chore(deps): update terraform aws to v6#1329
Conversation
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" | ||
| } | ||
|
|
||
| random = { |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
coverage: 88.926%. remained the same — renovate/aws-6.x into master |
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
from
8ae3e12 to
8ed51b1
Compare
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
5 times, most recently
from
6ef8563 to
ded4987
Compare
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
from
ded4987 to
f6829a0
Compare
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" | ||
| } | ||
|
|
||
| random = { |
There was a problem hiding this comment.
Bug: The AWS provider upgrade to v6.0 removes the name argument from the aws_db_instance resource. The code still uses this deprecated argument, which will cause terraform apply to fail.
Severity: CRITICAL
Suggested Fix
In the aws_db_instance resource, replace the name argument with db_name. Subsequently, update all references to this attribute, such as in sm.tf, from aws_db_instance.db.name to aws_db_instance.db.db_name to align with the new provider version's schema.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: deployment/terraform/main.tf#L10-L16
Potential issue: The pull request updates the AWS provider version from `~> 3.0` to `~>
6.0`. This upgrade crosses a major version boundary (v5.0.0) where the `name` argument
for the `aws_db_instance` resource was removed and replaced with `db_name`. The
Terraform configuration still uses the old `name` argument in `rds.tf` and references
the `aws_db_instance.db.name` attribute in `sm.tf`. Because the `name` argument and
attribute no longer exist in the new provider version, any `terraform apply` command
will fail, blocking all infrastructure deployments and updates.
f6829a0 to
c42fdae
Compare
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" | ||
| } | ||
|
|
||
| random = { |
There was a problem hiding this comment.
Bug: The aws_db_instance resource uses the name argument, which was removed in AWS provider v5.0. This will cause terraform apply to fail after the upgrade to v6.0.
Severity: CRITICAL
Suggested Fix
In the aws_db_instance.db resource definition, replace the name argument with the db_name argument. The value "cadet_${var.env}" should be assigned to db_name instead. This aligns the configuration with the schema for AWS provider versions 5.0 and newer.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: deployment/terraform/main.tf#L10-L16
Potential issue: The `aws_db_instance` resource in `rds.tf` is configured using the
`name` argument. This argument was deprecated in version 4.0 of the AWS Terraform
provider and completely removed in version 5.0.0. Upgrading to version 6.0, as this pull
request does, will cause Terraform to reject this configuration. Any attempt to run
`terraform plan` or `terraform apply` will result in an immediate schema validation
error because the `name` argument is no longer supported, preventing any infrastructure
changes from being deployed.
4ad4ad2 to
4c019e7
Compare
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" |
There was a problem hiding this comment.
Bug: The AWS provider upgrade to v6 is incomplete. The aws_db_instance resource still uses the name argument, which was removed in v5, causing an immediate Terraform failure.
Severity: CRITICAL
Suggested Fix
In the aws_db_instance.db resource, replace the name argument with db_name. Subsequently, update any references from aws_db_instance.db.name to aws_db_instance.db.db_name, such as in the aws_secretsmanager_secret_version.db resource.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: deployment/terraform/main.tf#L13
Potential issue: The pull request upgrades the AWS provider constraint from version 3 to
version 6. However, it fails to update the `aws_db_instance` resource configuration
accordingly. The `name` argument used for this resource was removed in version 5.0 of
the provider and replaced with `db_name`. Because the code still uses the deprecated
`name` argument and references the corresponding `name` attribute, the Terraform
configuration will fail immediately during `terraform plan` or `terraform apply`,
blocking all infrastructure changes.
4c019e7 to
3332f9b
Compare
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" | ||
| } | ||
|
|
||
| random = { |
There was a problem hiding this comment.
Bug: The aws_s3_bucket resource uses the acl argument, which is removed in the upgraded AWS Terraform provider version, causing deployment failures.
Severity: CRITICAL
Suggested Fix
Remove the acl argument from the aws_s3_bucket resource in deployment/terraform/s3.tf. Replace it by defining a separate aws_s3_bucket_acl resource to manage the bucket's access control list, which is the recommended approach for recent versions of the AWS provider.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: deployment/terraform/main.tf#L10-L16
Potential issue: The pull request upgrades the AWS Terraform provider to a version (`~>
6.0`) where the `acl` argument on the `aws_s3_bucket` resource is no longer supported.
The `aws_s3_bucket` resource for `sourcecasts` in `deployment/terraform/s3.tf` still
uses this removed argument. Since the CI pipeline does not include a Terraform
validation step, this incompatibility will not be detected before merging. As a result,
any subsequent `terraform plan` or `terraform apply` command will fail with an
"Unsupported argument" error, which will block all infrastructure deployments.
205519d to
d217fcb
Compare
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
2 times, most recently
from
d8c69a9 to
435bdb0
Compare
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
from
435bdb0 to
0398e27
Compare
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
from
0398e27 to
bfb557f
Compare
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
from
bfb557f to
6c4962e
Compare
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
from
6c4962e to
21f05a8
Compare
1 participant
This PR contains the following updates:
~> 3.0→~> 6.0Release Notes
hashicorp/terraform-provider-aws (aws)
v6.41.0Compare Source
FEATURES:
aws_api_gateway_integration(#47370)aws_api_gateway_integration_response(#47388)aws_api_gateway_method(#47365)aws_api_gateway_method_response(#47387)aws_api_gateway_resource(#47382)aws_api_gateway_rest_api(#47404)aws_apigatewayv2_route(#47452)aws_cloudfront_distribution(#47459)aws_cloudwatch_alarm_mute_rule(#46750)aws_cloudwatch_log_subscription_filter(#47451)aws_nat_gateway(#47349)aws_sns_topic_policy(#47445)aws_cloudwatch_alarm_mute_rule(#46750)ENHANCEMENTS:
volume.s3files_volume_configurationattribute (#47363)deployment_strategy_optionsblock (#47401)topic_arn(#47381)metricsattribute (#47047)enable_directory_data_accessargument (#44736)volume.s3files_volume_configurationargument (#47363)passwords_woandpasswords_wo_versionwrite-only arguments (#45988)deployment_strategy_optionsconfiguration block (#47401)BUG FIXES:
ComputeAttributesorAssetLocation(#47450)traffic_sourceto Required (#47381)response_completion_timeoutfor Origins, by removing its default value (#46329)function_associationandlambda_function_associationblock ordering producing inconsistent result after apply when multiple associations are configured (#46378)originblock ordering producing inconsistent result after apply when multiple origins are configured (#47199)key_typeis unknown during plan-time. (#47456)range_keyis set to empty string (#47427)MySQLengine types triggered by upstream changes to the API error response text (#47448)MySQLengine types triggered by upstream changes to the API error response text (#47448)v6.40.0Compare Source
FEATURES:
aws_opensearchserverless_collection_group(#46308)aws_opensearchserverless_collection_groups(#46308)aws_s3files_access_point(#47352)aws_s3files_file_system(#47344)aws_s3files_file_systems(#47344)aws_s3files_mount_target(#47347)aws_config_config_rule(#47319)aws_glue_job(#47266)aws_opensearchserverless_collection_group(#46308)aws_s3files_access_point(#47352)aws_s3files_file_system(#47325)aws_s3files_file_system_policy(#47355)aws_s3files_mount_target(#47347)aws_s3files_synchronization_configuration(#47353)aws_ssm_association(#47321)aws_ssm_patch_group(#47329)aws_opensearchserverless_collection_group(#46308)aws_s3files_access_point(#47352)aws_s3files_file_system(#47325)aws_s3files_file_system_policy(#47355)aws_s3files_mount_target(#47347)aws_s3files_synchronization_configuration(#47353)aws_servicequotas_auto_management(#45968)ENHANCEMENTS:
broker_node_group_info.connectivity_info.network_typeattribute (#47279)depends_on_stack_setstoauto_deploymentconfiguration block (#47269)remediation_typesattribute (#46549)FLINK-2_2as a valid value forruntime_environment(#47207)broker_node_group_info.connectivity_info.network_typeargument (#47279)storage_lens_configuration.data_export.storage_lens_table_destinationargument (#47152)BUG FIXES:
export.data_query.table_configurations(#47261)patternlength in UTF-8 characters (#47287)nameas asForceNew(#47286)AccountAlreadyClosedExceptionerror when deleting an account that has already been closed withclose_on_deletionset totrue(#46627)rule.apply_server_side_encryption_by_default.kms_master_key_id,rule.blocked_encryption_types, andrule.bucket_key_enabledto Optional and Computed, preventings diffs once SSE-C is disabled for all new general purpose buckets (#47359)visible_regionsorvisible_servicesis set to an explicit empty set ([]) (#47290)v6.39.0Compare Source
NOTES:
tags_allattribute is deprecated and will be removed in a future major version (#47133)FEATURES:
aws_iam_role_policies(#46936)aws_iam_role_policy_attachments(#47119)aws_networkmanager_core_network(#45798)aws_uxc_services(#47115)aws_eks_cluster(#47133)aws_organizations_aws_service_access(#46993)aws_sagemaker_training_job(#46892)aws_workmail_group(#47131)aws_workmail_user(#47131)aws_organizations_aws_service_access(#46993)aws_sagemaker_training_job(#46892)aws_uxc_account_customizations(#47115)aws_workmail_group(#47131)aws_workmail_user(#47131)ENHANCEMENTS:
instance_familiesattribute (#47153)tier-8xlas a valid value forcontrol_plane_scaling_config.tier(#46976)source.source_logs_configuration.data_source_selection_criteriaargument. Changesource.source_logs_configuration.log_group_selection_criteriato Optional (#47154)source.vpcargument. Changesource.eksto Optional (#47155)storage_lens_configuration.account_level.advanced_performance_metricsandstorage_lens_configuration.account_level.bucket_level.advanced_performance_metricsarguments (#46865)BUG FIXES:
aws-cnpartition (#47141)Error: waiting for creation AWS DynamoDB Table (xxxxx): couldn't find resourcein highly active accounts by restoring5sdelay before polling for table status. This fixes a regression introduced in v6.28.0. (#47143)bootstrap_self_managed_addonstotruewhen importing (#47133)InvalidParameterCombinationerror whencache_usage_limitsis removed (#46134)v6.38.0Compare Source
FEATURES:
aws_dms_start_replication_task_assessment_run(#47058)aws_dynamodb_backups(#47036)aws_msk_topic(#46490)aws_savingsplans_offerings(#47081)aws_msk_cluster(#46490)aws_msk_serverless_cluster(#46490)aws_msk_topic(#46490)aws_route53_resolver_rule(#47063)aws_sagemaker_algorithm(#47051)aws_ssm_document(#46974)aws_ssoadmin_account_assignment(#47067)aws_vpc_endpoint(#46977)aws_workmail_domain(#46931)aws_msk_topic(#46490)aws_observabilityadmin_telemetry_enrichment(#47089)aws_sagemaker_algorithm(#47051)aws_workmail_default_domain(#46931)aws_workmail_domain(#46931)ENHANCEMENTS:
firewall_policy.enable_tls_session_holdingattribute (#47065)authorizer_configuration.custom_jwt_authorizer.custom_claimconfiguration block (#47049)authorizer_configuration.custom_jwt_authorizer.custom_claimconfiguration block (#47049)target_configuration.mcp.api_gatewayconfiguration block (#46916)restore_backup_arnargument (#47068)KinesisStreamsas a value foraction.target.key(#47010)VPCEndpointsas a value foraction.target.key(#47045)userblock to Optional (#46883)firewall_policy.enable_tls_session_holdingargument (#47065)filters.aws_account_nameconfiguration block (#47027)filters.compliance_associated_standards_idconfiguration block (#47027)filters.compliance_security_control_idconfiguration block (#47027)filters.compliance_security_control_parameters_nameconfiguration block (#47027)filters.compliance_security_control_parameters_valueconfiguration block (#47027)BUG FIXES:
@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)Provider produced inconsistent result after applyerror whenenvironmentvariables are defined in non-alphabetical order (#46771)Provider returned invalid result object after applyerrors where computed attributes remained unknown after create (#47012)@regionsuffix when using resource-levelregionattribute (#47043)userblock (#46883)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)@regionsuffix when using resource-levelregionattribute (#47043)Unable to unmarshal DynamicValueerror whenstatement.managed_rule_group_statement.rule_action_overrideblock is specified (#46998)WAFOptimisticLockExceptionerrors when multiple associations target the same Web ACL (#47037)v6.37.0Compare Source
BREAKING CHANGES:
resource_data.lf_tag.valuetoresource_data.lf_tag.valuesand change to a set of string values (#46788)NOTES:
offering_idattribute is deprecated. Usesavings_plan_offering_idinstead. (#46959)offering_idattribute is deprecated. Usesavings_plan_offering_idinstead. (#46959)FEATURES:
aws_ec2_transit_gateway_metering_policy(#46812)aws_iam_user(#46869)aws_s3_bucket_ownership_controls(#46832)aws_wafv2_web_acl_rule(#46682)aws_workmail_organization(#46692)aws_ec2_transit_gateway_metering_policy(#46812)aws_ec2_transit_gateway_metering_policy_entry(#46812)aws_wafv2_web_acl_rule(#46682)aws_workmail_organization(#46692)ENHANCEMENTS:
schedule.statusargument (#46037)shard_instance_countargument (#46938)bucket_namespaceargument in support of account regional namespaces for general purpose buckets (#46917)BUG FIXES:
savings_plan_offering_idduring read (#46959)authorizer_configuration.custom_jwt_authorizer. This fixes a regression introduced in v6.36.0 (#46908)EOFerrors when retrieving the activation key (#46958)key_schemasyntax deleting all GSIs (#46602)MissingParameter: When specifying CpuOptions you must specify both CoreCount and ThreadsPerCoreerrors when updatingcpu_options.core_countorcpu_options.threads_per_core(#46879)resource_data.lf_tag.valuetoresource_data.lf_tag.valuesand change to a set of string values. Previously, attempting to useresource_data.lf_tag.valuewould result inmissing required fielderrors (#46788)client_authentication.saslblock (#42163)client_authentication.tlsblock (#42163)client_authentication.saslblocks (#42163)client_authentication.tlsblocks (#42163)savings_plan_offering_idduring read to prevent forced replacement following import (#46959)enable_machine_learninginaws_managed_rules_bot_control_rule_setincorrectly defaulting tofalseinstead of reflecting the AWS default oftrue(#46682)v6.36.0Compare Source
NOTES:
GO-2026-4602, FileInfo can escape from a Root in os,GO-2026-4603, URLs in meta content attribute actions are not escaped in html/template, andGO-2026-4601, Incorrect parsing of IPv6 host literals in net/url(#46820)FEATURES:
aws_iam_outbound_web_identity_federation(#46503)aws_sts_web_identity_token(#46173)aws_s3_bucket_versioning(#46802)ENHANCEMENTS:
authorizer_config.custom_jwt_authorizer.allowed_scopesargument (#46828)resource_arnargument andpolicy_scopeandrevision_idattributes.policy_nameis now optional (#46813)open_table_format_input.iceberg_input.iceberg_table_inputargument (#46843)view_definitionargument (#46843)open_table_format_input.iceberg_input.metadata_operationandopen_table_format_input.iceberg_input.versionto ForceNew (#46843)parameters,storage_descriptor, andtable_typeto Optional and Computed (#46843)ip_set_idattribute (#46703)arnanddestination_idattributes (#46703)threat_intel_set_idattribute (#46703)rule.destination.destination_logs_configuration.log_group_name_configurationblock (#46811)BUG FIXES:
EntityNotFoundExceptionerrors (#46843)growth_factor(#46810)EntityNotFoundExceptionerrors (#46843)private_dns_enabledwhenvpc_endpoint_typeisInterface(#46800)network_interface_idsattribute when changingsubnet_configurationorsubnet_ids(#46800)VpnConcentratorLimitExceeded: The maximum number of mutating objects has been reachederrors on Create (#46823)v6.35.1Compare Source
BUG FIXES:
LifecycleRuleAndOperatorwhile flattening configuration (#46778)v6.35.0Compare Source
FEATURES:
aws_ecs_service(#46678)aws_lb(#46660)aws_lb_listener(#46679)aws_lb_listener_rule(#46731)aws_lb_target_group(#46662)aws_sns_topic(#46744)aws_sns_topic_subscription(#46738)aws_observabilityadmin_telemetry_pipeline(#46698)aws_sagemaker_mlflow_app(#45565)ENHANCEMENTS:
layer_version_arnargument to support cross-account Lambda layer access (#46673)job_level_cost_allocation_configurationblock (#46107)resource_share_configurationblock (#46715)BUG FIXES:
split_charge_ruletargetsfromTypeSettoTypeListto retain order (#42856)InvalidParameterCombinationExceptionerrors whenoracle_settingsis configured (#46689)replicas_per_node_groupandnode_group_configuration.replica_countto support quota increases (#46670)v6.34.0Compare Source
FEATURES:
aws_ec2_secondary_network(#46552)aws_ec2_secondary_subnet(#46552)aws_ecr_task_definition(#46628)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.