Data Source: aws_wafregional_subscribed_rule_group (#10563)
New Resource: aws_kendra_data_source (#25686)
New Resource: aws_macie2_classification_export_configuration (#19856)
New Resource: aws_transcribe_language_model (#25698)

ENHANCEMENTS:

data-source/aws_alb: Allow customizable read timeout (#26121)
data-source/aws_ami: Allow customizable read timeout (#26121)
data-source/aws_ami_ids: Allow customizable read timeout (#26121)
data-source/aws_availability_zone: Allow customizable read timeout (#26121)
data-source/aws_availability_zones: Allow customizable read timeout (#26121)
data-source/aws_customer_gateway: Allow customizable read timeout (#26121)
data-source/aws_dx_location: Add available_macsec_port_speeds attribute (#26110)
data-source/aws_ebs_default_kms_key: Allow customizable read timeout (#26121)
data-source/aws_ebs_encryption_by_default: Allow customizable read timeout (#26121)
data-source/aws_ebs_snapshot: Allow customizable read timeout (#26121)
data-source/aws_ebs_snapshot_ids: Allow customizable read timeout (#26121)
data-source/aws_ebs_volume: Allow customizable read timeout (#26121)
data-source/aws_ebs_volumes: Allow customizable read timeout (#26121)
data-source/aws_ec2_client_vpn_endpoint: Allow customizable read timeout (#26121)
data-source/aws_ec2_coip_pool: Allow customizable read timeout (#26121)
data-source/aws_ec2_coip_pools: Allow customizable read timeout (#26121)
data-source/aws_ec2_host: Allow customizable read timeout (#26121)
data-source/aws_ec2_instance_type: Allow customizable read timeout (#26121)
data-source/aws_ec2_instance_type_offering: Allow customizable read timeout (#26121)
data-source/aws_ec2_instance_type_offerings: Allow customizable read timeout (#26121)
data-source/aws_ec2_instance_types: Allow customizable read timeout (#26121)
data-source/aws_ec2_local_gateway: Allow customizable read timeout (#26121)
data-source/aws_ec2_local_gateway_route_table: Allow customizable read timeout (#26121)
data-source/aws_ec2_local_gateway_route_tables: Allow customizable read timeout (#26121)
data-source/aws_ec2_local_gateway_virtual_interface: Allow customizable read timeout (#26121)
data-source/aws_ec2_local_gateway_virtual_interface_group: Allow customizable read timeout (#26121)
data-source/aws_ec2_local_gateway_virtual_interface_groups: Allow customizable read timeout (#26121)
data-source/aws_ec2_local_gateways: Allow customizable read timeout (#26121)
data-source/aws_ec2_managed_prefix_list: Allow customizable read timeout (#26121)
data-source/aws_ec2_serial_console_access: Allow customizable read timeout (#26121)
data-source/aws_ec2_spot_price: Allow customizable read timeout (#26121)
data-source/aws_ec2_transit_gateway: Allow customizable read timeout (#26121)
data-source/aws_ec2_transit_gateway_connect: Allow customizable read timeout (#26121)
data-source/aws_ec2_transit_gateway_connect_peer: Allow customizable read timeout (#26121)
data-source/aws_ec2_transit_gateway_dx_gateway_attachment: Allow customizable read timeout (#26121)
data-source/aws_ec2_transit_gateway_multicast_domain: Allow customizable read timeout (#26121)
data-source/aws_ec2_transit_gateway_peering_attachment: Allow customizable read timeout (#26121)
data-source/aws_ec2_transit_gateway_route_table: Allow customizable read timeout (#26121)
data-source/aws_ec2_transit_gateway_route_tables: Allow customizable read timeout (#26121)
data-source/aws_ec2_transit_gateway_vpc_attachment: Allow customizable read timeout (#26121)
data-source/aws_ec2_transit_gateway_vpc_attachments: Allow customizable read timeout (#26121)
data-source/aws_ec2_transit_gateway_vpn_attachment: Allow customizable read timeout (#26121)
data-source/aws_eip: Allow customizable read timeout (#26121)
data-source/aws_eips: Allow customizable read timeout (#26121)
data-source/aws_instance: Allow customizable read timeout (#26121)
data-source/aws_instances: Allow customizable read timeout (#26121)
data-source/aws_internet_gateway: Allow customizable read timeout (#26121)
data-source/aws_key_pair: Allow customizable read timeout (#26121)
data-source/aws_launch_template: Allow customizable read timeout (#26121)
data-source/aws_lb: Add preserve_host_header attribute (#26056)
data-source/aws_lb: Allow customizable read timeout (#26121)
data-source/aws_lb_listener: Allow customizable read timeout (#26121)
data-source/aws_lb_target_group: Allow customizable read timeout (#26121)
data-source/aws_nat_gateway: Allow customizable read timeout (#26121)
data-source/aws_nat_gateways: Allow customizable read timeout (#26121)
data-source/aws_network_acls: Allow customizable read timeout (#26121)
data-source/aws_network_interface: Allow customizable read timeout (#26121)
data-source/aws_network_interfaces: Allow customizable read timeout (#26121)
data-source/aws_prefix_list: Allow customizable read timeout (#26121)
data-source/aws_route: Allow customizable read timeout (#26121)
data-source/aws_route_table: Allow customizable read timeout (#26121)
data-source/aws_route_tables: Allow customizable read timeout (#26121)
data-source/aws_security_group: Allow customizable read timeout (#26121)
data-source/aws_security_groups: Allow customizable read timeout (#26121)
data-source/aws_subnet: Allow customizable read timeout (#26121)
data-source/aws_subnet_ids: Allow customizable read timeout (#26121)
data-source/aws_subnets: Allow customizable read timeout (#26121)
data-source/aws_vpc: Allow customizable read timeout (#26121)
data-source/aws_vpc_dhcp_options: Allow customizable read timeout (#26121)
data-source/aws_vpc_endpoint: Allow customizable read timeout (#26121)
data-source/aws_vpc_endpoint_service: Allow customizable read timeout (#26121)
data-source/aws_vpc_ipam_pool: Allow customizable read timeout (#26121)
data-source/aws_vpc_ipam_preview_next_cidr: Allow customizable read timeout (#26121)
data-source/aws_vpc_peering_connection: Allow customizable read timeout (#26121)
data-source/aws_vpc_peering_connections: Allow customizable read timeout (#26121)
data-source/aws_vpcs: Allow customizable read timeout (#26121)
data-source/aws_vpn_gateway: Allow customizable read timeout (#26121)
resource/aws_ecrpublic_repository: Add tags argument and tags_all attribute to support resource tagging (#26057)
resource/aws_fsx_openzfs_file_system: Add root_volume_configuration.record_size_kib argument (#26049)
resource/aws_fsx_openzfs_volume: Add record_size_kib argument (#26049)
resource/aws_globalaccelerator_accelerator: Support DUAL_STACK value for ip_address_type (#26055)
resource/aws_iam_role_policy: Add plan time validation to role argument (#26082)
resource/aws_internet_gateway: Allow customizable timeouts (#26121)
resource/aws_internet_gateway_attachment: Allow customizable timeouts (#26121)
resource/aws_lb: Add preserve_host_header argument (#26056)
resource/aws_s3_bucket: Allow customizable timeouts (#26121)

BUG FIXES:

resource/aws_api_gateway_rest_api: Add put_rest_api_mode argument to address race conditions when importing OpenAPI Specifications (#26051)
resource/aws_appstream_fleet: Fix IAM InvalidRoleException error on creation (#26060)

`v4.24.0`

Compare Source

FEATURES:

New Resource: aws_acmpca_permission (#12485)
New Resource: aws_ssm_service_setting (#13018)

ENHANCEMENTS:

data-source/aws_ecs_service: Add tags attribute (#25961)
resource/aws_datasync_task: Add includes argument (#25929)
resource/aws_guardduty_detector: Add malware_protection attribute to the datasources configuration block (#25994)
resource/aws_guardduty_organization_configuration: Add malware_protection attribute to the datasources configuration block (#25992)
resource/aws_security_group: Additional plan-time validation for name and name_prefix (#15011)
resource/aws_security_group_rule: Add configurable Create timeout (#24340)
resource/aws_ses_configuration_set: Add tracking_options.0.custom_redirect_domain argument (NOTE: This enhancement is provided as best effort due to testing limitations, i.e., the requirement of a verified domain) (#26032)

BUG FIXES:

data-source/aws_networkmanager_core_network_policy_document: Fix bug where bool values for attachment-policy.action.require-acceptance can only be true or omitted (#26010)
resource/aws_appmesh_gateway_route: Fix crash when only one of hostname rewrite or path rewrite is configured (#26012)
resource/aws_ce_anomaly_subscription:Fix crash upon adding or removing monitor ARNs to monitor_arn_list. (#25941)
resource/aws_cognito_identity_pool_provider_principal_tag: Fix read operation when using an OIDC provider (#25964)
resource/aws_route53_record: Don't ignore dualstack prefix in Route 53 Record alias names (#10672)
resource/aws_s3_bucket: Prevents unexpected import of existing bucket in us-east-1. (#26011)
resource/aws_s3_bucket: Refactored object_lock_enabled parameter's default assignment behavior to protect partitions without Object Lock available. (#25098)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever MR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Edited Jun 18, 2025 by Renovate Bot

Admin message

chore(deps): update terraform aws to v5 - autoclosed

Release Notes