v3.42.0

FEATURES:

• New Data Source: aws_service_discovery_dns_namespace (#6856)
• New Resource: aws_cloudwatch_metric_stream (#18870)
• New Resource: aws_servicecatalog_constraint (#19385)
• New Resource: aws_servicecatalog_product_portfolio_association (#19385)
• New Resource: aws_servicecatalog_service_action (#19369)

ENHANCEMENTS:

• resource/aws_autoscaling_policy: Add PredictiveScaling policy_type and predictive_scaling_configuration argument (#19447)

BUG FIXES:

• resource/aws_networkfirewall_rule_group: Correctly update resource on rules change (#19430)

v3.41.0

FEATURES:

• New Data Source: aws_cloudfront_function (#19315)
• New Data Source: aws_glue_connection (#18802)
• New Data Source: aws_glue_data_catalog_encryption_settings (#18802)
• New Data Source: aws_organizations_delegated_administrators (#19389)
• New Data Source: aws_organizations_delegated_services (#19389)
• New Resource: aws_apprunner_auto_scaling_configuration_version (#19432)
• New Resource: aws_apprunner_connection (#19432)
• New Resource: aws_apprunner_custom_domain_association (#19432)
• New Resource: aws_apprunner_service (#19432)
• New Resource: aws_cloudfront_function (#19315)
• New Resource: aws_macie2_invitation_accepter (#19304)
• New Resource: aws_macie2_member (#19304)
• New Resource: aws_macie2_organization_admin_account (#19303)
• New Resource: aws_organizations_delegated_administrator (#19389)
• New Resource: aws_servicecatalog_organizations_access (#19278)
• New Resource: aws_servicecatalog_portfolio_share (#19278)

ENHANCEMENTS:

• data-source/aws_outposts_outpost: owner_id is now an optional argument (#17585)
• data-source/aws_outposts_outposts: Add owner_id argument (#17585)
• resource/aws_cloudfront_distribution: Add function_association argument to ordered_cache_behavior and default_cache_behavior configuration blocks (#19315)
• resource/aws_glue_catalog_database: Add target_database argument (#19371)
• resource/aws_glue_catalog_table: Add target_table argument (#19372)
• resource/aws_launch_template: Add interface_type argument to network_interfaces configuration block (#18841)
• resource/aws_network_interface: Add interface_type argument (#18841)

BUG FIXES:

• resource/aws_lambda_function: Wait for successful completion of function code update (#19386)
• resource/aws_pinpoint_email_channel: role_arn argument is optional (#19361)

v3.40.0

FEATURES:

• New Resource: aws_macie2_custom_data_identifier (#19254)
• New Resource: aws_macie2_findings_filter (#19283)
• New Resource: aws_servicecatalog_tag_option (#19300)
• New Resource: aws_timestreamwrite_database (#15463)
• New Resource: aws_timestreamwrite_table (#19354)

ENHANCEMENTS:

• data-source/aws_codestarconnections_connection: Add host_arn attribute (#19284)
• data-source/aws_lb_listener: Add tags attribute. (#19286)
• resource/aws_ami_copy: Add destination_outpost_arn argument (#17735)
• resource/aws_cloudwatch_event_target: Add http_target argument (#19337)
• resource/aws_codestarconnections_connection: Add host_arn argument (#19284)
• resource/aws_datasync_location_s3: Add agent_arns argument (#18547)
• resource/aws_datasync_option: Add private_link_endpoint, security_group_arns, subnet_arns and vpc_endpoint_id arguments (#16207)
• resource/aws_datasync_task: Add excludes argument and overwrite_mode, task_queueing, and transfer_mode to the options configuration block (#16204)
• resource/aws_datasync_task: Add schedule argument (#14452)
• resource/aws_datasync_task: Add plan time validation to cloudwatch_log_group_arn, destination_location_arn and source_location_arn (#14452)
• resource/aws_eks_node_group: Add node_group_name_prefix argument (#13938)
• resource/aws_lambda_event_source_mapping: Support reading starting_position and starting_position_timestamp attributes (#19253)
• resource/aws_lb_listener: Add tags argument & tags_all attribute. (#19286)
• resource/aws_lb_listener_rule: Add plan time validation to listener_arn, action.target_group_arn, action.forward.target_group.arn, action.redirect.host, action.redirect.path, action.redirect.query, action.redirect.status_code, action.fixed_response.message_body, action.authenticate_cognito.user_pool_arn. (#19285)
• resource/aws_lb_listener_rule: Add tagging support. (#19285)

v3.39.0

FEATURES:

• New Data Source: aws_cloudwatch_event_source (#19219)
• New Resource: aws_dynamodb_kinesis_streaming_destination (#16743)
• New Resource: aws_macie2_classification_job (#19165)

ENHANCEMENTS:

• data-source/aws_transfer_server: Add certificate, endpoint_type, protocols and security_policy_name attributes (#13371)
• resource/aws_cloudwatch_event_bus: Support partner event bus creation (#19072)
• resource/aws_cloudwatch_event_rule: Support partner event bus names (#18491)
• resource/aws_cloudwatch_event_target: Support partner event bus names (#18491)
• resource/aws_codebuild_project: Add file_system_locations argument (#12130)
• resource/aws_cognito_identity_pool: Add allow_classic_flow argument (#19176)
• resource/aws_datasync_location_s3: Add s3_storage_class argument (#19190)
• resource/aws_glue_connection: Add plan time validation for connection_properties, description, match_criteria, name, and physical_connection_requirements.security_group_id_list (#19172)
• resource/aws_msk_cluster: Support in-place instance_type updates (#17447)
• resource/aws_sfn_state_machine: Add tracing_configuration attribute (#15434)
• resource/aws_shield_protection: Add tags argument (#19168)
• resource/aws_transfer_server: Add protocols argument (#13371)
• resource/aws_transfer_server: Add security_policy_name argument (#15375)

BUG FIXES:

• aws_batch_compute_environment: Allow update of just service_role for managed compute environments (#19205)
• aws_batch_compute_environment: service_role argument is optional (#19205)
• provider: Prevent Provider produced inconsistent final plan errors when lifecycle arguments apply to resource tags not known until apply (#19251)
• resource/aws_appautoscaling_target: Ignore ObjectNotFoundException on deletion (#18115)
• resource/aws_batch_job_definition: Prevent diff with default value of fargatePlatformConfiguration (#19207)
• resource/aws_lakeformation_permissions: Fix issues related to permissions not being revoked and attempts to revoke non-existent permissions (#18505)
• resource/aws_mwaa_environment: Correctly apply plugins_s3_object_version change (#19266)
• resource/aws_sfn_state_machine: Handle eventual consistency of state machine updates (#15434)
• resource/aws_ssoadmin_managed_policy_attachment: Retry attachment/detachment when other permission-set attachment event was not yet propagated, to avoid ConflictException. (#19216)

v3.38.0

NOTES:

• provider: default_tags support generally available to all provider resources that support tags with the exception of aws_autoscaling_group (#19084)

FEATURES:

• New Data Source: aws_cloudformation_type (#18579)
• New Data Source: aws_kms_public_key (#18873)
• New Data Source: aws_resourcegroupstaggingapi_resources (#17804)
• New Resource: aws_cloudformation_type (#18579)
• New Resource: aws_codestarconnections_host (#16918)
• New Resource: aws_macie2_account (#19069)
• New Resource: aws_rds_proxy_endpoint (#18881)
• New Resource: aws_route53_resolver_firewall_rule (#18712)
• New Resource: aws_route53_resolver_firewall_rule_group_association (#19164)
• New Resource: aws_servicecatalog_product (#19122)

ENHANCEMENTS:

• data-source/aws_efs_mount_target: Add access_point_id, file_system_id arguments (#18918)
• data-source/aws_iam_policy: Add support for lookup by arn, name, and/or path_prefix (#6084)
• data-source/aws_launch_template: Add placement host_resource_group_arn attribute (#15785)
• data/source_aws_eks_addon: added validation for cluster_name (#19078)
• data/source_aws_eks_cluster: added validation for cluster_name (#19078)
• resource/aws_appsync_resolver: Mark request_template and response_template as optional (support Lambda) (#14710)
• resource/aws_batch_compute_environment: Additional supported value FARGATE and FARGATE_SPOT for the type argument in the compute_resources configuration block (#16819)
• resource/aws_batch_compute_environment: The instance_role, instance_type and min_vcpus arguments in the compute_resources configuration block are now optional (#16819)
• resource/aws_batch_compute_environment: The security_group_ids and subnets arguments in the compute_resources configuration block can now be updated in-place for Fargate compute resources (#16819)
• resource/aws_batch_job_definition: Add propagate_tags argument (#18336)
• resource/aws_codebuild_project: Add build_batch_config argument (#14534)
• resource/aws_codebuild_project: Add build_status_config attribute to source and secondary_sources configuration blocks (#15442)
• resource/aws_codebuild_project: Add concurrent_build_limit argument to specify build concurrency. (#18320)
• resource/aws_codebuild_project: Add plan time validation for secondary_artifacts, secondary_sources, service_role (#18843)
• resource/aws_eip: Add address argument to recover or an IPv4 address from an address pool, supporting BYOIP (#8876)
• resource/aws_eks_addon: added validation for cluster_name (#19078)
• resource/aws_eks_cluster: added validation for name (#19078)
• resource/aws_eks_fargate_profile: added validation for cluster_name (#19078)
• resource/aws_eks_node_group: added validation for cluster_name (#19078)
• resource/aws_elasticache_global_replication_group: Adds parameter engine_version_actual to match other ElastiCache resources (#18920)
• resource/aws_elasticache_subnet_group: Add tags argument (#19119)
• resource/aws_instance: Make instance_initiated_shutdown_behavior also computed, allowing value to be read (#18880)
• resource/aws_lambda_event_source_mapping: Don't incorrectly update unspecified maximum_batching_window_in_seconds, maximum_record_age_in_seconds and maximum_retry_attempts arguments from their default values (#17933)
• resource/aws_lambda_event_source_mapping: Fix update of batch_size for MSK event source mappings (#17933)
• resource/aws_launch_template: Add placement host_resource_group_arn argument (#15785)
• resource/aws_organizations_organizational_unit: Add tags argument (#18861)
• resource/aws_rds_global_cluster: Allow engine_version to be upgraded in place. (#18598)
• resource/aws_s3outposts_endpoint: Extends creation timeout to 20 minutes (#18454)
• resource/aws_ses_configuration_set: Adds reputation_metrics_enabled and sending_enabled arguments and last_fresh_start attribute (#17608)
• resource/aws_ses_receipt_rule: Add encoding argument to sns_action configuration block. (#17654)
• resource/aws_sns_topic_policy: Add owner attribute (#14123)
• resource/aws_sns_topic_policy: Add plan time validation to arn (#14123)
• resource/aws_wafv2_web_acl_logging_configuration: Add logging_filter argument (#19051)

BUG FIXES:

• provider: Prevent Provider produced inconsistent final plan errors when resource tags are not known until apply (#18958)
• resource/aws_batch_job_definition: Treat empty container_properties.logConfiguration.secretOptions array as null to prevent continual diffs (#16120)
• resource/aws_batch_job_queue: Recreate batch job queue if the name changes (#19121)
• resource/aws_codebuild_project: Allow fetching submodules for bitbucket source types (#18843)
• resource/aws_codebuild_project: Fix removing secondary_sources and secondary_artifacts (#18843)
• resource/aws_ec2_managed_prefix_list: Prevent entry description update errors (#19095)
• resource/aws_elasticache_cluster: Allows specifying Redis 6.x (#18920)
• resource/aws_elasticache_replication_group: Allows specifying Redis 6.x (#18920)
• resource/aws_glue_crawler: Allow '/' in name argument (#19160)
• resource/aws_lambda_event_source_mapping: Support -1 (forever) as a valid value for maximum_record_age_in_seconds (#16113)
• resource/aws_lambda_event_source_mapping: Support -1 (forever) as a valid value for maximum_retry_attempts (#16113)
• resource/aws_ram_principal_association: Improve handling of eventual consistency (#17032)
• resource/aws_ram_resource_share: Improve handling of eventual consistency (#17032)
• resource/aws_ram_resource_share_accepter: Improve handling of eventual consistency (#17032)
• resource/aws_storagegateway_gateway: Correctly handle additional error message returned in some regions (#19116)
• resource/aws_vpc_endpoint: F...

v3.37.0

NOTES:

• provider: The HTTP User-Agent header has been reordered so the AWS SDK Go product is last, except when using the TF_APPEND_USER_AGENT environment variable. Environments dependent on the previous User-Agent header ordering may require updates. (#18855)

FEATURES:

• New Data Source: aws_eks_addon (#16972)
• New Resource: aws_eks_addon (#16972)
• New Resource: aws_route53_resolver_firewall_domain_list (#18558)
• New Resource: aws_securityhub_insight (#18494)

ENHANCEMENTS:

• resource/aws_autoscaling_group: Add Warm Pool support (#18734)
• resource/aws_cloudfront_distribution: Add trusted_key_groups argument (#18644)
• resource/aws_codedeploy_app: Add arn, linked_to_github, github_account_name, application_id attributes (#18564)
• resource/aws_codedeploy_app: Add tags argument (#18564)
• resource/aws_codedeploy_app: Add plan time validation for name (#18564)
• resource/aws_codedeploy_deployment_group: Add arn, compute_platform, and deployment_group_id attributes (#18716)
• resource/aws_codedeploy_deployment_group: Add tags argument (#18716)
• resource/aws_codedeploy_deployment_group: Add plan time validation for terminate_blue_instances_on_deployment_success.termination_wait_time_in_minutes, service_role_arn, load_balancer_info.target_group_pair_info.prod_traffic_route.listener_arns, load_balancer_info.target_group_pair_info.test_traffic_route.listener_arns, trigger_configuration.trigger_target_arn (#18716)
• resource/aws_codedeploy_deployment_group: Updating deployment_group_name doesnt recreate group (#18716)
• resource/aws_dynamodb_table: Add kms_key_arn argument to replica configuration block (#18373)
• resource/aws_emr_cluster: Adds support for multiple subnets (#17219)
• resource/aws_rds_cluster: Database port is updated in-place (#18081)
• resource/aws_servicequotas_service_quota: Add plan time validation to quota_code and service_code (#17992)
• resource/aws_sns_topic: Add fifo_topic and content_based_deduplication attributes (#15828)

BUG FIXES:

• resource/aws_dynamodb_table: Update Global Secondary Index provisioned throughput settings on new changes (#18215)
• resource/aws_ecr_replication_configuration: Remove relication rules on resource deletion (#18882)
• resource/aws_eip: Tags are created for EIPs which default to vpc domain (#18909)
• resource/aws_fms_policy: Use API model regular expression for resource_type and resource_type_list argument plan time validation (#18600)
• resource/aws_sqs_queue: Append .fifo suffix for Terraform-assigned FIFO queue names (#17164)

v3.36.0

FEATURES:

• New Resource: aws_cloudfront_key_group (#17041)
• New Resource: aws_ecr_registry_policy (#16831)
• New Resource: aws_ecr_replication_configuration (#16853)
• New Resource: aws_kinesisanalyticsv2_application_snapshot (#18056)
• New Resource: aws_mwaa_environment (#16616)

ENHANCEMENTS:

• data-source/aws_lb_listener: Add alpn_policy argument (#14462)
• data-source/aws_s3_bucket_object: Add bucket_key_enabled attribute (Support S3 Bucket Keys) (#16581)
• resource/aws_eip: Tags are set on create (#17612)
• resource/aws_kinesisanalyticsv2_application: Add force_stop attribute (#18056)
• resource/aws_kinesisanalyticsv2_application: Add run_configuration attribute for starting a Flink application (#18056)
• resource/aws_kinesisanalyticsv2_application: Add start_application attribute (#18056)
• resource/aws_kinesisanalyticsv2_application: starting_position_configuration can be specified when starting a SQL application (#18056)
• resource/aws_lb_listener: Add alpn_policy argument (#14462)
• resource/aws_s3_bucket: Add bucket_key_enabled argument to server_side_encryption_configuration rule configuration block (Support S3 Bucket Keys) (#16581)
• resource/aws_s3_bucket_object: Add bucket_key_enabled attribute (Support S3 Bucket Keys) (#16581)
• resource/aws_s3_object_copy: Add bucket_key_enabled argument (#18611)

BUG FIXES:

• resource/aws_appmesh_gateway_route: Handle read-after-create eventual consistency (#18529)
• resource/aws_appmesh_mesh: Handle read-after-create eventual consistency (#18529)
• resource/aws_appmesh_route: Handle read-after-create eventual consistency (#18529)
• resource/aws_appmesh_virtual_gateway: Handle read-after-create eventual consistency (#18529)
• resource/aws_appmesh_virtual_node: Handle read-after-create eventual consistency (#18529)
• resource/aws_appmesh_virtual_router: Handle read-after-create eventual consistency (#18529)
• resource/aws_appmesh_virtual_service: Handle read-after-create eventual consistency (#18529)
• resource/aws_cloudhsm_v2_hsm: Prevent orphaned HSM Instances by additionally matching on ENI identifier during lookup (#18580)
• resource/aws_dms_replication_task: Handle read-only attributes in replication_task_settings to avoid unnecessary diffs. (#13476)
• resource/aws_docdb_cluster_parameter_group: Read all user parameters and parameters specified in the configuration. (#18486)
• resource/aws_ecr_lifecycle_policy: Handle read-after-create eventual consistency (#18464)
• resource/aws_ecr_repository: Handle read-after-create eventual consistency (#18464)
• resource/aws_ecr_repository_policy: Handle read-after-create eventual consistency (#18464)
• resource/aws_elasticache_replication_group: Remmoves incorrect plan-time validation for automatic_failover_enabled (#18635)
• resource/aws_iam_group: Handle read-after-create eventual consistency (#18459)
• resource/aws_iam_group_membership: Handle read-after-create eventual consistency (#18459)
• resource/aws_iam_group_policy: Handle read-after-create eventual consistency (#18459)
• resource/aws_iam_group_policy_attachment: Handle read-after-create eventual consistency (#18459)
• resource/aws_iam_user: Handle read-after-create eventual consistency (#18458)
• resource/aws_iam_user_group_membership: Handle read-after-create eventual consistency (#18458)
• resource/aws_iam_user_login_profile: Handle read-after-create eventual consistency (#18458)
• resource/aws_iam_user_policy: Handle read-after-create eventual consistency (#18458)
• resource/aws_iam_user_policy_attachment: Handle read-after-create eventual consistency (#18458)
• resource/aws_iam_user_ssh_key: Handle read-after-create eventual consistency (#18458)
• resource/aws_lb_target_group: Handle read-after-create eventual consistency (#18634)
• resource/aws_secretsmanager_secret: Handle read-after-create eventual consistency (#18462)
• resource/aws_secretsmanager_secret_policy: Handle read-after-create eventual consistency (#18462)
• resource/aws_secretsmanager_secret_rotation: Handle read-after-create eventual consistency (#18462)
• resource/aws_secretsmanager_secret_version: Handle read-after-create eventual consistency (#18462)
• resource/aws_ssm_parameter: Allow allowed_pattern and description arguments to be empty strings (#18588)
• resource/aws_ssm_parameter: Allow tags to be applied to resource when overwrite is configured (#18640)
• resource/aws_vpc_endpoint_route_table_association: Handle read-after-create eventual consistency (#18465)
• resource/aws_xray_sampling_rule: Change the maximum length of rule_name from 128 to 32 (#18667)

v3.35.0

FEATURES:

• New Resource: aws_cloudwatch_query_definition (#17899)

ENHANCEMENTS:

• data-source/aws_efs_file_system: Add availability_zone_id and availability_zone_name attributes (#18319)
• data-source/aws_iam_policy: Add policy_id and tags attributes (#18276)
• resource/aws_apigatewayv2_route: Add request_parameter attribute (#18410)
• resource/aws_appmesh_virtual_gateway: Add spec.backend_defaults.client_policy.tls.certificate, spec.backend_defaults.client_policy.tls.validation.subject_alternative_names, spec.listener.tls.certificate and spec.listener.tls.validation.subject_alternative_names attributes to support mutual TLS authentication (#18106)
• resource/aws_appmesh_virtual_gateway: Add spec.backend_defaults.client_policy.tls.validation.trust.sds and spec.listener.tls.validation.trust.sds attributes to support Envoy Service Discovery Service certificates (#18106)
• resource/aws_appmesh_virtual_node: Add spec.backend.virtual_service.client_policy.tls.certificate, spec.backend.virtual_service.client_policy.tls.validation.subject_alternative_names, spec.backend_defaults.client_policy.tls.certificate, spec.backend_defaults.client_policy.tls.validation.subject_alternative_names, spec.listener.tls.certificate and spec.listener.tls.validation.subject_alternative_names attributes to support mutual TLS authentication (#18127)
• resource/aws_appmesh_virtual_node: Add spec.backend.virtual_service.client_policy.tls.validation.trust.sds, spec.backend_defaults.client_policy.tls.validation.trust.sds and spec.listener.tls.validation.trust.sds attributes to support Envoy Service Discovery Service certificates (#18127)
• resource/aws_backup_plan: Add enable_continuous_backup argument (#18315)
• resource/aws_cloudformation_stack_set: Add auto_deployment configuration block and permissions_model arguments (support service managed permissions) (#12423)
• resource/aws_cognito_user_pool: Allow schema items to be added without recreating resource. (#18512)
• resource/aws_ecs_service: Add deployment_circuit_breaker (#16936)
• resource/aws_efs_file_system: Add availability_zone_id attribute and availability_zone_name argument (#18319)
• resource/aws_efs_file_system: Add number_of_mount_targets, size_in_bytes and owner_id attributes (#17969)
• resource/aws_elasticsearch_domain: Add domain_endpoint_options configuration block custom_endpoint, custom_endpoint_certificate_arn, and custom_endpoint_enabled arguments (#16192)
• resource/aws_iam_policy: Add policy_id attribute (#18276)
• resource/aws_iam_policy: Add tagging support (#18276)
• resource/aws_lb_target_group: Add preserve_client_ip target attribute support (#17731)
• resource/aws_route: destination_prefix_list_id attribute can be specified for managed prefix list destinations (#17291)
• resource/aws_ssm_parameter: Add plan time validation to name, description and allowed_pattern (#17830)
• resource/aws_ssm_parameter: Tag on create (#17830)

BUG FIXES:

• resource/aws_ec2_transit_gateway_route_table_propagation: Wait for enable and disable operations to complete (#18470)
• resource/aws_ecs_service: Improve handling of eventual consistency including security group dependency violations on deletion (#16936)
• resource/aws_iam_role: Handle read-after-create eventual consistency (#18435)
• resource/aws_iam_role_policy: Handle read-after-create eventual consistency (#18435)
• resource/aws_iam_role_policy_attachment: Handle read-after-create eventual consistency (#18435)
• resource/aws_network_interface_sg_attachment: Handle read-after-create eventual consistency (#18466)
• resource/aws_route_table: Improve eventual consistency handling and handling of out-of-band resource removal (#17319)
• resource/aws_route_table_association: Improve eventual consistency handling and handling of out-of-band resource removal (#17319)
• resource/aws_s3_bucket_object: Handle read-after-create eventual consistency (#17236)
• resource/aws_securityhub_organization_admin_account: Retry on ResourceConflictException error during creation (#18341)
• resource/aws_sns_topic_subscription: Enforce lowercase protocol argument validation to match API and prevent resource errors (#18475)
• resource/aws_sns_topic_subscription: Handle read-after-create eventual consistency (#18475)
• resource/aws_spot_instance_request: Handle read-after-create eventual consistency (#18473)
• resource/aws_synthetics_canary: Handle asynchronous IAM eventual consistency error on creation (#18404)
• resource/aws_vpc_dhcp_options_association: Handle read-after-create eventual consistency (#18472)
• resource/aws_vpn_gateway_route_propagation: Improve eventual consistency handling and handling of out-of-band resource removal (#17319)

v3.34.0

NOTES:

• resource/aws_storagegateway_upload_buffer: The Storage Gateway ListLocalDisks API operation has been implemented to support the disk_path attribute for Cached and VTL gateway types. Environments using restrictive IAM permissions may require updates. (#18313)

FEATURES:

• New Data Source: aws_codestarconnections_connection (#18129)
• New Resource: aws_lightsail_instance_public_ports (#8611)

ENHANCEMENTS:

• resource/aws_ami_from_instance: Tag on create. (#17968)
• resource/aws_ecr_repository_policy: Add plan time validation for policy (#14193)
• resource/aws_fms_admin_account: Extend creation timeout to 10 minutes (#17596)
• resource/aws_iam_instance_profile: Add tagging support (#17962)
• resource/aws_iam_openid_connect_provider: Add plan time validation for client_id_list and thumbprint_list (#17964)
• resource/aws_iam_openid_connect_provider: Add tagging support (#17964)
• resource/aws_iam_saml_provider: Add plan time validation for name and saml_metadata_document (#17965)
• resource/aws_iam_saml_provider: Add tagging support (#17965)
• resource/aws_iam_server_certificate: Add expiration and upload_date attributes (#17967)
• resource/aws_iam_server_certificate: Add tagging support (#17967)
• resource/aws_light_instance_public_ports: Add cidrs argument to port_info (#14905)
• resource/aws_pinpoint_email_channel: Add configuration_set argument (#18314)
• resource/aws_pinpoint_email_channel: Add plan time validation for identity and role_arn (#18314)
• resource/aws_pinpoint_event_stream: Plan time validations for destination_stream_arn and role_arn (#18305)
• resource/aws_route: Validate route destination and target attributes (#16930)
• resource/aws_sns_topic_subscription: Add plan time validation for subscription_role_arn and topic_arn (#14101)
• resource/aws_storagegateway_upload_buffer: Add disk_path argument for Cached and VTL gateways (#18313)

BUG FIXES:

• data-source/aws_storagegateway_local_disk: Allow disk_path reference on disk_node lookup and vice-versa (#18313)
• resource/aws_api_gateway_vpc_link: Persist ID of failed VPC Link to state (#18382)
• resource/aws_apigatewayv2_domain_name: Allow update of mutual TLS S3 object version (#18351)
• resource/aws_cloudfront_distribution: Allow forwarded_values to be set to empty when values were previously set (#18042)
• resource/aws_cloudwatch_event_permission: Fix error in Event Bridge/CloudWatch Events bus name validation (#16815)
• resource/aws_cloudwatch_event_rule: Fix error in Event Bridge/CloudWatch Events bus name validation (#16815)
• resource/aws_cloudwatch_event_target: Fix error in Event Bridge/CloudWatch Events bus name validation (#16815)
• resource/aws_config_configuration_aggregator: Allow name to have uppercase characters (#14247)
• resource/aws_ecs_service: Re-create service when service_registries changes (#17387)
• resource/aws_elasticache_replication_group: Prevents re-creation of secondary replication groups when encryption is enabled (#18361)
• resource/aws_mq_configuration: Add ldap as an authentication_strategy and RabbitMQ as an engine_type (#18070)
• resource/aws_network_acl: Handle EC2 eventual consistency errors on creation (#18388)
• resource/aws_network_acl_rule: Handle EC2 eventual consistency errors on creation (#18388)
• resource/aws_pinpoint_event_stream: Retry on eventual consistency error (#18305)
• resource/aws_pinpoint_sms_channel: Set all params on update (#18281)
• resource/aws_route: Correctly handle updates to the route target attributes (egress_only_gateway_id, gateway_id, instance_id, local_gateway_id, nat_gateway_id, network_interface_id, transit_gateway_id, vpc_peering_connection_id) (#16930)
• resource/aws_sns_topic_subscription: recreate subscription if topic is deleted (#14101)
• resource/aws_subnet: Handle EC2 eventual consistency errors on creation (#18392)
• resource/aws_vpc: Handle EC2 eventual consistency errors on creation (#18391)
• resource/aws_wafv2_web_acl_logging_configuration: Remove deprecation warning for redacted_fields single_header argument (#18384)

v3.33.0

NOTES:

• data-source/aws_vpc_endpoint_service: The service_type argument filtering has been switched from client-side to new EC2 API functionality (#17641)
• provider: New default_tags argument as a public preview for applying tags across all resources under a provider. Support for the functionality must be added to individual resources in the codebase and is only implemented for the aws_subnet and aws_vpc resources at this time. Until a general availability announcement, no compatibility promises are made with these provider arguments and their functionality. (#17974)
• resource/aws_codebuild_project: The source and secondary_sources configuration block auth attributes have been deprecated to match the CodeBuild API documentation. Use the aws_codebuild_source_credential resource instead. (#17465)
• resource/aws_wafv2_web_acl_logging_configuration: The redacted_fields configuration block all_query_arguments, body, and single_query_argument arguments have been deprecated to match the WAF API documentation (#14319)

FEATURES:

• New Data Source: aws_ec2_transit_gateway_route_tables (#17589)
• New Data Source: aws_kinesis_stream_consumer (#17149)
• New Resource: aws_kinesis_stream_consumer (#17149)

ENHANCEMENTS:

• provider: Add default_tags argument (in public preview, see note above) (#17974)
• resource/aws_db_parameter_group: Store all values in lowercase to prevent unexpected diffs (#17909)
• resource/aws_ssm_parameter: Add support for Intelligent-Tiering (#11967)
• resource/aws_storagegateway_gateway: Add support for smb_file_share_visibility. (#18076)
• resource/aws_subnet: Support provider-wide default tags (in public preview, see note above) (#17974)
• resource/aws_vpc: Support provider-wide default tags (in public preview, see note above) (#17974)

BUG FIXES:

• data-source/aws_vpc_endpoint_service: Prevent panic with incorrect service_type argument values (#17641)
• resource/aws_dms_certificate: Correctly base64 decode certificate_wallet value (#17958)
• resource/aws_globalaccelerator_accelerator: Correct length for name attribute validation (#17985)
• resource/aws_lakeformation_permissions: Properly serialize SELECT permission for permissions and permissions_with_grant_option fields (#18203)
• resource/aws_ssm_patch_group: Allow for a single patch group to be registered with multiple patch baselines (#15213)
• resource/aws_ssm_patch_group: Replace Provider produced inconsistent result after apply with actual error message (#15213)
• resource/aws_waf_rule: Fix rule deletion when still referenced by a WebACL (#17876)
• resource/aws_wafv2_web_acl_logging_configuration: Ensure redacted_fields are applied to the resource (#14319)