Update Terraform aws to v6.30.0

[citygeo-bot]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
aws (source)	required_provider	minor	6.25.0 → 6.30.0

---

Release Notes

hashicorp/terraform-provider-aws (aws)

v6.30.0

Compare Source

FEATURES:

• New Resource: aws_ssoadmin_managed_policy_attachments_exclusive (#​46176)

BUG FIXES:

• resource/aws_dynamodb_table: Fix panic when global_secondary_index or global_secondary_index.key_schema are dynamic (#​46195)

v6.29.0

Compare Source

NOTES:

• data-source/aws_organizations_organization: Add return_organization_only argument to return only the results of the DescribeOrganization API and avoid API limits (#​40884)
• resource/aws_cloudfront_anycast_ip_list: Because we cannot easily test all this functionality, it is best effort and we ask for community help in testing (#​43331)
• resource/aws_invoicing_invoice_unit: Deprecates region attribute, as the resource is global. (#​46185)
• resource/aws_organizations_organization: Add return_organization_only argument to return only the results of the DescribeOrganization API and avoid API limits (#​40884)
• resource/aws_savingsplans_savings_plan: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​45834)

FEATURES:

• New Data Source: aws_arcregionswitch_plan (#​43781)
• New Data Source: aws_arcregionswitch_route53_health_checks (#​43781)
• New Data Source: aws_organizations_entity_path (#​45890)
• New Data Source: aws_resourcegroupstaggingapi_required_tags (#​45994)
• New Data Source: aws_s3_bucket_object_lock_configuration (#​45990)
• New Data Source: aws_s3_bucket_replication_configuration (#​42662)
• New Data Source: aws_s3control_access_points (#​45949)
• New Data Source: aws_s3control_multi_region_access_points (#​45974)
• New Data Source: aws_savingsplans_savings_plan (#​45834)
• New Data Source: aws_wafv2_managed_rule_group (#​45899)
• New List Resource: aws_appflow_connector_profile (#​45983)
• New List Resource: aws_appflow_flow (#​45980)
• New List Resource: aws_cleanrooms_collaboration (#​45953)
• New List Resource: aws_cleanrooms_configured_table (#​45956)
• New List Resource: aws_cloudfront_key_value_store (#​45957)
• New List Resource: aws_opensearchserverless_collection (#​46001)
• New List Resource: aws_route53_record (#​46059)
• New List Resource: aws_s3_bucket (#​46004)
• New List Resource: aws_s3_object (#​46002)
• New List Resource: aws_security_group (#​46062)
• New Resource: aws_apigatewayv2_routing_rule (#​42961)
• New Resource: aws_arcregionswitch_plan (#​43781)
• New Resource: aws_cloudfront_anycast_ip_list (#​43331)
• New Resource: aws_notifications_managed_notification_account_contact_association (#​45185)
• New Resource: aws_notifications_managed_notification_additional_channel_association (#​45186)
• New Resource: aws_notifications_organizational_unit_association (#​45197)
• New Resource: aws_notifications_organizations_access (#​45273)
• New Resource: aws_opensearch_application (#​43822)
• New Resource: aws_ram_permission (#​44114)
• New Resource: aws_ram_resource_associations_exclusive (#​45883)
• New Resource: aws_sagemaker_labeling_job (#​46041)
• New Resource: aws_sagemaker_model_card (#​45993)
• New Resource: aws_sagemaker_model_card_export_job (#​46009)
• New Resource: aws_savingsplans_savings_plan (#​45834)
• New Resource: aws_sesv2_tenant_resource_association (#​45904)
• New Resource: aws_vpc_security_group_rules_exclusive (#​45876)

ENHANCEMENTS:

• aws_api_gateway_domain_name: Add routing_mode argument to support dynamic routing via routing rules (#​42961)
• aws_apigatewayv2_domain_name: Add routing_mode argument to support dynamic routing via routing rules (#​42961)
• data-source/aws_batch_job_definition: Add allow_privilege_escalation attribute to eks_properties.pod_properties.containers.security_context (#​45896)
• data-source/aws_dynamodb_table: Add global_secondary_index.key_schema attribute (#​46157)
• data-source/aws_networkmanager_core_network_policy_document: Add segment_actions.routing_policy_names argument (#​45928)
• data-source/aws_s3_object: Add body_base64 and download_body attributes. For improved performance, set download_body = false to ensure bodies are never downloaded (#​46163)
• data-source/aws_vpc_ipam_pool: Add source_resource attribute (#​44705)
• resource/aws_batch_job_definition: Add allow_privilege_escalation attribute to eks_properties.pod_properties.containers.security_context (#​45896)
• resource/aws_bedrockagent_data_source: Add vector_ingestion_configuration.parsing_configuration.bedrock_data_automation_configuration block (#​45966)
• resource/aws_bedrockagent_data_source: Add vector_ingestion_configuration.parsing_configuration.bedrock_foundation_model_configuration.parsing_modality argument (#​46056)
• resource/aws_docdb_cluster_instance: Add certificate_rotation_restart argument (#​45984)
• resource/aws_dynamodb_table: Add support for multi-attribute keys in global secondary indexes. Introduces hash_keys and range_keys to the gsi block and makes hash_key optional for backwards compatibility. (#​45357)
• resource/aws_dynamodb_table: Adds warning when stream_view_type is set and stream_enabled is either false or unset. (#​45934)
• resource/aws_ecr_account_setting: Add support for BLOB_MOUNTING account setting name with ENABLED and DISABLED values (#​46092)
• resource/aws_fsx_windows_file_system: Add domain_join_service_account_secret argument to self_managed_active_directory configuration block (#​45852)
• resource/aws_fsx_windows_file_system: Change self_managed_active_directory.password to Optional and self_managed_active_directory.username to Optional and Computed (#​45852)
• resource/aws_invoicing_invoice_unit: Adds resource identity support. (#​46185)
• resource/aws_invoicing_invoice_unit: Adds validation to restrict rules to a single element. (#​46185)
• resource/aws_lambda_function: Increase upper limit of memory_size from 10240 MB to 32768 MB (#​46065)
• resource/aws_launch_template: Add network_performance_options argument (#​46071)
• resource/aws_odb_network: Enhancements to support KMS and STS parameters in CreateOdbNetwork and UpdateOdbNetwork. (#​45636)
• resource/aws_opensearchserverless_collection: Add resource identity support (#​45981)
• resource/aws_osis_pipeline: Updates pipeline_configuration_body maximum length validation to 2,621,440 bytes to align with AWS API specification. (#​44881)
• resource/aws_sagemaker_endpoint: Retry IAM eventual consistency errors on Create (#​45951)
• resource/aws_sagemaker_monitoring_schedule: Add monitoring_schedule_config.monitoring_job_definition argument (#​45951)
• resource/aws_sagemaker_monitoring_schedule: Make monitoring_schedule_config.monitoring_job_definition_name argument optional (#​45951)
• resource/aws_vpc_ipam_pool: Add source_resource argument in support of provisioning of VPC Resource Planning Pools (#​44705)
• resource/aws_vpc_ipam_resource_discovery: Add organizational_unit_exclusion argument (#​45890)
• resource/aws_vpc_subnet: Add ipv4_ipam_pool_id, ipv4_netmask_length, ipv6_ipam_pool_id, and ipv6_netmask_length arguments in support of provisioning of subnets using IPAM (#​44705)
• resource/aws_vpc_subnet: Change ipv6_cidr_block to Optional and Computed (#​44705)

BUG FIXES:

• data-source/aws_ecr_lifecycle_policy_document: Add rule.action.target_storage_class and rule.selection.storage_class to JSON serialization (#​45909)
• data-source/aws_lakeformation_permissions: Remove incorrect validation from catalog_id, data_location.catalog_id, database.catalog_id, lf_tag_policy.catalog_id, table.catalog_id, and table_with_columns.catalog_id arguments (#​43931)
• data-source/aws_networkmanager_core_network_policy_document: Fix panic when attachment_routing_policy_rules.action.associate_routing_policies is empty (#​46160)
• provider: Fix crash when using custom S3 endpoints with non-standard region strings (e.g., S3-compatible storage like Ceph or MinIO) (#​46000)
• provider: When importing resources with region defined, in AWS European Sovereign Cloud, prevent failing due to region validation requiring region names to start with "[a-z]{2}-" (#​45895)
• resource/aws_athena_workgroup: Fix error when removing configuration.result_configuration.encryption_configuration argument (#​46159)
• resource/aws_bcmdataexports_export: Fix Provider produced inconsistent result after apply error when querying CARBON_EMISSIONS table without table_configurations (#​45972)
• resource/aws_bedrock_inference_profile: Fixed forced replacement following import when model_source is set (#​45713)
• resource/aws_billing_view: Fix handling of data_filter_expression (#​45293)
• resource/aws_cloudformation_stack_set: Fix perpetual diff when using auto_deployment with permission_model set to SERVICE_MANAGED (#​45992)
• resource/aws_cloudfront_distribution: Fix runtime error: invalid memory address or nil pointer dereference panic when mistakenly importing a multi-tenant distribution (#​45873)
• resource/aws_cloudfront_distribution: Prevent mistakenly importing a multi-tenant distribution (#​45873)
• resource/aws_cloudfront_multitenant_distribution: Fix "specified origin server does not exist or is not valid" errors when attempting to use Origin Access Control (OAC) (#​45977)
• resource/aws_cloudfront_multitenant_distribution: Fix origin_group to use correct id attribute name and fix field mapping to resolve missing required field errors (#​45921)
• resource/aws_cloudwatch_event_rule: Prevent failing on AWS European Sovereign Cloud regions due to region validation requiring region names to start with "[a-z]{2}-" (#​45895)
• resource/aws_config_configuration_recorder: Fix InvalidRecordingGroupException: The recording group provided is not valid errors when the recording_group.exclusion_by_resource_type or recording_group.recording_strategy argument is removed during update (#​46110)
• resource/aws_datazone_environment_profile: Prevent failing on AWS European Sovereign Cloud regions due to region validation requiring region names to start with "[a-z]{2}-" (#​45895)
• resource/aws_dynamodb_table: Fix perpetual diff for warm_throughput in global_secondary_index when not set in configuration. (#​46094)
• resource/aws_dynamodb_table: Fixes error when name is known after apply (#​45917)
• resource/aws_eks_cluster: Fix kubernetes_network_config argument name in EKS Auto Mode validation error message (#​45997)
• resource/aws_emrserverless_application: Prevent failing on AWS European Sovereign Cloud regions due to region validation requiring region names to start with "[a-z]{2}-" (#​45895)
• resource/aws_lakeformation_permissions: Remove incorrect validation from catalog_id, data_location.catalog_id, database.catalog_id, lf_tag_policy.catalog_id, table.catalog_id, and table_with_columns.catalog_id arguments (#​43931)
• resource/aws_lambda_event_source_mapping: Prevent failing on AWS European Sovereign Cloud regions due to region validation requiring region names to start with "[a-z]{2}-" (#​45895)
• resource/aws_lambda_invocation: Fix panic when deleting or replacing resource with empty input in CRUD lifecycle scope (#​45967)
• resource/aws_lambda_permission: Prevent failing on AWS European Sovereign Cloud regions due to region validation requiring region names to start with "[a-z]{2}-" (#​45895)
• resource/aws_lb_target_group: Fix update error when switching health_check.protocol from HTTP to TCP when protocol is TCP (#​46036)
• resource/aws_multitenant_cloudfront_distribution: Prevent mistakenly importing a standard distribution (#​45873)
• resource/aws_networkfirewall_firewall_policy: Support partner-managed rule groups via firewall_policy.stateful_rule_group_reference.resource_arn (#​46124)
• resource/aws_odb_network: Fix delete_associated_resources being set when value is unknown (#​45636)
• resource/aws_pipes_pipe: Prevent failing on AWS European Sovereign Cloud regions due to region validation requiring region names to start with "[a-z]{2}-" (#​45895)
• resource/aws_placement_group: Correct validation of partition_count (#​45042)
• resource/aws_rds_cluster: Properly set iam_database_authentication_enabled when restored from snapshot (#​39461)
• resource/aws_redshift_cluster: Changing port now works. (#​45870)
• resource/aws_redshiftserverless_workgroup: Fix ValidationException: Base capacity cannot be updated when PerformanceTarget is Enabled error when updating price_performance_target and base_capacity (#​46137)
• resource/aws_route53_health_check: Mark regions argument as Computed to fix an unexpected regions diff when it is not specified (#​45829)
• resource/aws_route53_zone: Fix InvalidChangeBatch errors during ForceNew operations when zone name changes (#​45242)
• resource/aws_route53_zone: Fixes error where Delete would fail if the remote resource had already been deleted. (#​45985)
• resource/aws_route53profiles_resource_association: Fix Invalid JSON String Value error on initial apply and ConflictException on subsequent apply when associating Route53 Resolver Query Log Configs (#​45958)
• resource/aws_route53recoverycontrolconfig_control_panel: Fix crash when create returns an error (#​45954)
• resource/aws_s3_bucket: Fix bucket creation with tags in non-commercial AWS regions by handling UnsupportedArgument errors during tag-on-create operations (#​46122)
• resource/aws_s3_bucket: Fix tag read and update operations in non-commercial AWS regions by handling MethodNotAllowed errors when S3 Control APIs are unavailable (#​46122)
• resource/aws_servicecatalog_portfolio_share: Support organization and OU IDs in addition to ARNs for GovCloud compatibility (#​39863)
• resource/aws_subnet: Mark ipv6_cidr_block as ForceNew when the existing IPv6 subnet was created with assign_ipv6_address_on_create = true (#​46043)
• resource/aws_vpc_endpoint: Fix persistent diffs caused by case differences in ip_address_type (#​45947)

v6.28.0

Compare Source

NOTES:

• resource/aws_dynamodb_global_secondary_index: This resource type is experimental. The schema or behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#​44999)

FEATURES:

• New Data Source: aws_cloudfront_connection_group (#​44885)
• New Data Source: aws_cloudfront_distribution_tenant (#​45088)
• New List Resource: aws_kms_alias (#​45700)
• New List Resource: aws_sqs_queue (#​45691)
• New Resource: aws_cloudfront_connection_function (#​45664)
• New Resource: aws_cloudfront_connection_group (#​44885)
• New Resource: aws_cloudfront_distribution_tenant (#​45088)
• New Resource: aws_cloudfront_multitenant_distribution (#​45535)
• New Resource: aws_dynamodb_global_secondary_index (#​44999)
• New Resource: aws_ecr_pull_time_update_exclusion (#​45765)
• New Resource: aws_organizations_tag (#​45730)
• New Resource: aws_redshift_idc_application (#​37345)
• New Resource: aws_secretsmanager_tag (#​45825)
• New Resource: aws_sesv2_tenant (#​45706)

ENHANCEMENTS:

• data-source/aws_apigateway_domain_name : Add endpoint_access_mode attribute (#​45741)
• data-source/aws_db_proxy: Add endpoint_network_type and target_connection_network_type attributes (#​45634)
• data-source/aws_dx_gateway: Add tags attribute (#​45766)
• data-source/aws_ecr_lifecycle_policy_document: Add rule.action.target_storage_class and rule.selection.storage_class arguments, and new valid values for rule.action.type and rule.selection.count_type arguments (#​45752)
• data-source/aws_iam_saml_provider: Add saml_provider_uuid attribute (#​45707)
• data-source/aws_lambda_function: Add response_streaming_invoke_arn attribute (#​45652)
• data-source/aws_lambda_function: Support code_signing_config_arn in AWS GovCloud (US) Regions (#​45652)
• data-source/aws_route53_resolver_firewall_rules: Add dns_threat_protection, confidence_threshold, firewall_threat_protection_id, firewall_domain_redirection_action, and q_type attributes (#​45711)
• data-source/aws_route53_resolver_rule: Add target_ips attribute (#​45492)
• data-source/aws_vpc_endpoint: Add dns_options.private_dns_preference and dns_options.private_dns_specified_domains attributes (#​45679)
• data-source/aws_vpc_endpoint: Promote service_region and vpc_endpoint_type from attributes to arguments for filtering (#​45679)
• resource/aws_alb: Enforce tag policy compliance for the elasticloadbalancing:loadbalancer tag type (#​45671)
• resource/aws_alb_listener: Enforce tag policy compliance for the elasticloadbalancing:listener tag type (#​45671)
• resource/aws_alb_listener_rule: Enforce tag policy compliance for the elasticloadbalancing:listener-rule tag type (#​45671)
• resource/aws_alb_target_group: Enforce tag policy compliance for the elasticloadbalancing:targetgroup tag type (#​45671)
• resource/aws_apigateway_domain_name: Add endpoint_access_mode argument and configurable timeout for create and update (#​45741)
• resource/aws_athena_workgroup: Add customer_content_encryption_configuration argument (#​45744)
• resource/aws_athena_workgroup: Add enable_minimum_encryption_configuration argument (#​45744)
• resource/aws_athena_workgroup: Add monitoring_configuration argument (#​45744)
• resource/aws_cleanrooms_collaboration: Add resource identity support (#​45548)
• resource/aws_cloudfront_distribution: Add connection_function_association and viewer_mtls_config arguments (#​45847)
• resource/aws_cloudfront_distribution: Add owner_account_id argument to vpc_origin_config for cross-account VPC origin support (#​45011)
• resource/aws_cloudwatch_log_subscription_filter: Add apply_on_transformed_logs argument (#​45826)
• resource/aws_cloudwatch_log_subscription_filter: Add emit_system_fields argument (#​45760)
• resource/aws_db_proxy: Add endpoint_network_type and target_connection_network_type arguments (#​45634)
• resource/aws_docdb_cluster_instance: Enforce tag policy compliance for the rds:db tag type (#​45671)
• resource/aws_docdb_global_cluster: Enforce tag policy compliance for the rds:global-cluster tag type (#​45671)
• resource/aws_dx_gateway: Add tags argument and tags_all attribute. This functionality requires the directconnect:TagResource and directconnect:UntagResource IAM permissions (#​45766)
• resource/aws_ecr_repository_creation_template: Support CREATE_ON_PUSH as a valid value for applied_for (#​45720)
• resource/aws_ecs_capacity_provider: Add managed_instances_provider.instance_launch_template.capacity_option_type argument (#​45667)
• resource/aws_fsx_lustre_file_system: Enforce tag policy compliance for the fsx:file-system tag type (#​45671)
• resource/aws_fsx_ontap_file_system: Enforce tag policy compliance for the fsx:file-system tag type (#​45671)
• resource/aws_fsx_openzfs_file_system: Enforce tag policy compliance for the fsx:file-system tag type (#​45671)
• resource/aws_fsx_openzfs_snapshot: Enforce tag policy compliance for the fsx:snapshot tag type (#​45671)
• resource/aws_fsx_openzfs_volume: Enforce tag policy compliance for the fsx:volume tag type (#​45671)
• resource/aws_fsx_windows_file_system: Enforce tag policy compliance for the fsx:file-system tag type (#​45671)
• resource/aws_guardduty_filter: Add finding_criteria.criterion.matches and finding_criteria.criterion.not_matches arguments (#​45758)
• resource/aws_iam_policy: Add delay_after_policy_creation_in_ms argument. This functionality requires the iam:SetDefaultPolicyVersion IAM permission (#​42054)
• resource/aws_iam_saml_provider: Add saml_provider_uuid attribute (#​45707)
• resource/aws_iam_virtual_mfa_device: Add serial_number attribute (#​45751)
• resource/aws_imagebuilder_image: Add logging_configuration argument (#​45749)
• resource/aws_imagebuilder_image_pipeline: Add logging_configuration argument (#​45749)
• resource/aws_inspector_assessment_target: Add plan-time validation of resource_group_arn (#​45688)
• resource/aws_inspector_assessment_template: Add plan-time validation of rules_package_arns and target_arn (#​45688)
• resource/aws_lambda_event_source_mapping: Add provisioned_poller_config.poller_group_name argument (#​45313)
• resource/aws_lambda_event_source_mapping: Support Amazon MSK and self-managed Apache Kafka destinations (kafka://topic-name) for destination_config.on_failure.destination_arn argument (#​45802)
• resource/aws_lambda_function: Add response_streaming_invoke_arn attribute (#​45652)
• resource/aws_lambda_function: Support code_signing_config_arn in AWS GovCloud (US) Regions (#​45652)
• resource/aws_lambda_function_url: Automatically add the lambda:InvokeFunction permission, with the InvokedViaFunctionUrl flag set to true, to the function on creation when authorization_type is NONE (#​44858)
• resource/aws_lambda_permission: Add invoked_via_function_url argument (#​44858)
• resource/aws_lb_target_group_attachment: Add quic_server_id argument (#​45666)
• resource/aws_lb_target_group_attachment: Add plan-time validation of target_group_arn (#​45666)
• resource/aws_neptune_cluster: Enforce tag policy compliance for the rds:cluster tag type (#​45671)
• resource/aws_neptune_cluster_instance: Enforce tag policy compliance for the rds:db tag type (#​45671)
• resource/aws_neptune_global_cluster: Enforce tag policy compliance for the rds:global-cluster tag type (#​45671)
• resource/aws_networkmanager_vpc_attachment: Enable in-place updates of routing_policy_label argument. This functionality requires the networkmanager: PutAttachmentRoutingPolicyLabel and networkmanager: RemoveAttachmentRoutingPolicyLabel IAM permissions (#​45728)
• resource/aws_osis_pipeline: Add pipeline_role_arn argument to support specifying a IAM role at the pipeline level (#​45806)
• resource/aws_rds_cluster: Enforce tag policy compliance for the rds:cluster tag type (#​45671)
• resource/aws_redshift_data_share_consumer_association: Add plan-time validation of consumer_region (#​45688)
• resource/aws_route53_resolver_firewall_rule: Add dns_threat_protection, confidence_threshold, and firewall_threat_protection_id arguments to support DNS Firewall Advanced rules (#​45711)
• resource/aws_transfer_web_app: Add endpoint_details.vpc configuration block to support VPC hosted Transfer Family web app (#​45745)
• resource/aws_vpc_endpoint: Add dns_options.private_dns_preference and dns_options.private_dns_specified_domains arguments (#​45679)
• resource/aws_vpclattice_service_network_resource_association: Add private_dns_enabled argument (#​45673)
• resource/aws_vpn_connection: Support in-place updates for tunnel*_inside_cidr and tunnel*_inside_ipv6_cidr arguments (#​45781)

BUG FIXES:

• data-source/aws_ecr_authorization_token: Fix value of proxy_endpoint when registry_id is specified (#​45754)
• data-source/aws_networkmanager_core_network_policy_document: Support account-id, not account, as a valid value for attachment_policies.conditions.type. This fixes a regression introduced in v6.27.0 (#​45788)
• data-source/aws_vpc_endpoint: Add missing implementation for service_region attribute (#​45679)
• provider: Fix handling of user_agent values where the product name contains a forward slash (#​45715)
• resource/aws_batch_job_definition: Fix crash during update when node_properties has NodeRangeProperties.ecsProperties set (#​45676)
• resource/aws_batch_job_definition: Fix handling of logically deleted results in List (#​45694)
• resource/aws_cloudwatch_log_subscription_filter: CloudWatch Logs: PutSubscriptionFilter: Retry ValidationException: Make sure you have given CloudWatch Logs permission to assume the provided role (#​43762)
• resource/aws_ec2_subnet_cidr_reservation: Fix 255 subnet CIDR reservation limit (#​45778)
• resource/aws_nat_gateway: Handle eventual consistency with attached appliances on delete (#​45842)
• resource/aws_vpc: Fix reading EC2 VPC (...) default Security Group: empty result and reading EC2 VPC (...) main Route Table: empty result errors when importing RAM-shared VPCs. This fixes a regression introduced in v6.17.0 (#​45780)
• resource/aws_vpc_endpoint: Fix "InvalidParameter: DnsOptions PrivateDnsOnlyForInboundResolverEndpoint is applicable only to Interface VPC Endpoints" error when creating S3 gateway VPC endpoint with IPv6 enabled (#​45849)
• resource/aws_vpc_endpoint: private_dns_enabled argument is now marked as ForceNew (#​45679)

v6.27.0

Compare Source

FEATURES:

• New Data Source: aws_organizations_account (#​45543)
• New Function: user_agent (#​45464)
• New List Resource: aws_kms_key (#​45514)
• New Resource: aws_cloudfront_trust_store (#​45534)

ENHANCEMENTS:

• data-source/aws_datazone_domain: Add root_domain_unit_id attribute (#​44964)
• data-source/aws_networkmanager_core_network_policy_document: Add routing_policies and attachment_routing_policy_rules arguments (#​45246)
• data-source/aws_route53_resolver_endpoint: Add rni_enhanced_metrics_enabled attribute (#​45630)
• data-source/aws_route53_resolver_endpoint: Add target_name_server_metrics_enabled attribute (#​45630)
• provider: Add user_agent argument (#​45464)
• provider: The provider_meta block is now supported. The user_agent argument enables module authors to include additional product information in the User-Agent header sent during all AWS API requests made during Create, Read, Update, and Delete operations. (#​45464)
• resource/aws_bedrockagent_knowledge_base: Add knowledge_base_configuration.kendra_knowledge_base_configuration argument (#​44388)
• resource/aws_bedrockagent_knowledge_base: Add knowledge_base_configuration.sql_knowledge_base_configuration and storage_configuration.neptune_analytics_configuration arguments (#​45465)
• resource/aws_bedrockagent_knowledge_base: Add storage_configuration.mongo_db_atlas_configuration argument (#​37220)
• resource/aws_bedrockagent_knowledge_base: Add storage_configuration.opensearch_managed_cluster_configuration argument (#​44060)
• resource/aws_bedrockagent_knowledge_base: Add storage_configuration.s3_vectors_configuration block (#​45468)
• resource/aws_bedrockagent_knowledge_base: Make knowledge_base_configuration.vector_knowledge_base_configuration and ``storage_configuration` optional (#​44388)
• resource/aws_codebuild_project: Add cache.cache_namespace argument (#​45584)
• resource/aws_datazone_domain: Add root_domain_unit_id argument (#​44964)
• resource/aws_lambda_function: code_sha256 is now optional and computed (#​45618)
• resource/aws_networkmanager_connect_attachment: Add routing_policy_label argument (#​45246)
• resource/aws_networkmanager_connect_peer: Support 4 byte ASNs in bgp_options.peer_asn (#​45246)
• resource/aws_networkmanager_connect_peer: Support 4 byte ASNs in configuration.bgp_configurations.peer_asn (#​45639)
• resource/aws_networkmanager_dx_gateway_attachment: Add routing_policy_label argument (#​45246)
• resource/aws_networkmanager_site_to_site_vpn_attachment: Add routing_policy_label argument (#​45246)
• resource/aws_networkmanager_transit_gateway_route_table_attachment: Add routing_policy_label argument (#​45246)
• resource/aws_networkmanager_vpc_attachment: Add routing_policy_label argument (#​45246)
• resource/aws_route53_resolver_endpoint: Add rni_enhanced_metrics_enabled argument (#​45630)
• resource/aws_route53_resolver_endpoint: Add target_name_server_metrics_enabled argument (#​45630)
• resource/aws_vpclattice_service_network_vpc_association: Add private_dns_enabled and dns_options arguments (#​45619)

BUG FIXES:

• data-source/aws_networkmanager_core_network_policy_document: Correct plan-time validation of attachment_policies.conditions.type to allow account instead of account-id (#​45246)
• resource/aws_bedrockagent_knowledge_base: Mark knowledge_base_configuration.vector_knowledge_base_configuration.embedding_model_configuration and knowledge_base_configuration.vector_knowledge_base_configuration.supplemental_data_storage_configuration as ForceNew (#​45465)
• resource/aws_dynamodb_table: Fix perpetual diff on global_secondary_index when using ignore_changes lifecycle meta-argument (#​41113)
• resource/aws_iam_user: Fix NoSuchEntity errors when name and tags arguments are both updated (#​45608)
• resource/aws_lakeformation_data_cells_filter: Fix excluded_column_names ordering causing "Provider produced inconsistent result after apply" errors (#​45453)
• resource/aws_neptune_global_cluster: Fix a regression in the minor version upgrade workflow triggered by upstream changes to the API error response text (#​45605)
• resource/aws_networkmanager_connect_peer: Change bgp_options and bgp_options.peer_asn to Optional, Computed and ForceNew (#​45639)
• resource/aws_odb_cloud_vm_cluster: Enable deletion of vm cluster in resource shared account. (#​45552)
• resource/aws_rds_global_cluster: Fix a regression in the minor version upgrade workflow triggered by upstream changes to the API error response text (#​45605)
• resource/aws_s3_bucket: Fix endpoint rule error, AccountId must only contain a-z, A-Z, 0-9 and `-`​ errors when the provider is configured with skip_requesting_account_id = true. This fixes a regression introduced in v6.23.0 (#​45576)
• resource/aws_verifiedpermissions_identity_source: Fixes error when updating resource (#​45540)
• resource/aws_verifiedpermissions_identity_source: Prevents eventual consistency error with associated Policy Store (#​45540)
• resource/aws_verifiedpermissions_identity_source: Removes AutoFlex error log messages (#​45540)

v6.26.0

Compare Source

FEATURES:

• New List Resource: aws_batch_job_definition (#​45401)
• New List Resource: aws_codebuild_project (#​45400)
• New List Resource: aws_lambda_capacity_provider (#​45467)
• New List Resource: aws_ssm_parameter (#​45512)
• New Resource: aws_iam_outbound_web_identity_federation (#​45217)

ENHANCEMENTS:

• data-source/aws_db_instance: Add upgrade_rollout_order attribute (#​45527)
• data-source/aws_eks_node_group : Add update_config block including update_strategy attribute (#​41487)
• data-source/aws_rds_cluster: Add upgrade_rollout_order attribute (#​45527)
• resource/aws_bedrockagent_agent: Add session_summary_configuration.max_recent_sessions argument (#​45449)
• resource/aws_db_instance: Add upgrade_rollout_order attribute (#​45527)
• resource/aws_eks_node_group : Add update_config.update_strategy attribute (#​41487)
• resource/aws_kinesisanalyticsv2_application: Add application_configuration.application_encryption_configuration argument (#​45356)
• resource/aws_kinesisanalyticsv2_application: Support FLINK-1_20 as a valid value for runtime_environment (#​45356)
• resource/aws_lambda_capacity_provider: Add resource identity support (#​45456)
• resource/aws_odb_network_peering_connection: Add network peering creation using odb_network_arn for resource sharing model. (#​45509)
• resource/aws_rds_cluster: Add upgrade_rollout_order attribute (#​45527)
• resource/aws_s3vectors_index: Add encryption_configuration block (#​45470)
• resource/aws_s3vectors_index: Add metadata_configuration block (#​45470)

BUG FIXES:

• data-source/aws_ec2_transit_gateway: Fix potential crash when reading encryption_support. This addresses a regression introduced in v6.25.0. (#​45462)
• resource/aws_api_gateway_integration: Fix timeout_milliseconds validation to allow up to 900,000 ms when response_transfer_mode is STREAM ([#​45482](https://redirect.github.com/hashicorp/terraform-provi

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

Terraform plan output for ./terraform/common

Contains changes: no

Show Plan

data.secretsmanager_login.keeper: Reading...
data.secretsmanager_login.keeper: Read complete after 0s [id=l4pqeAaAA7HGzEXaNdKVWQ]
data.aws_caller_identity.current: Reading...
data.aws_caller_identity.current: Read complete after 0s [id=975050025792]
aws_kms_key.common: Refreshing state... [id=fbcb8b62-b2f3-4832-99d0-0f163b0260ed]
aws_kms_alias.common: Refreshing state... [id=alias/grafana]
aws_ssm_parameter.kms_arn: Refreshing state... [id=/grafana/common/kms_arn]
aws_ssm_parameter.ksm_config: Refreshing state... [id=/grafana/common/ksm_config]
aws_ssm_parameter.kms_id: Refreshing state... [id=/grafana/common/kms_id]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

Pusher: @citygeo-bot[bot]

[github-actions]

Terraform plan output for ./terraform/env/prod

Contains changes: no

Show Plan

module.grafana.data.secretsmanager_login.loki_basic: Reading...
module.grafana.data.secretsmanager_login.db: Reading...
module.grafana.data.secretsmanager_login.prometheus_basic: Reading...
module.grafana.data.secretsmanager_login.loki_basic: Read complete after 1s [id=TVNsnRso_U7J_raing91Dw]
module.grafana.data.secretsmanager_login.prometheus_basic: Read complete after 1s [id=9edLxyQsbIoU5lw7K3m36w]
module.grafana.data.secretsmanager_login.db: Read complete after 1s [id=yUO3Wbl52b8g9LukZgZ5uA]
module.grafana.aws_security_group.eks_control: Refreshing state... [id=sg-06e7128cd92771b98]
module.grafana.data.aws_ssm_parameter.kms_arn: Reading...
module.grafana.module.karpenter.data.aws_caller_identity.current[0]: Reading...
module.grafana.data.aws_ssm_parameter.kms_id: Reading...
module.grafana.aws_iam_policy.ssm: Refreshing state... [id=arn:aws:iam::975050025792:policy/grafana-prd-ssm]
module.grafana.aws_iam_policy.sts: Refreshing state... [id=arn:aws:iam::975050025792:policy/grafana-prd-sts-assume-role]
module.grafana.aws_security_group.eks_node: Refreshing state... [id=sg-00f90be2a44ec92e1]
module.grafana.aws_lb_target_group.loki: Refreshing state... [id=arn:aws:elasticloadbalancing:us-east-1:975050025792:targetgroup/grafana-prd-loki/c9c82dfdaea7a39d]
module.grafana.aws_lb_target_group.prometheus: Refreshing state... [id=arn:aws:elasticloadbalancing:us-east-1:975050025792:targetgroup/grafana-prd-prometheus/efbd12c473371e48]
module.grafana.aws_security_group.alb: Refreshing state... [id=sg-00ec47708efc3cf95]
module.grafana.module.karpenter.data.aws_caller_identity.current[0]: Read complete after 0s [id=975050025792]
module.grafana.aws_security_group.ec2: Refreshing state... [id=sg-01d5ff819e2be4c9b]
module.grafana.data.aws_ssm_parameter.kms_arn: Read complete after 0s [id=/grafana/common/kms_arn]
module.grafana.aws_security_group.kafka: Refreshing state... [id=sg-08dfa8278246436ed]
module.grafana.data.aws_ssm_parameter.kms_id: Read complete after 0s [id=/grafana/common/kms_id]
module.grafana.aws_security_group.rds: Refreshing state... [id=sg-05a87fe0acd31972d]
module.grafana.module.karpenter.data.aws_service_principal.ec2[0]: Reading...
module.grafana.module.karpenter.data.aws_service_principal.ec2[0]: Read complete after 0s [id=ec2.us-east-1.amazonaws.com]
module.grafana.module.aws_load_balancer_controller_policy.aws_iam_policy.alb_controller: Refreshing state... [id=arn:aws:iam::975050025792:policy/grafana-prd-eks-alb-controller]
module.grafana.aws_ec2_tag.eks_subnets_karpenter["subnet-0d0d5a4bdbaf916d1"]: Refreshing state... [id=subnet-0d0d5a4bdbaf916d1,karpenter.sh/discovery-grafana-prd]
module.grafana.aws_ec2_tag.eks_subnets_karpenter["subnet-00eb4cfd73abefd2e"]: Refreshing state... [id=subnet-00eb4cfd73abefd2e,karpenter.sh/discovery-grafana-prd]
module.grafana.aws_s3_bucket.eks: Refreshing state... [id=phl-citygeo-grafana-prd-eks]
module.grafana.module.karpenter.data.aws_region.current[0]: Reading...
module.grafana.aws_ssm_parameter.domain_name: Refreshing state... [id=/grafana/prd/domain_name]
module.grafana.module.karpenter.data.aws_region.current[0]: Read complete after 0s [id=us-east-1]
module.grafana.aws_iam_role.eks: Refreshing state... [id=grafana-prd-eks]
module.grafana.aws_iam_role.eks_fargate: Refreshing state... [id=grafana-prd-eks-fargate]
module.grafana.aws_s3_bucket.main: Refreshing state... [id=phl-citygeo-grafana-prd]
module.grafana.module.karpenter.data.aws_partition.current[0]: Reading...
module.grafana.aws_iam_role.ec2: Refreshing state... [id=grafana-prd-ec2]
module.grafana.module.karpenter.data.aws_partition.current[0]: Read complete after 0s [id=aws]
module.grafana.aws_db_subnet_group.postgres: Refreshing state... [id=grafana-prd]
module.grafana.aws_lb_target_group.grafana: Refreshing state... [id=arn:aws:elasticloadbalancing:us-east-1:975050025792:targetgroup/grafana-prd-http/e3b106f61dfc1bdc]
module.grafana.aws_iam_policy.kms: Refreshing state... [id=arn:aws:iam::975050025792:policy/grafana-prd-kms]
module.grafana.aws_ssm_parameter.prometheus_user: Refreshing state... [id=/grafana/prd/prometheus_user]
module.grafana.aws_ssm_parameter.rds_user: Refreshing state... [id=/grafana/prd/rds_user]
module.grafana.aws_ssm_parameter.prometheus_pw: Refreshing state... [id=/grafana/prd/prometheus_pw]
module.grafana.aws_ssm_parameter.rds_pw: Refreshing state... [id=/grafana/prd/rds_pw]
module.grafana.aws_ssm_parameter.loki_user: Refreshing state... [id=/grafana/prd/loki_user]
module.grafana.aws_ssm_parameter.loki_pw: Refreshing state... [id=/grafana/prd/loki_pw]
module.grafana.aws_vpc_security_group_egress_rule.eks_control_all_to_outbound: Refreshing state... [id=sgr-069ab1c692133cdf4]
module.grafana.aws_vpc_security_group_ingress_rule.eks_control_https_from_phl: Refreshing state... [id=sgr-07e8feffac6da2299]
module.grafana.aws_vpc_security_group_ingress_rule.eks_node_all_from_self: Refreshing state... [id=sgr-062711fbbc99b2d6d]
module.grafana.aws_vpc_security_group_egress_rule.eks_node_all_to_outbound: Refreshing state... [id=sgr-061d69dd5fecdf39d]
module.grafana.aws_vpc_security_group_ingress_rule.eks_control_all_from_node: Refreshing state... [id=sgr-0183b4d3b42310fa5]
module.grafana.aws_vpc_security_group_ingress_rule.eks_node_all_from_control: Refreshing state... [id=sgr-041c65f8175a9fa3a]
module.grafana.aws_vpc_security_group_ingress_rule.alb_inbound_prometheus_from_cidr["mulesofttestvpc"]: Refreshing state... [id=sgr-0964516bf57a61377]
module.grafana.aws_vpc_security_group_ingress_rule.eks_node_inbound_grafana_from_alb: Refreshing state... [id=sgr-0fc0033745ba6905d]
module.grafana.aws_vpc_security_group_ingress_rule.alb_inbound_prometheus_from_cidr["citygeoprodvpc"]: Refreshing state... [id=sgr-079749f6bcd2a9fe2]
module.grafana.aws_vpc_security_group_ingress_rule.alb_inbound_prometheus_from_cidr["airflowprodvpc"]: Refreshing state... [id=sgr-070df7d2899d00458]
module.grafana.aws_vpc_security_group_ingress_rule.alb_inbound_prometheus_from_cidr["airflowtestvpc"]: Refreshing state... [id=sgr-084ce6bc658b57f25]
module.grafana.aws_vpc_security_group_ingress_rule.alb_inbound_prometheus_from_cidr["citygeotestvpc"]: Refreshing state... [id=sgr-01dd4e26fa512da51]
module.grafana.aws_vpc_security_group_egress_rule.alb_all_to_outbound: Refreshing state... [id=sgr-0b589ae3d23e10824]
module.grafana.aws_vpc_security_group_ingress_rule.alb_inbound_prometheus_from_cidr["mulesoftprodvpc"]: Refreshing state... [id=sgr-0226a8bf3112c57d3]
module.grafana.aws_vpc_security_group_ingress_rule.alb_inbound_loki_from_cidr["mulesoftprodvpc"]: Refreshing state... [id=sgr-077619cc59540dcb6]
module.grafana.aws_vpc_security_group_ingress_rule.alb_inbound_loki_from_cidr["citygeoprodvpc"]: Refreshing state... [id=sgr-03a7ce3aefaf0b24d]
module.grafana.aws_vpc_security_group_ingress_rule.alb_inbound_loki_from_cidr["citygeotestvpc"]: Refreshing state... [id=sgr-0c02eed6fbacd61b1]
module.grafana.aws_vpc_security_group_ingress_rule.ec2_inbound_mimir_from_ec2: Refreshing state... [id=sgr-096fbc6d16cbbc870]
module.grafana.aws_vpc_security_group_ingress_rule.alb_inbound_https_from_anywhere: Refreshing state... [id=sgr-0a312930b901a3a33]
module.grafana.aws_vpc_security_group_ingress_rule.alb_inbound_http_from_anywhere: Refreshing state... [id=sgr-092201db4cd9e3c8e]
module.grafana.aws_lb.main: Refreshing state... [id=arn:aws:elasticloadbalancing:us-east-1:975050025792:loadbalancer/app/grafana-prd/3cd196f222693cb7]
module.grafana.aws_vpc_security_group_ingress_rule.eks_node_inbound_gateway_from_alb: Refreshing state... [id=sgr-06b9e67a689fd165c]
module.grafana.aws_vpc_security_group_egress_rule.ec2_outbound_all_to_everywhere: Refreshing state... [id=sgr-01ba63cb7bd090a79]
module.grafana.aws_vpc_security_group_ingress_rule.ec2_inbound_http_from_alb: Refreshing state... [id=sgr-040f28c6154e147c7]
module.grafana.aws_vpc_security_group_ingress_rule.alb_inbound_loki_from_cidr["airflowprodvpc"]: Refreshing state... [id=sgr-0273ed4c7c38efcfb]
module.grafana.aws_vpc_security_group_ingress_rule.ec2_inbound_loki_from_alb: Refreshing state... [id=sgr-0590dcc16ba04d862]
module.grafana.aws_vpc_security_group_ingress_rule.alb_inbound_loki_from_cidr["mulesofttestvpc"]: Refreshing state... [id=sgr-0feae3466b25be383]
module.grafana.aws_vpc_security_group_ingress_rule.alb_inbound_loki_from_cidr["airflowtestvpc"]: Refreshing state... [id=sgr-0d164f5cb119cec20]
module.grafana.aws_vpc_security_group_ingress_rule.ec2_inbound_prometheus_from_alb: Refreshing state... [id=sgr-0c3e4e567e273dd73]
module.grafana.aws_vpc_security_group_ingress_rule.kafka_from_eks: Refreshing state... [id=sgr-0303cebccf72470c8]
module.grafana.aws_vpc_security_group_ingress_rule.rds_from_eks: Refreshing state... [id=sgr-023ab67c1d5e3147a]
module.grafana.aws_vpc_security_group_ingress_rule.rds_from_app: Refreshing state... [id=sgr-02f695ccf00c8f305]
module.grafana.aws_iam_role_policy_attachments_exclusive.eks_fargate: Refreshing state...
module.grafana.aws_iam_role_policy_attachments_exclusive.eks: Refreshing state...
module.grafana.aws_iam_instance_profile.ec2: Refreshing state... [id=grafana-prd-ec2]
module.grafana.module.karpenter.data.aws_iam_policy_document.node_assume_role[0]: Reading...
module.grafana.module.karpenter.data.aws_iam_policy_document.node_assume_role[0]: Read complete after 0s [id=2560088296]
module.grafana.aws_ssm_parameter.grafana_s3_name: Refreshing state... [id=/grafana/prd/grafana_s3_name]
module.grafana.aws_s3_bucket_server_side_encryption_configuration.main: Refreshing state... [id=phl-citygeo-grafana-prd]
module.grafana.aws_s3_bucket_public_access_block.main: Refreshing state... [id=phl-citygeo-grafana-prd]
module.grafana.aws_iam_policy.s3: Refreshing state... [id=arn:aws:iam::975050025792:policy/grafana-prd-s3]
module.grafana.aws_iam_policy.s3_eks: Refreshing state... [id=arn:aws:iam::975050025792:policy/grafana-prd-s3-eks]
module.grafana.aws_s3_bucket_public_access_block.eks: Refreshing state... [id=phl-citygeo-grafana-prd-eks]
module.grafana.aws_s3_bucket_server_side_encryption_configuration.eks: Refreshing state... [id=phl-citygeo-grafana-prd-eks]
module.grafana.aws_db_instance.postgres: Refreshing state... [id=db-27VB6O47UQUCWIL3F3OSD5R474]
module.grafana.aws_eks_cluster.main: Refreshing state... [id=grafana-prd]
module.grafana.aws_lb_listener.http_redirect: Refreshing state... [id=arn:aws:elasticloadbalancing:us-east-1:975050025792:listener/app/grafana-prd/3cd196f222693cb7/41eff09f7708dc3d]
module.grafana.aws_lb_listener.grafana: Refreshing state... [id=arn:aws:elasticloadbalancing:us-east-1:975050025792:listener/app/grafana-prd/3cd196f222693cb7/5d94e3e805e095e4]
module.grafana.aws_lb_listener.prometheus: Refreshing state... [id=arn:aws:elasticloadbalancing:us-east-1:975050025792:listener/app/grafana-prd/3cd196f222693cb7/c201a76b1dcdd59b]
module.grafana.aws_lb_listener.loki: Refreshing state... [id=arn:aws:elasticloadbalancing:us-east-1:975050025792:listener/app/grafana-prd/3cd196f222693cb7/799b6d35b9b368f4]
module.grafana.aws_launch_template.main: Refreshing state... [id=lt-090109bfef90613d9]
module.grafana.aws_iam_role_policy_attachments_exclusive.ec2: Refreshing state...
module.grafana.aws_ssm_parameter.rds_db_name: Refreshing state... [id=/grafana/prd/rds_db_name]
module.grafana.aws_ssm_parameter.rds_host: Refreshing state... [id=/grafana/prd/rds_host]
module.grafana.aws_autoscaling_group.main: Refreshing state... [id=grafana-prd]
module.grafana.aws_eks_addon.kube-proxy: Refreshing state... [id=grafana-prd:kube-proxy]
module.grafana.aws_eks_access_entry.admins["arn:aws:iam::975050025792:role/TFRole"]: Refreshing state... [id=grafana-prd:arn:aws:iam::975050025792:role/TFRole]
module.grafana.aws_eks_access_policy_association.admins["arn:aws:iam::975050025792:role/TFRole"]: Refreshing state... [id=grafana-prd#arn:aws:iam::975050025792:role/TFRole#arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy]
module.grafana.aws_eks_access_entry.admins["arn:aws:iam::975050025792:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AWS-mulesoft-infra-devs_128f50c8d80a23d4"]: Refreshing state... [id=grafana-prd:arn:aws:iam::975050025792:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AWS-mulesoft-infra-devs_128f50c8d80a23d4]
module.grafana.aws_vpc_security_group_ingress_rule.eks_default_sg_all_from_node: Refreshing state... [id=sgr-0d9f2824d41e29a83]
module.grafana.aws_eks_access_policy_association.admins["arn:aws:iam::975050025792:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AWS-mulesoft-infra-admins_a23294be18f9f843"]: Refreshing state... [id=grafana-prd#arn:aws:iam::975050025792:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AWS-mulesoft-infra-admins_a23294be18f9f843#arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy]
module.grafana.aws_eks_addon.coredns: Refreshing state... [id=grafana-prd:coredns]
module.grafana.aws_eks_access_entry.admins["arn:aws:iam::975050025792:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AWS-mulesoft-infra-admins_a23294be18f9f843"]: Refreshing state... [id=grafana-prd:arn:aws:iam::975050025792:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AWS-mulesoft-infra-admins_a23294be18f9f843]
module.grafana.aws_eks_access_policy_association.admins["arn:aws:iam::975050025792:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AWS-mulesoft-infra-devs_128f50c8d80a23d4"]: Refreshing state... [id=grafana-prd#arn:aws:iam::975050025792:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AWS-mulesoft-infra-devs_128f50c8d80a23d4#arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy]
module.grafana.aws_eks_fargate_profile.karpenter: Refreshing state... [id=grafana-prd:grafana-prd-karpenter]
module.grafana.module.karpenter.aws_cloudwatch_event_rule.this["instance_state_change"]: Refreshing state... [id=grafan-prd-karp-InstanceStateChange-20251209193710026200000006]
module.grafana.data.aws_ssm_parameter.eks_ami_release_version: Reading...
module.grafana.module.karpenter.aws_sqs_queue.this[0]: Refreshing state... [id=https://sqs.us-east-1.amazonaws.com/975050025792/grafana-prd-karpenter]
module.grafana.module.karpenter.aws_cloudwatch_event_rule.this["spot_interrupt"]: Refreshing state... [id=grafan-prd-karp-SpotInterrupt-20251209193710291700000007]
module.grafana.data.aws_ssm_parameter.eks_ami_release_version: Read complete after 0s [id=/aws/service/eks/optimized-ami/1.34/amazon-linux-2023/x86_64/standard/recommended/release_version]
module.grafana.module.karpenter.aws_cloudwatch_event_rule.this["health_event"]: Refreshing state... [id=grafan-prd-karp-HealthEvent-20251209193709942400000005]
module.grafana.module.karpenter.aws_cloudwatch_event_rule.this["instance_rebalance"]: Refreshing state... [id=grafan-prd-karp-InstanceRebalance-20251209193710368900000008]
module.grafana.module.karpenter.aws_iam_role.node[0]: Refreshing state... [id=grafana-prd-karpenter-node]
module.grafana.data.tls_certificate.main: Reading...
module.grafana.aws_autoscaling_attachment.grafana: Refreshing state... [id=grafana-prd-20250822170243951700000001]
module.grafana.aws_autoscaling_attachment.prometheus: Refreshing state... [id=grafana-prd-20250822170225180900000002]
module.grafana.aws_autoscaling_attachment.loki: Refreshing state... [id=grafana-prd-20250822170224946900000001]
module.grafana.module.karpenter.data.aws_iam_policy_document.queue[0]: Reading...
module.grafana.module.karpenter.data.aws_iam_policy_document.queue[0]: Read complete after 0s [id=1285653589]
module.grafana.module.karpenter.aws_cloudwatch_event_target.this["spot_interrupt"]: Refreshing state... [id=grafan-prd-karp-SpotInterrupt-20251209193710291700000007-KarpenterInterruptionQueueTarget]
module.grafana.module.karpenter.aws_cloudwatch_event_target.this["instance_state_change"]: Refreshing state... [id=grafan-prd-karp-InstanceStateChange-20251209193710026200000006-KarpenterInterruptionQueueTarget]
module.grafana.module.karpenter.aws_cloudwatch_event_target.this["health_event"]: Refreshing state... [id=grafan-prd-karp-HealthEvent-20251209193709942400000005-KarpenterInterruptionQueueTarget]
module.grafana.module.karpenter.aws_cloudwatch_event_target.this["instance_rebalance"]: Refreshing state... [id=grafan-prd-karp-InstanceRebalance-20251209193710368900000008-KarpenterInterruptionQueueTarget]
module.grafana.module.karpenter.aws_sqs_queue_policy.this[0]: Refreshing state... [id=https://sqs.us-east-1.amazonaws.com/975050025792/grafana-prd-karpenter]
module.grafana.data.tls_certificate.main: Read complete after 0s [id=88977b17f5da90190ac0f03250614c63d91dc073]
module.grafana.aws_iam_openid_connect_provider.main: Refreshing state... [id=arn:aws:iam::975050025792:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/86CD053CFB5302E2A52E6D64473076CF]
module.grafana.module.karpenter.aws_iam_role_policy_attachment.node["AmazonEC2ContainerRegistryPullOnly"]: Refreshing state... [id=grafana-prd-karpenter-node/arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPullOnly]
module.grafana.module.karpenter.aws_iam_role_policy_attachment.node_additional["KMS"]: Refreshing state... [id=grafana-prd-karpenter-node/arn:aws:iam::975050025792:policy/grafana-prd-kms]
module.grafana.module.karpenter.aws_eks_access_entry.node[0]: Refreshing state... [id=grafana-prd:arn:aws:iam::975050025792:role/grafana-prd-karpenter-node]
module.grafana.module.karpenter.aws_iam_role_policy_attachment.node["AmazonEKS_CNI_Policy"]: Refreshing state... [id=grafana-prd-karpenter-node/arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy]
module.grafana.module.karpenter.aws_iam_role_policy_attachment.node["AmazonEKSWorkerNodePolicy"]: Refreshing state... [id=grafana-prd-karpenter-node/arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy]
module.grafana.aws_iam_role.eks_ebs_csi_driver: Refreshing state... [id=grafana-prd-eks-ebs-csi-driver]
module.grafana.aws_iam_role.mimir: Refreshing state... [id=grafana-prd-mimir-irsa]
module.grafana.aws_iam_role.external_secrets: Refreshing state... [id=grafana-prd-external-secrets-irsa]
module.grafana.module.karpenter.data.aws_iam_policy_document.controller[0]: Reading...
module.grafana.aws_iam_role.grafana: Refreshing state... [id=grafana-prd-grafana-irsa]
module.grafana.aws_iam_role.eks_alb_controller: Refreshing state... [id=grafana-prd-eks-alb-controller]
module.grafana.aws_iam_role.loki: Refreshing state... [id=grafana-prd-loki-irsa]
module.grafana.module.karpenter.data.aws_iam_policy_document.controller_assume_role[0]: Reading...
module.grafana.aws_iam_role.eks_addon_vpc_cni: Refreshing state... [id=grafana-prd-eks-addon-vpc-cni]
module.grafana.module.karpenter.data.aws_iam_policy_document.controller_assume_role[0]: Read complete after 0s [id=3283606561]
module.grafana.module.karpenter.data.aws_iam_policy_document.controller[0]: Read complete after 0s [id=1545713303]
module.grafana.module.karpenter.aws_iam_role.controller[0]: Refreshing state... [id=grafana-prd-karpenter-controller]
module.grafana.module.karpenter.aws_iam_policy.controller[0]: Refreshing state... [id=arn:aws:iam::975050025792:policy/grafana-prd-karpenter-controller]
module.grafana.aws_iam_role_policy_attachments_exclusive.eks_ebs_csi_driver: Refreshing state...
module.grafana.aws_iam_role_policy_attachments_exclusive.external_secrets: Refreshing state...
module.grafana.aws_iam_role_policy_attachments_exclusive.mimir: Refreshing state...
module.grafana.aws_iam_role_policy_attachments_exclusive.grafana: Refreshing state...
module.grafana.aws_iam_role_policy_attachments_exclusive.eks_addon_vpc_cni: Refreshing state...
module.grafana.aws_iam_role_policy_attachments_exclusive.eks_alb_controller: Refreshing state...
module.grafana.module.karpenter.aws_iam_role_policy_attachment.controller[0]: Refreshing state... [id=grafana-prd-karpenter-controller/arn:aws:iam::975050025792:policy/grafana-prd-karpenter-controller]
module.grafana.module.karpenter.aws_iam_role_policy_attachment.controller_additional["KMS"]: Refreshing state... [id=grafana-prd-karpenter-controller/arn:aws:iam::975050025792:policy/grafana-prd-kms]
module.grafana.aws_eks_addon.vpc_cni: Refreshing state... [id=grafana-prd:vpc-cni]
module.grafana.aws_iam_role_policy_attachments_exclusive.loki: Refreshing state...

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

Pusher: @citygeo-bot[bot]