Update Terraform aws to v6

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
aws (source)	required_provider	major	5.98.0 → 6.68.0

---

Release Notes

hashicorp/terraform-provider-aws (aws)

v6.68.0

Compare Source

BREAKING CHANGES:

• resource/aws_docdb_cluster: availability_zones now validates that at most 3 items are provided at plan time. This is acceptable in a minor version because AWS would always reject requests with more than 3 availability zones at apply time. (#​50015)
• resource/aws_rds_cluster: availability_zones now validates that at most 3 items are provided at plan time. This is acceptable in a minor version because AWS would always reject requests with more than 3 availability zones at apply time. (#​50014)

FEATURES:

• New Data Source: aws_lambdamicrovms_image_version (#​50299)
• New Data Source: aws_odb_autonomous_database (#​48991)
• New List Resource: aws_ec2_transit_gateway_route (#​50202)
• New List Resource: aws_ram_resource_association (#​49901)
• New Resource: aws_odb_autonomous_database (#​48991)
• New Resource: aws_odb_autonomous_database_secrets_manager_integration (#​48991)

ENHANCEMENTS:

• resource/aws_bedrockagentcore_agent_runtime: Add platform_version argument (#​50081)
• resource/aws_docdb_cluster: Add validation that availability_zones contains at most 3 items, failing at plan time instead of forcing a destructive replacement (#​50015)
• resource/aws_ec2_transit_gateway_route: Add resource identity support (#​50202)
• resource/aws_grafana_workspace: Update grafana_version argument to support v13.2 (#​50234)
• resource/aws_network_interface: Add connection_tracking_specification argument (#​50119)
• resource/aws_ram_resource_association: Add resource identity support (#​49901)
• resource/aws_rds_cluster: Add validation that availability_zones contains at most 3 items, failing at plan time instead of forcing a destructive replacement (#​50014)

BUG FIXES:

• provider: Fixes error when parsing YAML documents with literal tab characters in double-quoted string (#​50340)
• resource/aws_odb_autonomous_database_secrets_manager_integration: Avoid redundant disable requests when the integration is already absent or terminating (#​48991)
• resource/aws_redshiftserverless_workgroup: Restores fully reading config_parameter when not specified (#​50255)

v6.67.0

Compare Source

NOTES:

• resource/aws_route53_record: Batched reads is experimental. The behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#​48525)

FEATURES:

• New Ephemeral Resource: aws_bedrockruntime_apply_guardrail (#​50155)
• New List Resource: aws_default_security_group (#​50120)
• New List Resource: aws_directory_service_ip_route (#​50138)
• New List Resource: aws_directoryservicedata_user (#​50001)
• New List Resource: aws_ec2_transit_gateway_route_table_propagation (#​50193)
• New Resource: aws_directory_service_ip_route (#​50138)
• New Resource: aws_directory_service_ip_routes_exclusive (#​50204)
• New Resource: aws_directoryservicedata_user (#​50001)

ENHANCEMENTS:

• resource/aws_apprunner_custom_domain_association: Add validation to prevent trailing dot on domain_name (#​50189)
• resource/aws_apprunner_custom_domain_association: Add validation to require enable_www_subdomain to be false for wildcard domain (#​50189)
• resource/aws_bedrockagentcore_workload_identity: Add tags and tags_all attributes (#​49746)
• resource/aws_bedrockagentcore_workload_identity: Add resource identity support (#​49746)
• resource/aws_default_security_group: Add Resource Identity support (#​50120)
• resource/aws_ec2_transit_gateway_route_table_propagation: Add Resource Identity support (#​50193)
• resource/aws_route53_record: Add the TF_AWS_ROUTE53_RECORD_BATCH_READS environment variable to reduce AWS API calls when managing many records in a zone (#​48525)
• resource/aws_sns_topic: Add maximum_message_size argument (#​50111)

BUG FIXES:

• list-resource/aws_dynamodb_table_replica: Fix eventual consistency error when replacing resource. (#​50133)
• resource/aws_apprunner_custom_domain_association: Populate dns_target when importing (#​50206)
• resource/aws_autoscaling_group: Fix interface conversion: interface {} is nil, not map[string]interface {} panics when capacity_reservation_target is empty (#​50084)
• resource/aws_bedrockagentcore_harness: Fix "inconsistent result after apply" when environment_variables is unset (#​50088)
• resource/aws_config_aggregate_authorization: Fix region to authorized_aws_region migration incorrectly forcing resource replacement (#​49851)
• resource/aws_rds_global_cluster: Wait for source cluster promotion to complete when source_db_cluster_identifier is specified, fixing race condition with downstream resources (#​48076)

v6.66.0

Compare Source

NOTES:

• resource/aws_iam_openid_connect_provider: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​50024)

FEATURES:

• New List Resource: aws_efs_mount_target (#​50057)
• New List Resource: aws_iam_openid_connect_provider (#​50024)
• New Resource: aws_msk_channel (#​49266)

ENHANCEMENTS:

• data-source/aws_ecs_service: Add target_type and timeout_configuration attributes to the lifecycle_hook block. (#​48128)
• resource/aws_bedrockagentcore_api_key_credential_provider: Add Resource Identity support (#​48629)
• resource/aws_bedrockagentcore_api_key_credential_provider: Add api_key_secret_source argument and api_key_secret_config configuration block to support customer-managed AWS Secrets Manager secrets (#​48629)
• resource/aws_ecs_service: Add target_type and timeout_configuration arguments to the lifecycle_hook configuration block to support ECS PAUSE deployment hooks. hook_target_arn and role_arn are now Optional (still required for AWS_LAMBDA hooks). (#​48128)
• resource/aws_efs_access_point: Add Resource Identity support (#​50026)
• resource/aws_efs_backup_policy: Add Resource Identity support (#​50026)
• resource/aws_efs_file_system: Add Resource Identity support (#​50026)
• resource/aws_efs_file_system_policy: Add Resource Identity support (#​50026)
• resource/aws_efs_mount_target: Add Resource Identity support (#​50026)
• resource/aws_efs_replication_configuration: Add Resource Identity support (#​50026)

BUG FIXES:

• list-resource/aws_rds_cluster_instance: Cache cluster using the DBClusterIdentifier as the key (#​50040)
• resource/aws_pipes_pipe: Fix source_parameters.self_managed_kafka_parameters.server_root_ca_certificate being sent to the API as an empty string instead of being omitted, which caused UpdatePipe to fail with a ValidationException when the attribute was unset (#​40116)
• resource/aws_redshiftserverless_workgroup: Filter server-only config_parameter entries from state and allow newly returned config parameter keys without a provider update (#​49939)

v6.65.0

Compare Source

NOTES:

• resource/aws_dx_bgp_peer: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49590)
• resource/aws_dx_hosted_private_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49591)
• resource/aws_dx_hosted_public_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49591)
• resource/aws_dx_hosted_transit_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49591)
• resource/aws_dx_public_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49589)

FEATURES:

• New List Resource: aws_api_gateway_deployment (#​49820)
• New List Resource: aws_apigatewayv2_integration (#​48425)
• New List Resource: aws_dms_migration_project (#​49936)
• New List Resource: aws_ec2_transit_gateway_policy_table_entry (#​49256)
• New List Resource: aws_glue_catalog_table (#​49953)
• New List Resource: aws_iam_group (#​49994)
• New List Resource: aws_iam_user_policy (#​49993)
• New List Resource: aws_lambda_resource_policy (#​49866)
• New List Resource: aws_network_acl (#​50020)
• New List Resource: aws_network_acl_rule (#​49916)
• New List Resource: aws_rds_cluster_instance (#​50036)
• New List Resource: aws_wafv2_ip_set (#​50031)
• New Resource: aws_dms_migration_project (#​49936)
• New Resource: aws_ec2_transit_gateway_policy_table_entry (#​49256)
• New Resource: aws_lambda_resource_policy (#​49866)

ENHANCEMENTS:

• data-source/aws_agentregistry_registry: Add discovery_configuration.authorizer_configuration.custom_jwt_authorizer.private_endpoint and discovery_configuration.authorizer_configuration.custom_jwt_authorizer.private_endpoint_override attributes (#​49964)
• data-source/aws_agentregistry_registry: Add encryption_configuration attribute (#​49964)
• resource/aws_agentregistry_registry: Add auto_detection_configuration and encryption_configuration configuration blocks (#​49964)
• resource/aws_agentregistry_registry: Add discovery_configuration.authorizer_configuration.custom_jwt_authorizer.private_endpoint and discovery_configuration.authorizer_configuration.custom_jwt_authorizer.private_endpoint_override configuration blocks (#​49964)
• resource/aws_api_gateway_deployment: Add resource identity support (#​49820)
• resource/aws_apigatewayv2_integration: Add resource identity support (#​48425)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add callback_url attribute (#​48517)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add client_authentication_method, on_behalf_of_token_exchange_config, private_endpoint, private_endpoint_override, and private_key_jwt_config arguments to oauth2_provider_config.custom_oauth2_provider_config configuration block (#​48517)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add client_secret_config and client_secret_source arguments to oauth2_provider_config.custom_oauth2_provider_config, oauth2_provider_config.github_oauth2_provider_config, oauth2_provider_config.google_oauth2_provider_config, oauth2_provider_config.microsoft_oauth2_provider_config, oauth2_provider_config.salesforce_oauth2_provider_config, and oauth2_provider_config.slack_oauth2_provider_config configuration blocks (#​48517)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add oauth2_provider_config.atlassian_oauth2_provider_config, oauth2_provider_config.included_oauth2_provider_config, and oauth2_provider_config.linkedin_oauth2_provider_config configuration blocks (#​48517)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add oauth2_provider_config.microsoft_oauth2_provider_config.tenant_id, oauth2_provider_config.microsoft_oauth2_provider_config.tenant_id_wo, and oauth2_provider_config.microsoft_oauth2_provider_config.tenant_id_wo_version arguments (#​48517)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add token_endpoint_auth_methods attribute to all oauth2_provider_config.*.oauth_discovery configuration blocks (#​48517)
• resource/aws_dx_bgp_peer: Add bgp_asn_long argument (#​49590)
• resource/aws_dx_hosted_private_virtual_interface: Add bgp_asn_long argument (#​49591)
• resource/aws_dx_hosted_public_virtual_interface: Add bgp_asn_long argument (#​49591)
• resource/aws_dx_hosted_transit_virtual_interface: Add bgp_asn_long argument (#​49591)
• resource/aws_dx_public_virtual_interface: Add bgp_asn_long argument (#​49589)
• resource/aws_glue_catalog_table: Add resource identity support (#​49953)
• resource/aws_glue_catalog_table: Change storage_descriptor.additional_locations, storage_descriptor.bucket_columns, storage_descriptor.columns.parameters, storage_descriptor.parameters, storage_descriptor.ser_de_info, storage_descriptor.ser_de_info.parameters, view_definition, view_definition.definer, view_definition.is_protected, view_definition.representations.validation_connection, view_definition.representations.view_expanded_text, view_definition.representations.view_original_text, view_definition.sub_object_version_ids, and view_definition.sub_objects to Optional and Computed (#​49953)
• resource/aws_iam_group: Add resource identity support (#​49994)
• resource/aws_iam_user_policy: Add resource identity support (#​49993)
• resource/aws_mailmanager_ingress_point: Add status_to_update argument (#​49954)
• resource/aws_network_acl: Add resource identity support (#​50020)
• resource/aws_network_acl_rule: Remove filtering of default Ipv4 and Ipv6 rules from list (#​50017)
• resource/aws_rds_cluster_instance: Add resource identity support (#​50036)
• resource/aws_wafv2_ip_set: Add Resource Identity support (#​50031)

BUG FIXES:

• resource/aws_agentregistry_registry: Correct attribute validation so that at least one of discovery_configuration.authorizer_configuration.custom_jwt_authorizer.allowed_audience, discovery_configuration.authorizer_configuration.custom_jwt_authorizer.allowed_clients, or discovery_configuration.authorizer_configuration.custom_jwt_authorizer.allowed_scopes is configured (#​50025)
• resource/aws_amplify_app: Fix BadRequestException: Environment variables cannot have an empty key when clearing auto_branch_creation_config.environment_variables (#​49858)
• resource/aws_amplify_branch: Fix BadRequestException: Environment variables cannot have an empty key when clearing environment_variables (#​49858)
• resource/aws_bedrockagent_data_source: Change data_source_configuration.managed_knowledge_base_connector_configuration.deletion_protection_configuration.deletion_protection_threshold to Optional and Computed (#​49977)
• resource/aws_mailmanager_traffic_policy: Make policy_statement optional (#​49509)
• resource/aws_secretsmanager_secret: Fix removal of all replica blocks not being detected as a change (#​39235)
• resource/aws_wafv2_rule_group: Fix field_to_match.single_header.name and field_to_match.single_query_argument.name rejecting values the AWS WAF API accepts, such as names containing . (#​49984)
• resource/aws_wafv2_web_acl: Fix field_to_match.single_header.name and field_to_match.single_query_argument.name rejecting values the AWS WAF API accepts, such as names containing . (#​49984)

v6.64.0

Compare Source

FEATURES:

• New Data Source: aws_accountaccess_application (#​49553)
• New Data Source: aws_accountaccess_entitlements (#​49554)
• New Data Source: aws_agentregistry_registry (#​49806)
• New Data Source: aws_rds_events (#​49783)
• New List Resource: aws_accountaccess_entitlement (#​49552)
• New List Resource: aws_agentregistry_registry (#​49549)
• New List Resource: aws_bedrock_model_invocation_job (#​49877)
• New List Resource: aws_dms_data_provider (#​49897)
• New List Resource: aws_dms_instance_profile (#​49747)
• New List Resource: aws_fis_safety_lever_state (#​49841)
• New List Resource: aws_lambda_alias (#​49706)
• New Resource: aws_accountaccess_entitlement (#​49552)
• New Resource: aws_agentregistry_registry (#​49549)
• New Resource: aws_bedrock_model_invocation_job (#​49877)
• New Resource: aws_dms_data_provider (#​49897)
• New Resource: aws_dms_instance_profile (#​49747)
• New Resource: aws_fis_safety_lever_state (#​49841)

ENHANCEMENTS:

• data-source/aws_workspaces_directory: Add workspace_access_properties.access_endpoint_config attribute (#​49849)
• resource/aws_appconfig_hosted_configuration_version: Add version_label argument (#​49881)
• resource/aws_bedrockagentcore_harness: Add model.bedrock_model_config.additional_params argument (#​48498)
• resource/aws_bedrockagentcore_harness: Add model.bedrock_model_config.api_format and model.openai_model_config.api_format arguments (#​48521)
• resource/aws_bedrockagentcore_harness: Add model.gemini_model_config.additional_params and model.openai_model_config.additional_params arguments (#​48656)
• resource/aws_bedrockagentcore_harness: Add model.litellm_model_config configuration block (#​48656)
• resource/aws_bedrockagentcore_harness: Add skill.aws_skills, skill.git, and skill.s3 configuration blocks (#​48656)
• resource/aws_bedrockagentcore_harness: Change max_tokens to Optional and Computed (#​48656)
• resource/aws_bedrockagentcore_harness: Change skill.path to Optional (#​48656)
• resource/aws_bedrockagentcore_harness: Change system_prompt to Required (#​48656)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add Resource Identity support (#​49900)
• resource/aws_bedrockagentcore_oauth2_credential_provider: Add configurable resource timeouts (#​49900)
• resource/aws_cloudwatch_metric_alarm: Add warm_up_configuration configuration block (#​49873)
• resource/aws_db_instance: Add warning_event_categories argument. When set, surface a warning diagnostic for each matching RDS event reported during create or update. Requires the rds:DescribeEvents IAM permission (#​49783)
• resource/aws_ecs_capacity_provider: Add managed_instances_provider.auto_repair_configuration configuration block (#​49763)
• resource/aws_msk_replicator: Add kafka_cluster.client_authentication to configure mtls or sasl_scram authentication to an Apache Kafka cluster (#​49265)
• resource/aws_msk_replicator: Add kafka_cluster.encryption_in_transit to supply a custom root CA certificate for an Apache Kafka cluster (#​49265)
• resource/aws_msk_replicator: Support self-managed and on-premises Apache Kafka clusters as a replication source or target, via the kafka_cluster.apache_kafka_cluster block and the replication_info_list.source_kafka_cluster_id and target_kafka_cluster_id arguments (#​49265)
• resource/aws_rds_cluster: Add warning_event_categories argument. When set, surface a warning diagnostic for each matching RDS event reported during create or update. Requires the rds:DescribeEvents IAM permission (#​49783)
• resource/aws_rds_cluster_instance: Add warning_event_categories argument. When set, surface a warning diagnostic for each matching RDS event reported during create or update. Requires the rds:DescribeEvents IAM permission (#​49783)

BUG FIXES:

• data-source/aws_workspaces_directory: Fix setting workspace_access_properties: Invalid address to set errors (#​49849)
• resource/aws_bedrockagentcore_harness: Retry Role validation failed for '...'. Please verify that the role exists and its trust policy allows assumption by this service IAM eventual consistency errors on Create. Because this error is returned while waiting for a newly-created harness to stabilize, the failed harness is deleted and creation is restarted. You may see CloudTrail events that reflect this sequence of operations (#​48656)
• resource/aws_db_instance: Fix error when restoring multi-az SQL Server from snapshot. (#​49846)
• resource/aws_rds_global_cluster: Fix potential eventual consistency error when re-creating resource. (#​49804)

v6.63.0

Compare Source

FEATURES:

• New List Resource: aws_accountaccess_application (#​49551)
• New List Resource: aws_key_pair (#​49712)
• New List Resource: aws_lambdamicrovms_image (#​49724)
• New List Resource: aws_lambdamicrovms_microvm (#​48984)
• New List Resource: aws_mailmanager_archive (#​49580)
• New List Resource: aws_opensearchserverless_access_policy (#​49717)
• New List Resource: aws_opensearchserverless_lifecycle_policy (#​49718)
• New List Resource: aws_opensearchserverless_security_config (#​49769)
• New List Resource: aws_opensearchserverless_security_policy (#​49770)
• New List Resource: aws_opensearchserverless_vpc_endpoint (#​49774)
• New Resource: aws_accountaccess_application (#​49551)
• New Resource: aws_datazone_policy_grant (#​47050)
• New Resource: aws_lambdamicrovms_microvm (#​48984)
• New Resource: aws_mailmanager_archive (#​49580)

ENHANCEMENTS:

• data-source/aws_dx_connection: Add prefix_pool_size_ipv4, prefix_pool_size_ipv6, prefix_pool_unallocated_count_ipv4, and prefix_pool_unallocated_count_ipv6 attributes (#​49711)
• data-source/aws_dx_connection: Add rate_limiter_status attribute (#​48910)
• data-source/aws_eks_cluster: Add pod_gc_controller_config attribute to the kube_controller_manager_config configuration block (#​49728)
• data-source/aws_eks_cluster_versions: Add pod_gc_controller_config attribute to the control_plane_component_config.kube_controller_manager_config configuration block (#​49730)
• resource/aws_bedrockagentcore_gateway_target: Add Resource Identity support (#​48706)
• resource/aws_bedrockagentcore_gateway_target: Add target_configuration.http.agentcore_runtime.schema and target_configuration.http.passthrough configuration blocks (#​48704)
• resource/aws_bedrockagentcore_gateway_target: Add target_configuration.inference configuration block (#​48705)
• resource/aws_bedrockagentcore_gateway_target: Add target_configuration.mcp.connector configuration block (#​48706)
• resource/aws_dx_connection: Add prefix_pool_size_ipv4, prefix_pool_size_ipv6, prefix_pool_unallocated_count_ipv4, and prefix_pool_unallocated_count_ipv6 attributes (#​49711)
• resource/aws_dx_connection: Add rate_limiter_status attribute (#​48910)
• resource/aws_dx_hosted_private_virtual_interface: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 attributes (#​49711)
• resource/aws_dx_hosted_private_virtual_interface: Add rate_limit argument (#​48910)
• resource/aws_dx_hosted_private_virtual_interface_accepter: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 arguments (#​49711)
• resource/aws_dx_hosted_public_virtual_interface: Add rate_limit argument (#​48910)
• resource/aws_dx_hosted_transit_virtual_interface: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 attributes (#​49711)
• resource/aws_dx_hosted_transit_virtual_interface: Add rate_limit argument (#​48910)
• resource/aws_dx_hosted_transit_virtual_interface_accepter: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 arguments (#​49711)
• resource/aws_dx_lag: Add rate_limiter_status attribute (#​48910)
• resource/aws_dx_private_virtual_interface: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 arguments (#​49711)
• resource/aws_dx_private_virtual_interface: Add rate_limit argument (#​48910)
• resource/aws_dx_public_virtual_interface: Add rate_limit argument (#​48910)
• resource/aws_dx_transit_virtual_interface: Add prefix_pool_allocated_count_ipv4 and prefix_pool_allocated_count_ipv6 arguments (#​49711)
• resource/aws_dx_transit_virtual_interface: Add rate_limit argument (#​48910)
• resource/aws_eks_cluster: Add pod_gc_controller_config argument to the kube_controller_manager_config configuration block (#​49725)
• resource/aws_key_pair: Add resource identity support (#​49712)
• resource/aws_synthetics_canary: Add kms_key_arn argument (#​49406)

BUG FIXES:

• provider: Fix assume_role_with_web_identity.web_identity_token being rejected when AWS_WEB_IDENTITY_TOKEN_FILE is set (#​49671)
• resource/aws_db_parameter_group: Fix name_prefix length validation to allow the correct maximum of 229 characters (#​49197)
• resource/aws_docdb_cluster_parameter_group: Fix name_prefix length validation to allow the correct maximum of 229 characters (#​49197)
• resource/aws_observabilityadmin_telemetry_rule_for_organization: Fix updates when all_regions is enabled (#​49743)
• resource/aws_rds_cluster_parameter_group: Fix name_prefix length validation to allow the correct maximum of 229 characters (#​49197)
• resource/aws_redshift_namespace_registration: Fixes errors when Importing by ID (#​49690)
• resource/aws_redshift_namespace_registration: Fixes errors when Importing by Identity (#​49690)
• resource/aws_s3_bucket: Setting object_lock_configuration.object_lock_enabled to Enabled no longer forces a replacement (#​36530)
• resource/aws_s3_bucket: Setting object_lock_enabled to true no longer forces a replacement (#​36530)

v6.62.0

Compare Source

NOTES:

• resource/aws_db_instance: When manage_master_user_password is enabled, the managed secret's automatic rotation can now be disabled using aws_secretsmanager_secret_rotation with rotation_enabled = false (#​49659)
• resource/aws_rds_cluster: When manage_master_user_password is enabled, the managed secret's automatic rotation can now be disabled using aws_secretsmanager_secret_rotation with rotation_enabled = false (#​49659)
• resource/aws_savingsplans_savings_plan: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49264)

FEATURES:

• New List Resource: aws_db_instance (#​49602)
• New List Resource: aws_dsql_cluster (#​49657)
• New List Resource: aws_dsql_cluster_policy (#​49676)
• New List Resource: aws_ecr_lifecycle_policy (#​49696)
• New List Resource: aws_ecs_cluster (#​49682)
• New List Resource: aws_pinpointsmsvoicev2_keyword (#​48967)
• New Resource: aws_pinpointsmsvoicev2_keyword (#​48967)
• New Resource: aws_sesv2_multi_region_endpoint (#​49660)

ENHANCEMENTS:

• data-source/aws_resiliencehubv2_service: Add associated_system.user_journey_ids attribute (#​49603)
• resource/aws_bedrockagentcore_browser: Add plan-time validation of name (#​48766)
• resource/aws_bedrockagentcore_memory: Add Resource Identity support (#​48766)
• resource/aws_bedrockagentcore_memory: Allow adding indexed_key entries in place instead of forcing a new resource (#​48877)
• resource/aws_bedrockagentcore_memory: Change indexed_key from List to Set to ignore ordering (#​48877)
• resource/aws_bedrockagentcore_memory_strategy: Add Resource Identity support (#​48766)
• resource/aws_bedrockagentcore_memory_strategy: Add configuration.self_managed_configuration argument in support of self-managed strategies (#​48766)
• resource/aws_bedrockagentcore_memory_strategy: Add memory_record_schema argument (#​48765)
• resource/aws_bedrockagentcore_memory_strategy: Add plan-time validation of description (#​48766)
• resource/aws_bedrockagentcore_memory_strategy: Change description to Optional and Computed (#​48766)
• resource/aws_cloudfront_function: Validate name, code, and comment against CloudFront's documented constraints during plan instead of failing at apply time (#​49395)
• resource/aws_db_instance: Add resource identity support (#​49602)
• resource/aws_dsql_cluster: Add resource identity support (#​49657)
• resource/aws_dx_private_virtual_interface: Add bgp_asn_long argument (#​49587)
• resource/aws_dx_transit_virtual_interface: Add bgp_asn_long argument (#​49588)
• resource/aws_ecs_cluster: Add resource identity support (#​49682)
• resource/aws_elasticache_replication_group: Add auth_token_wo and auth_token_wo_version write-only arguments (#​49268)
• resource/aws_observabilityadmin_centralization_rule_for_organization: Add tag_propagation_configuration configuration block to rule.destination.destination_logs_configuration, and tag_propagation_status and tag_propagation_failure_reason attributes (#​49656)
• resource/aws_resiliencehubv2_service: Add user_journey_ids argument to the associated_system configuration block (#​49603)
• resource/aws_secretsmanager_secret_rotation: rotation_enabled is now configurable (previously read-only) and can be set to false to disable rotation for a secret. This is particularly useful for secrets whose rotation is otherwise managed by AWS, such as an RDS master user password secret created with manage_master_user_password (#​49659)
• resource/aws_secretsmanager_secret_rotation: rotation_rules is now optional, and must be omitted when rotation_enabled is false (#​49659)
• resource/aws_workspaces_directory: Add workspace_access_properties.access_endpoint_config argument (#​49668)

BUG FIXES:

• resource/aws_bedrockagentcore_harness: Correct plan-time validation of name (#​48766)
• resource/aws_bedrockagentcore_memory_strategy: Force resource replacement when name is modified (#​48766)
• resource/aws_bedrockagentcore_registry: Correct plan-time validation of name (#​48766)
• resource/aws_cloudwatch_log_resource_policy: Fixes error when importing by identity when using resource-scope (#​49614)
• resource/aws_elasticache_cluster: Add plan-time validation to reject transit_encryption_enabled for Redis and Valkey engines, which are only supported on aws_elasticache_replication_group (#​49114)
• resource/aws_resiliencehubv2_input_source: Change resource_configuration.resource_tag from List to Set to ignore ordering (#​49585)
• resource/aws_s3_account_public_access_block: Fixes eventual consistency issue on creation (#​49687)
• resource/aws_savingsplan_savings_plan: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49678)
• resource/aws_savingsplan_savings_plan: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​49679)
• resource/aws_savingsplan_savings_plan: Mark purchase_time as Optional and Computed (#​49679)
• resource/aws_savingsplan_savings_plan: Treat queued as a target state during creation (#​49678)
• resource/aws_savingsplans_savings_plan: Mark upfront_payment_amount as Computed to fix a Provider produced inconsistent result after apply error for No Upfront savings plans (#​49264)

v6.61.0

Compare Source

FEATURES:

• New Data Source: aws_odb_iam_role_association (#​46794)
• New List Resource: aws_ec2_ami_launch_permission (#​49461)
• New List Resource: aws_iam_instance_profile (#​49576)
• New List Resource: aws_lambdacore_network_connector (#​49387)
• New List Resource: aws_mailmanager_relay (#​49394)
• New List Resource: aws_resiliencehubv2_assertion (#​48329)
• New List Resource: aws_resiliencehubv2_service_function (#​48328)
• New List Resource: aws_resiliencehubv2_user_journey (#​48330)
• New Resource: aws_dsql_cluster_policy (#​47748)
• New Resource: aws_lambdacore_network_connector (#​49387)
• New Resource: aws_lambdamicrovms_image (#​48950)
• New Resource: aws_mailmanager_relay (#​49394)
• New Resource: aws_odb_iam_role_association (#​46794)
• New Resource: aws_resiliencehubv2_assertion (#​48329)
• New Resource: aws_resiliencehubv2_service_function (#​48328)
• New Resource: aws_resiliencehubv2_user_journey (#​48330)
• New Resource: aws_securityhub_feature_v2 (#​49503)

ENHANCEMENTS:

• data-source/aws_fsx_ontap_file_system: Add network_type attribute (#​49512)
• data-source/aws_fsx_windows_file_system: Add network_type attribute (#​49514)
• data-source/aws_lb_listener_rule: Add condition.source_ip.ip_address_type attribute (#​49476)
• data-source/aws_resiliencehubv2_service: Add associated_system attribute (#​49498)
• data-source/aws_vpclattice_service: Add idle_timeout_seconds attribute (#​49540)
• resource/aws_bedrockagentcore_harness: Adds attribute environment_actual (#​48815)
• resource/aws_ec2_ami_launch_permission: Add resource identity support (#​49461)
• resource/aws_fsx_ontap_file_system: Add network_type argument (#​49512)
• resource/aws_fsx_openzfs_file_system: Add network_type argument (#​49513)
• resource/aws_fsx_windows_file_system: Add network_type argument (#​49514)
• resource/aws_lb_listener_rule: Add condition.source_ip.ip_address_type argument (#​49476)
• resource/aws_lb_listener_rule: Change condition.source_ip.values to Optional (#​49476)
• resource/aws_medialive_channel: Add resource identity ([#​49532](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/4

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.