aws breaking changes

aws_wafv2_web_acl_rule

• resource/aws_wafv2_web_acl_rule: Removes and_statement from statement blocks nested in and_statement, and or_statement from statement blocks nested in or_statement. These values are rejected by AWS. Source for aws_wafv2_web_acl_rule in v6.73.0
• resource/aws_wafv2_web_acl_rule: Removes managed_rule_group_statement, rate_based_statement and rule_group_reference_statement from statement blocks nested in and_statement, not_statement and or_statement. These values are rejected by AWS. Source for aws_wafv2_web_acl_rule in v6.73.0
• resource/aws_wafv2_web_acl_rule: Removes or_statement from statement blocks nested in or_statement. These values are rejected by AWS. Source for aws_wafv2_web_acl_rule in v6.73.0

aws_route53domains_delegation_signer_record

• resource/aws_route53domains_delegation_signer_record: Change the format of the import ID from domain_name,dnssec_key_id to domain_name,flags,algorithm,public_key. This is acceptable in a minor version because AWS no longer return DNSKEY flags and delegation signer records can no longer reliably be found by domain name and key ID Source for aws_route53domains_delegation_signer_record in v6.70.0

aws_docdb_cluster

• resource/aws_docdb_cluster: availability_zones now validates that at most 3 items are provided at plan time. This is acceptable in a minor version because AWS would always reject requests with more than 3 availability zones at apply time. Source for aws_docdb_cluster in v6.68.0

aws_rds_cluster

• resource/aws_rds_cluster: availability_zones now validates that at most 3 items are provided at plan time. This is acceptable in a minor version because AWS would always reject requests with more than 3 availability zones at apply time. Source for aws_rds_cluster in v6.68.0

aws_pinpointsmsvoicev2_phone_number

• resource/aws_pinpointsmsvoicev2_phone_number: Remove provider-side defaults for opt_out_list_name and two_way_channel_enabled in favor of AWS server-side defaults (Default and false respectively). Configurations that omit these attributes will now show (known after apply) on first plan instead of the previous static value; the post-apply state is unchanged. This change mitigates persistent drift when the phone number is managed by an aws_pinpointsmsvoicev2_pool. Source for aws_pinpointsmsvoicev2_phone_number in v6.53.0

aws_xray_resource_policy

• resource/aws_xray_resource_policy: Changes to policy_name now force resource recreation. Technically this is a breaking change but the resource did not function correctly previously; updating policy_name would leave an orphaned policy with the old name in AWS Source for aws_xray_resource_policy in v6.46.0

aws_mq_configuration

• resource/aws_mq_configuration: Destruction of this resource will now delete the configuration. Previously delete was a no-op due to missing API operations, leaving resources in an unmanaged state. For this reason a breaking change was deemed acceptable in a minor version. This functionality requires the mq:DeleteConfiguration IAM permission. To restore the previous no-op behavior, set skip_destroy to true. Source for aws_mq_configuration in v6.42.0

aws_lakeformation_opt_in

• resource/aws_lakeformation_opt_in: Rename resource_data.lf_tag.value to resource_data.lf_tag.values and change to a set of string values Source for aws_lakeformation_opt_in in v6.37.0

aws_bedrockagentcore_browser

• resource/aws_bedrockagentcore_browser: Rename network_configuration.network_mode_config to network_configuration.vpc_config Source for aws_bedrockagentcore_browser in v6.21.0

aws_ecs_service

• resource/aws_ecs_service: Fix behavior when updating capacity_provider_strategy to avoid ECS service recreation after recent AWS changes Source for aws_ecs_service in v6.15.0

aws_ami

• data-source/aws_ami: The severity of the diagnostic returned when most_recent is true and owner and image ID filter criteria has been increased to an error. Existing configurations which were previously receiving a warning diagnostic will now fail to apply. To prevent this error, set the owner argument or include a filter block with an image-id or owner-id name/value pair. To continue using unsafe filter values with most_recent set to true, set the new allow_unsafe_filter argument to true. This is not recommended. Source for aws_ami in v6.0.0

aws_ecs_task_definition

• data-source/aws_ecs_task_definition: Remove inference_accelerator attribute. Amazon Elastic Inference reached end of life on April, 2024. Source for aws_ecs_task_definition in v6.0.0
• resource/aws_ecs_task_definition: Remove inference_accelerator attribute. Amazon Elastic Inference reached end of life on April, 2024. Source for aws_ecs_task_definition in v6.0.0

aws_ecs_task_execution

• data-source/aws_ecs_task_execution: Remove inference_accelerator_overrides attribute. Amazon Elastic Inference reached end of life on April, 2024. Source for aws_ecs_task_execution in v6.0.0

aws_elbv2_listener_rule

• data-source/aws_elbv2_listener_rule: The action.authenticate_cognito, action.authenticate_oidc, action.fixed_response, action.forward, action.forward.stickiness, action.redirect, condition.host_header, condition.http_header, condition.http_request_method, condition.path_pattern, condition.query_string, and condition.source_ip attributes are now list nested blocks instead of single nested blocks Source for aws_elbv2_listener_rule in v6.0.0

aws_identitystore_user

• data-source/aws_identitystore_user: filter has been removed Source for aws_identitystore_user in v6.0.0

aws_launch_template

• data-source/aws_launch_template: Remove elastic_inference_accelerator attribute. Amazon Elastic Inference reached end of life on April, 2024. Source for aws_launch_template in v6.0.0
• data-source/aws_launch_template: elastic_gpu_specifications has been removed Source for aws_launch_template in v6.0.0
• resource/aws_launch_template: block_device_mappings.ebs.delete_on_termination, block_device_mappings.ebs.encrypted, ebs_optimized, network_interfaces.associate_carrier_ip_address, network_interfaces.associate_public_ip_address, network_interfaces.delete_on_termination, and network_interfaces.primary_ipv6 now only accept one of "" (empty string), true, or false Source for aws_launch_template in v6.0.0
• resource/aws_launch_template: Remove elastic_inference_accelerator attribute. Amazon Elastic Inference reached end of life on April, 2024. Source for aws_launch_template in v6.0.0
• resource/aws_launch_template: elastic_gpu_specifications has been removed Source for aws_launch_template in v6.0.0

aws_opensearch_domain

• data-source/aws_opensearch_domain: kibana_endpoint has been removed Source for aws_opensearch_domain in v6.0.0
• resource/aws_opensearch_domain: kibana_endpoint has been removed Source for aws_opensearch_domain in v6.0.0

aws_opensearchserverless_security_config

• data-source/aws_opensearchserverless_security_config: saml_options is now a list nested block instead of a single nested block Source for aws_opensearchserverless_security_config in v6.0.0
• resource/aws_opensearchserverless_security_config: saml_options is now a list nested block instead of a single nested block Source for aws_opensearchserverless_security_config in v6.0.0

aws_service_discovery_service

• data-source/aws_service_discovery_service: Remove tags_all attribute Source for aws_service_discovery_service in v6.0.0

aws_accessanalyzer_archive_rule

• resource/aws_accessanalyzer_archive_rule: filter.exists now only accepts one of "" (empty string), true, or false Source for aws_accessanalyzer_archive_rule in v6.0.0

aws_alb_target_group

• resource/aws_alb_target_group: preserve_client_ip now only accepts one of "" (empty string), true, or false Source for aws_alb_target_group in v6.0.0

aws_api_gateway_account

• resource/aws_api_gateway_account: The reset_on_delete argument has been removed Source for aws_api_gateway_account in v6.0.0

aws_api_gateway_deployment

• resource/aws_api_gateway_deployment: Remove canary_settings, execution_arn, invoke_url, stage_description, and stage_name arguments. Instead, use the aws_api_gateway_stage resource to manage stages. Source for aws_api_gateway_deployment in v6.0.0

aws_batch_compute_environment

• resource/aws_batch_compute_environment: Rename compute_environment_name to name resource/aws_batch_compute_environment: Rename compute_environment_name_prefix to name_prefix Source for aws_batch_compute_environment in v6.0.0

aws_batch_compute_environment_data_source

• resource/aws_batch_compute_environment_data_source: Rename compute_environment_name to name Source for aws_batch_compute_environment_data_source in v6.0.0

aws_batch_job_queue

• resource/aws_batch_job_queue: Remove deprecated parameter compute_environments in place of compute_environment_order Source for aws_batch_job_queue in v6.0.0

aws_bedrock_model_invocation_logging_configuration

• resource/aws_bedrock_model_invocation_logging_configuration: logging_config, logging_config.cloudwatch_config, logging_config.cloudwatch_config.large_data_delivery_s3_config, and logging_config.s3_config are now list nested blocks instead of single nested blocks Source for aws_bedrock_model_invocation_logging_configuration in v6.0.0

aws_cloudfront_key_value_store

• resource/aws_cloudfront_key_value_store: Attribute id is now set to remote object's Id instead of name Source for aws_cloudfront_key_value_store in v6.0.0

aws_cloudfront_response_headers_policy

• resource/aws_cloudfront_response_headers_policy: The etag argument is now computed only Source for aws_cloudfront_response_headers_policy in v6.0.0

aws_cloudtrail_event_data_store

• resource/aws_cloudtrail_event_data_store: suspend now only accepts one of "" (empty string), true, or false Source for aws_cloudtrail_event_data_store in v6.0.0

aws_cognito_user_in_group

• resource/aws_cognito_user_in_group: The id attribute is now a comma-delimited string concatenating the user_pool_id, group_name, and username arguments Source for aws_cognito_user_in_group in v6.0.0

aws_cur_report_definition

• resource/aws_cur_report_definition: The s3_prefix argument is now required Source for aws_cur_report_definition in v6.0.0

aws_db_instance

• resource/aws_db_instance: character_set_name now cannot be set with replicate_source_db, restore_to_point_in_time, s3_import, or snapshot_identifier. Source for aws_db_instance in v6.0.0

aws_dms_endpoint

• resource/aws_dms_endpoint: Remove s3_settings attribute. Use aws_dms_s3_endpoint instead Source for aws_dms_endpoint in v6.0.0

aws_dx_gateway_association

• resource/aws_dx_gateway_association: vpn_gateway_id has been removed Source for aws_dx_gateway_association in v6.0.0

aws_ec2_spot_instance_fleet

• resource/aws_ec2_spot_instance_fleet: terminate_instances_on_delete now only accepts one of "" (empty string), true, or false Source for aws_ec2_spot_instance_fleet in v6.0.0

aws_ec2_spot_instance_request

• resource/aws_ec2_spot_instance_request: Remove block_duration_minutes attribute Source for aws_ec2_spot_instance_request in v6.0.0

aws_eip

• resource/aws_eip: vpc has been removed. Use domain instead. Source for aws_eip in v6.0.0

aws_eks_addon

• resource/aws_eks_addon: resolve_conflicts has been removed. Use resolve_conflicts_on_create and resolve_conflicts_on_update instead. Source for aws_eks_addon in v6.0.0

aws_elasticache_cluster

• resource/aws_elasticache_cluster: auto_minor_version_upgrade now only accepts one of "" (empty string), true, or false Source for aws_elasticache_cluster in v6.0.0

aws_elasticache_replication_group

• resource/aws_elasticache_replication_group: at_rest_encryption_enabled and auto_minor_version_upgrade now only accept one of "" (empty string), true, or false Source for aws_elasticache_replication_group in v6.0.0
• resource/aws_elasticache_replication_group: auth_token_update_strategy no longer has a default value. If auth_token is set, auth_token_update_strategy must also be explicitly configured. Source for aws_elasticache_replication_group in v6.0.0

aws_evidently_feature

• resource/aws_evidently_feature: variations.value.bool_value now only accepts one of "" (empty string), true, or false Source for aws_evidently_feature in v6.0.0

aws_flow_log

• resource/aws_flow_log: log_group_name has been removed. Use log_destination instead. Source for aws_flow_log in v6.0.0

aws_globalaccelerator_accelerator

• resource/aws_globalaccelerator_accelerator: The id attribute is now computed only Source for aws_globalaccelerator_accelerator in v6.0.0

aws_guardduty_detector

• resource/aws_guardduty_detector: Deprecates datasources. Use aws_guardduty_detector_feature resources instead. Source for aws_guardduty_detector in v6.0.0

aws_guardduty_organization_configuration

• resource/aws_guardduty_organization_configuration: The auto_enable attribute has been removed Source for aws_guardduty_organization_configuration in v6.0.0

aws_identitystore_group

• resource/aws_identitystore_group: filter has been removed Source for aws_identitystore_group in v6.0.0

aws_imagebuilder_container_recipe

• resource/aws_imagebuilder_container_recipe: instance_configuration.block_device_mapping.ebs.delete_on_termination and instance_configuration.block_device_mapping.ebs.encrypted now only accept one of "" (empty string), true, or false Source for aws_imagebuilder_container_recipe in v6.0.0

aws_imagebuilder_image_recipe

• resource/aws_imagebuilder_image_recipe: block_device_mapping.ebs.delete_on_termination and block_device_mapping.ebs.encrypted now only accept one of "" (empty string), true, or false Source for aws_imagebuilder_image_recipe in v6.0.0

aws_instance

• resource/aws_instance: Remove cpu_core_count and cpu_threads_per_core. Instead, use cpu_options. Source for aws_instance in v6.0.0
• resource/aws_instance: user_data now displays cleartext instead of a hash. Base64 encoded content should use user_data_base64 instead. Source for aws_instance in v6.0.0

aws_lb_listener

• resource/aws_lb_listener: mutual_authentication attributes advertise_trust_store_ca_names, ignore_client_certificate_expiry, and trust_store_arn are only valid if mode is verify Source for aws_lb_listener in v6.0.0

aws_lb_target_group

• resource/aws_lb_target_group: preserve_client_ip now only accepts one of "" (empty string), true, or false Source for aws_lb_target_group in v6.0.0

aws_mq_broker

• resource/aws_mq_broker: logs.audit now only accepts one of "" (empty string), true, or false Source for aws_mq_broker in v6.0.0

aws_networkmanager_core_network

• resource/aws_networkmanager_core_network: The base_policy_region argument has been removed. Use base_policy_regions instead. Source for aws_networkmanager_core_network in v6.0.0

aws_paymentcryptography_key

• resource/aws_paymentcryptography_key: key_attributes and key_attributes.key_modes_of_use are now list nested blocks instead of single nested blocks. Source for aws_paymentcryptography_key in v6.0.0

aws_quicksight_data_set

• resource/aws_quicksight_data_set: tags_all has been removed Source for aws_quicksight_data_set in v6.0.0

aws_redshift_cluster

• resource/aws_redshift_cluster: Attributes cluster_public_key, cluster_revision_number, and endpoint are now read only and should not be set Source for aws_redshift_cluster in v6.0.0
• resource/aws_redshift_cluster: The logging attribute has been removed Source for aws_redshift_cluster in v6.0.0
• resource/aws_redshift_cluster: The publicly_accessible attribute now defaults to false Source for aws_redshift_cluster in v6.0.0
• resource/aws_redshift_cluster: The snapshot_copy attribute has been removed Source for aws_redshift_cluster in v6.0.0

aws_rekognition_stream_processor

• resource/aws_rekognition_stream_processor: regions_of_interest.bounding_box is now a list nested block instead of a single nested block Source for aws_rekognition_stream_processor in v6.0.0

aws_resiliencehub_resiliency_policy

• resource/aws_resiliencehub_resiliency_policy: policy, policy.az, policy.hardware, policy.software, and policy.region are now list nested blocks instead of single nested blocks Source for aws_resiliencehub_resiliency_policy in v6.0.0

aws_sagemaker_app_image_config

• resource/aws_sagemaker_app_image_config: Exactly one code_editor_app_image_config, jupyter_lab_image_config, or kernel_gateway_image_config block must be configured Source for aws_sagemaker_app_image_config in v6.0.0

aws_sagemaker_image_version

• resource/aws_sagemaker_image_version: id is now a comma-delimited string concatenating image_name and version Source for aws_sagemaker_image_version in v6.0.0

aws_sagemaker_notebook_instance

• resource/aws_sagemaker_notebook_instance: Remove accelerator_types from your configuration, it no longer exists. Instead, use instance_type to use Inferentia. Source for aws_sagemaker_notebook_instance in v6.0.0

aws_ssm_association

• resource/aws_ssm_association: Remove instance_id argument Source for aws_ssm_association in v6.0.0

aws_verifiedpermissions_schema

• resource/aws_verifiedpermissions_schema: definition is now a list nested block instead of a single nested block Source for aws_verifiedpermissions_schema in v6.0.0

aws_wafv2_web_acl

• resource/aws_wafv2_web_acl: rule.statement.managed_rule_group_statement.managed_rule_group_configs.aws_managed_rules_bot_control_rule_set.enable_machine_learning now defaults to false Source for aws_wafv2_web_acl in v6.0.0

Other changes

• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_application resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_custom_layer resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_ecs_cluster_layer resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_ganglia_layer resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_haproxy_layer resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_instance resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_java_app_layer resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_memcached_layer resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_mysql_layer resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_nodejs_app_layer resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_permission resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_php_app_layer resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_rails_app_layer resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_rds_db_instance resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_stack resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_static_web_layer resource has been removed Source for this change in v6.0.0
• provider: As the AWS OpsWorks Stacks service has reached End Of Life, the aws_opsworks_user_profile resource has been removed Source for this change in v6.0.0
• provider: As the AWS SDK for Go v2 does not support Amazon SimpleDB the aws_simpledb_domain resource has been removed. Add a constraint to v5 of the Terraform AWS Provider for continued use of this resource Source for this change in v6.0.0
• provider: As the AWS SDK for Go v2 does not support Amazon Worklink, the aws_worklink_fleet resource has been removed Source for this change in v6.0.0
• provider: As the AWS SDK for Go v2 does not support Amazon Worklink, the aws_worklink_website_certificate_authority_association resource has been removed Source for this change in v6.0.0
• provider: The aws_redshift_service_account resource has been removed. AWS recommends that a service principal name should be used instead of an AWS account ID in any relevant IAM policy Source for this change in v6.0.0
• provider: The endpoints.iotanalytics and endpoints.iotevents configuration arguments have been removed Source for this change in v6.0.0
• provider: The endpoints.opsworks configuration argument has been removed Source for this change in v6.0.0
• provider: The endpoints.simpledb and endpoints.sdb configuration arguments have been removed Source for this change in v6.0.0
• provider: The endpoints.worklink configuration argument has been removed Source for this change in v6.0.0

aws_s3_bucket_lifecycle_configuration

• resource/aws_s3_bucket_lifecycle_configuration: rule.noncurrent_version_expiration.noncurrent_days and rule.noncurrent_version_transition.noncurrent_days are Required Source for aws_s3_bucket_lifecycle_configuration in v5.90.0
• resource/aws_s3_bucket_lifecycle_configuration: rule.noncurrent_version_expiration.noncurrent_days and rule.noncurrent_version_transition.noncurrent_days are Required. Technically this is a breaking change, but failure to configure this attribute would have led to InvalidArgument or MalformedXML errors Source for aws_s3_bucket_lifecycle_configuration in v5.90.0

aws_api_gateway_stage

• resource/aws_api_gateway_stage: Add canary_settings.deployment_id attribute as required Source for aws_api_gateway_stage in v5.75.0
• resource/aws_api_gateway_stage: deployment_id was added to canary_settings as a required attribute. This breaking change was necessary to make canary_settings functional. Without this change all canary traffic was routed to the main deployment Source for aws_api_gateway_stage in v5.75.0

aws_lexv2models_slot_type

• resource/aws_lexv2models_slot_type: Within the composite_slot_type_setting block, the subslots argument has been renamed sub_slots. See the linked pull request for additional justification on this change. The previous misnaming effectively made this argument unusable, therefore a breaking change in a minor version was deemed acceptable. Source for aws_lexv2models_slot_type in v5.68.0

aws_lexv2models_slot_type

• resource/aws_lexv2models_slot_type: Within the value_selection_setting.advanced_recognition_setting block, the audio_recognition_setting argument has been renamed audio_recognition_strategy Source for aws_lexv2models_slot_type in v5.67.0
• resource/aws_lexv2models_slot_type: Within the value_selection_setting.advanced_recognition_setting block, the audio_recognition_setting argument has been renamed audio_recognition_strategy. See the linked pull request for additional justification on this change. The previous misnaming effectively made this argument unusable, therefore a breaking change in a minor version was deemed acceptable. Source for aws_lexv2models_slot_type in v5.67.0

• provider: This release includes an update to the AWS SDK for Go v2 with breaking type changes to several services: internetmonitor, ivschat, pipes, and s3. These changes primarily affect how arguments with default values are serialized for outbound requests, changing scalar types to pointers. See this AWS SDK for Go V2 issue for additional context. The corresponding provider changes should make this breakfix transparent to users, but as with any breaking change there is the potential for missed edge cases. If errors are observed in the impacted resources, please link to this dependency update pull request in the bug report Source for this change in v5.27.0

• provider: This release includes an update to the AWS SDK for Go v2 with breaking type changes to several services: finspace, kafka, medialive, rds, s3control, timestreamwrite, and xray. These changes primarily affect how arguments with default values are serialized for outbound requests, changing scalar types to pointers. See this AWS SDK for Go V2 issue for additional context. The corresponding provider changes should make this breakfix transparent to users, but as with any breaking change there is the potential for missed edge cases. If errors are observed in the impacted resources, please link to this dependency update pull request in the bug report. Source for this change in v5.23.0

aws_s3_bucket_object

• data-source/aws_s3_bucket_object: Following migration to AWS SDK for Go v2, the metadata attribute's keys are always returned in lowercase Source for aws_s3_bucket_object in v5.19.0

aws_s3_object

• data-source/aws_s3_object: Following migration to AWS SDK for Go v2, the metadata attribute's keys are always returned in lowercase Source for aws_s3_object in v5.19.0

aws_iam_role

• resource/aws_iam_role: The role_last_used attribute has been removed. Use the aws_iam_role data source instead. Source for aws_iam_role in v5.1.0
• resource/aws_iam_role: The role_last_used attribute has been removed. Use the aws_iam_role data source instead. See the community feedback provided in the linked issue for additional justification on this change. As the attribute is read-only, unlikely to be used as an input to another resource, and available in the corresponding data source, a breaking change in a minor version was deemed preferable to a long deprecation/removal cycle in this circumstance. Source for aws_iam_role in v5.1.0

aws_api_gateway_rest_api

• data-source/aws_api_gateway_rest_api: minimum_compression_size is now a string type to allow values set via the body attribute to be properly computed. Source for aws_api_gateway_rest_api in v5.0.0
• resource/aws_api_gateway_rest_api: minimum_compression_size is now a string type to allow values set via the body attribute to be properly computed. Source for aws_api_gateway_rest_api in v5.0.0

aws_connect_hours_of_operation

• data-source/aws_connect_hours_of_operation: The hours_of_operation_arn attribute has been removed Source for aws_connect_hours_of_operation in v5.0.0
• resource/aws_connect_hours_of_operation: The hours_of_operation_arn attribute has been removed Source for aws_connect_hours_of_operation in v5.0.0

aws_db_instance

• data-source/aws_db_instance: With the retirement of EC2-Classic the db_security_groups attribute has been removed Source for aws_db_instance in v5.0.0
• resource/aws_db_instance: Remove name - use db_name instead Source for aws_db_instance in v5.0.0
• resource/aws_db_instance: With the retirement of EC2-Classic the security_group_names attribute has been removed Source for aws_db_instance in v5.0.0
• resource/aws_db_instance: id is no longer the AWS database identifier - id is now the dbi-resource-id. Refer to identifier instead of id to use the database's identifier Source for aws_db_instance in v5.0.0

aws_elasticache_cluster

• data-source/aws_elasticache_cluster: With the retirement of EC2-Classic the security_group_names attribute has been removed Source for aws_elasticache_cluster in v5.0.0
• resource/aws_elasticache_cluster: With the retirement of EC2-Classic the security_group_names attribute has been removed Source for aws_elasticache_cluster in v5.0.0

aws_elasticache_replication_group

• data-source/aws_elasticache_replication_group: Remove number_cache_clusters, replication_group_description arguments -- use num_cache_clusters, and description, respectively, instead Source for aws_elasticache_replication_group in v5.0.0
• resource/aws_elasticache_replication_group: Remove availability_zones, number_cache_clusters, replication_group_description arguments -- use preferred_cache_cluster_azs, num_cache_clusters, and description, respectively, instead Source for aws_elasticache_replication_group in v5.0.0
• resource/aws_elasticache_replication_group: Remove cluster_mode configuration block -- use top-level num_node_groups and replicas_per_node_group instead Source for aws_elasticache_replication_group in v5.0.0

aws_iam_policy_document

• data-source/aws_iam_policy_document: Don't add empty statement.sid values to json attribute value Source for aws_iam_policy_document in v5.0.0
• data-source/aws_iam_policy_document: source_json and override_json have been removed -- use source_policy_documents and override_policy_documents, respectively, instead Source for aws_iam_policy_document in v5.0.0

aws_identitystore_group

• data-source/aws_identitystore_group: The filter argument has been removed Source for aws_identitystore_group in v5.0.0

aws_identitystore_user

• data-source/aws_identitystore_user: The filter argument has been removed Source for aws_identitystore_user in v5.0.0

aws_launch_configuration

• data-source/aws_launch_configuration: With the retirement of EC2-Classic the vpc_classic_link_id and vpc_classic_link_security_groups attributes have been removed Source for aws_launch_configuration in v5.0.0
• resource/aws_launch_configuration: With the retirement of EC2-Classic the vpc_classic_link_id and vpc_classic_link_security_groups attributes have been removed Source for aws_launch_configuration in v5.0.0

aws_redshift_cluster

• data-source/aws_redshift_cluster: With the retirement of EC2-Classic the cluster_security_groups attribute has been removed Source for aws_redshift_cluster in v5.0.0
• resource/aws_redshift_cluster: With the retirement of EC2-Classic the cluster_security_groups attribute has been removed Source for aws_redshift_cluster in v5.0.0

aws_secretsmanager_secret

• data-source/aws_secretsmanager_secret: The rotation_enabled, rotation_lambda_arn and rotation_rules attributes have been removed Source for aws_secretsmanager_secret in v5.0.0
• resource/aws_secretsmanager_secret: The rotation_enabled, rotation_lambda_arn and rotation_rules attributes have been removed Source for aws_secretsmanager_secret in v5.0.0

aws_vpc_peering_connection

• data-source/aws_vpc_peering_connection: With the retirement of EC2-Classic the allow_classic_link_to_remote_vpc and allow_vpc_to_remote_classic_link attributes have been removed Source for aws_vpc_peering_connection in v5.0.0
• resource/aws_vpc_peering_connection: With the retirement of EC2-Classic the allow_classic_link_to_remote_vpc and allow_vpc_to_remote_classic_link attributes have been removed Source for aws_vpc_peering_connection in v5.0.0

aws_acmpca_certificate_authority

• resource/aws_acmpca_certificate_authority: The status attribute has been removed Source for aws_acmpca_certificate_authority in v5.0.0

aws_autoscaling_attachment

• resource/aws_autoscaling_attachment: alb_target_group_arn has been removed -- use lb_target_group_arn instead Source for aws_autoscaling_attachment in v5.0.0

aws_autoscaling_group

• resource/aws_autoscaling_group: Remove deprecated tags attribute Source for aws_autoscaling_group in v5.0.0

aws_budgets_budget

• resource/aws_budgets_budget: The cost_filters attribute has been removed Source for aws_budgets_budget in v5.0.0

aws_ce_anomaly_subscription

• resource/aws_ce_anomaly_subscription: The threshold attribute has been removed Source for aws_ce_anomaly_subscription in v5.0.0

aws_cloudwatch_event_target

• resource/aws_cloudwatch_event_target: The ecs_target.propagate_tags attribute now has no default value Source for aws_cloudwatch_event_target in v5.0.0

aws_codebuild_project

• resource/aws_codebuild_project: The secondary_sources.auth and source.auth attributes have been removed Source for aws_codebuild_project in v5.0.0

aws_connect_queue

• resource/aws_connect_queue: The quick_connect_ids_associated attribute has been removed Source for aws_connect_queue in v5.0.0

aws_connect_routing_profile

• resource/aws_connect_routing_profile: The queue_configs_associated attribute has been removed Source for aws_connect_routing_profile in v5.0.0

aws_default_vpc

• resource/aws_default_vpc: With the retirement of EC2-Classic the enable_classiclink and enable_classiclink_dns_support attributes have been removed Source for aws_default_vpc in v5.0.0

aws_dms_endpoint

• resource/aws_dms_endpoint: s3_settings.ignore_headers_row has been removed Source for aws_dms_endpoint in v5.0.0

aws_docdb_cluster

• resource/aws_docdb_cluster: snapshot_identifier change now properly forces replacement Source for aws_docdb_cluster in v5.0.0

aws_ec2_client_vpn_endpoint

• resource/aws_ec2_client_vpn_endpoint: The status attribute has been removed Source for aws_ec2_client_vpn_endpoint in v5.0.0

aws_ec2_client_vpn_network_association

• resource/aws_ec2_client_vpn_network_association: The security_groups attribute has been removed Source for aws_ec2_client_vpn_network_association in v5.0.0
• resource/aws_ec2_client_vpn_network_association: The status attribute has been removed Source for aws_ec2_client_vpn_network_association in v5.0.0

aws_ecs_cluster

• resource/aws_ecs_cluster: The capacity_providers and default_capacity_provider_strategy attributes have been removed Source for aws_ecs_cluster in v5.0.0

aws_eip

• resource/aws_eip: With the retirement of EC2-Classic the standard domain is no longer supported Source for aws_eip in v5.0.0

aws_eip_association

• resource/aws_eip_association: With the retirement of EC2-Classic the standard domain is no longer supported Source for aws_eip_association in v5.0.0

aws_kinesis_firehose_delivery_stream

• resource/aws_kinesis_firehose_delivery_stream: Remove s3_configuration attribute from the root of the resource. s3_configuration is now a part of the following blocks: elasticsearch_configuration, opensearch_configuration, redshift_configuration, splunk_configuration, and http_endpoint_configuration Source for aws_kinesis_firehose_delivery_stream in v5.0.0
• resource/aws_kinesis_firehose_delivery_stream: Remove s3 as an option for destination. Use extended_s3 instead Source for aws_kinesis_firehose_delivery_stream in v5.0.0
• resource/aws_kinesis_firehose_delivery_stream: Rename extended_s3_configuration.0.s3_backup_configuration.0.buffer_size and extended_s3_configuration.0.s3_backup_configuration.0.buffer_interval to extended_s3_configuration.0.s3_backup_configuration.0.buffering_size and extended_s3_configuration.0.s3_backup_configuration.0.buffering_interval, respectively Source for aws_kinesis_firehose_delivery_stream in v5.0.0
• resource/aws_kinesis_firehose_delivery_stream: Rename redshift_configuration.0.s3_backup_configuration.0.buffer_size and redshift_configuration.0.s3_backup_configuration.0.buffer_interval to redshift_configuration.0.s3_backup_configuration.0.buffering_size and redshift_configuration.0.s3_backup_configuration.0.buffering_interval, respectively Source for aws_kinesis_firehose_delivery_stream in v5.0.0
• resource/aws_kinesis_firehose_delivery_stream: Rename s3_configuration.0.buffer_size and s3_configuration.0.buffer_internval to s3_configuration.0.buffering_size and s3_configuration.0.buffering_internval, respectively Source for aws_kinesis_firehose_delivery_stream in v5.0.0

aws_lightsail_instance

• resource/aws_lightsail_instance: The ipv6_address attribute has been removed Source for aws_lightsail_instance in v5.0.0

aws_medialive_multiplex_program

• resource/aws_medialive_multiplex_program: The statemux_settings attribute has been removed. Use statmux_settings argument instead Source for aws_medialive_multiplex_program in v5.0.0

aws_msk_cluster

• resource/aws_msk_cluster: The broker_node_group_info.ebs_volume_size attribute has been removed Source for aws_msk_cluster in v5.0.0

aws_neptune_cluster

• resource/aws_neptune_cluster: snapshot_identifier change now properly forces replacement Source for aws_neptune_cluster in v5.0.0

aws_networkmanager_core_network

• resource/aws_networkmanager_core_network: Removed policy_document argument -- use aws_networkmanager_core_network_policy_attachment resource instead Source for aws_networkmanager_core_network in v5.0.0

aws_rds_cluster

• resource/aws_rds_cluster: The engine argument is now required and has no default Source for aws_rds_cluster in v5.0.0
• resource/aws_rds_cluster: snapshot_identifier change now properly forces replacement Source for aws_rds_cluster in v5.0.0

aws_rds_cluster_instance

• resource/aws_rds_cluster_instance: The engine argument is now required and has no default Source for aws_rds_cluster_instance in v5.0.0

aws_route

• resource/aws_route: instance_id can no longer be set in configurations. Use network_interface_id instead, for example, setting network_interface_id to aws_instance.test.primary_network_interface_id. Source for aws_route in v5.0.0

aws_route_table

• resource/aws_route_table: route.*.instance_id can no longer be set in configurations. Use route.*.network_interface_id instead, for example, setting network_interface_id to aws_instance.test.primary_network_interface_id. Source for aws_route_table in v5.0.0

aws_security_group

• resource/aws_security_group: With the retirement of EC2-Classic non-VPC security groups are no longer supported Source for aws_security_group in v5.0.0

aws_security_group_rule

• resource/aws_security_group_rule: With the retirement of EC2-Classic non-VPC security groups are no longer supported Source for aws_security_group_rule in v5.0.0

aws_servicecatalog_product

• resource/aws_servicecatalog_product: Changes to any provisioning_artifact_parameters arguments now properly trigger a replacement. This fixes incorrect behavior, but may technically be breaking for configurations expecting non-functional in-place updates. Source for aws_servicecatalog_product in v5.0.0

aws_vpc

• resource/aws_vpc: With the retirement of EC2-Classic the enable_classiclink and enable_classiclink_dns_support attributes have been removed Source for aws_vpc in v5.0.0

aws_vpc_peering_connection_accepter

• resource/aws_vpc_peering_connection_accepter: With the retirement of EC2-Classic the allow_classic_link_to_remote_vpc and allow_vpc_to_remote_classic_link attributes have been removed Source for aws_vpc_peering_connection_accepter in v5.0.0

aws_vpc_peering_connection_options

• resource/aws_vpc_peering_connection_options: With the retirement of EC2-Classic the allow_classic_link_to_remote_vpc and allow_vpc_to_remote_classic_link attributes have been removed Source for aws_vpc_peering_connection_options in v5.0.0

aws_wafv2_web_acl

• resource/aws_wafv2_web_acl: The statement.managed_rule_group_statement.excluded_rule and statement.rule_group_reference_statement.excluded_rule attributes have been removed Source for aws_wafv2_web_acl in v5.0.0

aws_wafv2_web_acl_logging_configuration

• resource/aws_wafv2_web_acl_logging_configuration: The redacted_fields.all_query_arguments, redacted_fields.body and redacted_fields.single_query_argument attributes have been removed Source for aws_wafv2_web_acl_logging_configuration in v5.0.0

Other changes

• provider: The assume_role.duration_seconds, assume_role_with_web_identity.duration_seconds, s3_force_path_style, shared_credentials_file and skip_get_ec2_platforms attributes have been removed Source for this change in v5.0.0
• provider: The aws_subnet_ids data source has been removed Source for this change in v5.0.0
• provider: With the retirement of EC2-Classic the aws_db_security_group resource has been removed Source for this change in v5.0.0
• provider: With the retirement of EC2-Classic the aws_elasticache_security_group resource has been removed Source for this change in v5.0.0
• provider: With the retirement of EC2-Classic the aws_redshift_security_group resource has been removed Source for this change in v5.0.0
• provider: With the retirement of Macie Classic the aws_macie_member_account_association resource has been removed Source for this change in v5.0.0
• provider: With the retirement of Macie Classic the aws_macie_s3_bucket_association resource has been removed Source for this change in v5.0.0