chore(deps): update terraform aws to v6#1329
Conversation
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" | ||
| } | ||
|
|
||
| random = { |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
from
8ae3e12 to
8ed51b1
Compare
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
5 times, most recently
from
6ef8563 to
ded4987
Compare
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
from
ded4987 to
f6829a0
Compare
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" | ||
| } | ||
|
|
||
| random = { |
There was a problem hiding this comment.
Bug: The AWS provider upgrade to v6.0 removes the name argument from the aws_db_instance resource. The code still uses this deprecated argument, which will cause terraform apply to fail.
Severity: CRITICAL
Suggested Fix
In the aws_db_instance resource, replace the name argument with db_name. Subsequently, update all references to this attribute, such as in sm.tf, from aws_db_instance.db.name to aws_db_instance.db.db_name to align with the new provider version's schema.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: deployment/terraform/main.tf#L10-L16
Potential issue: The pull request updates the AWS provider version from `~> 3.0` to `~>
6.0`. This upgrade crosses a major version boundary (v5.0.0) where the `name` argument
for the `aws_db_instance` resource was removed and replaced with `db_name`. The
Terraform configuration still uses the old `name` argument in `rds.tf` and references
the `aws_db_instance.db.name` attribute in `sm.tf`. Because the `name` argument and
attribute no longer exist in the new provider version, any `terraform apply` command
will fail, blocking all infrastructure deployments and updates.
f6829a0 to
c42fdae
Compare
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" | ||
| } | ||
|
|
||
| random = { |
There was a problem hiding this comment.
Bug: The aws_db_instance resource uses the name argument, which was removed in AWS provider v5.0. This will cause terraform apply to fail after the upgrade to v6.0.
Severity: CRITICAL
Suggested Fix
In the aws_db_instance.db resource definition, replace the name argument with the db_name argument. The value "cadet_${var.env}" should be assigned to db_name instead. This aligns the configuration with the schema for AWS provider versions 5.0 and newer.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: deployment/terraform/main.tf#L10-L16
Potential issue: The `aws_db_instance` resource in `rds.tf` is configured using the
`name` argument. This argument was deprecated in version 4.0 of the AWS Terraform
provider and completely removed in version 5.0.0. Upgrading to version 6.0, as this pull
request does, will cause Terraform to reject this configuration. Any attempt to run
`terraform plan` or `terraform apply` will result in an immediate schema validation
error because the `name` argument is no longer supported, preventing any infrastructure
changes from being deployed.
4ad4ad2 to
4c019e7
Compare
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" |
There was a problem hiding this comment.
Bug: The AWS provider upgrade to v6 is incomplete. The aws_db_instance resource still uses the name argument, which was removed in v5, causing an immediate Terraform failure.
Severity: CRITICAL
Suggested Fix
In the aws_db_instance.db resource, replace the name argument with db_name. Subsequently, update any references from aws_db_instance.db.name to aws_db_instance.db.db_name, such as in the aws_secretsmanager_secret_version.db resource.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: deployment/terraform/main.tf#L13
Potential issue: The pull request upgrades the AWS provider constraint from version 3 to
version 6. However, it fails to update the `aws_db_instance` resource configuration
accordingly. The `name` argument used for this resource was removed in version 5.0 of
the provider and replaced with `db_name`. Because the code still uses the deprecated
`name` argument and references the corresponding `name` attribute, the Terraform
configuration will fail immediately during `terraform plan` or `terraform apply`,
blocking all infrastructure changes.
4c019e7 to
3332f9b
Compare
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" | ||
| } | ||
|
|
||
| random = { |
There was a problem hiding this comment.
Bug: The aws_s3_bucket resource uses the acl argument, which is removed in the upgraded AWS Terraform provider version, causing deployment failures.
Severity: CRITICAL
Suggested Fix
Remove the acl argument from the aws_s3_bucket resource in deployment/terraform/s3.tf. Replace it by defining a separate aws_s3_bucket_acl resource to manage the bucket's access control list, which is the recommended approach for recent versions of the AWS provider.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: deployment/terraform/main.tf#L10-L16
Potential issue: The pull request upgrades the AWS Terraform provider to a version (`~>
6.0`) where the `acl` argument on the `aws_s3_bucket` resource is no longer supported.
The `aws_s3_bucket` resource for `sourcecasts` in `deployment/terraform/s3.tf` still
uses this removed argument. Since the CI pipeline does not include a Terraform
validation step, this incompatibility will not be detected before merging. As a result,
any subsequent `terraform plan` or `terraform apply` command will fail with an
"Unsupported argument" error, which will block all infrastructure deployments.
205519d to
d217fcb
Compare
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
2 times, most recently
from
d8c69a9 to
435bdb0
Compare
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
from
435bdb0 to
0398e27
Compare
1 participant
This PR contains the following updates:
~> 3.0→~> 6.0Release Notes
hashicorp/terraform-provider-aws (aws)
v6.38.0Compare Source
FEATURES:
aws_dms_start_replication_task_assessment_run(#47058)aws_dynamodb_backups(#47036)aws_msk_topic(#46490)aws_savingsplans_offerings(#47081)aws_msk_cluster(#46490)aws_msk_serverless_cluster(#46490)aws_msk_topic(#46490)aws_route53_resolver_rule(#47063)aws_sagemaker_algorithm(#47051)aws_ssm_document(#46974)aws_ssoadmin_account_assignment(#47067)aws_vpc_endpoint(#46977)aws_workmail_domain(#46931)aws_msk_topic(#46490)aws_observabilityadmin_telemetry_enrichment(#47089)aws_sagemaker_algorithm(#47051)aws_workmail_default_domain(#46931)aws_workmail_domain(#46931)ENHANCEMENTS:
firewall_policy.enable_tls_session_holdingattribute (#47065)authorizer_configuration.custom_jwt_authorizer.custom_claimconfiguration block (#47049)authorizer_configuration.custom_jwt_authorizer.custom_claimconfiguration block (#47049)target_configuration.mcp.api_gatewayconfiguration block (#46916)restore_backup_arnargument (#47068)KinesisStreamsas a value foraction.target.key(#47010)VPCEndpointsas a value foraction.target.key(#47045)userblock to Optional (#46883)firewall_policy.enable_tls_session_holdingargument (#47065)filters.aws_account_nameconfiguration block (#47027)filters.compliance_associated_standards_idconfiguration block (#47027)filters.compliance_security_control_idconfiguration block (#47027)filters.compliance_security_control_parameters_nameconfiguration block (#47027)filters.compliance_security_control_parameters_valueconfiguration block (#47027)BUG FIXES:
@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)Provider produced inconsistent result after applyerror whenenvironmentvariables are defined in non-alphabetical order (#46771)Provider returned invalid result object after applyerrors where computed attributes remained unknown after create (#47012)@regionsuffix when using resource-levelregionattribute (#47043)userblock (#46883)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)Unable to unmarshal DynamicValueerror whenstatement.managed_rule_group_statement.rule_action_overrideblock is specified (#46998)WAFOptimisticLockExceptionerrors when multiple associations target the same Web ACL (#47037)v6.37.0Compare Source
BREAKING CHANGES:
resource_data.lf_tag.valuetoresource_data.lf_tag.valuesand change to a set of string values (#46788)NOTES:
offering_idattribute is deprecated. Usesavings_plan_offering_idinstead. (#46959)offering_idattribute is deprecated. Usesavings_plan_offering_idinstead. (#46959)FEATURES:
aws_ec2_transit_gateway_metering_policy(#46812)aws_iam_user(#46869)aws_s3_bucket_ownership_controls(#46832)aws_wafv2_web_acl_rule(#46682)aws_workmail_organization(#46692)aws_ec2_transit_gateway_metering_policy(#46812)aws_ec2_transit_gateway_metering_policy_entry(#46812)aws_wafv2_web_acl_rule(#46682)aws_workmail_organization(#46692)ENHANCEMENTS:
schedule.statusargument (#46037)shard_instance_countargument (#46938)bucket_namespaceargument in support of account regional namespaces for general purpose buckets (#46917)BUG FIXES:
savings_plan_offering_idduring read (#46959)authorizer_configuration.custom_jwt_authorizer. This fixes a regression introduced in v6.36.0 (#46908)EOFerrors when retrieving the activation key (#46958)key_schemasyntax deleting all GSIs (#46602)MissingParameter: When specifying CpuOptions you must specify both CoreCount and ThreadsPerCoreerrors when updatingcpu_options.core_countorcpu_options.threads_per_core(#46879)resource_data.lf_tag.valuetoresource_data.lf_tag.valuesand change to a set of string values. Previously, attempting to useresource_data.lf_tag.valuewould result inmissing required fielderrors (#46788)client_authentication.saslblock (#42163)client_authentication.tlsblock (#42163)client_authentication.saslblocks (#42163)client_authentication.tlsblocks (#42163)savings_plan_offering_idduring read to prevent forced replacement following import (#46959)enable_machine_learninginaws_managed_rules_bot_control_rule_setincorrectly defaulting tofalseinstead of reflecting the AWS default oftrue(#46682)v6.36.0Compare Source
NOTES:
GO-2026-4602, FileInfo can escape from a Root in os,GO-2026-4603, URLs in meta content attribute actions are not escaped in html/template, andGO-2026-4601, Incorrect parsing of IPv6 host literals in net/url(#46820)FEATURES:
aws_iam_outbound_web_identity_federation(#46503)aws_sts_web_identity_token(#46173)aws_s3_bucket_versioning(#46802)ENHANCEMENTS:
authorizer_config.custom_jwt_authorizer.allowed_scopesargument (#46828)resource_arnargument andpolicy_scopeandrevision_idattributes.policy_nameis now optional (#46813)open_table_format_input.iceberg_input.iceberg_table_inputargument (#46843)view_definitionargument (#46843)open_table_format_input.iceberg_input.metadata_operationandopen_table_format_input.iceberg_input.versionto ForceNew (#46843)parameters,storage_descriptor, andtable_typeto Optional and Computed (#46843)ip_set_idattribute (#46703)arnanddestination_idattributes (#46703)threat_intel_set_idattribute (#46703)rule.destination.destination_logs_configuration.log_group_name_configurationblock (#46811)BUG FIXES:
EntityNotFoundExceptionerrors (#46843)growth_factor(#46810)EntityNotFoundExceptionerrors (#46843)private_dns_enabledwhenvpc_endpoint_typeisInterface(#46800)network_interface_idsattribute when changingsubnet_configurationorsubnet_ids(#46800)VpnConcentratorLimitExceeded: The maximum number of mutating objects has been reachederrors on Create (#46823)v6.35.1Compare Source
BUG FIXES:
LifecycleRuleAndOperatorwhile flattening configuration (#46778)v6.35.0Compare Source
FEATURES:
aws_ecs_service(#46678)aws_lb(#46660)aws_lb_listener(#46679)aws_lb_listener_rule(#46731)aws_lb_target_group(#46662)aws_sns_topic(#46744)aws_sns_topic_subscription(#46738)aws_observabilityadmin_telemetry_pipeline(#46698)aws_sagemaker_mlflow_app(#45565)ENHANCEMENTS:
layer_version_arnargument to support cross-account Lambda layer access (#46673)job_level_cost_allocation_configurationblock (#46107)resource_share_configurationblock (#46715)BUG FIXES:
split_charge_ruletargetsfromTypeSettoTypeListto retain order (#42856)InvalidParameterCombinationExceptionerrors whenoracle_settingsis configured (#46689)replicas_per_node_groupandnode_group_configuration.replica_countto support quota increases (#46670)v6.34.0Compare Source
FEATURES:
aws_ec2_secondary_network(#46552)aws_ec2_secondary_subnet(#46552)aws_ecr_task_definition(#46628)aws_elb(#46639)aws_s3_bucket_lifecycle_configuration(#46531)aws_networkmanager_prefix_list_association(#46566)ENHANCEMENTS:
kms_key_idattribute (#46584)network_typeandip_discoveryattributes (#46636)configuration.query_results_s3_access_grants_configurationargument (#46376)metadata_configurationblock for HTTP header and query parameter propagation (#45808)auth_parameters.connectivity_parametersargument (#41561)service_connect_configuration.access_log_configurationargument (#45820)kms_key_idargument (#46584)cpu_options.core_count,cpu_options.nested_virtualization, andcpu_options.threads_per_coreto be updated in-place (#46568)network_typeandip_discoveryarguments (#46636)jwt_optionsattribute (#46439)managed_rule_group_configswithinmanaged_rule_groupand root-levelvisibility_configblock for CloudWatch metrics configuration (#44426)BUG FIXES:
mongodb_settings.use_update_lookupattribute to fix "invalid address to set" error (#46616)statement.principals.identifierscontains a non-string value (#46226)couldn't find resource (21 retries)errors updatingload_balancers,target_group_arns, andtraffic_source(#46622)credential_provider_configuration.oauth.default_return_urlandcredential_provider_configuration.oauth.grant_typearguments (#46127)data_filter_expression.dimensions.values(#46462)encryption_configurationto Optional and Computed, fixingunexpected new value: .encryption_configuration: was null, but now cty.ObjectVal(map[string]cty.Value{"kms_key_arn":cty.NullVal(cty.String),"sse_algorithm":cty.StringVal("AES256")})errors (#46150)InvalidParameter: DnsOptions PrivateDnsOnlyForInboundResolverEndpoint is applicable only to Interface VPC Endpointserrors when creating S3Tables VPC endpoints (#46102)v6.33.0Compare Source
FEATURES:
aws_networkmanager_attachment_routing_policy_label(#46489)ENHANCEMENTS:
cpu_options.nested_virtualizationandnetwork_performance_optionsattributes (#46540)custom_pathargument torevocation_configuration.crl_configurationconfiguration block (#46487)custom_pathargument torevocation_configuration.crl_configurationconfiguration block (#46487)filter_expressionattribute (#46501)access_alternate_directly,add_supplemental_logging,additional_archived_log_dest_id,allow_selected_nested_tables,archived_log_dest_id,archived_logs_only,asm_password,asm_server,asm_user,authentication_method,char_length_semantics,convert_timestamp_with_zone_to_utc,direct_path_no_log,direct_path_parallel_load,enable_homogenous_tablespace,extra_archived_log_dest_ids,fail_task_on_lob_truncation,number_datatype_scale,open_transaction_window,oracle_path_prefix,parallel_asm_read_threads,read_ahead_blocks,read_table_space_name,replace_path_prefix,retry_interval,secrets_manager_oracle_asm_access_role_arn,secrets_manager_oracle_asm_secret_id,security_db_encryption,security_db_encryption_name,spatial_data_option_to_geo_json_function_name,standby_delay_time,trim_space_in_char,use_alternate_folder_for_online,use_bfile,use_direct_path_full_load,use_logminer_reader, anduse_path_prefixarguments to theoracle_settings` configuration block (#46516)use_update_lookupargument tomongodb_settingsconfiguration block (#46253)nested_virtualizationattribute tocpu_optionsconfiguration block (#46533)nested_virtualizationattribute tocpu_optionsconfiguration block (#46533)secondary_interfacesconfiguration block (#46540)qna_intent_configurationattribute (#46419)domain_settings.trusted_identity_propagation_settingsargument (#44965)BUG FIXES:
runtime error: invalid memory address or nil pointer dereferencepanics whenname_regexis an invalid regular expression (#46478)ap-southeast-5andeusc-de-east-1as valid values fors3_region(#46475)serverless_v2_scaling_configurationwithout forcing cluster replacement (#45049)ValidationError ... Member must have length less than or equal to 20errors when more than 20 load balancer attributes are being modified (#46496)cidr_blockwhen allocating a subnet from an IPAM resource pool. (#46453)expected ipv6_netmask_length to be one of [44 48 52 56 60], got 64validation error (#46515)v6.32.1Compare Source
BUG FIXES:
couldn't find resourceerror during creation when waiting for capacity to be satisfied (#46452)s3_delivery_configuration.suffix_pathlosing AWS-added prefix on update (#46455)key_schemawith a single range key on a global secondary index (#46442)auth_tokenreferences another resource (#46454)v6.32.0Compare Source
FEATURES:
aws_ecr_repository(#46344)aws_lambda_permission(#46341)aws_route(#46370)aws_route53_resolver_rule_association(#46349)aws_route_table(#46337)aws_s3_directory_bucket(#46373)aws_secretsmanager_secret(#46318)aws_secretsmanager_secret_version(#46342)aws_vpc_security_group_egress_rule(#46368)aws_vpc_security_group_ingress_rule(#46367)aws_ec2_secondary_network(#46408)aws_ec2_secondary_subnet(#46408)ENHANCEMENTS:
secondary_network_interfaceargument (#46408)use_asproperty to create special RLS rules dataset (#42687)BUG FIXES:
configuration.result_configurationor child attributes. (#46427)custom_error_responseis configured andcustom_error_response.response_codeandcustom_error_response.response_page_pathare omitted (#46375)network_access_controlis configured with emptyprefix_list_idsandvpce_ids(#45637)v6.31.0Compare Source
NOTES:
expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerandaclattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)FEATURES:
aws_account_regions(#41746)aws_ecrpublic_authorization_token(#45841)aws_cloudwatch_event_rule(#46304)aws_cloudwatch_event_target(#46297)aws_cloudwatch_metric_alarm(#46268)aws_iam_role_policy(#46293)aws_lambda_function(#46295)aws_s3_bucket_acl(#46305)aws_s3_bucket_policy(#46312)aws_s3_bucket_public_access_block(#46309)aws_ssoadmin_customer_managed_policy_attachments_exclusive(#46191)ENHANCEMENTS:
serverless_vector_accelerationtoaiml_options(#45882)BUG FIXES:
auth_token_update_strategyalways requiredauth_token, which caused an error when migrating from AUTH to RBAC. Now,auth_token_update_strategystill requiresauth_tokenexcept whenauth_token_update_strategyisDELETE. (#45518)aws_elasticache_replication_groupwhencluster_mode="enabled"andnum_node_groupsis reduced. Previously, downscaling could fail in certain scenarios; for example, if nodes0001,0002,0003,0004, and0005exist, and a user manually removes0003and0005, then setsnum_node_groups = 2, terraform would attempt to delete0003,0004, and0005. This is now fixed, after this fix terraform will retrieve the current node groups before resizing. (#45893)user_group_idremoval during modification. (#45571)Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.