chore(deps): update terraform aws to v6#1329
Conversation
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" | ||
| } | ||
|
|
||
| random = { |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
from
8ae3e12 to
8ed51b1
Compare
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
5 times, most recently
from
6ef8563 to
ded4987
Compare
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
bot
force-pushed
the
renovate/aws-6.x
branch
from
ded4987 to
f6829a0
Compare
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" | ||
| } | ||
|
|
||
| random = { |
There was a problem hiding this comment.
Bug: The AWS provider upgrade to v6.0 removes the name argument from the aws_db_instance resource. The code still uses this deprecated argument, which will cause terraform apply to fail.
Severity: CRITICAL
Suggested Fix
In the aws_db_instance resource, replace the name argument with db_name. Subsequently, update all references to this attribute, such as in sm.tf, from aws_db_instance.db.name to aws_db_instance.db.db_name to align with the new provider version's schema.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: deployment/terraform/main.tf#L10-L16
Potential issue: The pull request updates the AWS provider version from `~> 3.0` to `~>
6.0`. This upgrade crosses a major version boundary (v5.0.0) where the `name` argument
for the `aws_db_instance` resource was removed and replaced with `db_name`. The
Terraform configuration still uses the old `name` argument in `rds.tf` and references
the `aws_db_instance.db.name` attribute in `sm.tf`. Because the `name` argument and
attribute no longer exist in the new provider version, any `terraform apply` command
will fail, blocking all infrastructure deployments and updates.
f6829a0 to
c42fdae
Compare
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" | ||
| } | ||
|
|
||
| random = { |
There was a problem hiding this comment.
Bug: The aws_db_instance resource uses the name argument, which was removed in AWS provider v5.0. This will cause terraform apply to fail after the upgrade to v6.0.
Severity: CRITICAL
Suggested Fix
In the aws_db_instance.db resource definition, replace the name argument with the db_name argument. The value "cadet_${var.env}" should be assigned to db_name instead. This aligns the configuration with the schema for AWS provider versions 5.0 and newer.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: deployment/terraform/main.tf#L10-L16
Potential issue: The `aws_db_instance` resource in `rds.tf` is configured using the
`name` argument. This argument was deprecated in version 4.0 of the AWS Terraform
provider and completely removed in version 5.0.0. Upgrading to version 6.0, as this pull
request does, will cause Terraform to reject this configuration. Any attempt to run
`terraform plan` or `terraform apply` will result in an immediate schema validation
error because the `name` argument is no longer supported, preventing any infrastructure
changes from being deployed.
4ad4ad2 to
4c019e7
Compare
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" |
There was a problem hiding this comment.
Bug: The AWS provider upgrade to v6 is incomplete. The aws_db_instance resource still uses the name argument, which was removed in v5, causing an immediate Terraform failure.
Severity: CRITICAL
Suggested Fix
In the aws_db_instance.db resource, replace the name argument with db_name. Subsequently, update any references from aws_db_instance.db.name to aws_db_instance.db.db_name, such as in the aws_secretsmanager_secret_version.db resource.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: deployment/terraform/main.tf#L13
Potential issue: The pull request upgrades the AWS provider constraint from version 3 to
version 6. However, it fails to update the `aws_db_instance` resource configuration
accordingly. The `name` argument used for this resource was removed in version 5.0 of
the provider and replaced with `db_name`. Because the code still uses the deprecated
`name` argument and references the corresponding `name` attribute, the Terraform
configuration will fail immediately during `terraform plan` or `terraform apply`,
blocking all infrastructure changes.
4c019e7 to
3332f9b
Compare
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.0" | ||
| version = "~> 6.0" | ||
| } | ||
|
|
||
| random = { |
There was a problem hiding this comment.
Bug: The aws_s3_bucket resource uses the acl argument, which is removed in the upgraded AWS Terraform provider version, causing deployment failures.
Severity: CRITICAL
Suggested Fix
Remove the acl argument from the aws_s3_bucket resource in deployment/terraform/s3.tf. Replace it by defining a separate aws_s3_bucket_acl resource to manage the bucket's access control list, which is the recommended approach for recent versions of the AWS provider.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: deployment/terraform/main.tf#L10-L16
Potential issue: The pull request upgrades the AWS Terraform provider to a version (`~>
6.0`) where the `acl` argument on the `aws_s3_bucket` resource is no longer supported.
The `aws_s3_bucket` resource for `sourcecasts` in `deployment/terraform/s3.tf` still
uses this removed argument. Since the CI pipeline does not include a Terraform
validation step, this incompatibility will not be detected before merging. As a result,
any subsequent `terraform plan` or `terraform apply` command will fail with an
"Unsupported argument" error, which will block all infrastructure deployments.
3332f9b to
205519d
Compare
1 participant
This PR contains the following updates:
~> 3.0→~> 6.0Release Notes
hashicorp/terraform-provider-aws (aws)
v6.35.1Compare Source
BUG FIXES:
LifecycleRuleAndOperatorwhile flattening configuration (#46778)v6.35.0Compare Source
FEATURES:
aws_ecs_service(#46678)aws_lb(#46660)aws_lb_listener(#46679)aws_lb_listener_rule(#46731)aws_lb_target_group(#46662)aws_sns_topic(#46744)aws_sns_topic_subscription(#46738)aws_observabilityadmin_telemetry_pipeline(#46698)aws_sagemaker_mlflow_app(#45565)ENHANCEMENTS:
layer_version_arnargument to support cross-account Lambda layer access (#46673)job_level_cost_allocation_configurationblock (#46107)resource_share_configurationblock (#46715)BUG FIXES:
split_charge_ruletargetsfromTypeSettoTypeListto retain order (#42856)InvalidParameterCombinationExceptionerrors whenoracle_settingsis configured (#46689)replicas_per_node_groupandnode_group_configuration.replica_countto support quota increases (#46670)v6.34.0Compare Source
FEATURES:
aws_ec2_secondary_network(#46552)aws_ec2_secondary_subnet(#46552)aws_ecr_task_definition(#46628)aws_elb(#46639)aws_s3_bucket_lifecycle_configuration(#46531)aws_networkmanager_prefix_list_association(#46566)ENHANCEMENTS:
kms_key_idattribute (#46584)network_typeandip_discoveryattributes (#46636)configuration.query_results_s3_access_grants_configurationargument (#46376)metadata_configurationblock for HTTP header and query parameter propagation (#45808)auth_parameters.connectivity_parametersargument (#41561)service_connect_configuration.access_log_configurationargument (#45820)kms_key_idargument (#46584)cpu_options.core_count,cpu_options.nested_virtualization, andcpu_options.threads_per_coreto be updated in-place (#46568)network_typeandip_discoveryarguments (#46636)jwt_optionsattribute (#46439)managed_rule_group_configswithinmanaged_rule_groupand root-levelvisibility_configblock for CloudWatch metrics configuration (#44426)BUG FIXES:
mongodb_settings.use_update_lookupattribute to fix "invalid address to set" error (#46616)statement.principals.identifierscontains a non-string value (#46226)couldn't find resource (21 retries)errors updatingload_balancers,target_group_arns, andtraffic_source(#46622)credential_provider_configuration.oauth.default_return_urlandcredential_provider_configuration.oauth.grant_typearguments (#46127)data_filter_expression.dimensions.values(#46462)encryption_configurationto Optional and Computed, fixingunexpected new value: .encryption_configuration: was null, but now cty.ObjectVal(map[string]cty.Value{"kms_key_arn":cty.NullVal(cty.String),"sse_algorithm":cty.StringVal("AES256")})errors (#46150)InvalidParameter: DnsOptions PrivateDnsOnlyForInboundResolverEndpoint is applicable only to Interface VPC Endpointserrors when creating S3Tables VPC endpoints (#46102)v6.33.0Compare Source
FEATURES:
aws_networkmanager_attachment_routing_policy_label(#46489)ENHANCEMENTS:
cpu_options.nested_virtualizationandnetwork_performance_optionsattributes (#46540)custom_pathargument torevocation_configuration.crl_configurationconfiguration block (#46487)custom_pathargument torevocation_configuration.crl_configurationconfiguration block (#46487)filter_expressionattribute (#46501)access_alternate_directly,add_supplemental_logging,additional_archived_log_dest_id,allow_selected_nested_tables,archived_log_dest_id,archived_logs_only,asm_password,asm_server,asm_user,authentication_method,char_length_semantics,convert_timestamp_with_zone_to_utc,direct_path_no_log,direct_path_parallel_load,enable_homogenous_tablespace,extra_archived_log_dest_ids,fail_task_on_lob_truncation,number_datatype_scale,open_transaction_window,oracle_path_prefix,parallel_asm_read_threads,read_ahead_blocks,read_table_space_name,replace_path_prefix,retry_interval,secrets_manager_oracle_asm_access_role_arn,secrets_manager_oracle_asm_secret_id,security_db_encryption,security_db_encryption_name,spatial_data_option_to_geo_json_function_name,standby_delay_time,trim_space_in_char,use_alternate_folder_for_online,use_bfile,use_direct_path_full_load,use_logminer_reader, anduse_path_prefixarguments to theoracle_settings` configuration block (#46516)use_update_lookupargument tomongodb_settingsconfiguration block (#46253)nested_virtualizationattribute tocpu_optionsconfiguration block (#46533)nested_virtualizationattribute tocpu_optionsconfiguration block (#46533)secondary_interfacesconfiguration block (#46540)qna_intent_configurationattribute (#46419)domain_settings.trusted_identity_propagation_settingsargument (#44965)BUG FIXES:
runtime error: invalid memory address or nil pointer dereferencepanics whenname_regexis an invalid regular expression (#46478)ap-southeast-5andeusc-de-east-1as valid values fors3_region(#46475)serverless_v2_scaling_configurationwithout forcing cluster replacement (#45049)ValidationError ... Member must have length less than or equal to 20errors when more than 20 load balancer attributes are being modified (#46496)cidr_blockwhen allocating a subnet from an IPAM resource pool. (#46453)expected ipv6_netmask_length to be one of [44 48 52 56 60], got 64validation error (#46515)v6.32.1Compare Source
BUG FIXES:
couldn't find resourceerror during creation when waiting for capacity to be satisfied (#46452)s3_delivery_configuration.suffix_pathlosing AWS-added prefix on update (#46455)key_schemawith a single range key on a global secondary index (#46442)auth_tokenreferences another resource (#46454)v6.32.0Compare Source
FEATURES:
aws_ecr_repository(#46344)aws_lambda_permission(#46341)aws_route(#46370)aws_route53_resolver_rule_association(#46349)aws_route_table(#46337)aws_s3_directory_bucket(#46373)aws_secretsmanager_secret(#46318)aws_secretsmanager_secret_version(#46342)aws_vpc_security_group_egress_rule(#46368)aws_vpc_security_group_ingress_rule(#46367)aws_ec2_secondary_network(#46408)aws_ec2_secondary_subnet(#46408)ENHANCEMENTS:
secondary_network_interfaceargument (#46408)use_asproperty to create special RLS rules dataset (#42687)BUG FIXES:
configuration.result_configurationor child attributes. (#46427)custom_error_responseis configured andcustom_error_response.response_codeandcustom_error_response.response_page_pathare omitted (#46375)network_access_controlis configured with emptyprefix_list_idsandvpce_ids(#45637)v6.31.0Compare Source
NOTES:
expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerandaclattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)expected_bucket_ownerattribute. (#46262)expected_bucket_ownerattribute from Resource Identity. (#46272)FEATURES:
aws_account_regions(#41746)aws_ecrpublic_authorization_token(#45841)aws_cloudwatch_event_rule(#46304)aws_cloudwatch_event_target(#46297)aws_cloudwatch_metric_alarm(#46268)aws_iam_role_policy(#46293)aws_lambda_function(#46295)aws_s3_bucket_acl(#46305)aws_s3_bucket_policy(#46312)aws_s3_bucket_public_access_block(#46309)aws_ssoadmin_customer_managed_policy_attachments_exclusive(#46191)ENHANCEMENTS:
serverless_vector_accelerationtoaiml_options(#45882)BUG FIXES:
auth_token_update_strategyalways requiredauth_token, which caused an error when migrating from AUTH to RBAC. Now,auth_token_update_strategystill requiresauth_tokenexcept whenauth_token_update_strategyisDELETE. (#45518)aws_elasticache_replication_groupwhencluster_mode="enabled"andnum_node_groupsis reduced. Previously, downscaling could fail in certain scenarios; for example, if nodes0001,0002,0003,0004, and0005exist, and a user manually removes0003and0005, then setsnum_node_groups = 2, terraform would attempt to delete0003,0004, and0005. This is now fixed, after this fix terraform will retrieve the current node groups before resizing. (#45893)user_group_idremoval during modification. (#45571)UnauthorizedOperationerror when detaching resource that does not have an attachment (#46211)v6.30.0Compare Source
FEATURES:
aws_ssoadmin_managed_policy_attachments_exclusive(#46176)BUG FIXES:
global_secondary_indexorglobal_secondary_index.key_schemaaredynamic(#46195)v6.29.0Compare Source
NOTES:
return_organization_onlyargument to return only the results of theDescribeOrganizationAPI and avoid API limits (#40884)regionattribute, as the resource is global. (#46185)return_organization_onlyargument to return only the results of theDescribeOrganizationAPI and avoid API limits (#40884)FEATURES:
aws_arcregionswitch_plan(#43781)aws_arcregionswitch_route53_health_checks(#43781)aws_organizations_entity_path(#45890)aws_resourcegroupstaggingapi_required_tags(#45994)aws_s3_bucket_object_lock_configuration(#45990)aws_s3_bucket_replication_configuration(#42662)aws_s3control_access_points(#45949)aws_s3control_multi_region_access_points(#45974)aws_savingsplans_savings_plan(#45834)aws_wafv2_managed_rule_group(#45899)aws_appflow_connector_profile(#45983)aws_appflow_flow(#45980)aws_cleanrooms_collaboration(#45953)aws_cleanrooms_configured_table(#45956)aws_cloudfront_key_value_store(#45957)aws_opensearchserverless_collection(#46001)aws_route53_record(#46059)aws_s3_bucket(#46004)aws_s3_object(#46002)aws_security_group(#46062)aws_apigatewayv2_routing_rule(#42961)aws_arcregionswitch_plan(#43781)aws_cloudfront_anycast_ip_list(#43331)aws_notifications_managed_notification_account_contact_association(#45185)aws_notifications_managed_notification_additional_channel_association(#45186)aws_notifications_organizational_unit_association(#45197)aws_notifications_organizations_access(#45273)aws_opensearch_application(#43822)aws_ram_permission(#44114)aws_ram_resource_associations_exclusive(#45883)aws_sagemaker_labeling_job(#46041)aws_sagemaker_model_card(#45993)aws_sagemaker_model_card_export_job(#46009)aws_savingsplans_savings_plan(#45834)aws_sesv2_tenant_resource_association(#45904)aws_vpc_security_group_rules_exclusive(#45876)ENHANCEMENTS:
routing_modeargument to support dynamic routing via routing rules (#42961)routing_modeargument to support dynamic routing via routing rules (#42961)allow_privilege_escalationattribute toeks_properties.pod_properties.containers.security_context(#45896)global_secondary_index.key_schemaattribute (#46157)segment_actions.routing_policy_namesargument (#45928)body_base64anddownload_bodyattributes. For improved performance, setdownload_body = falseto ensure bodies are never downloaded (#46163)source_resourceattribute (#44705)allow_privilege_escalationattribute toeks_properties.pod_properties.containers.security_context(#45896)vector_ingestion_configuration.parsing_configuration.bedrock_data_automation_configurationblock (#45966)vector_ingestion_configuration.parsing_configuration.bedrock_foundation_model_configuration.parsing_modalityargument (#46056)certificate_rotation_restartargument (#45984)stream_view_typeis set andstream_enabledis eitherfalseor unset. (#45934)BLOB_MOUNTINGaccount setting name withENABLEDandDISABLEDvalues (#46092)domain_join_service_account_secretargument toself_managed_active_directoryconfiguration block (#45852)self_managed_active_directory.passwordto Optional andself_managed_active_directory.usernameto Optional and Computed (#45852)rulesto a single element. (#46185)memory_sizefrom 10240 MB to 32768 MB (#46065)network_performance_optionsargument (#46071)pipeline_configuration_bodymaximum length validation to 2,621,440 bytes to align with AWS API specification. (#44881)monitoring_schedule_config.monitoring_job_definitionargument (#45951)monitoring_schedule_config.monitoring_job_definition_nameargument optional (#45951)source_resourceargument in support of provisioning of VPC Resource Planning Pools (#44705)organizational_unit_exclusionargument (#45890)ipv4_ipam_pool_id,ipv4_netmask_length,ipv6_ipam_pool_id, andipv6_netmask_lengtharguments in support of provisioning of subnets using IPAM (#44705)ipv6_cidr_blockto Optional and Computed (#44705)BUG FIXES:
rule.action.target_storage_classandrule.selection.storage_classto JSON serialization (#45909)catalog_id,data_location.catalog_id,database.catalog_id,lf_tag_policy.catalog_id,table.catalog_id, andtable_with_columns.catalog_idarguments (#43931)attachment_routing_policy_rules.action.associate_routing_policiesis empty (#46160)regiondefined, in AWS European Sovereign Cloud, prevent failing due to region validation requiring region names to start with "[a-z]{2}-" (#45895)configuration.result_configuration.encryption_configurationargument (#46159)Provider produced inconsistent result after applyerror when queryingCARBON_EMISSIONStable withouttable_configurations(#45972)model_sourceis set (#45713)auto_deploymentwithpermission_modelset toSERVICE_MANAGED(#45992)runtime error: invalid memory address or nil pointer dereferencepanic when mistakenly importing a multi-tenant distribution (#45873)origin_groupto use correctidattribute name and fix field mapping to resolvemissing required fielderrors (#45921)InvalidRecordingGroupException: The recording group provided is not validerrors when therecording_group.exclusion_by_resource_typeorrecording_group.recording_strategyargument is removed during update (#46110)warm_throughputin global_secondary_index when not set in configuration. (#46094)nameis known after apply (#45917)kubernetes_network_configargument name in EKS Auto Mode validation error message (#45997)catalog_id,data_location.catalog_id,database.catalog_id,lf_tag_policy.catalog_id,table.catalog_id, andtable_with_columns.catalog_idarguments (#43931)health_check.protocolfromHTTPtoTCPwhenprotocolisTCP(#46036)firewall_policy.stateful_rule_group_reference.resource_arn(#46124)delete_associated_resourcesbeing set when value is unknown (#45636)partition_count(#45042)iam_database_authentication_enabledwhen restored from snapshot (#39461)portnow works. (#45870)ValidationException: Base capacity cannot be updated when PerformanceTarget is Enablederror when updatingprice_performance_targetandbase_capacity(#46137)regionsargument asComputedto fix an unexpectedregionsdiff when it is not specified (#45829)InvalidChangeBatcherrors during ForceNew operations when zone name changes (#45242)Invalid JSON String Valueerror on initial apply andConflictExceptionon subsequent apply when associating Route53 Resolver Query Log Configs (#45958)UnsupportedArgumenterrors during tag-on-create operations (#46122)MethodNotAllowederrors when S3 Control APIs are unavailable (#46122)ipv6_cidr_blockasForceNewwhen the existing IPv6 subnet was created withassign_ipv6_address_on_create = true(#46043)ip_address_type(#45947)v6.28.0Compare Source
NOTES:
FEATURES:
aws_cloudfront_connection_group(#44885)aws_cloudfront_distribution_tenant(#45088)aws_kms_alias(#45700)aws_sqs_queue(#45691)aws_cloudfront_connection_function(#45664)aws_cloudfront_connection_group(#44885)aws_cloudfront_distribution_tenant(#45088)aws_cloudfront_multitenant_distribution(#45535)aws_dynamodb_global_secondary_index(#44999)aws_ecr_pull_time_update_exclusion(#45765)aws_organizations_tag(#45730)aws_redshift_idc_application(#37345)Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.