Skip to content

Releases: cloudposse-terraform-components/aws-account

v2.0.0

20 Jan 21:37
@cloudposse-releaser cloudposse-releaser
v2.0.0
83e6829
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v2.0.0 Latest
Latest
feat!: refactor to single-resource pattern for managing individual AWS accounts @Benbentwo (#52) ## Summary
  • Refactor component from monolithic organization hierarchy management to single-resource pattern (one AWS account per component instance)
  • Add conditional import block support (requires OpenTofu >= 1.7.0)
  • Move import_account_id variable and import block to separate imports.tf (optional when vendoring)
  • Remove contacts management (moved to aws-account-settings component)

Breaking Changes

This component now manages a single AWS account instead of the entire organization hierarchy. See docs/migration.md for migration instructions.

New Component Suite

The monolithic account component is replaced by single-resource components:

Component Purpose
aws-organization Creates/imports the AWS Organization
aws-organizational-unit Creates/imports a single OU
aws-account Creates/imports a single AWS Account (this component)
aws-account-settings Configures account settings (IAM alias, S3 block, EBS encryption)
aws-scp Creates/imports Service Control Policies

Files Changed

File Change
src/main.tf Simplified to single-resource pattern
src/variables.tf New variables: account_email, parent_id, etc.
src/outputs.tf Simplified outputs
src/imports.tf New - Optional import block (exclude when vendoring if not needed)
src/versions.tf Requires OpenTofu >= 1.7.0
docs/migration.md New - Migration guide
src/contacts.tf Removed - Moved to aws-account-settings
src/contacts-variables.tf Removed - Moved to aws-account-settings

Summary by CodeRabbit

  • New Features

    • Import existing AWS accounts into state; single-account provisioning pattern

  • Documentation

    • Rewrote docs and READMEs for per-account usage; added migration guide and examples (basic, import, defaults, multi-account sample)

  • Removed Features

    • Removed contacts management and prior multi-account/OU/SCP orchestration guidance

  • Refactor

    • Simplified inputs/outputs and consolidated provisioning to a single-account interface

  • Chores

    • Bumped Terraform requirement to >= 1.7.0

✏️ Tip: You can customize this high-level summary in your review settings.

🤖 Automatic Updates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#53) ## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

chore(deps): update tflint plugin terraform-linters/tflint-ruleset-aws to v0.45.0 @[renovate[bot]](https://github.com/apps/renovate) (#50) This PR contains the following updates:
Package Type Update Change
terraform-linters/tflint-ruleset-aws plugin minor 0.44.0 → 0.45.0

Release Notes

terraform-linters/tflint-ruleset-aws (terraform-linters/tflint-ruleset-aws)

v0.45.0

Compare Source

What's Changed

Breaking Changes
Enhancements
Bug Fixes
Chores
Read more

Contributors

Benbentwo
Assets 2
Loading

v1.538.0

12 Dec 20:27
@cloudposse-releaser cloudposse-releaser
v1.538.0
b941429
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.538.0
feat(contacts): add support for account contacts @johncblandii (#48) ## what
  • Support account contacts

why

  • Allows contact support for accounts

references

Summary by CodeRabbit

  • New Features

    • Manage AWS account contacts: primary and alternate contacts for master and sub-accounts via new public resources.
    • Add a structured "contacts" input to configure enabled flag, primary address/contact details, and named alternates (billing, operations, security).

  • Documentation

    • README and examples updated to show the new contacts input structure and usage.

  • Validation

    • Input validates alternate types and enforces 2-letter country codes for primary.

✏️ Tip: You can customize this high-level summary in your review settings.

🤖 Automatic Updates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#49) ## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

Contributors

johncblandii
Loading

v1.537.1

12 Dec 03:55
@cloudposse-releaser cloudposse-releaser
v1.537.1
2699dd1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.537.1

🤖 Automatic Updates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#47) ## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

chore(deps): update terraform cloudposse/service-control-policies/aws to v0.15.2 @[renovate[bot]](https://github.com/apps/renovate) (#46) This PR contains the following updates:
Package Type Update Change
cloudposse/service-control-policies/aws (source) module patch 0.15.1 -> 0.15.2

Release Notes

cloudposse/terraform-aws-service-control-policies (cloudposse/service-control-policies/aws)

v0.15.2

Compare Source

Enhance SCP to Cover Additional BlockPublicAccess Cases @​petabook (#​69) This update extends the Service Control Policy (SCP) to address more scenarios involving S3 `BlockPublicAccess`. * There are two types of `BlockPublicAccess` APIs: - Bucket-level - Account-level

By using a wildcard * the SCP now denies both (and future) types.

  • Additionally, deletion of these policies is protected to prevent accidental or unauthorized removal.
Impact
  • Strengthens security posture by ensuring consistent enforcement of S3 BlockPublicAccess at both the bucket and account levels.
  • Prevents tampering or removal of critical access control policies.
🤖 Automatic Updates
Fix go version in tests @​osterman (#​68)
what
  • Update go 1.24
why
  • Error loading shared library libresolv.so.2 in Go 1.20
References
Replace Makefile with atmos.yaml @​osterman (#​67)
what
  • Remove Makefile
  • Add atmos.yaml
why
  • Replace build-harness with atmos for readme genration
References
  • DEV-3229 Migrate from build-harness to atmos

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

chore(deps): update tflint plugin terraform-linters/tflint-ruleset-aws to v0.44.0 @[renovate[bot]](https://github.com/apps/renovate) (#45) This PR contains the following updates:
Package Type Update Change
terraform-linters/tflint-ruleset-aws plugin minor 0.43.0 -> 0.44.0

Release Notes

terraform-linters/tflint-ruleset-aws (terraform-linters/tflint-ruleset-aws)

v0.44.0

Compare Source

What's Changed

Support for Cosign signatures has been removed from this release. The checksums.txt.keyless.sig and checksums.txt.pem will not be included in the release.
These files are not used in normal use cases, so in most cases this will not affect you, but if you are affected, you can use Artifact Attestations instead.

Breaking Changes
  • Bump github.com/terraform-linters/tflint-plugin-sdk from 0.22.0 to 0.23.1 by @​dependabot[bot] in #​966
    • Requires TFLint v0.46+
Enhancements
Chores

New Contributors

Full Changelog: terraform-linters/tflint-ruleset-aws@v0.43.0...v0.44.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR w...

Read more
Loading

v1.537.0

30 Oct 23:43
@cloudposse-releaser cloudposse-releaser
v1.537.0
ce7e5da
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.537.0
feat: `aws_iam_organizations_features` @milldr (#43) ## what - Added optional resource, `aws_iam_organizations_features`

why

  • We can use this to enable RootCredentialsManagement and RootSessions. By doing so, we can centralized root access and remove the requirement for root creds in each child account

For example

components:
  terraform:
    account:
      vars:
...
        organization_enabled_features:
          - RootCredentialsManagement
          - RootSessions

references

Manages centralized root access features across AWS member accounts managed using AWS Organizations. More information about managing root access in IAM can be found in the Centralize root access for member accounts.

Summary by CodeRabbit

  • New Features
    • Enable and manage AWS Organizations features at the Organization Root level.
    • Feature activation is conditional and tied to organization state.
    • Configure multiple features at once using a simple list-based setting with sensible defaults.

🤖 Automatic Updates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#44) ## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#42) ## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

chore(deps): update tflint plugin terraform-linters/tflint-ruleset-aws to v0.43.0 @[renovate[bot]](https://github.com/apps/renovate) (#41) Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more [here](https://redirect.github.com/renovatebot/renovate/discussions/37842).

This PR contains the following updates:

Package Type Update Change
terraform-linters/tflint-ruleset-aws plugin minor 0.42.0 -> 0.43.0

Release Notes

terraform-linters/tflint-ruleset-aws (terraform-linters/tflint-ruleset-aws)

v0.43.0

Compare Source

What's Changed

Breaking Changes
Enhancements
Chores

Full Changelog: terraform-linters/tflint-ruleset-aws@v0.42.0...v0.43.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#40) ## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#38) ## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

Update README.yaml wiht AI @goruha (#36) ## what - Update README.yaml

why

  • Use atmos to generate readme

Summary by CodeRabbit

  • Documentation
    • ...
Read more

Contributors

goruha and milldr
Loading

v1.536.2

26 Jun 18:51
@cloudposse-releaser cloudposse-releaser
v1.536.2
cdefedb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.536.2
chore(deps): restrict aws provider version to < 6.0.0 @Benbentwo (#29) This pull request includes a version constraint update for the AWS provider in the Terraform configuration file `src/versions.tf`. The change ensures compatibility with versions up to but not including 6.0.0.
  • src/versions.tf: Updated the version constraint for the aws provider to >= 4.9.0, < 6.0.0 to ensure compatibility with future versions while avoiding potential breaking changes in version 6.0.0.

Summary by CodeRabbit

  • Chores
    • Updated AWS provider version constraints to prevent automatic upgrades to major version 6 or above.

🤖 Automatic Updates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#30) ## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

Enable merge queue @goruha (#28) ## what - Added `auto-merge` workflow - Update `settings.yaml` - Fix CodeOwners files

why

  • Support auto merge PRs
  • Create merge queue
  • Implement new CodeOwners policy
Enable merge queue @goruha (#27) ## what - Added `auto-merge` workflow - Update `settings.yaml` - Fix CodeOwners files

why

  • Support auto merge PRs
  • Create merge queue
  • Implement new CodeOwners policy
chore(deps): update tflint plugin terraform-linters/tflint-ruleset-aws to v0.40.0 @[renovate[bot]](https://github.com/apps/renovate) (#4) This PR contains the following updates:
Package Type Update Change
terraform-linters/tflint-ruleset-aws plugin minor 0.23.1 -> 0.40.0

Release Notes

terraform-linters/tflint-ruleset-aws (terraform-linters/tflint-ruleset-aws)

v0.40.0

Compare Source

What's Changed

Enhancements
Chores

Full Changelog: terraform-linters/tflint-ruleset-aws@v0.39.0...v0.40.0

v0.39.0

Compare Source

What's Changed

Enhancements
Bug Fixes
Chores
Read more

Contributors

goruha and Benbentwo
Loading

v1.536.1

19 May 21:24
@cloudposse-releaser cloudposse-releaser
v1.536.1
3c13a84
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.536.1
Add new output `account_name_id_map` @Benbentwo (#19) ## what * another output

why

  • Provides a map of account_name to id for all accounts including organization owner.

Summary by CodeRabbit

  • New Features
    • Added a new output that provides a map of account names to their account IDs, including the root account.

🤖 Automatic Updates

chore(deps): update terraform cloudposse/service-control-policies/aws to v0.15.1 @[renovate[bot]](https://github.com/apps/renovate) (#3) This PR contains the following updates:
Package Type Update Change
cloudposse/service-control-policies/aws (source) module minor 0.9.2 -> 0.15.1

Release Notes

cloudposse/terraform-aws-service-control-policies (cloudposse/service-control-policies/aws)

v0.15.1

Compare Source

🚀 Enhancements
Update EC2 policies to include new instance types @​Nuru (#​64)
what
  • Update DenyEC2NonNitroInstances and DenyEC2InstancesWithoutEncryptionInTransit to include instances made available since the last update
why
  • Allow qualifying instances that would have otherwise been denied because they were too new

v0.15.0

Compare Source

feat: Add require ebs encryption scp @​wavemoran (#​60)
what
  • Adds SCP to require EBS volume encryption
why
  • Encrypting EBS volumes is a good default security policy
  • Seems like a common enough policy to include in the provided catalog
references
Run tests 1 policy at a time @​goruha (#​62)
what
  • Run tests 1 policy at a time
why
  • Workaround service control policies limits
🚀 Enhancements
chore(deps): bump github.com/hashicorp/go-getter from 1.7.3 to 1.7.5 in /test/src in the go_modules group @​dependabot (#​57) Bumps the go_modules group in /test/src with 1 update: [github.com/hashicorp/go-getter](https://redirect.github.com/hashicorp/go-getter).

Updates github.com/hashicorp/go-getter from 1.7.3 to 1.7.5

Release notes

Sourced from github.com/hashicorp/go-getter's releases.

v1.7.5

What's Changed

New Contributors

Full Changelog: https://github.com/hashicorp/go-getter/compare/v1.7.4...v1.7.5

v1.7.4

What's Changed

Full Changelog: https://github.com/hashicorp/go-getter/compare/v1.7.3...v1.7.4

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.
🤖 Automatic Updates
chore(deps): bump github.com/hashicorp/go-getter from 1.7.3 to 1.7.5 in /test/src in the go_modules group @​dependabot (#​57) Bumps the go_modules group in /test/src with 1 update: [github.com/hashicorp/go-getter](https://redirect.github.com/hashicorp/go-getter).

Updates github.com/hashicorp/go-getter from 1.7.3 to 1.7.5

Release notes

Sourced from github.com/hashicorp/go-getter's releases.

v1.7.5

What's Changed

Read more

Contributors

Benbentwo
Loading

v1.536.0

07 Jan 19:56
@cloudposse-releaser cloudposse-releaser
v1.536.0
bad8068
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.536.0
fix: update legacy splat operator @RoseSecurity (#14) ## what
  • Replace the legacy "attribute-only" splat expressions which use the sequence .* with the newer expression[*]

why

Earlier versions of the Terraform language had a slightly different version of splat expressions, which Terraform continues to support for backward compatibility. This older variant is less useful than the modern form described above, and so Hashicorp recommends against using it in new configurations.

references

Summary by CodeRabbit

  • Refactor
    • Updated Terraform output syntax for organization service control policies
    • Replaced splat operator (.*) with modern indexing syntax ([*])
    • Maintained existing output functionality and descriptions

Contributors

RoseSecurity
Loading

v1.535.0

04 Jan 11:16
@goruha goruha
v1.535.0
841bf94
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.535.0

Migrate component from cloudposse/terraform-aws-components

Loading

v1.534.0

04 Jan 10:58
@goruha goruha
v1.534.0
841bf94
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.534.0

Migrate component from cloudposse/terraform-aws-components

Loading

v1.533.0

13 Dec 19:45
@goruha goruha
v1.533.0
e9444a5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.533.0

Migrate component from cloudposse/terraform-aws-components

Loading