Merge branch 'main' into elasticache-cluster-transit-encryption

.actrc

@@ -1,3 +1,4 @@
 # Needed for testing our workflows
--P ubuntu-latest=ghcr.io/catthehacker/ubuntu:full-18.04
--P medium=ghcr.io/catthehacker/ubuntu:full-18.04
+# The `full` variants are needed for Maven for TeamCity configuration validation
+-P ubuntu-latest=ghcr.io/catthehacker/ubuntu:full-20.04
+-P linux=ghcr.io/catthehacker/ubuntu:full-20.04

.changelog/12310.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_quicksight_user
+```

.changelog/12311.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_quicksight_group
+```

.changelog/13477.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_securityhub_account: Add `enable_default_standards` argument
+```

.changelog/15406.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_dms_replication_instance
+```

.changelog/17727.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_elastic_beanstalk_application: Add plan time validation to `appversion_lifecycle.service_role` and `name` arguments
+```

.changelog/19065.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+ resource/aws_securityhub_member: `email` is Optional
+ ```

.changelog/20891.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cloudhsm_v2_hsm: Enforce `ExactlyOneOf` for `availability_zone` and `subnet_id` arguments
+```

.changelog/21293.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_instance: When encountering `InsufficientInstanceCapacity` errors, do not retry in order to fail faster, as this error is typically not resolvable in the near future
+```

.changelog/21373.txt

@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_config_organization_custom_policy_rule
+```
+
+```release-note:note
+resource/aws_config_organization_custom_policy_rule: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing
+```

.changelog/22300.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_api_gateway_rest_api: Added `fail_on_warnings` attribute
+```

.changelog/22302.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_cognito_user_pool: `account_recovery_setting.recovery_mechanism` is Optional+Computed
+```

.changelog/22339.txt

@@ -4,4 +4,4 @@ resource/aws_subnet: Add `enable_dns64`, `ipv6_native`, `enable_resource_name_dn
 
 ```release-note:enhancement
 data-source/aws_subnet: Add `enable_dns64`, `ipv6_native`, `enable_resource_name_dns_aaaa_record_on_launch`, `enable_resource_name_dns_a_record_on_launch` and `private_dns_hostname_type_on_launch` attributes
-```
+```

.changelog/23839.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_s3outposts_endpoint: Add `access_type` and `customer_owned_ipv4_pool` arguments
+```

.changelog/24350.txt

@@ -0,0 +1,7 @@
+```release-note:new-data-source
+aws_organizations_organizational_unit_child_accounts
+```
+
+```release-note:new-data-source
+aws_organizations_organizational_unit_descendant_accounts
+```

.changelog/24507.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_route: Allow `gateway_id` value of `local` when updating a Route
+```

.changelog/24941.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_appintegrations_data_integration
+```

.changelog/24965.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_appintegrations_event_integration
+```

.changelog/25275.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+aws_cognito_user_pool_domain: Add ability to update `certificate_arn` in place
+```

.changelog/25474.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_networkfirewall_resource_policy
+```

.changelog/25535.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_servicecatalog_provisioning_artifacts
+```

.changelog/25846.txt

@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_cloudwatch_event_endpoint
+```
+
+```release-note:bug
+resource/aws_cloudwatch_event_rule: Add retry to read step, resolving `couldn't find resource` error
+```

.changelog/25849.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_ssoadmin_permission_set: Extend timeout delay and min timeout
+```
+
+```release-note:enhancement
+resource/aws_ssoadmin_account_assignment: Extend timeout delay and min timeout
+```

.changelog/25926.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_rbin_rule
+```

.changelog/26123.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_account_primary_contact
+```

.changelog/26151.txt

@@ -0,0 +1,7 @@
+```release-note:note
+resource/aws_connect_queue: The `quick_connect_ids_associated` attribute is being deprecated in favor of `quick_connect_ids`
+```
+
+```release-note:note
+resource/aws_connect_routing_profile: The `queue_configs_associated` attribute is being deprecated in favor of `queue_configs`
+```

.changelog/26206.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_gamelift_game_session_queue: Add `custom_event_data` argument
+```

.changelog/26305.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_instance: Add ability to update `private_dns_name_options` in place
+```

.changelog/26317.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_s3_bucket: Correct S3 Object Lock error handling for third-party S3-compatible API implementations
+```
+
+```release-note:enhancement
+resource/aws_s3_bucket_object_lock_configuration: Correct error handling for third-party S3-compatible API implementations
+```

.changelog/26343.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_redshiftdata_statement: Fix `ValidationException` errors reading expired statements 
+```

.changelog/26371.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_servicecatalog_provisioned_product: Changes in the provisioning_artifact_name attribute are now reflected correctly in AWS
+```

.changelog/26546.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lakeformation_lf_tag: Increase values MaxItem up to 1000 to match with AWS real limit
+```

.changelog/26643.txt

@@ -0,0 +1,19 @@
+```release-note:bug
+ resource/aws_lakeformation_permissions: Change `lf_tag`, `lf_tag.values`, `lf_tag_policy`, `lf_tag_policy.expression.key`, `lf_tag_policy.expression.values` and `lf_tag_policy.resource_type` to [ForceNew](https://developer.hashicorp.com/terraform/plugin/sdkv2/schemas/schema-behaviors#forcenew)
+```
+
+```release-note:bug
+ resource/aws_lakeformation_permissions: Remove limit on number of `lf_tag_policy.expression` blocks
+```
+
+```release-note:bug
+ data-source/aws_lakeformation_permissions: Remove limit on number of `lf_tag_policy.expression` blocks
+```
+
+```release-note:bug
+ resource/aws_lakeformation_permissions: Change `lf_tag_policy.expression` from `TypeList` to `TypeSet` as order is not significant
+```
+
+```release-note:bug
+ data-source/aws_lakeformation_permissions: Change `lf_tag_policy.expression` from `TypeList` to `TypeSet` as order is not significant
+```

.changelog/26695.txt

@@ -0,0 +1,11 @@
+```release-note:new-data-source
+aws_appmesh_route
+```
+
+```release-note:bug
+data-source/aws_appmesh_mesh: Don't attempt to list tags if the current AWS account is not the mesh owner
+```
+
+```release-note:bug
+data-source/aws_appmesh_virtual_service: Don't attempt to list tags if the current AWS account is not the mesh owner
+```

.changelog/26746.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+data-source/aws_opensearch_domain: Add missing `advanced_security_options.anonymous_auth_enabled` attribute
+```

.changelog/26838.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_network_acl_association: Add retry to read step, resolving `empty result` error
+```

.changelog/26857.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+data-source/aws_ecr_image: Add `most_recent` argument to return the most recently pushed image
+```
+
+```release-note:enhancement
+data-source/aws_ecr_repository: Add `most_recent_image_tags` attribute containing the most recently pushed image tag(s) in an ECR repository
+```

.changelog/26908.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_appmesh_virtual_router
+```

.changelog/27057.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_appmesh_virtual_gateway
+```

.changelog/27207.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_batch_compute_environment: Allow a maximum of 2 `compute_resources.ec2_configuration`s
+```

.changelog/27337.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_fis_experiment_template: Add support for `Cluster` Network Actions to `actions.*.target`
+```

.changelog/27351.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_ecs_task_definition: Add `arn_without_revision` attribute
+```

.changelog/27472.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_prometheus_workspace: Create a logging configuration on resource update if none existed previously
+```

.changelog/27502.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+various IAM resource types: more detailed error messages for invalid policy document JSON
+```

.changelog/27545.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_appmesh_virtual_node
+```

.changelog/27563.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_transfer_user: Fix bug preventing removal of all `home_directory_mappings` due to empty list validation error
+```
+
+```release-note:enhancement
+resource/aws_transfer_user: Add configurable timeout for Delete
+```

.changelog/27598.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_elasticsearch_domain: Remove upper bound validation for `ebs_options.throughput` as the 1,000 MB/s limit can be raised
+```
+
+```release-note:bug
+resource/aws_opensearch_domain: Remove upper bound validation for `ebs_options.throughput` as the 1,000 MB/s limit can be raised
+```

.changelog/27616.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_appflow_flow: Add attribute `preserve_source_data_typing` to `s3_output_format_config` in `s3`
+```

.changelog/27640.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_vpc_endpoint_service_allowed_principal: Changed id to use ServicePermissionId
+```

.changelog/27704.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+data-source/aws_s3_object: Expand content types that can be read from S3 to include some human-readable application types (e.g., `application/xml`, `application/atom+xml`)
+```
+
+```release-note:enhancement
+data-source/aws_s3_bucket_object: Expand content types that can be read from S3 to include some human-readable application types (e.g., `application/xml`, `application/atom+xml`)
+```

.changelog/27730.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_transfer_server: Add support for `on_partial_upload` block on the `workflow_details` attribute.
+```
+
+```release-note:bug
+resource/aws_transfer_server: Allow the removal of `workflow_details` attribute.
+```

.changelog/27778.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_cloudfront_response_headers_policy: Allow `server_timing_headers_config.0.sampling_rate` to be `0`
+```

.changelog/27790.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cognito_user_pool_domain: Add `cloudfront_distribution` and `cloudfront_distribution_zone_id` attributes
+```

.changelog/27991.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_opsworks_permission: `stack_id` and `user_arn` are both Required and ForceNew
+```
+
+```release-note:enhancement
+resource/aws_efs_mount_target: Add configurable timeouts for Create and Delete
+```

.changelog/28051.txt

@@ -0,0 +1,15 @@
+```release-note:bug
+resource/aws_neptune_cluster: Fix major version upgrade
+```
+
+```release-note:enhancement
+resource/aws_neptune_cluster: Add `neptune_instance_parameter_group_name` argument, used only when upgrading major version
+```
+
+```release-note:enhancement
+resource/aws_neptune_global_cluster: Increase Update timeout to 120 minutes (per global cluster member)
+```
+
+```release-note:bug
+resource/aws_neptune_cluster: Fix [restore-from-snapshot functionality](https://docs.aws.amazon.com/neptune/latest/userguide/backup-restore-restore-snapshot.html) using the `snapshot_identifier` argument on resource Create
+```

.changelog/28142.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_acmpca_certificate: Add `api_passthrough` argument
+```

.changelog/28148.txt

@@ -0,0 +1,7 @@
+```release-note:new-data-source
+aws_api_gateway_authorizers
+```
+
+```release-note:new-data-source
+aws_api_gateway_authorizer
+```

.changelog/28245.txt

@@ -0,0 +1,7 @@
+```release-note:new-data-source
+aws_ec2_public_ipv4_pools
+```
+
+```release-note:new-data-source
+aws_ec2_public_ipv4_pool
+```

.changelog/28258.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lakeformation_lf_tag: Fix support for lf-tag keys with colons in the name
+```

.changelog/28309.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_backup_report_plan: Add `accounts`, `organization_units` and `regions` attributes to the `report_setting` block
+```
+
+```release-note:enhancement
+data-source/aws_backup_report_plan: Add `accounts`, `organization_units` and `regions` attributes to the `report_setting` block
+```

.changelog/28384.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cloudwatch_event_target: Add `ecs_target.ordered_placement_strategy` argument
+```

.changelog/28424.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/db_snapshot: Add `shared_accounts` argument
+```

.changelog/28432.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_db_proxy: Add `auth.client_password_auth_type` attribute
+```