Skip to content

Update Terraform aws to v6 - abandoned - #248

Open
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/aws-6.x
Open

renovate[bot] wants to merge 2 commits into
mainfrom
renovate/aws-6.x

Conversation

@renovate

@renovate renovate Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
aws (source) required_provider major ~> 5.0 → ~> 6.0

Release Notes

hashicorp/terraform-provider-aws (aws)

v6.70.0

Compare Source

BREAKING CHANGES:

  • resource/aws_route53domains_delegation_signer_record: Change the format of the import ID from domain_name,dnssec_key_id to domain_name,flags,algorithm,public_key. This is acceptable in a minor version because AWS no longer return DNSKEY flags and delegation signer records can no longer reliably be found by domain name and key ID (#​50522)

NOTES:

  • provider: The provider is now built with Go 1.26.10, which no longer trusts certificates issued through a set of compromised eMudhra intermediate CAs (CVE-2026-111943) (#​50555)
  • resource/aws_dx_macsec_key_association: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​50559)

FEATURES:

  • New List Resource: aws_cloudwatchomni_access_grant (#​50483)
  • New List Resource: aws_cloudwatchomni_access_profile (#​50471)
  • New List Resource: aws_cloudwatchomni_view (#​50428)
  • New List Resource: aws_directory_service_directory_setting (#​50145)
  • New List Resource: aws_directoryservicedata_group (#​50221)
  • New Resource: aws_bedrock_enforced_guardrail_configuration (#​47408)
  • New Resource: aws_cloudwatchomni_access_grant (#​50483)
  • New Resource: aws_cloudwatchomni_access_profile (#​50471)
  • New Resource: aws_cloudwatchomni_view (#​50428)
  • New Resource: aws_directory_service_directory_setting (#​50145)
  • New Resource: aws_directoryservicedata_group (#​50221)

ENHANCEMENTS:

  • resource/aws_arcregionswitch_plan: Add step.rds_switchover_read_replica_config argument (#​49675)
  • resource/aws_dx_macsec_key_association: Add cak_wo, cak_wo_version, ckn_wo, and ckn_wo_version arguments (#​50559)
  • resource/aws_elasticache_global_replication_group: Enable Global Replication Group Failover. Changing primary_replication_group_id no longer replaces resource. (#​47913)
  • resource/aws_guardduty_detector_feature: Add RDS_DATA_RISK as a valid value for additional_configuration.name (#​50445)
  • resource/aws_guardduty_member_detector_feature: Add RDS_DATA_RISK as a valid value for additional_configuration.name (#​50445)
  • resource/aws_guardduty_organization_configuration_feature: Add RDS_DATA_RISK as a valid value for additional_configuration.name (#​50445)
  • resource/aws_neptune_cluster: Add network_type argument (#​50331)

BUG FIXES:

  • resource/aws_guardduty_detector_feature: Fix perpetual diff when additional_configuration is omitted and AWS returns default entries such as RDS_DATA_RISK (#​50445)
  • resource/aws_guardduty_member_detector_feature: Fix perpetual diff when additional_configuration is omitted and AWS returns default entries such as RDS_DATA_RISK (#​50445)
  • resource/aws_guardduty_organization_configuration_feature: Fix forced replacement when additional_configuration is omitted and AWS returns default entries such as RDS_DATA_RISK (#​50445)
  • resource/aws_prometheus_scraper: Fix update failure on scrapers with a CloudWatch destination by omitting unchanged destination from update requests (#​50463)
  • resource/aws_route53domains_delegation_signer_record: Fix handling of null Flags and PublicKey fields for .uk/.co.uk domain registries which caused resources to be removed from state when they existed at AWS (#​50522)
  • resource/aws_secretsmanager_secret_version: Fix read and delete errors when the version is no longer current and its KMS key has been disabled or deleted, such as after the secret moved to a new key. Terraform keeps the value from state and shows a warning (#​50369)

v6.69.1

Compare Source

BUG FIXES:

  • provider: Fixes bufio.Scanner: token too long when logging requests or responses with long lines (#​50501)

v6.69.0

Compare Source

FEATURES:

  • New List Resource: aws_cloudwatchomni_domain (#​50329)
  • New List Resource: aws_cloudwatchomni_space (#​50385)
  • New List Resource: aws_devopsagent_agent_space (#​47795)
  • New List Resource: aws_pricingplanmanager_subscription (#​49235)
  • New List Resource: aws_ram_principal_association (#​50427)
  • New List Resource: aws_ssm_service_setting (#​50359)
  • New Resource: aws_cloudwatch_resource_metrics_configuration (#​50254)
  • New Resource: aws_cloudwatchomni_domain (#​50329)
  • New Resource: aws_cloudwatchomni_space (#​50385)
  • New Resource: aws_devopsagent_agent_space (#​47795)
  • New Resource: aws_pricingplanmanager_subscription (#​49235)

ENHANCEMENTS:

  • data-source/aws_resiliencehubv2_policy: Add sharing_enabled attribute (#​50241)
  • resource/aws_bedrockagent_data_source: Add data_source_configuration.managed_knowledge_base_connector_configuration.sync_schedule configuration block (#​50276)
  • resource/aws_bedrockagent_data_source: Add vector_ingestion_configuration.context_enrichment_configuration configuration block (#​50276)
  • resource/aws_cloudwatch_metric_alarm: Add evaluation_window argument to support wall clock evaluation windows (#​50373)
  • resource/aws_cloudwatch_otel_enrichment: Add include_filter and exclude_filter arguments (#​50390)
  • resource/aws_observabilityadmin_telemetry_evaluation: Add all_regions and regions attributes (#​50402)
  • resource/aws_opensearch_domain: Increase default timeouts.delete value to 120m (#​46969)
  • resource/aws_quicksight_custom_permissions: Add action, analysis, automate, chat_agent, create_chat_agents, dashboard, flow, knowledge_base, perform_flow_ui_task, publish_without_approval, research, space, use_agent_web_search, and use_bedrock_models to capabilities configuration block (#​47135)
  • resource/aws_ram_principal_association: Add resource identity support (#​50427)
  • resource/aws_rds_cluster: Add publicly_accessible argument (#​50354)
  • resource/aws_resiliencehubv2_input_source: Add resource_configuration.eks.label_selector argument (#​50075)
  • resource/aws_resiliencehubv2_policy: Add sharing_enabled argument (#​50241)
  • resource/aws_s3files_file_system: Support misconfigured lifecycle state during create and delete (#​50336)
  • resource/aws_ssm_service_setting: Add resource identity support (#​50359)
  • resource/aws_wafv2_rule_group: Add monetize action to the rule action block and add the monetization_config argument (#​48419)
  • resource/aws_wafv2_web_acl: Add monetize action to the rule action block and add the monetization_config argument (#​48419)

BUG FIXES:

  • resource/aws_agentregistry_registry: Fix validation of custom_claim-only custom JWT authorizers (#​50298)
  • resource/aws_api_gateway_method: Fix deserialization failed, expected string, got null failure during Read (#​50444)
  • resource/aws_ec2_transit_gateway_peering_attachment: Prevent erroneous forced replacement when the DescribeTransitGatewayPeeringAttachments API returns a present-but-empty Options object (#​50405)
  • resource/aws_ecs_cluster_capacity_providers: Fix delete handling for inactive clusters (#​50374)
  • resource/aws_observabilityadmin_telemetry_rule: Fix updates when all_regions is enabled (#​50150)
  • resource/aws_opensearch_domain: Remove hardcoded enum validation for cluster_config.warm_type to support newer instance types (e.g., oi2.large.search) (#​46969)

v6.68.0

Compare Source

BREAKING CHANGES:

  • resource/aws_docdb_cluster: availability_zones now validates that at most 3 items are provided at plan time. This is acceptable in a minor version because AWS would always reject requests with more than 3 availability zones at apply time. (#​50015)
  • resource/aws_rds_cluster: availability_zones now validates that at most 3 items are provided at plan time. This is acceptable in a minor version because AWS would always reject requests with more than 3 availability zones at apply time. (#​50014)

FEATURES:

  • New Data Source: aws_lambdamicrovms_image_version (#​50299)
  • New Data Source: aws_odb_autonomous_database (#​48991)
  • New List Resource: aws_ec2_transit_gateway_route (#​50202)
  • New List Resource: aws_ram_resource_association (#​49901)
  • New Resource: aws_odb_autonomous_database (#​48991)
  • New Resource: aws_odb_autonomous_database_secrets_manager_integration (#​48991)

ENHANCEMENTS:

  • resource/aws_bedrockagentcore_agent_runtime: Add platform_version argument (#​50081)
  • resource/aws_docdb_cluster: Add validation that availability_zones contains at most 3 items, failing at plan time instead of forcing a destructive replacement (#​50015)
  • resource/aws_ec2_transit_gateway_route: Add resource identity support (#​50202)
  • resource/aws_grafana_workspace: Update grafana_version argument to support v13.2 (#​50234)
  • resource/aws_network_interface: Add connection_tracking_specification argument (#​50119)
  • resource/aws_ram_resource_association: Add resource identity support (#​49901)
  • resource/aws_rds_cluster: Add validation that availability_zones contains at most 3 items, failing at plan time instead of forcing a destructive replacement (#​50014)

BUG FIXES:

  • provider: Fixes error when parsing YAML documents with literal tab characters in double-quoted string (#​50340)
  • resource/aws_odb_autonomous_database_secrets_manager_integration: Avoid redundant disable requests when the integration is already absent or terminating (#​48991)
  • resource/aws_redshiftserverless_workgroup: Restores fully reading config_parameter when not specified (#​50255)

v6.67.0

Compare Source

NOTES:

  • resource/aws_route53_record: Batched reads is experimental. The behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#​48525)

FEATURES:

  • New Ephemeral Resource: aws_bedrockruntime_apply_guardrail (#​50155)
  • New List Resource: aws_default_security_group (#​50120)
  • New List Resource: aws_directory_service_ip_route (#​50138)
  • New List Resource: aws_directoryservicedata_user (#​50001)
  • New List Resource: aws_ec2_transit_gateway_route_table_propagation (#​50193)
  • New Resource: aws_directory_service_ip_route (#​50138)
  • New Resource: aws_directory_service_ip_routes_exclusive (#​50204)
  • New Resource: aws_directoryservicedata_user (#​50001)

ENHANCEMENTS:

  • resource/aws_apprunner_custom_domain_association: Add validation to prevent trailing dot on domain_name (#​50189)
  • resource/aws_apprunner_custom_domain_association: Add validation to require enable_www_subdomain to be false for wildcard domain (#​50189)
  • resource/aws_bedrockagentcore_workload_identity: Add tags and tags_all attributes (#​49746)
  • resource/aws_bedrockagentcore_workload_identity: Add resource identity support (#​49746)
  • resource/aws_default_security_group: Add Resource Identity support (#​50120)
  • resource/aws_ec2_transit_gateway_route_table_propagation: Add Resource Identity support (#​50193)
  • resource/aws_route53_record: Add the TF_AWS_ROUTE53_RECORD_BATCH_READS environment variable to reduce AWS API calls when managing many records in a zone (#​48525)
  • resource/aws_sns_topic: Add maximum_message_size argument (#​50111)

BUG FIXES:

  • list-resource/aws_dynamodb_table_replica: Fix eventual consistency error when replacing resource. (#​50133)
  • resource/aws_apprunner_custom_domain_association: Populate dns_target when importing (#​50206)
  • resource/aws_autoscaling_group: Fix interface conversion: interface {} is nil, not map[string]interface {} panics when capacity_reservation_target is empty (#​50084)
  • resource/aws_bedrockagentcore_harness: Fix "inconsistent result after apply" when environment_variables is unset (#​50088)
  • resource/aws_config_aggregate_authorization: Fix region to authorized_aws_region migration incorrectly forcing resource replacement (#​49851)
  • resource/aws_rds_global_cluster: Wait for source cluster promotion to complete when source_db_cluster_identifier is specified, fixing race condition with downstream resources (#​48076)

v6.66.0

Compare Source

NOTES:

  • resource/aws_iam_openid_connect_provider: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​50024)

FEATURES:

  • New List Resource: aws_efs_mount_target (#​50057)
  • New List Resource: aws_iam_openid_connect_provider (#​50024)
  • New Resource: aws_msk_channel (#​49266)

ENHANCEMENTS:

  • data-source/aws_ecs_service: Add target_type and timeout_configuration attributes to the lifecycle_hook block. (#​48128)
  • resource/aws_bedrockagentcore_api_key_credential_provider: Add Resource Identity support (#​48629)
  • resource/aws_bedrockagentcore_api_key_credential_provider: Add api_key_secret_source argument and api_key_secret_config configuration block to support customer-managed AWS Secrets Manager secrets (#​48629)
  • resource/aws_ecs_service: Add target_type and timeout_configuration arguments to the lifecycle_hook configuration block to support ECS PAUSE deployment hooks. hook_target_arn and role_arn are now Optional (still required for AWS_LAMBDA hooks). (#​48128)
  • resource/aws_efs_access_point: Add Resource Identity support (#​50026)
  • resource/aws_efs_backup_policy: Add Resource Identity support (#​50026)
  • resource/aws_efs_file_system: Add Resource Identity support (#​50026)
  • resource/aws_efs_file_system_policy: Add Resource Identity support (#​50026)
  • resource/aws_efs_mount_target: Add Resource Identity support (#​50026)
  • resource/aws_efs_replication_configuration: Add Resource Identity support (#​50026)

BUG FIXES:

  • list-resource/aws_rds_cluster_instance: Cache cluster using the DBClusterIdentifier as the key (#​50040)
  • resource/aws_pipes_pipe: Fix source_parameters.self_managed_kafka_parameters.server_root_ca_certificate being sent to the API as an empty string instead of being omitted, which caused UpdatePipe to fail with a ValidationException when the attribute was unset (#​40116)
  • resource/aws_redshiftserverless_workgroup: Filter server-only config_parameter entries from state and allow newly returned config parameter keys without a provider update (#​49939)

v6.65.0

Compare Source

NOTES:

  • resource/aws_dx_bgp_peer: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49590)
  • resource/aws_dx_hosted_private_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49591)
  • resource/aws_dx_hosted_public_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49591)
  • resource/aws_dx_hosted_transit_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49591)
  • resource/aws_dx_public_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49589)

FEATURES:

  • New List Resource: aws_api_gateway_deployment (#​49820)
  • New List Resource: aws_apigatewayv2_integration (#​48425)
  • New List Resource: aws_dms_migration_project (#​49936)
  • New List Resource: aws_ec2_transit_gateway_policy_table_entry (#​49256)
  • New List Resource: aws_glue_catalog_table (#​49953)
  • New List Resource: aws_iam_group (#​49994)
  • New List Resource: aws_iam_user_policy (#​49993)
  • New List Resource: aws_lambda_resource_policy (#​49866)
  • New List Resource: aws_network_acl (#​50020)
  • New List Resource: aws_network_acl_rule (#​49916)
  • New List Resource: aws_rds_cluster_instance (#​50036)
  • New List Resource: aws_wafv2_ip_set (#​50031)
  • New Resource: aws_dms_migration_project (#​49936)
  • New Resource: aws_ec2_transit_gateway_policy_table_entry (#​49256)
  • New Resource: aws_lambda_resource_policy (#​49866)

ENHANCEMENTS:

  • data-source/aws_agentregistry_registry: Add discovery_configuration.authorizer_configuration.custom_jwt_authorizer.private_endpoint and discovery_configuration.authorizer_configuration.custom_jwt_authorizer.private_endpoint_override attributes (#​49964)
  • data-source/aws_agentregistry_registry: Add encryption_configuration attribute (#​49964)
  • resource/aws_agentregistry_registry: Add auto_detection_configuration and encryption_configuration configuration blocks (#​49964)
  • resource/aws_agentregistry_registry: Add discovery_configuration.authorizer_configuration.custom_jwt_authorizer.private_endpoint and discovery_configuration.authorizer_configuration.custom_jwt_authorizer.private_endpoint_override configuration blocks (#​49964)
  • resource/aws_api_gateway_deployment: Add resource identity support (#​49820)
  • resource/aws_apigatewayv2_integration: Add resource identity support (#​48425)
  • resource/aws_bedrockagentcore_oauth2_credential_provider: Add callback_url attribute (#​48517)
  • resource/aws_bedrockagentcore_oauth2_credential_provider: Add client_authentication_method, on_behalf_of_token_exchange_config, private_endpoint, private_endpoint_override, and private_key_jwt_config arguments to oauth2_provider_config.custom_oauth2_provider_config configuration block (#​48517)
  • resource/aws_bedrockagentcore_oauth2_credential_provider: Add client_secret_config and client_secret_source arguments to oauth2_provider_config.custom_oauth2_provider_config, oauth2_provider_config.github_oauth2_provider_config, oauth2_provider_config.google_oauth2_provider_config, oauth2_provider_config.microsoft_oauth2_provider_config, oauth2_provider_config.salesforce_oauth2_provider_config, and oauth2_provider_config.slack_oauth2_provider_config configuration blocks (#​48517)
  • resource/aws_bedrockagentcore_oauth2_credential_provider: Add oauth2_provider_config.atlassian_oauth2_provider_config, oauth2_provider_config.included_oauth2_provider_config, and oauth2_provider_config.linkedin_oauth2_provider_config configuration blocks (#​48517)
  • resource/aws_bedrockagentcore_oauth2_credential_provider: Add oauth2_provider_config.microsoft_oauth2_provider_config.tenant_id, oauth2_provider_config.microsoft_oauth2_provider_config.tenant_id_wo, and oauth2_provider_config.microsoft_oauth2_provider_config.tenant_id_wo_version arguments (#​48517)
  • resource/aws_bedrockagentcore_oauth2_credential_provider: Add token_endpoint_auth_methods attribute to all oauth2_provider_config.*.oauth_discovery configuration blocks (#​48517)
  • resource/aws_dx_bgp_peer: Add bgp_asn_long argument (#​49590)
  • resource/aws_dx_hosted_private_virtual_interface: Add bgp_asn_long argument (#​49591)
  • resource/aws_dx_hosted_public_virtual_interface: Add bgp_asn_long argument (#​49591)
  • resource/aws_dx_hosted_transit_virtual_interface: Add bgp_asn_long argument (#​49591)
  • resource/aws_dx_public_virtual_interface: Add bgp_asn_long argument (#​49589)
  • resource/aws_glue_catalog_table: Add resource identity support (#​49953)
  • resource/aws_glue_catalog_table: Change storage_descriptor.additional_locations, storage_descriptor.bucket_columns, storage_descriptor.columns.parameters, storage_descriptor.parameters, storage_descriptor.ser_de_info, storage_descriptor.ser_de_info.parameters, view_definition, view_definition.definer, view_definition.is_protected, view_definition.representations.validation_connection, view_definition.representations.view_expanded_text, view_definition.representations.view_original_text, view_definition.sub_object_version_ids, and view_definition.sub_objects to Optional and Computed (#​49953)
  • resource/aws_iam_group: Add resource identity support (#​49994)
  • resource/aws_iam_user_policy: Add resource identity support (#​49993)
  • resource/aws_mailmanager_ingress_point: Add status_to_update argument (#​49954)
  • resource/aws_network_acl: Add resource identity support (#​50020)
  • resource/aws_network_acl_rule: Remove filtering of default Ipv4 and Ipv6 rules from list (#​50017)
  • resource/aws_rds_cluster_instance: Add resource identity support (#​50036)
  • resource/aws_wafv2_ip_set: Add Resource Identity support (#​50031)

BUG FIXES:

  • resource/aws_agentregistry_registry: Correct attribute validation so that at least one of discovery_configuration.authorizer_configuration.custom_jwt_authorizer.allowed_audience, discovery_configuration.authorizer_configuration.custom_jwt_authorizer.allowed_clients, or discovery_configuration.authorizer_configuration.custom_jwt_authorizer.allowed_scopes is configured (#​50025)
  • resource/aws_amplify_app: Fix BadRequestException: Environment variables cannot have an empty key when clearing auto_branch_creation_config.environment_variables (#​49858)
  • resource/aws_amplify_branch: Fix BadRequestException: Environment variables cannot have an empty key when clearing environment_variables (#​49858)
  • resource/aws_bedrockagent_data_source: Change data_source_configuration.managed_knowledge_base_connector_configuration.deletion_protection_configuration.deletion_protection_threshold to Optional and Computed (#​49977)
  • resource/aws_mailmanager_traffic_policy: Make policy_statement optional (#​49509)
  • resource/aws_secretsmanager_secret: Fix removal of all replica blocks not being detected as a change (#​39235)
  • resource/aws_wafv2_rule_group: Fix field_to_match.single_header.name and field_to_match.single_query_argument.name rejecting values the AWS WAF API accepts, such as names containing . (#​49984)
  • resource/aws_wafv2_web_acl: Fix field_to_match.single_header.name and field_to_match.single_query_argument.name rejecting values the AWS WAF API accepts, such as names containing . (#​49984)

v6.64.0

Compare Source

FEATURES:

  • New Data Source: aws_accountaccess_application (#​49553)
  • New Data Source: aws_accountaccess_entitlements (#​49554)
  • New Data Source: aws_agentregistry_registry (#​49806)
  • New Data Source: aws_rds_events (#​49783)
  • New List Resource: aws_accountaccess_entitlement (#​49552)
  • New List Resource: aws_agentregistry_registry (#​49549)
  • New List Resource: aws_bedrock_model_invocation_job (#​49877)
  • New List Resource: aws_dms_data_provider (#​49897)
  • New List Resource: aws_dms_instance_profile (#​49747)
  • New List Resource: aws_fis_safety_lever_state (#​49841)
  • New List Resource: aws_lambda_alias (#​49706)
  • New Resource: aws_accountaccess_entitlement (#​49552)
  • New Resource: aws_agentregistry_registry (#​49549)
  • New Resource: aws_bedrock_model_invocation_job (#​49877)
  • New Resource: aws_dms_data_provider (#​49897)
  • New Resource: aws_dms_instance_profile (#​49747)
  • New Resource: aws_fis_safety_lever_state (#​49841)

ENHANCEMENTS:

  • data-source/aws_workspaces_directory: Add workspace_access_properties.access_endpoint_config attribute (#​49849)
  • resource/aws_appconfig_hosted_configuration_version: Add version_label argument (#​49881)
  • resource/aws_bedrockagentcore_harness: Add model.bedrock_model_config.additional_params argument (#​48498)
  • resource/aws_bedrockagentcore_harness: Add model.bedrock_model_config.api_format and model.openai_model_config.api_format arguments (#​48521)
  • resource/aws_bedrockagentcore_harness: Add model.gemini_model_config.additional_params and model.openai_model_config.additional_params arguments (#​48656)
  • resource/aws_bedrockagentcore_harness: Add model.litellm_model_config configuration block (#​48656)
  • resource/aws_bedrockagentcore_harness: Add skill.aws_skills, skill.git, and skill.s3 configuration blocks (#​48656)
  • resource/aws_bedrockagentcore_harness: Change max_tokens to Optional and Computed (#​48656)
  • resource/aws_bedrockagentcore_harness: Change skill.path to Optional (#​48656)
  • resource/aws_bedrockagentcore_harness: Change system_prompt to Required (#​48656)
  • resource/aws_bedrockagentcore_oauth2_credential_provider: Add Resource Identity support (#​49900)
  • resource/aws_bedrockagentcore_oauth2_credential_provider: Add configurable resource timeouts (#​49900)
  • resource/aws_cloudwatch_metric_alarm: Add warm_up_configuration configuration block (#​49873)
  • resource/aws_db_instance: Add warning_event_categories argument. When set, surface a warning diagnostic for each matching RDS event reported during create or update. Requires the rds:DescribeEvents IAM permission (#​49783)
  • resource/aws_ecs_capacity_provider: Add managed_instances_provider.auto_repair_configuration configuration block (#​49763)
  • resource/aws_msk_replicator: Add kafka_cluster.client_authentication to configure mtls or sasl_scram authentication to an Apache Kafka cluster (#​49265)
  • resource/aws_msk_replicator: Add kafka_cluster.encryption_in_transit to supply a custom root CA certificate for an Apache Kafka cluster (#​49265)
  • resource/aws_msk_replicator: Support self-managed and on-premises Apache Kafka clusters as a replication source or target, via the kafka_cluster.apache_kafka_cluster block and the replication_info_list.source_kafka_cluster_id and target_kafka_cluster_id arguments (#​49265)
  • resource/aws_rds_cluster: Add warning_event_categories argument. When set, surface a warning diagnostic for each matching RDS event reported during create or update. Requires the rds:DescribeEvents IAM permission (#​49783)
  • resource/aws_rds_cluster_instance: Add warning_event_categories argument. When set, surface a warning diagnostic for each matching RDS event reported during create or update. Requires the rds:DescribeEvents IAM permission (#​49783)

BUG FIXES:

  • data-source/aws_workspaces_directory: Fix setting workspace_access_properties: Invalid address to set errors (#​49849)
  • resource/aws_bedrockagentcore_harness: Retry Role validation failed for '...'. Please verify that the role exists and its trust policy allows assumption by this service IAM eventual consistency errors on Create. Because this error is returned while waiting for a newly-created harness to stabilize, the failed harness is deleted and creation is restarted. You may see CloudTrail events that reflect this sequence of operations (#​48656)
  • resource/aws_db_instance: Fix error when restoring multi-az SQL Server from snapshot. (#​49846)
  • resource/aws_rds_global_cluster: Fix potential eventual consistency error when re-creating resource. (#​49804)

v6.63.0

Compare Source

FEATURES:

  • New List Resource: aws_accountaccess_application (#​49551)
  • New List Resource: aws_key_pair (#​49712)
  • New List Resource: aws_lambdamicrovms_image (#​49724)
  • New List Resource: aws_lambdamicrovms_microvm (#​48984)
  • New List Resource: aws_mailmanager_archive (#​49580)
  • New List Resource: aws_opensearchserverless_access_policy (#​49717)
  • New List Resource: aws_opensearchserverless_lifecycle_policy (#​49718)
  • New List Resource: aws_opensearchserverless_security_config (#​49769)
  • New List Resource: aws_opensearchserverless_security_policy (#​49770)
  • New List Resource: aws_opensearchserverless_vpc_endpoint (#​49774)
  • New Resource: aws_accountaccess_application (#​49551)
  • New Resource: aws_datazone_policy_grant (#​47050)
  • New Resource: aws_lambdamicrovms_microvm (#​48984)
  • New Resource: aws_mailmanager_archive (#​49580)

ENHANCEMENTS:

  • data-source/aws_dx_connection: Add prefix_pool_size_ipv4, prefix_pool_size_ipv6, prefix_pool_unallocated_count_ipv4, and prefix_pool_unallocated_count_ipv6 attributes (#​49711)
  • data-source/aws_dx_connection: Add rate_limiter_status attribute (#​48910)
  • data-source/aws_eks_cluster: Add pod_gc_controller_config attribute to the kube_controller_manager_config configuration block (#​49728)
  • data-source/aws_eks_cluster_versions: Add pod_gc_controller_config attribute to the control_plane_component_config.kube_controller_manager_config configuration block (#​49730)
  • resource/aws_bedrockagentcore_gateway_target: Add Resource Identity support (#​48706)
  • resource/aws_bedrockagentcore_gateway_target: Add target_configuration.http.agentcore_runtime.schema and target_configuration.http.passthrough configuration blocks (#​48704)
  • resource/aws_bedrockagentcore_gateway_target: Add target_configuration.inference configuration block (#​48705)
  • resource/aws_bedrockagentcore_gateway_target: Add target_configuration.mcp.connector configuration block (#​48706)
  • resource/aws_dx_connection: Add prefix_pool_size_ipv4, prefix_pool_size_ipv6, prefix_pool_unallocated_count_ipv4, and prefix_pool_unallocated_count_ipv6 attributes (#​49711)
  • resource/aws_dx_connection: Add rate_limiter_status attribute (#​48910)
  • resource/aws_dx_hosted_private_virtual_interface: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 attributes (#​49711)
  • resource/aws_dx_hosted_private_virtual_interface: Add rate_limit argument (#​48910)
  • resource/aws_dx_hosted_private_virtual_interface_accepter: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 arguments (#​49711)
  • resource/aws_dx_hosted_public_virtual_interface: Add rate_limit argument (#​48910)
  • resource/aws_dx_hosted_transit_virtual_interface: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 attributes (#​49711)
  • resource/aws_dx_hosted_transit_virtual_interface: Add rate_limit argument (#​48910)
  • resource/aws_dx_hosted_transit_virtual_interface_accepter: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 arguments (#​49711)
  • resource/aws_dx_lag: Add rate_limiter_status attribute (#​48910)
  • resource/aws_dx_private_virtual_interface: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 arguments (#​49711)
  • resource/aws_dx_private_virtual_interface: Add rate_limit argument (#​48910)
  • resource/aws_dx_public_virtual_interface: Add rate_limit argument (#​48910)
  • resource/aws_dx_transit_virtual_interface: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 arguments (#​49711)
  • resource/aws_dx_transit_virtual_interface: Add rate_limit argument (#​48910)
  • resource/aws_eks_cluster: Add pod_gc_controller_config argument to the kube_controller_manager_config configuration block (#​49725)
  • resource/aws_key_pair: Add resource identity support (#​49712)
  • resource/aws_synthetics_canary: Add kms_key_arn argument (#​49406)

BUG FIXES:

  • provider: Fix assume_role_with_web_identity.web_identity_token being rejected when AWS_WEB_IDENTITY_TOKEN_FILE is set (#​49671)
  • resource/aws_db_parameter_group: Fix name_prefix length validation to allow the correct maximum of 229 characters (#​49197)
  • resource/aws_docdb_cluster_parameter_group: Fix name_prefix length validation to allow the correct maximum of 229 characters (#​49197)
  • resource/aws_observabilityadmin_telemetry_rule_for_organization: Fix updates when all_regions is enabled (#​49743)
  • resource/aws_rds_cluster_parameter_group: Fix name_prefix length validation to allow the correct maximum of 229 characters (#​49197)
  • resource/aws_redshift_namespace_registration: Fixes errors when Importing by ID (#​49690)
  • resource/aws_redshift_namespace_registration: Fixes errors when Importing by Identity (#​49690)
  • resource/aws_s3_bucket: Setting object_lock_configuration.object_lock_enabled to Enabled no longer forces a replacement (#​36530)
  • resource/aws_s3_bucket: Setting object_lock_enabled to true no longer forces a replacement (#​36530)

v6.62.0

Compare Source

NOTES:

  • resource/aws_db_instance: When manage_master_user_password is enabled, the managed secret's automatic rotation can now be disabled using aws_secretsmanager_secret_rotation with rotation_enabled = false (#​49659)
  • resource/aws_rds_cluster: When manage_master_user_password is enabled, the managed secret's automatic rotation can now be disabled using aws_secretsmanager_secret_rotation with rotation_enabled = false (#​49659)
  • resource/aws_savingsplans_savings_plan: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49264)

FEATURES:

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@renovate renovate Bot changed the title Update Terraform aws to v6 Update Terraform aws to v6 - abandoned Oct 23, 2026
@renovate

renovate Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants