v4.14.0

feat(outputs): add bucket_hosted_zone_id output RoseSecurity (#293)

## what

• Create a new bucket_hosted_zone_id output

why

• Add the ability to output the Route 53 Hosted Zone ID for this bucket's region.

references

• Closes #290

v4.13.0

feat: add bucket_namespace argument Quentin BERTRAND (@QuentinBtd) (#291)

## what

Add bucket_namespace argument

why

AWS added regional namespaces for bucket.

references

https://registry.terraform.io/providers/hashicorp/aws/6.37.0/docs/resources/s3_bucket.html#bucket_namespace-7
https://aws.amazon.com/fr/blogs/aws/introducing-account-regional-namespaces-for-amazon-s3-general-purpose-buckets/

v4.12.0

🐛 Bug Fixes

Add blocked_encryption_types variable to fix perpetual SSE config drift Chris Hilton (@duality72) (#289)

## what - Adds a new `blocked_encryption_types` variable (type `list(string)`, default `null`) to the module. - Wires it into the `rule` block of `aws_s3_bucket_server_side_encryption_configuration`. - Documents the variable in `variables.tf` and the inputs table in `README.md`.

why

Fixes #287.

On hashicorp/aws provider >= 6.22.0, GetBucketEncryption returns blocked_encryption_types = ["NONE"] by default. The module's encryption rule omits the field, which the provider treats as an empty list. The two do not round-trip, so terraform plan shows a perpetual in-place update on aws_s3_bucket_server_side_encryption_configuration — applying does not stabilize the plan.

Exposing the field as an opt-in variable lets callers on provider >= 6.22.0 silence the drift by setting blocked_encryption_types = ["NONE"], without forcing a provider floor bump on callers still on older providers.

design note: why null default, not ["NONE"]

The module's current provider floor is hashicorp/aws >= 4.9.0. The blocked_encryption_types argument was added to the AWS provider in v6.22.0. Defaulting to ["NONE"] would break every caller on provider < 6.22.0 with an "Unsupported argument" error.

There is no clean way to conditionally default based on resolved provider version (Terraform does not expose required_providers versions as HCL values). The null default mirrors the pattern used elsewhere in cloudposse modules for attributes gated behind newer provider versions: safe default, opt-in for callers who know they're on a new enough provider.

reviewer guide

1. variables.tf — new variable "blocked_encryption_types" block added immediately after bucket_key_enabled. Note the default = null and the description explaining the provider-version nuance.
2. main.tf (~line 86) — one new line inside the rule block: blocked_encryption_types = var.blocked_encryption_types. When the variable is null, the provider omits the attribute (standard Terraform null-handling), preserving existing behavior for all current callers.
3. README.md (inputs table, alphabetical position before bucket_key_enabled) — new row documenting the variable. Matches the style of adjacent rows.

test plan

• terraform fmt -check passes
• terraform validate passes with the current provider floor
• Reviewer: confirm on provider >= 6.22.0 that setting blocked_encryption_types = ["NONE"] eliminates the drift described in #287
• Reviewer: confirm on provider < 6.22.0 that the default (null) keeps behavior unchanged — no "Unsupported argument" error

v4.11.0

Add S3 Intelligent-Tiering archive configuration support Dan Miller (@milldr) (#286)

## What

Add aws_s3_bucket_intelligent_tiering_configuration resource and intelligent_tiering_configuration variable to support configuring archive access tiers within the INTELLIGENT_TIERING storage class.

Why

The module already supports INTELLIGENT_TIERING as a lifecycle transition storage class, but there's no way to configure the archive access tiers (Archive Access, Deep Archive Access) that control when objects within Intelligent-Tiering are moved to cheaper archive storage. This is needed for cost optimization on buckets with infrequently accessed data.

Ref

• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration

🤖 Automatic Updates

Fix go version in tests Erik Osterman (Cloud Posse) (@osterman) (#276)

## what - Update go `1.24`

why

• Error loading shared library libresolv.so.2 in Go 1.20

References

• https://sweetops.slack.com/archives/G014YEKDH4K/p1746672149263629
• golang/go#59305 (comment)
• cloudposse/terraform-aws-cloudfront-s3-cdn#294

Replace Makefile with atmos.yaml Erik Osterman (Cloud Posse) (@osterman) (#275)

## what - Remove `Makefile` - Add `atmos.yaml`

why

• Replace build-harness with atmos for readme genration

References

• DEV-3229 Migrate from build-harness to atmos

v4.10.0

feat: Add filter_prefix, filter_suffix config options for queues and topics Leonid Bogdanov (@vonZeppelin) (#261)

## what

• Adds missing filter_prefix and filter_suffix options in event notifications config for queues and topics.
• set lambda list filter arguments to optional

Signed-off-by: Leonid Bogdanov leonidbogdanov86@gmail.com

references

• Closes #260
• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_notification#lambda_function

v4.9.0

feat: add s3 request payment config RB (@nitrocode) (#259)

## what

• add s3 request payment config

why

• make requester pay

references

• closes #156
• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_request_payment_configuration
• https://docs.aws.amazon.com/AmazonS3/latest/userguide/RequesterPaysBuckets.html

v4.8.0

feat: support eventbridge bucket notification RB (@nitrocode) (#255)

## what

• support eventbridge bucket notification

why

• Emit s3 events to eventbridge

references

• Closes #254

v4.7.3

🚀 Enhancements

fix: use new destination.bucket key in policy RB (@nitrocode) (#256)

## what

• use new destination.bucket key in policy

why

• Support both deprecated destination_bucket and new destination.bucket
• Previous changes created destination.bucket and left destination_bucket for backwards compatibility, as stated in variables.tf, and forgot to include the new value in the IAM policy

references

• Closes #215

🐛 Bug Fixes

fix: use new destination.bucket key in policy RB (@nitrocode) (#256)

## what

• use new destination.bucket key in policy

why

• Support both deprecated destination_bucket and new destination.bucket
• Previous changes created destination.bucket and left destination_bucket for backwards compatibility, as stated in variables.tf, and forgot to include the new value in the IAM policy

references

• Closes #215

v4.7.2

🚀 Enhancements

fix: correct bucket name to fix broken `-replication` role Amila Kumaranayaka (@amila-ku) (#250)

## what

• Fixes replication IAM role name that gets created as '-replication'

why

• Replication IAM role name gets created as '-replication'. This made the replication role unsusable.
• Used Terraform version: 1.8.0

references

• Resolves #251

v4.7.1

🚀 Enhancements

fix: s3 lambda event notification assignments mpajuelofernandez (#253)

## what

It seems there is a typo kind if error here

dynamic "lambda_function" {
    for_each = var.event_notification_details.lambda_list
    content {
      lambda_function_arn = lambda_function.value.arn
      events              = lambda.value.events
      filter_prefix       = lambda_function.value.filter_prefix
      filter_suffix       = lambda_function.value.filter_suffix
    }
  }

I think it should be

dynamic "lambda_function" {
    for_each = var.event_notification_details.lambda_list
    content {
      lambda_function_arn = lambda_function.value.arn
      events              = lambda_function.value.events
      filter_prefix       = lambda_function.value.filter_prefix
      filter_suffix       = lambda_function.value.filter_suffix
    }
  }

why

The S3 notification can not be created unless this is fixed

references

This should fix #252

🐛 Bug Fixes

fix: s3 lambda event notification assignments mpajuelofernandez (#253)

## what

It seems there is a typo kind if error here

dynamic "lambda_function" {
    for_each = var.event_notification_details.lambda_list
    content {
      lambda_function_arn = lambda_function.value.arn
      events              = lambda.value.events
      filter_prefix       = lambda_function.value.filter_prefix
      filter_suffix       = lambda_function.value.filter_suffix
    }
  }

I think it should be

dynamic "lambda_function" {
    for_each = var.event_notification_details.lambda_list
    content {
      lambda_function_arn = lambda_function.value.arn
      events              = lambda_function.value.events
      filter_prefix       = lambda_function.value.filter_prefix
      filter_suffix       = lambda_function.value.filter_suffix
    }
  }

why

The S3 notification can not be created unless this is fixed

references

This should fix #252

🤖 Automatic Updates

Update terratest to '>= 0.46.0' Erik Osterman (Cloud Posse) (@osterman) (#235)

## what - Update terratest `>= 0.46.0`

why

• Support OpenTofu for testing

References

• https://github.com/gruntwork-io/terratest/releases/tag/v0.46.0
• DEV-374 Add opentofu to all our Terragrunt Testing GHA matrix

Migrate new test account Erik Osterman (Cloud Posse) (@osterman) (#248)

## what - Update `.github/settings.yml` - Update `.github/chatops.yml` files

why

• Re-apply .github/settings.yml from org level to get terratest environment
• Migrate to new test account

References

• DEV-388 Automate clean up of test account in new organization
• DEV-387 Update terratest to work on a shared workflow instead of a dispatch action
• DEV-386 Update terratest to use new testing account with GitHub OIDC

Update .github/settings.yml Erik Osterman (Cloud Posse) (@osterman) (#247)

## what - Update `.github/settings.yml` - Drop `.github/auto-release.yml` files

why

• Re-apply .github/settings.yml from org level
• Use organization level auto-release settings

references

• DEV-1242 Add protected tags with Repository Rulesets on GitHub

Update .github/settings.yml Erik Osterman (Cloud Posse) (@osterman) (#246)

## what - Update `.github/settings.yml` - Drop `.github/auto-release.yml` files

why

• Re-apply .github/settings.yml from org level
• Use organization level auto-release settings

references

• DEV-1242 Add protected tags with Repository Rulesets on GitHub