Merge branch 'main' into f-add_fms_policy_option

.changelog/24774.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_instance: Fix default for `metadata_options.http_endpoint` argument.
+```
+
+```release-note:note
+resource/aws_instance: The `metadata_options.http_endpoint` argument now correctly defaults to `enabled`.
+```

.changelog/25210.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cloudformation_stack_set: Add `managed_execution` argument
+```

.changelog/25569.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_iam_principal_policy_simulation
+```

.changelog/25724.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_s3_bucket: Fix bucket_regional_domain_name not including region for buckets in us-east-1
+```

.changelog/26880.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ecs_task_definition: Fix to prevent persistent diff when `efs_volume_configuration` has both `root_volume` and `authorization_config` set.
+```

.changelog/27197.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_s3_object: Remove `acl` default in order to work with S3 buckets that have ACL disabled
+```
+
+```release-note:bug
+resource/aws_s3_object_copy: Remove `acl` default in order to work with S3 buckets that have ACL disabled
+```

.changelog/27604.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_ses_active_receipt_rule_set: Support import
+```

.changelog/27811.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_datasync_task: Add `object_tags` attribute to `options` configuration block
+```
+
+```release-note:bug
+resource/aws_datasync_location_object_storage: Don't ignore `server_certificate` argument
+```

.changelog/28470.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_opensearchserverless_security_policy
+```

.changelog/28518.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_opensearchserverless_access_policy
+```

.changelog/28651.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_opensearchserverless_vpc_endpoint
+```

.changelog/28776.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_opensearchserverless_security_config
+```

.changelog/29367.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lambda_invocation: Add lifecycle_scope CRUD to invoke on each resource state transition
+```

.changelog/29571.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lambda_layer_version_permission: Add `skip_destroy` attribute
+```

.changelog/30242.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_resourcegroups_group: `resource_query` no longer conflicts with `configuration`
+```
+
+```release-note:bug
+resource/aws_resourcegroups_resource: Fix crash when resource Create fails
+```

.changelog/30545.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_launch_template: Remove default values in `metadata_options` to allow default condition
+```

.changelog/30817.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+data-source/aws_ssm_parameter: Add `insecure_value` attribute
+```

.changelog/30916.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_s3_bucket_logging: Retry on empty read of logging config
+```

.changelog/30995.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_s3_bucket_replication_configuration: Replication configs sometimes need more than a second or two. This resolves a race condition and adds retry logic when reading them.
+```

.changelog/30999.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_route_table: Fix `reading Route Table (rtb-abcd1234): couldn't find resource` errors when reading new resource
+```

.changelog/31006.txt

@@ -1,3 +1,3 @@
 ```release-note:note
-data-source/aws_db_security_group: The `aws_redshift_service_account` data source has been deprecated and will be removed in a future version. AWS documentation [states that](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-bucket-permissions) a [service principal name](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services) should be used instead of an AWS account ID in any relevant IAM policy
-```
+data-source/aws_redshift_service_account: The `aws_redshift_service_account` data source has been deprecated and will be removed in a future version. AWS documentation [states that](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-bucket-permissions) a [service principal name](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services) should be used instead of an AWS account ID in any relevant IAM policy
+```

.changelog/31091.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_opensearchserverless_collection
+```

.changelog/31264.txt

@@ -0,0 +1,11 @@
+```release-note:bug
+resource/aws_elasticache_cluster: Correctly supports ElastiCache Redis version 7+
+```
+
+```release-note:bug
+resource/aws_elasticache_global_replication_group: Correctly supports ElastiCache Redis version 7+
+```
+
+```release-note:bug
+resource/aws_elasticache_replication_group: Correctly supports ElastiCache Redis version 7+
+```

.changelog/31282.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_autoscaling_group: Ignore any `Failed` scaling activities due to IAM eventual consistency
+```

.changelog/31352.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_keyspaces_keyspace: Correct plan time validation for `name`
+```
+
+```release-note:bug
+resource/aws_keyspaces_table: Correct plan time validation for `keyspace_name`, `table_name` and column names
+```

.changelog/31365.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_chimesdkvoice_global_settings
+```

.changelog/31369.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_appsync_graphql_api: Add `visibility` argument
+```
+
+```release-note:enhancement
+resource/aws_appsync_graphql_api: Add plan time validation for `log_config.cloudwatch_logs_role_arn`
+```

.changelog/31372.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_vpclattice_resource_policy
+```

.changelog/31393.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_rbin_rule: Fix crash when multiple `resource_tags` blocks are configured
+```

.changelog/31398.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_sagemaker_endpoint_configuration: Add  and `shadow_production_variants.serverless_config.provisioned_concurrency` arguments
+```

.changelog/31399.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_emrcontainers_job_template
+```

.changelog/31422.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_grafana_workspace: Increase default Create and Update timeouts to 30 minutes
+```

.changelog/31424.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_quicksight_data_set: Fix join_instruction not applied when creating dataset
+```

.changelog/31430.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_resourcegroups_resource
+```

.changelog/31448.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_quicksight_dashboard
+```

.changelog/31452.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_ec2_transit_gateway_route_table_association: Add `replace_existing_association` argument
+```

.changelog/31480.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+data-source/aws_dx_connection: Fix the `vlan_id` being returned as null
+```
+
+```release-note:bug
+resource/aws_dx_connection: Fix the `vlan_id` being returned as null
+```

.changelog/31483.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_codebuild_project: The `secondary_sources.auth` and `source.auth` attributes have been removed
+```

.changelog/31484.txt

@@ -0,0 +1,7 @@
+```release-note:breaking-change
+resource/aws_connect_hours_of_operation: The `hours_of_operation_arn` attribute has been removed
+```
+
+```release-note:breaking-change
+data-source/aws_connect_hours_of_operation: The `hours_of_operation_arn` attribute has been removed
+```

.changelog/31486.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_wafv2_web_acl_logging_configuration: The `redacted_fields.all_query_arguments`, `redacted_fields.body` and `redacted_fields.single_query_argument` attributes have been removed
+```

.changelog/31487.txt

@@ -0,0 +1,7 @@
+```release-note:breaking-change
+resource/aws_secretsmanager_secret: The `rotation_enabled`, `rotation_lambda_arn` and `rotation_rules` attributes have been removed
+```
+
+```release-note:breaking-change
+data-source/aws_secretsmanager_secret: The `rotation_enabled`, `rotation_lambda_arn` and `rotation_rules` attributes have been removed
+```

.changelog/31488.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_quicksight_data_set: Ignore failure to read refresh properties for non-SPICE datasets
+```

.changelog/31489.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_lightsail_instance: The `ipv6_address` attribute has been removed
+```

.changelog/31490.txt

@@ -0,0 +1,7 @@
+```release-note:note
+resource/aws_opensearch_domain: The `kibana_endpoint` attribute has been deprecated. All configurations using `kibana_endpoint` should be updated to use the `dashboard_endpoint` attribute instead
+```
+
+```release-note:note
+data-source/aws_opensearch_domain: The `kibana_endpoint` attribute has been deprecated. All configurations using `kibana_endpoint` should be updated to use the `dashboard_endpoint` attribute instead
+```

.changelog/31495.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_instance: Add `instance_market_options` configuration block and `instance_lifecycle` and `spot_instance_request_id` attributes
+```

.changelog/31499.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_fis_experiment_template: Add support for `Volumes` to `actions.*.target`
+```

.changelog/31527.txt

@@ -0,0 +1,15 @@
+```release-note:new-resource
+aws_autoscaling_traffic_source_attachment
+```
+
+```release-note:enhancement
+resource/aws_autoscaling_group: Add `traffic_source` configuration block
+```
+
+```release-note:enhancement
+data-source/aws_autoscaling_group: Add `traffic_source` attribute
+```
+
+```release-note:note
+resource/aws_autoscaling_group: The `load_balancers` and `target_group_arns` attributes have been changed to `Computed`. This means that omitting this argument is interpreted as ignoring any existing load balancer or target group attachments. To remove all load balancer or target group attachments an empty list should be specified.
+```

.changelog/31536.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_transfer_server: Add support for `TransferSecurityPolicy-2023-05` `security_policy_name` value
+```

.changelog/31541.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_networkfirewall_firewall_policy: Add `stream_exception_policy` option to `firewall_policy.stateful_engine_options`
+```

.changelog/31542.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_quicksight_analysis
+```

.changelog/31544.txt

@@ -0,0 +1,27 @@
+```release-note:enhancement
+resource/aws_fsx_ontap_volume: Update `ontap_volume_type` attribute to be configurable
+```
+
+```release-note:enhancement
+resource/aws_fsx_ontap_volume: `junction_path` is Optional
+```
+
+```release-note:enhancement
+resource/aws_fsx_ontap_volume: Remove default value for `security_style` argument and mark as Computed
+```
+
+```release-note:enhancement
+resource/aws_fsx_ontap_volume: `storage_efficiency_enabled` is Optional
+```
+
+```release-note:bug
+resource/aws_fsx_ontap_volume: Change `volume_type` to [ForceNew](https://developer.hashicorp.com/terraform/plugin/sdkv2/schemas/schema-behaviors#forcenew)
+```
+
+```release-note:enhancement
+resource/aws_fsx_ontap_volume: Add `skip_final_backup` argument
+```
+
+```release-note:bug
+resource/aws_fsx_ontap_volume: Change `storage_virtual_machine_id` to [ForceNew](https://developer.hashicorp.com/terraform/plugin/sdkv2/schemas/schema-behaviors#forcenew)
+```

.changelog/31545.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_organizations_policies
+```

.changelog/31551.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_autoscaling_group: Now ignores previous failed scaling activities
+```

.changelog/31567.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_eip: Deprecate `vpc` attribute. Use `domain` instead
+```

.changelog/31568.txt

@@ -0,0 +1,8 @@
+
+```release-note:enhancement
+resource/aws_opensearch_domain: Removed `engine_version` default value
+```
+
+```release-note:note
+resource/aws_opensearch_domain: The `engine_version` attribute no longer has a default value. When omitted, the underlying AWS API will use the latest OpenSearch engine version.
+```

.changelog/31587.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+provider/tags: Fix crash when tags are `null`
+```

.changelog/31588.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_route53_vpc_association_authorization: Fix `ConcurrentModification` error
+```

.changelog/31604.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_glue_data_quality_ruleset
+```

.changelog/31607.txt

@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_pipes_pipe: Add `enrichment_parameters` argument
+```
+
+```release-note:enhancement
+resource/aws_pipes_pipe: Add `activemq_broker_parameters`, `dynamodb_stream_parameters`, `kinesis_stream_parameters`, `managed_streaming_kafka_parameters`, `rabbitmq_broker_parameters`, `self_managed_kafka_parameters` and `sqs_queue_parameters` attributes to the `source_parameters` configuration block. NOTE: Because we cannot easily test all this functionality, it is best effort and we ask for community help in testing
+```
+
+```release-note:enhancement
+resource/aws_pipes_pipe: Add `batch_job_parameters`, `cloudwatch_logs_parameters`, `ecs_task_parameters`, `eventbridge_event_bus_parameters`, `http_parameters`, `kinesis_stream_parameters`, `lambda_function_parameters`, `redshift_data_parameters`, `sagemaker_pipeline_parameters`, `sqs_queue_parameters` and `step_function_state_machine_parameters` attributes to the `target_parameters` configuration block. NOTE: Because we cannot easily test all this functionality, it is best effort and we ask for community help in testing
+```

.changelog/31608.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_cloudfront_distribution: Remove the upper limit on `origin_keepalive_timeout`
+```

.changelog/31612.txt

@@ -0,0 +1,7 @@
+```release-note:note
+resource/aws_redshift_cluster: Ignores the parameter `aqua_configuration_status`, since the AWS API ignores it. Now always returns `auto`.
+```
+
+```release-note:bug
+resource/aws_redshift_cluster: No longer errors on deletion when status is `Maintenance`
+```

.changelog/31646.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lambda_provisioned_concurrency_configuration: Add `skip_destroy` argument
+```

.changelog/31647.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_medialive_channel: Fix attribute spelling in `hls_cdn_settings` expand
+```

.changelog/31656.txt

@@ -0,0 +1,7 @@
+```release-note:breaking-change
+resource/aws_iam_role: The `role_last_used` attribute has been removed. Use the `aws_iam_role` data source instead.
+```
+
+```release-note:note
+resource/aws_iam_role: The `role_last_used` attribute has been removed. Use the `aws_iam_role` data source instead. See the community feedback provided in the [linked issue](https://github.com/hashicorp/terraform-provider-aws/issues/30861) for additional justification on this change. As the attribute is read-only, unlikely to be used as an input to another resource, and available in the corresponding data source, a breaking change in a minor version was deemed preferable to a long deprecation/removal cycle in this circumstance.
+```

.changelog/31669.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_kendra_index: Persist `user_group_resolution_mode` value to state after creation
+```