terraform(deps): Bump terraform-aws-modules/iam/aws from 5.55.0 to 6.0.0 in /terraform/aws/analytical-platform/oidc

[dependabot]

Bumps terraform-aws-modules/iam/aws from 5.55.0 to 6.0.0.

Release notes

Sourced from terraform-aws-modules/iam/aws's releases.

v6.0.0

6.0.0 (2025-08-13)

⚠ BREAKING CHANGES

• Upgrade AWS provider and min required Terraform version to 6.0 and 1.5.7 respectively (#585)

See docs/UPGRADE-6.0.md for further details

List of backwards incompatible changes

• Terraform v1.5.7 is now minimum supported version

• AWS provider v6.0.0 is now minimum supported version

• The ability to allow roles to assume their own roles has been removed. This was previously added as part of helping users mitigate https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/. Going forward, users will need to mitigate this on the application side (i.e. - do not have a role assume itself), or update the trust policy in their implementation to continue using this behavior. It is strongly recommended to mitigate this by not having the role assume itself.

• iam-account:

  • The aws_caller_identity data source and associated outputs have been removed. Users should instead use the data source directly in their configuration

• iam-assumable-role has been renamed to iam-role

• iam-assumable-role-with-oidc has been merged into iam-role

• iam-assumable-role-with-saml has been merged into iam-role

• iam-assumable-roles has been removed; iam-role should be used instead

• iam-assumable-roles-with-saml has been removed; iam-role should be used instead

• iam-github-oidc-provider has been renamed to iam-oidc-provider

• iam-github-oidc-role has been merged into iam-role

• iam-group-with-policies has been renamed to iam-group

• iam-group-with-assumable-roles-policy has been merged into iam-group

• iam-eks-role has been removed; iam-role-for-service-accounts or eks-pod-identity should be used instead

• iam-role-for-service-accounts-eks has been renamed to iam-role-for-service-accounts

  • Individual policy creation and attachment has been consolidated under one policy creation and attachment
  • Default values that enable permissive permissions have been removed; users will need to be explicit about the scope of access (i.e. ARNs) they provide when enabling permissions
  • AppMesh policy support has been removed due to service reaching end of support

Additional changes

Modified

• Variable definitions now contain detailed object types in place of the previously used any type

• iam-group

  • Policy management has been updated to support extending the policy created by the sub-module, as well as adding additional policies that will be attached to the group
  • The role assumption permissions has been removed from the policy; users can extend the policy to add this if needed via permissions
  • Default create conditional is now true instead of false

• iam-role

  • The use of individual variables to control/manipulate the assume role trust policy have been replaced by a generic trust_policy_permissions variable. This allows for any number of custom statements to be added to the role's trust policy.
  • custom_role_policy_arns has been renamed to policies and now accepts a map of name: policy-arn pairs; this allows for both existing policies and policies that will get created at the same time as the role. This also replaces the admin, readonly, and poweruser policy ARN variables and their associated attach_*_policy variables.
  • Default create conditional is now true instead of false
  • force_detach_policies has been removed; this is now always true
  • Support for inline policies has been added

• iam-role-for-service-accounts

... (truncated)

Changelog

Sourced from terraform-aws-modules/iam/aws's changelog.

6.0.0 (2025-08-13)

⚠ BREAKING CHANGES

• Upgrade AWS provider and min required Terraform version to 6.0 and 1.5.7 respectively (#585)

Features

• Upgrade AWS provider and min required Terraform version to 6.0 and 1.5.7 respectively (#585) (31b31d7)

5.60.0 (2025-08-08)

Features

• Add ssm:GetParametersByPath for external secrets (#583) (8e4541d)

5.59.0 (2025-07-05)

Features

• Update EBS CSI IAM policy to match current upstream project (#575) (49efa8c)

5.58.0 (2025-06-04)

Features

• Add FSx OpenZFS IRSA (#565) (51c9e96)

5.57.0 (2025-06-04)

Features

• Update IAM policy for AWS Gateway Controller (#563) (343e5fe)

5.56.0 (2025-06-04)

Features

• Update AWS Load Balancer controller policy to match v2.13 of the upstream project (#573) (4ce604e)

Commits

• 4d779a5 chore(release): version 6.0.0 [skip ci]
• 31b31d7 feat!: Upgrade AWS provider and min required Terraform version to 6.0 and `...
• c29ec1e chore(release): version 5.60.0 [skip ci]
• 8e4541d feat: Add ssm:GetParametersByPath for external secrets (#583)
• c4f752d docs: Correct typos in documentation and comments (#582)
• 0792d7f chore(release): version 5.59.0 [skip ci]
• 49efa8c feat: Update EBS CSI IAM policy to match current upstream project (#575)
• a787dce chore(release): version 5.58.0 [skip ci]
• 51c9e96 feat: Add FSx OpenZFS IRSA (#565)
• 453e9d6 chore(release): version 5.57.0 [skip ci]
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

Terraform Component 🧱: aws-analytical-platform-oidc

Checkov 🛂: success

Static Analysis Override Label 🏷️: false

Pusher: BrianEllwood, Action: pull_request, Working Directory: terraform/aws/analytical-platform/oidc, Workflow: Terraform, Marker: aws-analytical-platform-oidc_static_analysis

[dependabot]

A newer version of terraform-aws-modules/iam/aws exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

[tam (tamsinforbes)]

Dependabot (@dependabot) rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[tam (tamsinforbes)]

Dependabot (@dependabot) recreate