…v5.0.1)

BREAKING (operational, not API): the module no longer declares its own
provider "aws". As a child module, a self-declared provider block takes
precedence for the modules resources and IGNORES the callers provider,
stripping the wrapper control over credentials (assume_role / profile /
region) and default_tags — the deprecated pattern, and the root cause of the
STSaaS-account 403 workaround in atlantis.yaml (the module credential-less
provider ran as ambient atlantis-sa instead of the assumed STSaaS role).

The module keeps its provider *requirement* (versions.tf required_providers).
Now every module.comet resource inherits the CALLERs provider.

Wrapper migration required when bumping to v5.0.1:
  * ensure the wrapper provider "aws" carries region + assume_role/profile
    (stsaasuat already does, via var.provider_assume_role_arn)
  * move default_tags (Terraform / Environment / common_tags) onto the wrapper
    provider — the module no longer sets them
  * the atlantis.yaml assume-role-and-export-creds shell hack for the stsaas
    workflow can then be replaced with a normal provider-level assume_role

No aliased/region-specific providers exist in the module (checked: no
configuration_aliases, no provider = aws.*), so single-provider inheritance is
safe. terraform init + validate pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…am eks)

Replace the loose/inconsistent aws constraints (~> 6.0 root, >= 6.0 comet_eks)
with an honest floor: >= 6.52, the minimum required by the pinned
terraform-aws-modules/eks ~> 21.24. Anything looser was misleading — init could
never resolve below 6.52 anyway.

No upper bound and no bad-build exclusion (e.g. != 6.57.0) in the module: those
are deployment policy and stay in the wrappers. Effective resolved constraint
with the stsaasuat wrapper is >= 6.52, < 7.0, != 6.57.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…s README

Addresses baz review on #57:

* Region consistency (medium): with the module provider block removed, the
  provider region now comes from the caller while several resources still key off
  var.region as a string — notably the Karpenter controller IAM policy (EC2 ARNs
  scoped to arn:aws:ec2:${var.region}:... and an aws:RequestedRegion == var.region
  condition). If the caller provider region diverges, those grants target the wrong
  region and deny. Add data.aws_region.current + a terraform_data precondition that
  fails fast at plan when they mismatch. (Kept var.region in the ARNs — it is the
  intended region; the guard just enforces the provider agrees. Lighter and clearer
  than threading data.aws_region through every ARN.)

* Stale docs (low): modules/comet_eks/README.md advertised aws >= 5.0 and a
  kubernetes >= 2.10 requirement. Update to aws >= 6.52 (matches versions.tf) and
  drop kubernetes (removed in v5.0.0); add the time provider the module actually uses.

Skipped baz driver-README direct-consumer note: this module is only consumed as a
wrapper child (no backend of its own); the new precondition already fails fast on a
region mismatch, covering the substantive concern.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>