Merge branch 'main' into resource/aws_cloudwatch_query_definition

.changelog/10213.txt

@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_acmpca_certificate
+```
+
+```release-note:new-data-source
+aws_acmpca_certificate
+```

.changelog/11967.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_ssm_parameter: Add support for `Intelligent-Tiering`
+```

.changelog/12642.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+provider: Add validation for `role_arn`, `policy_arns`, and `policy`
+```

.changelog/12758.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_mq_broker: Support updating broker engine version without recreating broker
+```

.changelog/14101.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_sns_topic_subscription: Add plan time validation for `subscription_role_arn` and `topic_arn`
+```
+
+```release-note:bug
+resource/aws_sns_topic_subscription: recreate subscription if topic is deleted
+```

.changelog/14193.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_ecr_repository_policy: Add plan time validation for `policy`
+```

.changelog/14247.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_config_configuration_aggregator: Allow name to have uppercase characters
+```

.changelog/14255.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_sns_topic_subscription: Fix to avoid `delivery_policy` always showing diff.
+```

.changelog/14319.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_wafv2_web_acl_logging_configuration: Ensure `redacted_fields` are applied to the resource
+```
+
+```release-note:note
+resource/aws_wafv2_web_acl_logging_configuration: The `redacted_fields` configuration block `all_query_arguments`, `body`, and `single_query_argument` arguments have been deprecated to match the WAF API documentation
+```

.changelog/14905.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_light_instance_public_ports: Add `cidrs` argument to `port_info`
+```

.changelog/14923.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_sns_topic_subscription: Add `email`, `email-json`, and `firehose` to protocol values. Add `subscription_role_arn` argument for Firehose support. Add `confirmation_was_authenticated`, `owner_id`, and `pending_confirmation` attributes.
+```

.changelog/14935.txt

@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_cognito_user_pool_client: Add plan time validation for `name`, `default_redirect_uri`, `supported_identity_providers`
+```
+
+```release-note:enhancement
+resource/aws_cognito_user_pool_client: Add support for `access_token_validity` and `id_token_validity`, `token_validity_units`
+```
+
+```release-note:enhancement
+resource/aws_cognito_user_pool: Add support for `configuration_set` in `email_configuration`
+```

.changelog/15112.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lb_listener: Fix `default_action.forward.target_group` to have minimum of 1.
+```

.changelog/15213.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_ssm_patch_group: Allow for a single patch group to be registered with multiple patch baselines
+```
+
+```release-note:bug
+resource/aws_ssm_patch_group: Replace `Provider produced inconsistent result after apply` with actual error message
+```

.changelog/16108.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_mq_broker: Add RabbitMQ as option for `engine_type`, and new arguments `authentication_strategy`, `ldap_server_metadata`, and `storage_type`. Improve handling of eventual consistency.
+```

.changelog/16325.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_autoscaling_group: Added support Auto Scaling groups with multiple launch templates using a mixed instances policy
+```

.changelog/16815.txt

@@ -0,0 +1,11 @@
+```release-note:bug
+resource/aws_cloudwatch_event_permission: Fix error in Event Bridge/CloudWatch Events bus name validation
+```
+
+```release-note:bug
+resource/aws_cloudwatch_event_rule: Fix error in Event Bridge/CloudWatch Events bus name validation
+```
+
+```release-note:bug
+resource/aws_cloudwatch_event_target: Fix error in Event Bridge/CloudWatch Events bus name validation
+```

.changelog/16865.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_ecrpublic_repository
+```

.changelog/16930.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_route: Validate route destination and target attributes
+```
+
+```release-note:bug
+resource/aws_route: Correctly handle updates to the route target attributes (`egress_only_gateway_id`, `gateway_id`, `instance_id`,  `local_gateway_id`, `nat_gateway_id`, `network_interface_id`, `transit_gateway_id`, `vpc_peering_connection_id`)
+```

.changelog/16936.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_ecs_service: Add `deployment_circuit_breaker`
+```
+
+```release-note:bug
+resource/aws_ecs_service: Improve handling of eventual consistency including security group dependency violations on deletion
+```

.changelog/16961.txt

@@ -0,0 +1,3 @@
+```release-notes:enhancement
+resource/aws_route: Add `carrier_gateway_id` attribute
+```

.changelog/16963.txt

@@ -0,0 +1,3 @@
+```release-notes:enhancement
+data-source/aws_route: Add `carrier_gateway_id` attribute
+```

.changelog/16979.txt

@@ -0,0 +1,11 @@
+```release-notes:enhancement
+resource/aws_default_route_table: Add `arn` attribute
+```
+
+```release-notes:enhancement
+resource/aws_route_table: Add `arn` attribute
+```
+
+```release-notes:enhancement
+resource/aws_route_table: Add `carrier_gateway_id` attribute to `route` configuration block
+```

.changelog/17040.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_route53_record: Support `DS` value for `type` argument
+```

.changelog/17149.txt

@@ -0,0 +1,7 @@
+```release-note:new-data-source
+aws_kinesis_stream_consumer
+```
+
+```release-note:new-resource
+aws_kinesis_stream_consumer
+```

.changelog/17251.txt

@@ -0,0 +1,15 @@
+```release-note:new-resource
+aws_sagemaker_app
+```
+
+```release-note:enhancement
+resource/aws_sagemaker_domain: Make `default_resource_spec` optional for the `tensor_board_app_settings`, `jupyter_server_app_settings` and `kernel_gateway_app_settings` config blocks. 
+```
+
+```release-note:bug
+resource/aws_sagemaker_domain: Wait for update to finish.
+```
+
+```release-note:bug
+resource/aws_sagemaker_user_profile: Wait for update to finish.
+```

.changelog/17291.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_route: `destination_prefix_list_id` attribute can be specified for managed prefix list destinations
+```

.changelog/17295.txt

@@ -0,0 +1,3 @@
+```release-notes:enhancement
+data-source/aws_route: Add `destination_prefix_list_id` attribute
+```

.changelog/17319.txt

@@ -0,0 +1,19 @@
+```release-notes:enhancement
+resource/aws_default_route_table: Add `destination_prefix_list_id` attribute
+```
+
+```release-notes:enhancement
+resource/aws_route_table: Add `destination_prefix_list_id` attribute
+```
+
+```release-note:bug
+resource/aws_vpn_gateway_route_propagation: Improve eventual consistency handling and handling of out-of-band resource removal
+```
+
+```release-note:bug
+resource/aws_route_table: Improve eventual consistency handling and handling of out-of-band resource removal
+```
+
+```release-note:bug
+resource/aws_route_table_association: Improve eventual consistency handling and handling of out-of-band resource removal
+```

.changelog/17387.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ecs_service: Re-create service when `service_registries` changes
+```

.changelog/17465.txt

@@ -0,0 +1,3 @@
+```release-note:note
+resource/aws_codebuild_project: The `source` and `secondary_sources` configuration block `auth` attributes have been deprecated to match the CodeBuild API documentation. Use the `aws_codebuild_source_credential` resource instead.
+```

.changelog/17474.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_route53_hosted_zone_dnssec
+```

.changelog/17488.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_glue_trigger: Support starting ON_DEMAND triggers via `enabled` flag.
+```

.changelog/17579.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_msk_cluster: Orders `bootstrap_brokers`, `bootstrap_brokers_sasl_scram`, `bootstrap_brokers_tls`, and `zookeeper_connect_string`
+```
+
+```release-note:enhancement
+data-source/aws_msk_cluster: Orders `bootstrap_brokers`, `bootstrap_brokers_sasl_scram`, `bootstrap_brokers_tls`, and `zookeeper_connect_string`
+```

.changelog/17589.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_ec2_transit_gateway_route_tables
+```

.changelog/17596.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_fms_admin_account: Extend creation timeout to 10 minutes
+```

.changelog/17641.txt

@@ -0,0 +1,7 @@
+```release-note:note
+data-source/aws_vpc_endpoint_service: The `service_type` argument filtering has been switched from client-side to new EC2 API functionality
+```
+
+```release-note:bug
+data-source/aws_vpc_endpoint_service: Prevent panic with incorrect `service_type` argument values
+```

.changelog/17689.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_appautoscaling_scheduled_action: Adds `timezone` support
+```
+
+```release-note:enhancement
+resource/aws_appautoscaling_scheduled_action: Allows any timezone to be specified for `start_time` and `end_time`
+```

.changelog/17725.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_elasticache_replication_group: Allows creating a Replication Group as part of a Global Replication Group
+```

.changelog/17739.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_globalaccelerator_accelerator: Allow update of flow log attribute for active flow logs
+```
+
+```release-note:enhancement
+resource/aws_globalaccelerator_accelerator: Add plan time validation to `name`, `flow_logs_s3_bucket` and `flow_logs_s3_prefix` attributes
+```

.changelog/17754.txt

@@ -0,0 +1,3 @@
+``release-note:bug
+resource/aws_cloudwatch_event_archive: Fix retention_days type conversion on creation
+```

.changelog/17764.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_gamelift_build: Support all valid operating system values
+```

.changelog/17784.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_kinesis_analytics_application: Add `start_application` attribute
+```
+
+```release-note:enhancement
+resource/aws_kinesis_analytics_application: `starting_position_configuration` can be specified when starting an application
+```

.changelog/17801.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+provider: Underlying Terraform Plugin SDK update to ensure data source errors include configuration source (file and line)
+```

.changelog/17830.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_ssm_parameter: Add plan time validation to `name`, `description` and `allowed_pattern`
+```
+
+```release-note:enhancement
+resource/aws_ssm_parameter: Tag on create
+```

.changelog/17836.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_kms_grant: Adds support for operations on asymmetric keys
+```

.changelog/17850.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_acmpca_certificate_authority_certificate
+```

.changelog/17869.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_acm_certificate: Trigger resource recreation with `VALIDATION_TIMED_OUT` status
+```

.changelog/17872.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_neptune_cluster_parameter_group: Correctly update resource by `id`
+```

.changelog/17876.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_waf_rule: Fix rule deletion when still referenced by a WebACL
+```

.changelog/17880.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_storagegateway_upload_buffer: Replace `Provider produced inconsistent result after apply` with actual error message
+```

.changelog/17885.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ssm_maintenance_window_task: Prevent `ValidationException` error on update when priority is not set or 0
+```

.changelog/17901.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_neptune_cluster_instance: Add "storage-optimization" to Neptune cluster instance create/update pending states
+```

.changelog/17909.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_db_parameter_group: Store all values in lowercase to prevent unexpected diffs
+```

.changelog/17934.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+provider: Support automatic region validation for `ap-northeast-3`
+```

.changelog/17958.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_dms_certificate: Correctly base64 decode `certificate_wallet` value
+```

.changelog/17962.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_iam_instance_profile: Add tagging support
+```

.changelog/17964.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_iam_openid_connect_provider: Add tagging support
+```
+
+```release-note:enhancement
+resource/aws_iam_openid_connect_provider: Add plan time validation for `client_id_list` and `thumbprint_list`
+```

.changelog/17965.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_iam_saml_provider: Add tagging support
+```
+
+```release-note:enhancement
+resource/aws_iam_saml_provider: Add plan time validation for `name` and `saml_metadata_document`
+```

.changelog/17967.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_iam_server_certificate: Add tagging support
+```
+
+```release-note:enhancement
+resource/aws_iam_server_certificate: Add `expiration` and `upload_date` attributes
+```

.changelog/17968.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_ami_from_instance: Tag on create.
+```

.changelog/17969.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_efs_file_system: Add `number_of_mount_targets`, `size_in_bytes` and `owner_id` attributes
+```

.changelog/17974.txt

@@ -0,0 +1,15 @@
+```release-note:note
+provider: New `default_tags` argument as a public preview for applying tags across all resources under a provider. Support for the functionality must be added to individual resources in the codebase and is only implemented for the `aws_subnet` and `aws_vpc` resources at this time. Until a general availability announcement, no compatibility promises are made with these provider arguments and their functionality.
+```
+
+```release-note:enhancement
+provider: Add `default_tags` argument (in public preview, see note above)
+```
+
+```release-note:enhancement
+resource/aws_subnet: Support provider-wide default tags (in public preview, see note above)
+```
+
+```release-note:enhancement
+resource/aws_vpc: Support provider-wide default tags (in public preview, see note above)
+```

.changelog/17982.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_rds_cluster_instance: Add `configuring-iam-database-auth` pending state
+```