Skip to content
EOL Watch
Search itemsOpen menu

AWSBreaking change

Terraform AWS provider 6.0.0: breaking changes

Release date for Terraform AWS provider 6.0.0: 18 Jun 2025. Breaking changes listed in the release notes: 92.

Breaking since , 18 Jun 2025

ShareAdd to calendarReport an error

What breaks

Breaking changes listed in the release notes:

  • aws_ami: The severity of the diagnostic returned when most_recent is true and owner and image ID filter criteria has been increased to an error. Existing configurations which were previously receiving a warning diagnostic will now fail to apply. To prevent this error, set the owner argument or include a filter block with an image-id or owner-id name/value pair. To continue using unsafe filter values with most_recent set to true, set the new allow_unsafe_filter argument to true. This is not recommended.
  • aws_ecs_task_definition: Remove inference_accelerator attribute. Amazon Elastic Inference reached end of life on April, 2024.
  • aws_ecs_task_execution: Remove inference_accelerator_overrides attribute. Amazon Elastic Inference reached end of life on April, 2024.
  • aws_elbv2_listener_rule: The action.authenticate_cognito, action.authenticate_oidc, action.fixed_response, action.forward, action.forward.stickiness, action.redirect, condition.host_header, condition.http_header, condition.http_request_method, condition.path_pattern, condition.query_string, and condition.source_ip attributes are now list nested blocks instead of single nested blocks
  • aws_identitystore_user: filter has been removed
  • aws_launch_template: Remove elastic_inference_accelerator attribute. Amazon Elastic Inference reached end of life on April, 2024.
  • aws_launch_template: elastic_gpu_specifications has been removed
  • aws_opensearch_domain: kibana_endpoint has been removed
  • aws_opensearchserverless_security_config: saml_options is now a list nested block instead of a single nested block
  • aws_service_discovery_service: Remove tags_all attribute
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_application resource has been removed
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_custom_layer resource has been removed
Show 80 more changes
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_ecs_cluster_layer resource has been removed
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_ganglia_layer resource has been removed
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_haproxy_layer resource has been removed
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_instance resource has been removed
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_java_app_layer resource has been removed
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_memcached_layer resource has been removed
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_mysql_layer resource has been removed
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_nodejs_app_layer resource has been removed
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_permission resource has been removed
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_php_app_layer resource has been removed
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_rails_app_layer resource has been removed
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_rds_db_instance resource has been removed
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_stack resource has been removed
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_static_web_layer resource has been removed
  • provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_user_profile resource has been removed
  • provider: As the AWS SDK for Go v2 does not support Amazon SimpleDB the aws_simpledb_domain resource has been removed. Add a constraint to v5 of the Terraform AWS Provider for continued use of this resource
  • provider: As the AWS SDK for Go v2 does not support Amazon Worklink, the aws_worklink_fleet resource has been removed
  • provider: As the AWS SDK for Go v2 does not support Amazon Worklink, the aws_worklink_website_certificate_authority_association resource has been removed
  • provider: The aws_redshift_service_account resource has been removed. AWS recommends that a service principal name should be used instead of an AWS account ID in any relevant IAM policy
  • provider: The endpoints.iotanalytics and endpoints.iotevents configuration arguments have been removed
  • provider: The endpoints.opsworks configuration argument has been removed
  • provider: The endpoints.simpledb and endpoints.sdb configuration arguments have been removed
  • provider: The endpoints.worklink configuration argument has been removed
  • aws_accessanalyzer_archive_rule: filter.exists now only accepts one of "" (empty string), true, or false
  • aws_alb_target_group: preserve_client_ip now only accepts one of "" (empty string), true, or false
  • aws_api_gateway_account: The reset_on_delete argument has been removed
  • aws_api_gateway_deployment: Remove canary_settings, execution_arn, invoke_url, stage_description, and stage_name arguments. Instead, use the aws_api_gateway_stage resource to manage stages.
  • aws_batch_compute_environment: Rename compute_environment_name to name resource/aws_batch_compute_environment: Rename compute_environment_name_prefix to name_prefix
  • aws_batch_compute_environment_data_source: Rename compute_environment_name to name
  • aws_batch_job_queue: Remove deprecated parameter compute_environments in place of compute_environment_order
  • aws_bedrock_model_invocation_logging_configuration: logging_config, logging_config.cloudwatch_config, logging_config.cloudwatch_config.large_data_delivery_s3_config, and logging_config.s3_config are now list nested blocks instead of single nested blocks
  • aws_cloudfront_key_value_store: Attribute id is now set to remote object's Id instead of name
  • aws_cloudfront_response_headers_policy: The etag argument is now computed only
  • aws_cloudtrail_event_data_store: suspend now only accepts one of "" (empty string), true, or false
  • aws_cognito_user_in_group: The id attribute is now a comma-delimited string concatenating the user_pool_id, group_name, and username arguments
  • aws_cur_report_definition: The s3_prefix argument is now required
  • aws_db_instance: character_set_name now cannot be set with replicate_source_db, restore_to_point_in_time, s3_import, or snapshot_identifier.
  • aws_dms_endpoint: Remove s3_settings attribute. Use aws_dms_s3_endpoint instead
  • aws_dx_gateway_association: vpn_gateway_id has been removed
  • aws_ec2_spot_instance_fleet: terminate_instances_on_delete now only accepts one of "" (empty string), true, or false
  • aws_ec2_spot_instance_request: Remove block_duration_minutes attribute
  • aws_ecs_task_definition: Remove inference_accelerator attribute. Amazon Elastic Inference reached end of life on April, 2024.
  • aws_eip: vpc has been removed. Use domain instead.
  • aws_eks_addon: resolve_conflicts has been removed. Use resolve_conflicts_on_create and resolve_conflicts_on_update instead.
  • aws_elasticache_cluster: auto_minor_version_upgrade now only accepts one of "" (empty string), true, or false
  • aws_elasticache_replication_group: at_rest_encryption_enabled and auto_minor_version_upgrade now only accept one of "" (empty string), true, or false
  • aws_elasticache_replication_group: auth_token_update_strategy no longer has a default value. If auth_token is set, auth_token_update_strategy must also be explicitly configured.
  • aws_evidently_feature: variations.value.bool_value now only accepts one of "" (empty string), true, or false
  • aws_flow_log: log_group_name has been removed. Use log_destination instead.
  • aws_globalaccelerator_accelerator: The id attribute is now computed only
  • aws_guardduty_detector: Deprecates datasources. Use aws_guardduty_detector_feature resources instead.
  • aws_guardduty_organization_configuration: The auto_enable attribute has been removed
  • aws_identitystore_group: filter has been removed
  • aws_imagebuilder_container_recipe: instance_configuration.block_device_mapping.ebs.delete_on_termination and instance_configuration.block_device_mapping.ebs.encrypted now only accept one of "" (empty string), true, or false
  • aws_imagebuilder_image_recipe: block_device_mapping.ebs.delete_on_termination and block_device_mapping.ebs.encrypted now only accept one of "" (empty string), true, or false
  • aws_instance: Remove cpu_core_count and cpu_threads_per_core. Instead, use cpu_options.
  • aws_instance: user_data now displays cleartext instead of a hash. Base64 encoded content should use user_data_base64 instead.
  • aws_launch_template: block_device_mappings.ebs.delete_on_termination, block_device_mappings.ebs.encrypted, ebs_optimized, network_interfaces.associate_carrier_ip_address, network_interfaces.associate_public_ip_address, network_interfaces.delete_on_termination, and network_interfaces.primary_ipv6 now only accept one of "" (empty string), true, or false
  • aws_launch_template: Remove elastic_inference_accelerator attribute. Amazon Elastic Inference reached end of life on April, 2024.
  • aws_launch_template: elastic_gpu_specifications has been removed
  • aws_lb_listener: mutual_authentication attributes advertise_trust_store_ca_names, ignore_client_certificate_expiry, and trust_store_arn are only valid if mode is verify
  • aws_lb_target_group: preserve_client_ip now only accepts one of "" (empty string), true, or false
  • aws_mq_broker: logs.audit now only accepts one of "" (empty string), true, or false
  • aws_networkmanager_core_network: The base_policy_region argument has been removed. Use base_policy_regions instead.
  • aws_opensearch_domain: kibana_endpoint has been removed
  • aws_opensearchserverless_security_config: saml_options is now a list nested block instead of a single nested block
  • aws_paymentcryptography_key: key_attributes and key_attributes.key_modes_of_use are now list nested blocks instead of single nested blocks.
  • aws_quicksight_data_set: tags_all has been removed
  • aws_redshift_cluster: Attributes cluster_public_key, cluster_revision_number, and endpoint are now read only and should not be set
  • aws_redshift_cluster: The logging attribute has been removed
  • aws_redshift_cluster: The publicly_accessible attribute now defaults to false
  • aws_redshift_cluster: The snapshot_copy attribute has been removed
  • aws_rekognition_stream_processor: regions_of_interest.bounding_box is now a list nested block instead of a single nested block
  • aws_resiliencehub_resiliency_policy: policy, policy.az, policy.hardware, policy.software, and policy.region are now list nested blocks instead of single nested blocks
  • aws_sagemaker_app_image_config: Exactly one code_editor_app_image_config, jupyter_lab_image_config, or kernel_gateway_image_config block must be configured
  • aws_sagemaker_image_version: id is now a comma-delimited string concatenating image_name and version
  • aws_sagemaker_notebook_instance: Remove accelerator_types from your configuration, it no longer exists. Instead, use instance_type to use Inferentia.
  • aws_ssm_association: Remove instance_id argument
  • aws_verifiedpermissions_schema: definition is now a list nested block instead of a single nested block
  • aws_wafv2_web_acl: rule.statement.managed_rule_group_statement.managed_rule_group_configs.aws_managed_rules_bot_control_rule_set.enable_machine_learning now defaults to false

Who is affected

Affected versions

  • 6.0.0

What to do

  1. Give the provider a version constraint in the required_providers block. HashiCorp recommends a version constraint for every provider a module depends on.
  2. In a root module, also specify the maximum provider version, to avoid accidental upgrades to incompatible new versions. The ~> operator is a shorthand that allows the rightmost component of a version to increment. Do not use ~> or other maximum-version constraints in modules you intend to reuse across many configurations. Specify a minimum version there and let the root module manage the maximum version.
  3. Commit the dependency lock file to version control with the configuration, so that Terraform always installs the same provider versions.
  4. To adopt 6.0.0, change the version in the required_providers block and re-run terraform init. HashiCorp states that this upgrades the provider version in the lock file. Without a change, Terraform re-selects the version recorded in the lock file, even if a newer version has become available. With the -upgrade option, terraform init disregards the recorded selection and selects the newest available version matching the version constraint. The release notes list each breaking change.
  5. Review the changes Terraform made to the lock file in version control. If they are changes you made intentionally, send them through the usual code review process.

Replacement

Not stated by vendor.

Sources

Last checked against the first source in this list on .

Related

awsbreaking changes by version

Found an error? Report it

The text on this page is drafted with AI assistance from the vendor's text, checked against the official source and approved by a person before it is published. How items are written

Last checked · Added · Changelog for this item