Update Terraform aws to v5 (main)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aws (source)	required_provider	major	>= 3.0, < 4.0.0 -> < 6.0.0

---

Release Notes

hashicorp/terraform-provider-aws

v5.0.0

Compare Source

BREAKING CHANGES:

• data-source/aws_api_gateway_rest_api: minimum_compression_size is now a string type to allow values set via the body attribute to be properly computed. (#​30969)
• data-source/aws_connect_hours_of_operation: The hours_of_operation_arn attribute has been removed (#​31484)
• data-source/aws_db_instance: With the retirement of EC2-Classic the db_security_groups attribute has been removed (#​30966)
• data-source/aws_elasticache_cluster: With the retirement of EC2-Classic the security_group_names attribute has been removed (#​30966)
• data-source/aws_elasticache_replication_group: Remove number_cache_clusters, replication_group_description arguments -- use num_cache_clusters, and description, respectively, instead (#​31008)
• data-source/aws_iam_policy_document: Don't add empty statement.sid values to json attribute value (#​28539)
• data-source/aws_iam_policy_document: source_json and override_json have been removed -- use source_policy_documents and override_policy_documents, respectively, instead (#​30829)
• data-source/aws_identitystore_group: The filter argument has been removed (#​31312)
• data-source/aws_identitystore_user: The filter argument has been removed (#​31312)
• data-source/aws_launch_configuration: With the retirement of EC2-Classic the vpc_classic_link_id and vpc_classic_link_security_groups attributes have been removed (#​30966)
• data-source/aws_redshift_cluster: With the retirement of EC2-Classic the cluster_security_groups attribute has been removed (#​30966)
• data-source/aws_secretsmanager_secret: The rotation_enabled, rotation_lambda_arn and rotation_rules attributes have been removed (#​31487)
• data-source/aws_vpc_peering_connection: With the retirement of EC2-Classic the allow_classic_link_to_remote_vpc and allow_vpc_to_remote_classic_link attributes have been removed (#​30966)
• provider: The assume_role.duration_seconds, assume_role_with_web_identity.duration_seconds, s3_force_path_style, shared_credentials_file and skip_get_ec2_platforms attributes have been removed (#​31155)
• provider: The aws_subnet_ids data source has been removed (#​31140)
• provider: With the retirement of EC2-Classic the aws_db_security_group resource has been removed (#​30966)
• provider: With the retirement of EC2-Classic the aws_elasticache_security_group resource has been removed (#​30966)
• provider: With the retirement of EC2-Classic the aws_redshift_security_group resource has been removed (#​30966)
• provider: With the retirement of Macie Classic the aws_macie_member_account_association resource has been removed (#​31058)
• provider: With the retirement of Macie Classic the aws_macie_s3_bucket_association resource has been removed (#​31058)
• resource/aws_acmpca_certificate_authority: The status attribute has been removed (#​31084)
• resource/aws_api_gateway_rest_api: minimum_compression_size is now a string type to allow values set via the body attribute to be properly computed. (#​30969)
• resource/aws_autoscaling_attachment: alb_target_group_arn has been removed -- use lb_target_group_arn instead (#​30828)
• resource/aws_autoscaling_group: Remove deprecated tags attribute (#​30842)
• resource/aws_budgets_budget: The cost_filters attribute has been removed (#​31395)
• resource/aws_ce_anomaly_subscription: The threshold attribute has been removed (#​30374)
• resource/aws_cloudwatch_event_target: The ecs_target.propagate_tags attribute now has no default value (#​25233)
• resource/aws_codebuild_project: The secondary_sources.auth and source.auth attributes have been removed (#​31483)
• resource/aws_connect_hours_of_operation: The hours_of_operation_arn attribute has been removed (#​31484)
• resource/aws_connect_queue: The quick_connect_ids_associated attribute has been removed (#​31376)
• resource/aws_connect_routing_profile: The queue_configs_associated attribute has been removed (#​31376)
• resource/aws_db_instance: Remove name - use db_name instead (#​31232)
• resource/aws_db_instance: With the retirement of EC2-Classic the security_group_names attribute has been removed (#​30966)
• resource/aws_db_instance: id is no longer the AWS database identifier - id is now the dbi-resource-id. Refer to identifier instead of id to use the database's identifier (#​31232)
• resource/aws_default_vpc: With the retirement of EC2-Classic the enable_classiclink and enable_classiclink_dns_support attributes have been removed (#​30966)
• resource/aws_dms_endpoint: s3_settings.ignore_headers_row has been removed (#​30452)
• resource/aws_docdb_cluster: snapshot_identifier change now properly forces replacement (#​29409)
• resource/aws_ec2_client_vpn_endpoint: The status attribute has been removed (#​31223)
• resource/aws_ec2_client_vpn_network_association: The security_groups attribute has been removed (#​31396)
• resource/aws_ec2_client_vpn_network_association: The status attribute has been removed (#​31223)
• resource/aws_ecs_cluster: The capacity_providers and default_capacity_provider_strategy attributes have been removed (#​31346)
• resource/aws_eip: With the retirement of EC2-Classic the standard domain is no longer supported (#​30966)
• resource/aws_eip_association: With the retirement of EC2-Classic the standard domain is no longer supported (#​30966)
• resource/aws_elasticache_cluster: With the retirement of EC2-Classic the security_group_names attribute has been removed (#​30966)
• resource/aws_elasticache_replication_group: Remove availability_zones, number_cache_clusters, replication_group_description arguments -- use preferred_cache_cluster_azs, num_cache_clusters, and description, respectively, instead (#​31008)
• resource/aws_elasticache_replication_group: Remove cluster_mode configuration block -- use top-level num_node_groups and replicas_per_node_group instead (#​31008)
• resource/aws_kinesis_firehose_delivery_stream: Remove s3_configuration attribute from the root of the resource. s3_configuration is now a part of the following blocks: elasticsearch_configuration, opensearch_configuration, redshift_configuration, splunk_configuration, and http_endpoint_configuration (#​31138)
• resource/aws_kinesis_firehose_delivery_stream: Remove s3 as an option for destination. Use extended_s3 instead (#​31138)
• resource/aws_kinesis_firehose_delivery_stream: Rename extended_s3_configuration.0.s3_backup_configuration.0.buffer_size and extended_s3_configuration.0.s3_backup_configuration.0.buffer_interval to extended_s3_configuration.0.s3_backup_configuration.0.buffering_size and extended_s3_configuration.0.s3_backup_configuration.0.buffering_interval, respectively (#​31141)
• resource/aws_kinesis_firehose_delivery_stream: Rename redshift_configuration.0.s3_backup_configuration.0.buffer_size and redshift_configuration.0.s3_backup_configuration.0.buffer_interval to redshift_configuration.0.s3_backup_configuration.0.buffering_size and redshift_configuration.0.s3_backup_configuration.0.buffering_interval, respectively (#​31141)
• resource/aws_kinesis_firehose_delivery_stream: Rename s3_configuration.0.buffer_size and s3_configuration.0.buffer_internval to s3_configuration.0.buffering_size and s3_configuration.0.buffering_internval, respectively (#​31141)
• resource/aws_launch_configuration: With the retirement of EC2-Classic the vpc_classic_link_id and vpc_classic_link_security_groups attributes have been removed (#​30966)
• resource/aws_lightsail_instance: The ipv6_address attribute has been removed (#​31489)
• resource/aws_medialive_multiplex_program: The statemux_settings attribute has been removed. Use statmux_settings argument instead (#​31034)
• resource/aws_msk_cluster: The broker_node_group_info.ebs_volume_size attribute has been removed (#​31324)
• resource/aws_neptune_cluster: snapshot_identifier change now properly forces replacement (#​29409)
• resource/aws_networkmanager_core_network: Removed policy_document argument -- use aws_networkmanager_core_network_policy_attachment resource instead (#​30875)
• resource/aws_rds_cluster: The engine argument is now required and has no default (#​31112)
• resource/aws_rds_cluster: snapshot_identifier change now properly forces replacement (#​29409)
• resource/aws_rds_cluster_instance: The engine argument is now required and has no default (#​31112)
• resource/aws_redshift_cluster: With the retirement of EC2-Classic the cluster_security_groups attribute has been removed (#​30966)
• resource/aws_route: instance_id can no longer be set in configurations. Use network_interface_id instead, for example, setting network_interface_id to aws_instance.test.primary_network_interface_id. (#​30804)
• resource/aws_route_table: route.*.instance_id can no longer be set in configurations. Use route.*.network_interface_id instead, for example, setting network_interface_id to aws_instance.test.primary_network_interface_id. (#​30804)
• resource/aws_secretsmanager_secret: The rotation_enabled, rotation_lambda_arn and rotation_rules attributes have been removed (#​31487)
• resource/aws_security_group: With the retirement of EC2-Classic non-VPC security groups are no longer supported (#​30966)
• resource/aws_security_group_rule: With the retirement of EC2-Classic non-VPC security groups are no longer supported (#​30966)
• resource/aws_servicecatalog_product: Changes to any provisioning_artifact_parameters arguments now properly trigger a replacement. This fixes incorrect behavior, but may technically be breaking for configurations expecting non-functional in-place updates. (#​31061)
• resource/aws_vpc: With the retirement of EC2-Classic the enable_classiclink and enable_classiclink_dns_support attributes have been removed (#​30966)
• resource/aws_vpc_peering_connection: With the retirement of EC2-Classic the allow_classic_link_to_remote_vpc and allow_vpc_to_remote_classic_link attributes have been removed (#​30966)
• resource/aws_vpc_peering_connection_accepter: With the retirement of EC2-Classic the allow_classic_link_to_remote_vpc and allow_vpc_to_remote_classic_link attributes have been removed (#​30966)
• resource/aws_vpc_peering_connection_options: With the retirement of EC2-Classic the allow_classic_link_to_remote_vpc and allow_vpc_to_remote_classic_link attributes have been removed (#​30966)
• resource/aws_wafv2_web_acl: The statement.managed_rule_group_statement.excluded_rule and statement.rule_group_reference_statement.excluded_rule attributes have been removed (#​31374)
• resource/aws_wafv2_web_acl_logging_configuration: The redacted_fields.all_query_arguments, redacted_fields.body and redacted_fields.single_query_argument attributes have been removed (#​31486)

NOTES:

• data-source/aws_elasticache_replication_group: Update configurations to use description instead of the replication_group_description argument (#​31008)
• data-source/aws_elasticache_replication_group: Update configurations to use num_cache_clusters instead of the number_cache_clusters argument (#​31008)
• data-source/aws_opensearch_domain: The kibana_endpoint attribute has been deprecated. All configurations using kibana_endpoint should be updated to use the dashboard_endpoint attribute instead (#​31490)
• data-source/aws_quicksight_data_set: The tags_all attribute has been deprecated and will be removed in a future version (#​31162)
• data-source/aws_redshift_service_account: The aws_redshift_service_account data source has been deprecated and will be removed in a future version. AWS documentation states that a service principal name should be used instead of an AWS account ID in any relevant IAM policy (#​31006)
• data-source/aws_service_discovery_service: The tags_all attribute has been deprecated and will be removed in a future version (#​31162)
• resource/aws_api_gateway_rest_api: Update configurations with minimum_compression_size set to pass the value as a string. Valid values remain the same. (#​30969)
• resource/aws_autoscaling_attachment: Update configurations to use lb_target_group_arn instead of alb_target_group_arn which has been removed (#​30828)
• resource/aws_db_event_subscription: Configurations that define source_ids using the id attribute of aws_db_instance must be updated to use identifier instead - for example, source_ids = [aws_db_instance.example.id] must be updated to source_ids = [aws_db_instance.example.identifier] (#​31232)
• resource/aws_db_instance: Configurations that define replicate_source_db using the id attribute of aws_db_instance must be updated to use identifier instead - for example, replicate_source_db = aws_db_instance.example.id must be updated to replicate_source_db = aws_db_instance.example.identifier (#​31232)
• resource/aws_db_instance: The change of what id is, namely, a DBI Resource ID now versus DB Identifier previously, has far-reaching consequences. Configurations that refer to, for example, aws_db_instance.example.id will now have errors and must be changed to use identifier instead, for example, aws_db_instance.example.identifier (#​31232)
• resource/aws_db_instance_role_association: Configurations that define db_instance_identifier using the id attribute of aws_db_instance must be updated to use identifier instead - for example, db_instance_identifier = aws_db_instance.example.id must be updated to db_instance_identifier = aws_db_instance.example.identifier (#​31232)
• resource/aws_db_proxy_target: Configurations that define db_instance_identifier using the id attribute of aws_db_instance must be updated to use identifier instead - for example, db_instance_identifier = aws_db_instance.example.id must be updated to db_instance_identifier = aws_db_instance.example.identifier (#​31232)
• resource/aws_db_snapshot: Configurations that define db_instance_identifier using the id attribute of aws_db_instance must be updated to use identifier instead - for example, db_instance_identifier = aws_db_instance.example.id must be updated to db_instance_identifier = aws_db_instance.example.identifier (#​31232)
• resource/aws_docdb_cluster: Changes to the snapshot_identifier attribute will now trigger a replacement, rather than an in-place update. This corrects the previous behavior which resulted in a successful apply, but did not actually restore the cluster from the designated snapshot. (#​29409)
• resource/aws_dx_gateway_association: The vpn_gateway_id attribute has been deprecated. All configurations using vpn_gateway_id should be updated to use the associated_gateway_id attribute instead (#​31384)
• resource/aws_elasticache_replication_group: Update configurations to use description instead of the replication_group_description argument (#​31008)
• resource/aws_elasticache_replication_group: Update configurations to use num_cache_clusters instead of the number_cache_clusters argument (#​31008)
• resource/aws_elasticache_replication_group: Update configurations to use preferred_cache_cluster_azs instead of the availability_zones argument (#​31008)
• resource/aws_elasticache_replication_group: Update configurations to use top-level num_node_groups and replicas_per_node_group instead of cluster_mode.0.num_node_groups and cluster_mode.0.replicas_per_node_group, respectively (#​31008)
• resource/aws_flow_log: The log_group_name attribute has been deprecated. All configurations using log_group_name should be updated to use the log_destination attribute instead (#​31382)
• resource/aws_guardduty_organization_configuration: The auto_enable argument has been deprecated. Use the auto_enable_organization_members argument instead. (#​30736)
• resource/aws_neptune_cluster: Changes to the snapshot_identifier attribute will now trigger a replacement, rather than an in-place update. This corrects the previous behavior which resulted in a successful apply, but did not actually restore the cluster from the designated snapshot. (#​29409)
• resource/aws_networkmanager_core_network: Update configurations to use the aws_networkmanager_core_network_policy_attachment resource instead of the policy_document argument (#​30875)
• resource/aws_opensearch_domain: The engine_version attribute no longer has a default value. When omitted, the underlying AWS API will use the latest OpenSearch engine version. (#​31568)
• resource/aws_opensearch_domain: The kibana_endpoint attribute has been deprecated. All configurations using kibana_endpoint should be updated to use the dashboard_endpoint attribute instead (#​31490)
• resource/aws_rds_cluster: Changes to the snapshot_identifier attribute will now trigger a replacement, rather than an in-place update. This corrects the previous behavior which resulted in a successful apply, but did not actually restore the cluster from the designated snapshot. (#​29409)
• resource/aws_rds_cluster: Configurations not including the engine argument must be updated to include engine as it is now required. Previously, not including engine was equivalent to engine = "aurora" and created a MySQL-5.6-compatible cluster (#​31112)
• resource/aws_rds_cluster_instance: Configurations not including the engine argument must be updated to include engine as it is now required. Previously, not including engine was equivalent to engine = "aurora" and created a MySQL-5.6-compatible cluster instance (#​31112)
• resource/aws_route: Since instance_id can no longer be set in configurations, use network_interface_id instead. For example, set network_interface_id to aws_instance.test.primary_network_interface_id. (#​30804)
• resource/aws_route_table: Since route.*.instance_id can no longer be set in configurations, use route.*.network_interface_id instead. For example, set network_interface_id to aws_instance.test.primary_network_interface_id. (#​30804)
• resource/aws_ssm_association: The instance_id attribute has been deprecated. All configurations using instance_id should be updated to use the targets attribute instead (#​31380)

ENHANCEMENTS:

• provider: Allow computed tags on resources (#​30793)
• provider: Allow default_tags and resource tags to include zero values "" (#​30793)
• provider: Duplicate default_tags can now be included and will be overwritten by resource tags (#​30793)
• resource/aws_db_instance: Updates to identifier and identifier_prefix will no longer cause the database instance to be destroyed and recreated (#​31232)
• resource/aws_eip: Deprecate vpc attribute. Use domain instead (#​31567)
• resource/aws_guardduty_organization_configuration: Add auto_enable_organization_members attribute (#​30736)
• resource/aws_kinesis_firehose_delivery_stream: Add s3_configuration to elasticsearch_configuration, opensearch_configuration, redshift_configuration, splunk_configuration, and http_endpoint_configuration (#​31138)
• resource/aws_opensearch_domain: Removed engine_version default value (#​31568)
• resource/aws_wafv2_web_acl: Support rule_action_override on rule_group_reference_statement (#​31374)

BUG FIXES:

• resource/aws_ecs_capacity_provider: Allow an instance_warmup_period of 0 in the auto_scaling_group_provider.managed_scaling configuration block (#​24005)
• resource/aws_launch_template: Remove default values in metadata_options to allow default condition (#​30545)
• resource/aws_s3_bucket: Fix bucket_regional_domain_name not including region for buckets in us-east-1 (#​25724)
• resource/aws_s3_object: Remove acl default in order to work with S3 buckets that have ACL disabled (#​27197)
• resource/aws_s3_object_copy: Remove acl default in order to work with S3 buckets that have ACL disabled (#​27197)
• resource/aws_servicecatalog_product: Changes to provisioning_artifact_parameters arguments now properly trigger a replacement (#​31061)
• resource/aws_vpc_peering_connection: Fix crash in vpcPeeringConnectionOptionsEqual (#​30966)

v4.67.0

Compare Source

NOTES:

• resource/aws_lightsail_domain_entry: The id attribute is now comma-delimited (#​30820)

FEATURES:

• New Data Source: aws_connect_user (#​26156)
• New Data Source: aws_connect_vocabulary (#​26158)
• New Data Source: aws_organizations_policy (#​30920)
• New Data Source: aws_redshiftserverless_namespace (#​31250)
• New Resource: aws_quicksight_template (#​30453)
• New Resource: aws_quicksight_template_alias (#​31310)
• New Resource: aws_quicksight_vpc_connection (#​31309)

ENHANCEMENTS:

• aws_quicksight_data_set: Add support for configuring refresh properties (#​30744)
• data-source/aws_acmpca_certificate_authority: Add key_storage_security_standard attribute (#​31280)
• data-source/aws_elastic_beanstalk_hosted_zone: Add hosted zone ID for ap-southeast-3 AWS Region (#​31248)
• data-source/aws_s3_bucket: Set hosted_zone_id for cn-north-1 AWS China Region (#​31247)
• resource/aws_acmpca_certificate_authority: Add key_storage_security_standard argument (#​31280)
• resource/aws_cloudwatch_metric_stream: Add metric_names to include_filter and exclude_filter configuration blocks (#​31288)
• resource/aws_dms_endpoint: Add ability to use the db2-zos IBM DB2 for z/OS engine (#​31291)
• resource/aws_fsx_ontap_file_system: Allow in-place update of route_table_ids (#​31251)
• resource/aws_fsx_ontap_file_system: Support setting throughput_capacity to 4096 (#​31251)
• resource/aws_rds_cluster: Add ability to specify Aurora IO Optimized storage_type (#​31336)
• resource/aws_s3_bucket: Set hosted_zone_id for cn-north-1 AWS China Region (#​31247)

BUG FIXES:

• resource/aws_appintegrations_data_integration: Correctly read tags into state (#​31241)
• resource/aws_config_remediation_configuration: Change parameter attribute to TypeList for better diff calculation (#​31315)
• resource/aws_iam_openid_connect_provider: Change client_id_list from TypeList to TypeSet as order is not significant (#​31253)
• resource/aws_servicecatalog_provisioned_product: Fix to properly send stack_set_provisioned_preferences.0.accounts on create and update (#​31293)
• resource/aws_servicecatalog_provisioned_product: Fix to properly set stack_set_provisioned_preferences integer types failure_tolerance_count, failure_tolerance_percentage, max_concurrency_count, max_concurrency_percentage (#​31289)
• resource/aws_ssm_activation: Fix various ValidationException errors on resource Create (#​31340)

v4.66.1

Compare Source

BUG FIXES:

• resource/aws_appautoscaling_target: Fix InvalidParameter: 1 validation error(s) found. minimum field size of 1, ListTagsForResourceInput.ResourceARN. related to Application Auto Scaling resource tagging introduced in v4.66.0 (#​31214)

v4.66.0

Compare Source

NOTES:

• resource/aws_instance: The cpu_core_count argument is deprecated in favor of the cpu_options block. The cpu_options block can set core_count (#​31035)
• resource/aws_instance: The cpu_threads_per_core argument is deprecated in favor of the cpu_options block. The cpu_options block can set threads_per_core (#​31035)

FEATURES:

• New Data Source: aws_appintegrations_event_integration (#​24965)
• New Data Source: aws_dms_replication_instance (#​15406)
• New Data Source: aws_vpclattice_auth_policy (#​30898)
• New Data Source: aws_vpclattice_service_network (#​30904)
• New Resource: aws_account_primary_contact (#​26123)
• New Resource: aws_appintegrations_data_integration (#​24941)
• New Resource: aws_chimesdkvoice_voice_profile_domain (#​30977)
• New Resource: aws_directory_service_trust (#​31037)
• New Resource: aws_vpclattice_access_log_subscription (#​30896)
• New Resource: aws_vpclattice_auth_policy (#​30891)
• New Resource: aws_vpclattice_resource_policy (#​30900)
• New Resource: aws_vpclattice_target_group_attachment (#​31039)

ENHANCEMENTS:

• data-source/aws_autoscaling_group: Add max_instance_lifetime attribute (#​31067)
• data-source/aws_autoscaling_group: Add mixed_instances_policy attribute (#​31067)
• data-source/aws_autoscaling_group: Add predicted_capacity attribute (#​31067)
• data-source/aws_autoscaling_group: Add suspended_processes attribute (#​31067)
• data-source/aws_autoscaling_group: Add tag attribute (#​31067)
• data-source/aws_autoscaling_group: Add warm_pool_size attribute (#​31067)
• data-source/aws_autoscaling_group: Add warm_pool attribute (#​31067)
• datasource/aws_launch_template: Add amd_sev_snp attribute (#​31035)
• resource/aws_appautoscaling_policy: Add metrics to the target_tracking_scaling_policy_configuration.customized_metric_specification configuration block in support of metric math (#​30172)
• resource/aws_appautoscaling_target: Add arn attribute (#​30172)
• resource/aws_appautoscaling_target: Add tags argument and tags_all attribute to support resource tagging (#​30172)
• resource/aws_autoscaling_group: Add predicted_capacity attribute (#​31067)
• resource/aws_autoscaling_group: Add warm_pool_size attribute (#​31067)
• resource/aws_directory_service_conditional_forwarder: Add plan time validation for remote_domain_name (#​31037)
• resource/aws_directory_service_directory: Correct plan time validation for remote_domain_name (#​31037)
• resource/aws_elasticache_user: Add support for defining custom timeouts (#​31076)
• resource/aws_fsx_lustre_file_system: Add root_squash_configuration argument (#​31073)
• resource/aws_glue_catalog_database: Add tagging support (#​31071)
• resource/aws_grafana_workspace: Make grafana_version optional so that its value can be specified in configuration (#​31083)
• resource/aws_instance: Add amd_sev_snp argument (#​31035)
• resource/aws_instance: Add cpu_options argument (#​31035)
• resource/aws_lambda_function: Add support for java17 runtime value (#​31027)
• resource/aws_lambda_layer_version: Add support for java17 compatible_runtimes value (#​31028)
• resource/aws_launch_template: Add amd_sev_snp argument (#​31035)
• resource/aws_medialive_channel: Added H265 support. (#​30908)
• resource/aws_rds_cluster_role_association: Add configurable Create and Delete timeouts (#​31015)
• resource/aws_redshift_scheduled_action: Add plan time validation for name argument (#​31020)
• resource/aws_redshiftserverless_workgroup: Add support for defining custom timeouts (#​31054)
• resource/aws_sagemaker_domain: Add domain_settings.r_studio_server_pro_domain_settings, default_user_settings.canvas_app_settings.model_register_settings, and default_user_settings.r_studio_server_pro_app_settings arguments (#​31031)
• resource/aws_sagemaker_endpoint_configuration: Add async_inference_config.output_config.notification_config.include_inference_response_in and async_inference_config.output_config.s3_failure_path arguments (#​31070)
• resource/aws_sagemaker_user_profile: Add user_settings.canvas_app_settings.model_register_settings and user_settings.r_studio_server_pro_app_settings arguments (#​31072)
• resource/aws_servicecatalog_provisioning_artifact: Add provisioning_artifact_id attribute (#​31086)
• resource/aws_sfn_state_machine: Add configurable timeouts (#​31097)
• resource/aws_spot_fleet_request: Add 'aws_spot_fleet_request.context' argument (#​30918)
• resource/aws_vpn_connection: Add tunnel1_enable_tunnel_lifecycle_control and tunnel2_enable_tunnel_lifecycle_control arguments (#​31064)

BUG FIXES:

• data-source/aws_nat_gateway: Guarantee that all attributes are set when the NAT Gateway is associated with a single address (#​31118)
• data-source/aws_networkfirewall_firewall_policy: Add firewall_policy.stateful_rule_group_reference.override attribute, fixing setting firewall_policy: Invalid address to set error (#​31089)
• resource/aws_connect_routing_profile: Remove the limit on the maximum number of queues that can be associated with a routing profile. Batch processing is now done when there are more than 10 queues associated or disassociated at a time. (#​30895)
• resource/aws_db_instance: Consider delete-precheck a valid pending state for resource deletion (#​31047)
• resource/aws_inspector2_enabler: Correctly supports LAMBDA resource scanning (#​31038)
• resource/aws_inspector2_enabler: Correctly supports multiple accounts (#​31038)
• resource/aws_inspector2_enabler: No longer calls Disable API for status checking (#​31038)
• resource/aws_nat_gateway: Guarantee that all attributes are set when the NAT Gateway is associated with a single address (#​31118)
• resource/aws_rds_cluster_instance: Consider delete-precheck a valid pending state for resource deletion (#​31047)
• resource/aws_servicecatalog_provisioned_product: Changes in the provisioning_artifact_name attribute are now reflected correctly in AWS (#​26371)
• resource/aws_servicecatalog_provisioned_product: Fix product_name update handling (#​31094)

v4.65.0

Compare Source

NOTES:

• data-source/aws_db_instance: With the retirement of EC2-Classic thedb_security_groups attribute has been deprecated and will be removed in a future version (#​30919)
• data-source/aws_elasticache_cluster: With the retirement of EC2-Classic thesecurity_group_names attribute has been deprecated and will be removed in a future version (#​30919)
• data-source/aws_launch_configuration: With the retirement of EC2-Classic thevpc_classic_link_id and vpc_classic_link_security_groups attributes have been deprecated and will be removed in a future version (#​30919)
• data-source/aws_redshift_cluster: With the retirement of EC2-Classic the cluster_security_groups attribute has been deprecated and will be removed in a future version (#​30919)
• resource/aws_config_organization_custom_policy_rule: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​21373)

FEATURES:

• New Data Source: aws_api_gateway_authorizer (#​28148)
• New Data Source: aws_api_gateway_authorizers (#​28148)
• New Data Source: aws_dms_replication_subnet_group (#​30832)
• New Data Source: aws_dms_replication_task (#​30967)
• New Data Source: aws_ssmcontacts_contact (#​30667)
• New Data Source: aws_ssmcontacts_contact_channel (#​30667)
• New Data Source: aws_ssmcontacts_plan (#​30667)
• New Data Source: aws_ssmincidents_response_plan (#​30665)
• New Resource: aws_config_organization_custom_policy_rule (#​21373)
• New Resource: aws_quicksight_folder_membership (#​30871)
• New Resource: aws_quicksight_refresh_schedule (#​30788)
• New Resource: aws_ssmcontacts_contact (#​30667)
• New Resource: aws_ssmcontacts_contact_channel (#​30667)
• New Resource: aws_ssmcontacts_plan (#​30667)
• New Resource: aws_ssmincidents_response_plan (#​30665)
• New Resource: aws_synthetics_group (#​30678)
• New Resource: aws_synthetics_group_association (#​30678)

ENHANCEMENTS:

• data-source/aws_ami_ids: Add include_deprecated argument (#​30294)
• data-source/aws_backup_report_plan: Add accounts, organization_units and regions attributes to the report_setting block (#​28309)
• data-source/aws_imagebuilder_image: Add containers attribute to the output_resources block (#​30899)
• resource/aws_appstream_stack: Add streaming_experience_settings attribute (#​28512)
• resource/aws_backup_report_plan: Add accounts, organization_units and regions attributes to the report_setting block (#​28309)
• resource/aws_chime_voice_connector_streaming: Add media_insights_configuration argument (#​30713)
• resource/aws_db_subnet_group: Add vpc_id attribute (#​30775)
• resource/aws_fis_experiment_template: Add support for Cluster Network Actions to actions.*.target (#​27337)
• resource/aws_gamelift_game_session_queue: Add custom_event_data argument (#​26206)
• resource/aws_imagebuilder_image: Add containers attribute to the output_resources block (#​30899)
• resource/aws_networkfirewall_rule_group: Add limit for reference_sets (#​30759)
• resource/aws_networkmanager_core_network: Wait for the network policy to be in the READY_TO_EXECUTE state before executing any changes (#​30879)
• resource/aws_s3outposts_endpoint: Add access_type and customer_owned_ipv4_pool arguments (#​23839)
• resource/aws_wafv2_web_acl: Add token_domains argument (#​30340)
• various IAM resource types: more detailed error messages for invalid policy document JSON (#​27502)

BUG FIXES:

• resource/aws_api_gateway_api_key: Fix value minimum length verification when specified. (#​30894)
• resource/aws_apprunner_service: Allow additional instance_configuration.cpu and instance_configuration.memory values (#​30889)
• resource/aws_dms_replication_task: Fix perpetual diff on dms replication_task settings (#​30885)
• resource/aws_ds_shared_directory: Properly handle paged response objects on read (#​30914)
• resource/aws_ecs_service: Fix removal of service_registries configuration block (#​30852)
• resource/aws_redshiftdata_statement: Fix ValidationException errors reading expired statements (#​26343)
• resource/aws_vpc_endpoint_route_table_association: Retry resource Create for EC2 eventual consistency (#​30994)
• resource/aws_vpc_endpoint_service_allowed_principal: Fix too many results error (#​30974)

v4.64.0

Compare Source

FEATURES:

• New Data Source: aws_dms_endpoint (#​30717)
• New Data Source: aws_fsx_windows_file_system (#​28622)
• New Data Source: aws_networkfirewall_resource_policy (#​25474)
• New Data Source: aws_prometheus_workspaces (#​28574)
• New Data Source: aws_redshiftserverless_workgroup (#​29208)
• New Data Source: aws_route53_resolver_query_log_config (#​29111)
• New Data Source: aws_sesv2_configuration_set (#​30108)
• New Data Source: aws_vpclattice_listener (#​30843)
• New Resource: aws_cloudwatch_event_endpoint (#​25846)
• New Resource: aws_vpclattice_listener (#​30711)
• New Resource: aws_vpclattice_listener_rule (#​30784)

ENHANCEMENTS:

• data-source/aws_cloudfront_response_headers_policy: Add remove_headers_config attribute (#​28940)
• data-source/aws_ecs_task_definition: Add execution_role_arn attribute (#​28662)
• data-source/aws_eks_node_group: Add launch_template attribute (#​30780)
• data-source/aws_iam_role: Add role_last_used attribute (#​30750)
• data-source/aws_kms_key: Add cloud_hsm_cluster_id, custom_key_store_id, key_spec, pending_deletion_window_in_days, and xks_key_configuration attributes (#​29250)
• data-source/aws_lakeformation_data_lake_settings: Add allow_external_data_filtering, external_data_filtering_allow_list and authorized_session_tag_value_list attributes (#​30207)
• data-source/aws_outposts_outpost: Add lifecycle_status, site_arn, supported_hardware_type and tags attributes (#​30754)
• data-source/aws_servicequotas_service_quota: Add usage_metric attribute (#​29499)
• data-source/aws_subnet: Add enable_lni_at_device_index attribute (#​30798)
• resource/aws_appsync_datasource: Add opensearchservice_config argument (#​29578)
• resource/aws_cloudfront_response_headers_policy: Add remove_headers_config argument (#​28940)
• resource/aws_cloudwatch_event_target: Add ecs_target.ordered_placement_strategy argument ([#​28384](https://togithub.com/hashicorp/terraform-provider-aws/issues/

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠ Warning: custom changes will be lost.