Update Terraform aws to v6 by renovate[bot] · Pull Request #56 · redhatcloudx/infrastructure

renovate · 2025-06-18T21:02:43Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
aws (source)	required_provider	major	`5.60.0` → `6.55.0`

Release Notes

hashicorp/terraform-provider-aws (aws)

`v6.55.0`

Compare Source

FEATURES:

New Data Source: aws_elasticache_service_updates (#44608)
New List Resource: aws_autoscaling_group (#48928)
New List Resource: aws_cloudwatch_log_stream (#48878)
New List Resource: aws_kinesis_firehose_delivery_stream (#48946)
New List Resource: aws_network_interface (#48887)
New List Resource: aws_rds_cluster (#48948)
New List Resource: aws_sfn_state_machine (#48840)

ENHANCEMENTS:

resource/aws_bedrock_guardrail: Add updated_at attribute (#48881)
resource/aws_bedrockagentcore_agent_runtime: Add allowed_workload_configuration, private_endpoint, and private_endpoint_overrides configuration blocks to authorizer_configuration.custom_jwt_authorizer, and the read-only require_service_s3_endpoint attribute to network_configuration.network_mode_config (#48654)
resource/aws_bedrockagentcore_gateway: Add allowed_workload_configuration, private_endpoint, and private_endpoint_overrides configuration blocks to authorizer_configuration.custom_jwt_authorizer (#48654)
resource/aws_bedrockagentcore_harness: Add allowed_workload_configuration, private_endpoint, and private_endpoint_overrides configuration blocks to authorizer_configuration.custom_jwt_authorizer (#48654)
resource/aws_bedrockagentcore_harness: Add require_service_s3_endpoint argument to network_configuration.network_mode_config (#48654)
resource/aws_bedrockagentcore_registry: Add allowed_workload_configuration, private_endpoint, and private_endpoint_overrides configuration blocks to authorizer_configuration.custom_jwt_authorizer (#48654)
resource/aws_msk_replicator: Add consumer_group_offset_sync_mode attribute to consumer_group_replication block (#47670)
resource/aws_network_interface: Add resource identity support (#48887)
resource/aws_rds_cluster: Add resource identity support (#48948)

BUG FIXES:

resource/aws_bedrockagentcore_harness: Fix Unsupported Type errors when no memory is configured (#48654)
resource/aws_config_organization_managed_rule: Fix interface conversion: interface {} is nil, not *configservice.DescribeOrganizationConfigRuleStatusesOutput panics on delete (#48845)

`v6.54.0`

Compare Source

NOTES:

resource/aws_sagemaker_endpoint_configuration: Because we cannot easily test the behavior of capacity_reservation_config, it is best effort and we ask for community help in testing (#45926)
resource/aws_ssoadmin_region: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#48126)

FEATURES:

New Data Source: aws_route53profiles_profile (#48780)
New List Resource: aws_bedrockagentcore_browser_profile (#46862)
New List Resource: aws_codepipeline (#48808)
New List Resource: aws_lambda_function_scaling_config (#48229)
New List Resource: aws_scheduler_schedule (#48828)
New List Resource: aws_ssoadmin_region (#48126)
New List Resource: aws_workspaces_pool (#42678)
New Resource: aws_bedrockagentcore_browser_profile (#46862)
New Resource: aws_lambda_function_scaling_config (#48229)
New Resource: aws_ssoadmin_region (#48126)
New Resource: aws_workspaces_pool (#42678)

ENHANCEMENTS:

action/aws_codebuild_start_build: Add host_kernel_override argument (#48777)
data-source/aws_mq_broker: Add resource_share_arns and shared_resources attributes (#48729)
resource/aws_cloudfront_key_value_store: Add tags and tags_all attributes (#48458)
resource/aws_cloudwatch_event_api_destination: Add Resource Identity support (#48819)
resource/aws_cloudwatch_event_archive: Add Resource Identity support (#48819)
resource/aws_cloudwatch_event_bus: Add Resource Identity support (#48819)
resource/aws_cloudwatch_event_bus_policy: Add Resource Identity support (#48819)
resource/aws_cloudwatch_event_connection: Add Resource Identity support (#48819)
resource/aws_cloudwatch_event_endpoint: Add Resource Identity support (#48819)
resource/aws_cloudwatch_event_permission: Add Resource Identity support (#48819)
resource/aws_codebuild_project: Add host_kernel argument to the environment configuration block (#48777)
resource/aws_codepipeline: Add resource identity support (#48808)
resource/aws_iam_policy_attachment: Add resource identity support (#48639)
resource/aws_lambda_event_source_mapping: Add use_resource_timeout_for_propagation argument (#46405)
resource/aws_lambda_event_source_mapping: Add configurable resource timeouts. Defaults to 10m for create and update, 5m for delete. (#46405)
resource/aws_lambda_function: Add use_resource_timeout_for_propagation argument (#46405)
resource/aws_lambda_permission: Add configurable resource timeouts. Defaults to 5m for create, read, and delete. (#46405)
resource/aws_lambda_permission: Hard-coded timeouts to account for eventual consistency have been replaced with configurable resource timeouts (#46405)
resource/aws_mq_broker: Add resource_share_arns argument and shared_resources attribute (#48729)
resource/aws_prometheus_workspace_configuration: Add out_of_order_time_window_in_seconds and rule_query_offset_in_seconds arguments (#48659)
resource/aws_rds_cluster: Add support for auto_minor_version_upgrade argument (#42472)
resource/aws_sagemaker_endpoint_configuration: Add Resource Identity support (#45926)
resource/aws_sagemaker_endpoint_configuration: Add production_variants.capacity_reservation_config and shadow_production_variants.capacity_reservation_config configuration blocks (#45926)
resource/aws_scheduler_schedule: Add resource identity support (#48828)

BUG FIXES:

resource/aws_bedrock_guardrail: Prevents "inconsistent result" error when adding content_policy_config block. (#48772)
resource/aws_bedrock_guardrail: Prevents "inconsistent result" error when adding topic_policy_config block. (#48772)
resource/aws_bedrock_guardrail: Prevents "inconsistent result" error with multiple content_policy_config.filters_config.input_modalities values. (#48772)
resource/aws_bedrock_guardrail: Prevents "inconsistent result" error with multiple content_policy_config.filters_config.output_modalities values. (#48772)
resource/aws_cloudfront_multitenant_distribution: Correctly handles default tags. (#48783)
resource/aws_cloudfront_multitenant_distribution: Correctly taints resource if Create fails. (#48782)
resource/aws_cloudfront_multitenant_distribution: Sets etag on Import. (#48782)
resource/aws_cloudfront_multitenant_distribution: Updates etag when only tags updated. (#48782)
resource/aws_cloudfront_multitenant_distribution: Waits for deployment on Update. (#48782)
resource/aws_directory_service_directory: Fix UnsupportedOperationException error when reading enable_directory_data_access in regions where Directory Service Data is not available (e.g. GovCloud) (#47660)

`v6.53.0`

Compare Source

BREAKING CHANGES:

resource/aws_pinpointsmsvoicev2_phone_number: Remove provider-side defaults for opt_out_list_name and two_way_channel_enabled in favor of AWS server-side defaults (Default and false respectively). Configurations that omit these attributes will now show (known after apply) on first plan instead of the previous static value; the post-apply state is unchanged. This change mitigates persistent drift when the phone number is managed by an aws_pinpointsmsvoicev2_pool. (#48414)

NOTES:

list-resource/aws_bedrockagentcore_registry: This resource is deprecated. AWS Agent Registry is currently available in public preview. On August 6, 2026 this functionality will move from the bedrock-agentcore namespace to the agent-registry namespace. The aws_bedrockagentcore_browser resource will continue to work until September 17, 2026 (#48693)
resource/aws_bedrockagentcore_registry: This resource is deprecated. AWS Agent Registry is currently available in public preview. On August 6, 2026 this functionality will move from the bedrock-agentcore namespace to the agent-registry namespace. The aws_bedrockagentcore_browser resource will continue to work until September 17, 2026 (#48693)
resource/aws_ecs_capacity_provider: When a change forces replacement of a capacity provider that is associated with a cluster via aws_ecs_cluster_capacity_providers, add a replace_triggered_by lifecycle rule to the association so the old capacity provider is detached before it is deleted (#48156)

FEATURES:

New Data Source: aws_bedrock_foundation_model_agreement_offers (#47665)
New Data Source: aws_bedrock_use_case_for_model_access (#47665)
New Data Source: aws_ec2_capacity_block_reservation (#48185)
New List Resource: aws_pinpointsmsvoicev2_pool (#48414)
New Resource: aws_bedrock_foundation_model_agreement (#47665)
New Resource: aws_bedrock_use_case_for_model_access (#47665)
New Resource: aws_pinpointsmsvoicev2_pool (#48414)

ENHANCEMENTS:

data-source/aws_api_gateway_rest_api: Add security_policy and endpoint_access_mode attributes (#47973)
data-source/aws_msk_cluster: Add customer_action_status attribute (#48536)
resource/aws_api_gateway_rest_api: Add security_policy and endpoint_access_mode arguments (#47973)
resource/aws_bedrockagentcore_browser: Add browser_signing, certificate, and enterprise_policy configuration blocks (#47816)
resource/aws_bedrockagentcore_code_interpreter: Add certificate argument (#47817)
resource/aws_cloudwatch_composite_alarm: Add Resource Identity support (#48679)
resource/aws_cloudwatch_contributor_insight_rule: Add Resource Identity support (#48679)
resource/aws_cloudwatch_contributor_insight_rule: Add plan-time validation of rule_definition (#48679)
resource/aws_cloudwatch_contributor_insight_rule: Change rule_state to Optional and Computed (#48679)
resource/aws_cloudwatch_contributor_managed_insight_rule: Add Resource Identity support (#48679)
resource/aws_cloudwatch_contributor_managed_insight_rule: Add plan-time validation of resource_arn and template_name (#48679)
resource/aws_cloudwatch_dashboard: Add Resource Identity support (#48679)
resource/aws_cloudwatch_metric_stream: Add Resource Identity support (#48679)
resource/aws_default_vpc: Add resource identity support (#47590)
resource/aws_msk_cluster: Add customer_action_status attribute (#48536)
resource/aws_pinpointsmsvoicev2_phone_number: Add force_disassociate argument (#48414)
resource/aws_securityhub_automation_rule: Deprecates id in favor of arn (#48636)
resource/aws_ssmcontacts_rotation: Deprecates id in favor of arn (#48636)
resource/aws_ssoadmin_trusted_token_issuer: Deprecates id in favor of arn (#48636)

BUG FIXES:

data-source/aws_codeartifact_authorization_token: Mark authorization_token as sensitive (#48577)
resource/aws_cloudwatch_contributor_managed_insight_rule: Mark resource_arn, tags and template_name as ForceNew (#48679)
resource/aws_default_vpc: Fix provider panic (nil pointer dereference) when importing via an import block or terraform import (#47590)
resource/aws_ecs_capacity_provider: Return the underlying error immediately instead of timing out after 20 minutes when deleting a capacity provider that is still associated with a cluster (#48156)
resource/aws_iam_user: Handle InvalidAction errors in partitions where access key cleanup operations are not supported (#48473)
resource/aws_instance: Fix perpetual diff when instance_market_options.market_type is set to capacity-block (#48701)
resource/aws_lightsail_bucket_access_key: Mark secret_access_key as sensitive (#48577)
resource/aws_lightsail_key_pair: Mark private_key as sensitive (#48577)
resource/aws_route53_record: Fix the type attribute to no longer force resource replacement on change (#47105)
resource/aws_sqs_queue: Reduce the wait time for queue deletion. This fixes a regression introduced in v6.34.0. (#48722)

`v6.52.0`

Compare Source

NOTES:

resource/aws_lakeformation_permissions: Grants on aws_glue_catalog_table views (table_type = "VIRTUAL_VIEW") are now preserved when the view's view_definition is updated, as the underlying table is updated in place rather than recreated (#48532)
resource/aws_serverlessapplicationrepository_cloudformation_stack: Existing affected resources whose state still contains **** for NoEcho parameters or is missing default-matching parameters keys require a one-time manual reconciliation after upgrading. To recover: (1) add lifecycle { ignore_changes = [parameters] } temporarily, (2) pull state with terraform state pull, (3) correct the affected parameters values and increment serial, (4) push state back with terraform state push, (5) remove the ignore_changes block, and (6) confirm with terraform plan. For non-sensitive parameters you can instead temporarily set the parameter to a non-default value, apply, revert, and apply again (#46748)
resource/aws_serverlessapplicationrepository_cloudformation_stack: NoEcho parameter values are now persisted in Terraform state in plaintext rather than as ****. This is consistent with how Terraform stores other sensitive inputs (for example, aws_db_instance.password). Ensure your state backend is appropriately secured (#46748)

FEATURES:

New Data Source: aws_s3_bucket_notification (#31512)
New List Resource: aws_appautoscaling_target (#48449)
New List Resource: aws_bedrockagentcore_registry (#48314)
New List Resource: aws_dynamodb_table_item (#48520)
New Resource: aws_bedrockagentcore_registry (#48314)

ENHANCEMENTS:

data-source/aws_eks_cluster: Add control_plane_egress_mode attribute to vpc_config block (#48497)
provider: Generated names are now created using a cryptographically strong random generator instead of a timestamp and counter, so values are more uniformly distributed over the lowercase hexadecimal digit characters (#47995)
resource/aws_appautoscaling_target: Add resource identity support (#48449)
resource/aws_cloudwatch_log_account_policy: Add Resource Identity support (#48502)
resource/aws_cloudwatch_log_anomaly_detector: Add Resource Identity support (#48502)
resource/aws_cloudwatch_log_data_protection_policy: Add Resource Identity support (#48502)
resource/aws_cloudwatch_log_delivery: Add Resource Identity support (#48502)
resource/aws_cloudwatch_log_delivery_destination: Add Resource Identity support (#48502)
resource/aws_cloudwatch_log_delivery_destination_policy: Add Resource Identity support (#48502)
resource/aws_cloudwatch_log_delivery_source: Add Resource Identity support (#48502)
resource/aws_cloudwatch_log_destination: Add Resource Identity support (#48502)
resource/aws_cloudwatch_log_destination_policy: Add Resource Identity support (#48502)
resource/aws_cloudwatch_log_index_policy: Add Resource Identity support (#48502)
resource/aws_cloudwatch_log_resource_policy: Add Resource Identity support (#48502)
resource/aws_cloudwatch_log_stream: Add Resource Identity support (#48502)
resource/aws_cloudwatch_query_definition: Add Resource Identity support (#48502)
resource/aws_cloudwatch_query_definition: Add arn attribute (#48502)
resource/aws_default_network_acl: Prevents error on creation when tag-based authorization in use. (#44798)
resource/aws_dynamodb_table_item: Add Resource Identity support (#48520)
resource/aws_dynamodb_table_item: Add import support (#48520)
resource/aws_eks_cluster: Add control_plane_egress_mode argument to vpc_config block (#48497)
resource/aws_mq_broker: Known endpoints in instances.0.endpoints are now returned in a deterministic order based on protocol prefix and port, including the new https://...:16001 Prometheus metrics endpoint introduced in RabbitMQ 4.2 and later; any unrecognized endpoint types are appended afterward in API order (#47777)
resource/aws_serverlessapplicationrepository_cloudformation_stack: Change capabilities from Required to Optional/Computed. Applications without required capabilities can now omit the argument and the value applied by AWS will be tracked in state (#46748)

BUG FIXES:

provider: Fix AWS API errors such as EC2's IdempotentParameterMismatch by generating client-supplied idempotency tokens using a cryptographically strong random generator and extended alphabet (#47995)
provider: Restore HTTP request and response body content in TF_LOG=DEBUG output for resources, data sources, and list resources. Redaction continues to apply to ephemeral resources and actions (#48463)
resource/aws_cloudwatch_log_delivery: Add mutex lock around create, update, and delete operations to prevent ConflictException errors (#48158)
resource/aws_cloudwatch_log_delivery: Fix Provided delivery configuration is invalid for the destination type errors when s3_delivery_configuration is unchanged (#46123)
resource/aws_elasticache_global_replication_group: Fix persistent automatic_failover_enabled diff by reading the value from the primary member (#47647)
resource/aws_elasticache_replication_group: Fix persistent automatic_failover_enabled diff on member replication groups of an aws_elasticache_global_replication_group (#47647)
resource/aws_elasticache_reserved_cache_node: Fix Provider returned invalid result object after apply and subsequent too many results warning that silently removed the resource from state when id was not set in configuration (#48462)
resource/aws_elasticache_serverless_cache: Fix InvalidParameterCombination: Serverless Cache modifications only support modifying one field per request error when changing multiple attributes in a single apply (#47918)
resource/aws_elasticache_user: Fix user_id producing inconsistent final plan when using mixed-case values (#47705)
resource/aws_elasticache_user_group: Fix user_group_id producing inconsistent final plan when using mixed-case values (#47705)
resource/aws_glue_catalog_table: Allow in-place update of a VIRTUAL_VIEW table's view_definition by passing ViewUpdateAction to the Glue UpdateTable API (#48532)
resource/aws_serverlessapplicationrepository_cloudformation_stack: Fix change set: unexpected state 'FAILED', wanted target 'CREATE_COMPLETE'. last error: No updates are to be performed errors on subsequent applies. Previously, parameters whose value matched the application's default were pruned from state, and NoEcho parameter values were stored as ****, both of which produced false drift (#46748)

`v6.51.0`

Compare Source

NOTES:

resource/aws_cloudfront_distribution_tenant: When using managed_certificate_request, managed certificate issuance uses a fixed 3-hour timeout regardless of the configured resource timeout. This behavior will be updated in a future major version. (#47839)
resource/aws_dms_s3_endpoint: The kms_key_arn attribute has been deprecated. All configurations using kms_key_arn should be updated to use the server_side_encryption_kms_key_id attribute instead. (#48441)
resource/aws_eks_cluster: Because we cannot easily test the behavior of outpost_config, the changes are best effort and we ask for community help in testing (#48367)

FEATURES:

New List Resource: aws_acm_certificate (#48283)
New List Resource: aws_bedrockagentcore_evaluator (#47964)
New List Resource: aws_sagemaker_hub_content_reference (#48379)
New Resource: aws_bedrockagentcore_evaluator (#47964)
New Resource: aws_sagemaker_hub_content_reference (#48379)

ENHANCEMENTS:

data-source/aws_eks_cluster: Add outpost_config.control_plane_placement.spread_level, outpost_config.etcd_instance_type, and outpost_config.etcd_placement attributes (#48367)
resource/aws_cloudfront_distribution: Add origin.custom_origin_config.origin_mtls_config argument (#46421)
resource/aws_cloudfront_multitenant_distribution: Add origin.custom_origin_config.origin_mtls_config argument (#46421)
resource/aws_detective_graph: Add Resource Identity support (#48383)
resource/aws_detective_organization_configuration: Add Resource Identity support (#48383)
resource/aws_eks_cluster: Add outpost_config.control_plane_placement.spread_level, outpost_config.etcd_instance_type, and outpost_config.etcd_placement arguments (#48367)
resource/aws_eks_cluster: Change outpost_config.control_plane_placement.group_name to Optional (#48367)
resource/aws_elasticache_replication_group: Add durability argument (#48254)
resource/aws_elasticache_serverless_cache: Add network_type argument (#48371)
resource/aws_msk_replicator: Add Resource Identity support (#48338)
resource/aws_observabilityadmin_centralization_rule_for_organization: Add destination_metrics_configuration and source_metrics_configuration blocks (#48303)
resource/aws_opensearchserverless_collection: Add vector_options.serverless_vector_acceleration argument (#47018)

BUG FIXES:

resource/aws_acm_certificate: Correctly updates subject_alternative_names for Imported certificates (#48362)
resource/aws_acmpca_certificate_authority: Prevents hang when trying to create resources over the quota limit. (#48365)
resource/aws_cloudfront_distribution_tenant: Configured operation timeouts are now correctly honored, preventing potential indefinite hangs (#47839)
resource/aws_dms_s3_endpoint: Fix perpetual diff when kms_key_arn is set but not returned by the API for S3 engine endpoints. (#48441)
resource/aws_elasticache_replication_group: Fix error when adding a log_delivery_configuration with log_type = "slow-log" while simultaneously upgrading the engine from Redis 5 to Redis 6 or Valkey 7 (#46526)
resource/aws_kinesis_firehose_delivery_stream: Fix InvalidArgumentException errors when creating or updating extended_s3_configuration in AWS partitions that report unsupported custom_time_zone and file_extension attributes in a combined error message (#48369)
resource/aws_lakeformation_opt_in: Fix handling of out-of-band deletion of linked resource (#48416)
resource/aws_lakeformation_opt_in: Prevent crash by making the principal block required (#48416)
resource/aws_lakeformation_resource_lf_tag: Prevent crash when processing null tag values during read operations (#48417)
resource/aws_msk_replicator: Fix runtime error: index out of range [0] with length 0 panic when importing a replicator with no replication configurations (#48338)
resource/aws_ses_domain_mail_from: Correctly detect resources deleted outside of Terraform when refreshing state (#48387)

`v6.50.0`

Compare Source

NOTES:

resource/aws_bedrockagentcore_gateway_target: Because we cannot easily test the behavior of private_endpoint, it is best effort and we ask for community help in testing (#47602)

FEATURES:

New List Resource: aws_bedrockagentcore_policy (#47971)
New List Resource: aws_cloudwatch_log_s3_table_integration_source (#48190)
New List Resource: aws_ecs_daemon (#47562)
New List Resource: aws_ecs_daemon_task_definition (#47562)
New Resource: aws_bedrockagentcore_policy (#47971)
New Resource: aws_cloudwatch_log_s3_table_integration_source (#48190)
New Resource: aws_ecs_daemon (#47562)
New Resource: aws_ecs_daemon_task_definition (#47562)
New Resource: aws_observabilityadmin_s3_table_integration (#48190)

ENHANCEMENTS:

provider: Add Linux s390x support (#48272)
resource/aws_bedrockagentcore_agent_runtime: Add AGUI as a valid value for protocol_configuration.server_protocol (#47906)
resource/aws_bedrockagentcore_gateway: Add policy_engine_configuration configuration block (#47818)
resource/aws_bedrockagentcore_gateway_target: Add listing_mode argument to the target_configuration.mcp.mcp_server configuration block (#48225)
resource/aws_bedrockagentcore_gateway_target: Add private_endpoint argument to support private connectivity to VPC-hosted MCP servers via Amazon VPC Lattice (#47602)
resource/aws_bedrockagentcore_memory: Add indexed_key and stream_delivery_resources arguments (#48240)

BUG FIXES:

data-source/aws_secretsmanager_secret_version: Fix eventual consistency issues that could result in couldn't find resource errors when reading a version immediately after creation (#48318)
resource/aws_cloudwatch_log_subscription_filter: Retry ValidationException: Make sure you have given CloudWatch Logs permission to assume the provided role IAM eventual consistency errors on Create and Update (#48255)
resource/aws_datazone_project: Fix import separator to match the expected format. (#48271)
resource/aws_default_route_table: Fix perpetual drift on route.gateway_id when route.odb_network_arn is configured (#48239)
resource/aws_ecs_express_gateway_service: Fix "inconsistent result after apply" error for network_configuration[0].security_groups when using network_configuration. ec2:DescribeSecurityGroups IAM permission is newly required. (#47944)
resource/aws_ecs_express_gateway_service: Fix Resource Already Exists error when recreating a service after deletion (#48098)
resource/aws_elasticsearch_domain: Fix unexpected state error during engine version upgrade (#47316)
resource/aws_kinesis_firehose_delivery_stream: Fix InvalidArgumentException errors when creating or updating extended_s3_configuration in AWS partitions that do not support the custom_time_zone and file_extension attributes (#48284)
resource/aws_route: Fix perpetual drift on gateway_id when odb_network_arn is configured (#48239)
resource/aws_route_table: Fix perpetual drift on route.gateway_id when route.odb_network_arn is configured (#48239)
resource/aws_secretsmanager_secret_version: Fix Provider produced inconsistent final plan errors when secret_string or secret_string_wo_version references a resource being created or replaced in the same apply (#48318)
resource/aws_secretsmanager_secret_version: Fix eventual consistency issues on resource creation that could result in version_stages being empty in state (#48318)
resource/aws_secretsmanager_secret_version: Fix unnecessary resource replacement when switching between secret_string and secret_string_wo (or vice versa) without changing the secret value (#48318)

`v6.49.0`

Compare Source

ENHANCEMENTS:

data-source/aws_opensearch_domain: Add advanced_security_options.jwt_options.jwks_url attribute (#48146)
data-source/aws_opensearchserverless_collection_group: Add generation attribute (#48125)
resource/aws_bedrockagentcore_gateway: Add protocol_configuration.mcp.session_configuration block (#48179)
resource/aws_bedrockagentcore_gateway: Add protocol_configuration.mcp.streaming_configuration block (#48179)
resource/aws_cloudfront_function: Add tags and tags_all arguments (#47916)
resource/aws_opensearch_domain: Add advanced_security_options.jwt_options.jwks_url argument (#48146)
resource/aws_opensearchserverless_collection_group: Add generation argument (#48125)

BUG FIXES:

resource/aws_bedrockagentcore_gateway_target: Fix runtime error: slice bounds out of range [1:0] panics when refreshing state. This fixes a regression introduced in v6.48.0 (#48215)

`v6.48.0`

Compare Source

NOTES:

resource/aws_bedrockagentcore_gateway_target: Because we cannot easily test the ``credential_provider_configuration.gateway_iam_role` SigV4 functionality, it is best effort and we ask for community help in testing (#47626)

FEATURES:

New Data Source: aws_ec2_hosts (#47986)
New List Resource: aws_cleanrooms_membership (#48166)
New List Resource: aws_pinpointsmsvoicev2_event_destination (#48034)
New Resource: aws_ec2_local_gateway_route_table (#48013)
New Resource: aws_ec2_local_gateway_route_table_virtual_interface_group_association (#48014)
New Resource: aws_pinpointsmsvoicev2_event_destination (#48034)

ENHANCEMENTS:

data-source/aws_ec2_host: Add state, allocation_time, release_time, host_maintenance, host_reservation_id, availability_zone_id, allows_multiple_instance_types, member_of_service_linked_resource_group, instances, and available_capacity attributes (#47991)
data-source/aws_kinesis_stream: Add warm_throughput attribute (#48152)
data-source/aws_lb: Add enable_prefix_for_ipv6_source_nat attribute (#40431)
data-source/aws_odb_network: Add computed ec2_placement_group_ids attribute. (#47317)
resource/aws_bedrockagentcore_gateway: Mark protocol_type as Optional. Omit it to create a gateway that routes traffic directly to HTTP targets (e.g. AgentCore Runtime) (#47897)
resource/aws_bedrockagentcore_gateway_target: Add credential_provider_configuration.caller_iam_credentials and credential_provider_configuration.jwt_passthrough arguments (#47780)
resource/aws_bedrockagentcore_gateway_target: Add credential_provider_configuration.gateway_iam_role.service and credential_provider_configuration.gateway_iam_role.region arguments to enable SigV4 signing of upstream requests for mcp_server targets pointing at AWS-hosted endpoints (#47626)
resource/aws_bedrockagentcore_gateway_target: Add target_configuration.http argument (#47897)
resource/aws_cleanrooms_membership: Add resource identity support (#48166)
resource/aws_datazone_asset_type: Add resource identity support (#48136)
resource/aws_datazone_domain: Add resource identity support (#48136)
resource/aws_datazone_environment: Add resource identity support (#48136)
resource/aws_datazone_environment_blueprint_configuration: Add global_parameters argument (#44857)
resource/aws_datazone_environment_blueprint_configuration: Add resource identity support (#48136)
resource/aws_datazone_environment_profile: Add resource identity support (#48136)
resource/aws_datazone_form_type: Add resource identity support (#48136)
resource/aws_datazone_glossary: Add resource identity support (#48136)
resource/aws_datazone_glossary_term: Add resource identity support (#48136)
resource/aws_datazone_project: Add resource identity support (#48136)
resource/aws_datazone_user_profile: Add resource identity support (#48136)
resource/aws_kinesis_firehose_delivery_stream: Add Resource Identity support (#48186)
resource/aws_kinesis_stream: Add Resource Identity support (#48152)
resource/aws_kinesis_stream: Add warm_throughput_mib_ps argument. This functionality requires the kinesis:UpdateStreamWarmThroughput IAM permission (#48152)
resource/aws_kinesis_stream: Add plan-time validation of shard_level_metrics (#48152)
resource/aws_kinesis_stream_consumer: Add Resource Identity support (#48152)
resource/aws_lb: Add enable_prefix_for_ipv6_source_nat argument (#40431)
resource/aws_observabilityadmin_telemetry_rule: Expand rule schema to cover the full SDK shape, including all_regions, allow_field_updates, regions, scope, selection_criteria, telemetry_source_types, and the full destination_configuration tree (cloudtrail_parameters, elb_load_balancer_logging_parameters, log_delivery_parameters, msk_monitoring_parameters, vpc_flow_log_parameters, waf_logging_parameters) (#48072)
resource/aws_observabilityadmin_telemetry_rule_for_organization: Expand rule schema to cover the full SDK shape, including all_regions, allow_field_updates, regions, scope, selection_criteria, telemetry_source_types, and the full destination_configuration tree (cloudtrail_parameters, elb_load_balancer_logging_parameters, log_delivery_parameters, msk_monitoring_parameters, vpc_flow_log_parameters, waf_logging_parameters) (#48072)
resource/aws_odb_network: Add computed ec2_placement_group_ids attribute. (#47317)
resource/aws_osis_pipeline: Adds resource identity (#48155)
resource/aws_vpc_ipam_pool_cidr_allocation: Add tagging support (#48084)

BUG FIXES:

resource/aws_api_gateway_rest_api: Fix OpenAPI body-managed x-amazon-apigateway-policy updates being overwritten by prior policy state (#48118)
resource/aws_bedrockagentcore_gateway: Fix `ValidationException: Gateway with ID: ... has targets associated with it. Delete all targets before deleting the g

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

infracost · 2025-06-18T21:02:52Z

💰 Infracost report

This pull request is aligned with your company's FinOps policies and the Well-Architected Framework.

_{This comment will be updated when code changes.}

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from 0cd2331 to 3cafb56 Compare July 3, 2025 04:37

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from db58b80 to 1812af9 Compare July 17, 2025 23:31

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from f1ea368 to 8eb48c4 Compare July 29, 2025 01:41

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from 54e33a7 to 419a9b4 Compare August 7, 2025 20:44

renovate Bot force-pushed the renovate/aws-6.x branch from 419a9b4 to f2bba4a Compare August 14, 2025 20:52

renovate Bot force-pushed the renovate/aws-6.x branch from f2bba4a to c3b44e2 Compare August 21, 2025 23:42

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from 8ed322d to 5e72838 Compare September 4, 2025 21:03

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from 41e1e52 to 8f1c7d8 Compare September 19, 2025 01:28

renovate Bot force-pushed the renovate/aws-6.x branch from 8f1c7d8 to 90e6fdf Compare September 22, 2025 21:56

renovate Bot force-pushed the renovate/aws-6.x branch from 90e6fdf to 4c4a46a Compare October 2, 2025 20:47

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from bac3389 to 7921179 Compare October 16, 2025 21:03

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from 5f012c4 to f546245 Compare October 31, 2025 04:41

renovate Bot force-pushed the renovate/aws-6.x branch from f546245 to 1ea5096 Compare November 6, 2025 23:50

renovate Bot force-pushed the renovate/aws-6.x branch from 1ea5096 to 698e3d3 Compare November 14, 2025 00:02

renovate Bot force-pushed the renovate/aws-6.x branch 3 times, most recently from 6d674cc to 55fe04e Compare November 26, 2025 21:05

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from 1568ac4 to 17aa2fd Compare December 5, 2025 02:36

renovate Bot force-pushed the renovate/aws-6.x branch from 17aa2fd to 94b8b91 Compare December 10, 2025 22:30

renovate Bot force-pushed the renovate/aws-6.x branch from 94b8b91 to d8769bd Compare December 18, 2025 02:09

renovate Bot force-pushed the renovate/aws-6.x branch 3 times, most recently from 6fc6593 to 352e9c3 Compare February 4, 2026 21:59

renovate Bot force-pushed the renovate/aws-6.x branch 3 times, most recently from 0f5be8c to bd7951d Compare February 18, 2026 21:06

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from 05a8324 to 8d03bd5 Compare March 4, 2026 22:00

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from 76767eb to 773e3e0 Compare March 11, 2026 22:05

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from 4d1c196 to f69931d Compare March 25, 2026 21:11

renovate Bot force-pushed the renovate/aws-6.x branch from f69931d to 85ac064 Compare April 1, 2026 22:39

renovate Bot force-pushed the renovate/aws-6.x branch from 85ac064 to 2072b36 Compare April 8, 2026 23:32

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from 0349f77 to da93989 Compare April 23, 2026 01:01

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from ba9a33e to 739ff43 Compare May 7, 2026 01:09

renovate Bot force-pushed the renovate/aws-6.x branch from 739ff43 to 63319b7 Compare May 13, 2026 21:15

renovate Bot force-pushed the renovate/aws-6.x branch from 63319b7 to 57e9dab Compare May 20, 2026 21:45

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from 5e041dd to fa4bdf9 Compare June 3, 2026 21:43

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from eb1a86e to 7a33d9e Compare June 10, 2026 23:42

renovate Bot force-pushed the renovate/aws-6.x branch 2 times, most recently from 372f73c to 4efbc1a Compare June 24, 2026 21:43

renovate Bot force-pushed the renovate/aws-6.x branch from 4efbc1a to 8b082e2 Compare July 1, 2026 23:43

renovate Bot force-pushed the renovate/aws-6.x branch from 8b082e2 to f063893 Compare July 8, 2026 23:53

Update Terraform aws to v6

f438be7

renovate Bot force-pushed the renovate/aws-6.x branch from f063893 to f438be7 Compare July 15, 2026 19:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update Terraform aws to v6#56

Update Terraform aws to v6#56
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/aws-6.x

renovate Bot commented Jun 18, 2025 •

edited

Loading

Uh oh!

infracost Bot commented Jun 18, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jun 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Configuration

Uh oh!

infracost Bot commented Jun 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💰 Infracost report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jun 18, 2025 •

edited

Loading

infracost Bot commented Jun 18, 2025 •

edited

Loading