New Action: aws_dynamodb_create_backup (#45001)
New Resource: aws_networkflowmonitor_monitor (#44782)
New Resource: aws_networkflowmonitor_scope (#44782)
New Resource: aws_observabilityadmin_centralization_rule_for_organization (#44806)

ENHANCEMENTS:

data-source/aws_ecs_service: Add capacity_provider_strategy, created_at, created_by, deployment_configuration, deployment_controller, deployments, enable_ecs_managed_tags, enable_execute_command, events, health_check_grace_period_seconds, iam_role, network_configuration, ordered_placement_strategy, pending_count, placement_constraints, platform_family, platform_version, propagate_tags, running_count, service_connect_configuration, service_registries, status, and task_sets attributes (#44842)
resource/aws_bedrockagentcore_gateway_target: Add target_configuration.mcp.mcp_server block (#44991)
resource/aws_bedrockagentcore_gateway_target: Make credential_provider_configuration block optional (#44991)
resource/aws_cloudwatch_log_delivery_destination: Make delivery_destination_type and delivery_destination_configuration optional to support AWS X-Ray as a destination (#44995)
resource/aws_ecs_service: Add support for LINEAR and CANARY deployment strategies with deployment_configuration.linear_configuration and deployment_configuration.canary_configuration blocks (#44842)
resource/aws_lambda_function: Add support for java25 runtime value (#45024)
resource/aws_lambda_function: Add support for nodejs24.x runtime value (#45024)
resource/aws_lambda_function: Add support for python3.14 runtime value (#45024)
resource/aws_lambda_layer_version: Add support for java25 compatible_runtimes value (#45024)
resource/aws_lambda_layer_version: Add support for nodejs24.x compatible_runtimes value (#45024)
resource/aws_lambda_layer_version: Add support for python3.14 compatible_runtimes value (#45024)
resource/aws_s3tables_table: Add tagging support (#44996)
resource/aws_s3tables_table_bucket: Add tagging support (#44996)
resource/aws_sagemaker_endpoint_configuration: Add execution_role_arn argument and make model_name optional in production_variants and shadow_production_variants blocks to support Inference Components (#44977)
resource/aws_sns_topic: Fix AuthorizationError ... is not authorized to perform: iam:PassRole on resource ... IAM eventual consistency errors on Create and Update (#45018)

BUG FIXES:

provider: Fix situation where refreshes of removed infrastructure appear as errors rather than warnings (#45022)
resource/aws_apprunner_service: Prevents error when upgrading from provider pre-v6.0 without refreshing (#45050)
resource/aws_apprunner_service: Prevents error when upgrading from provider pre-v6.0 without refreshing (#45051)
resource/aws_ec2_image_block_public_access: Add region argument (#45023)
resource/aws_ec2_serial_console_access: Add region argument (#45064)
resource/aws_emrcontainers_job_template: Fix ValidationException: Value null at 'jobTemplateData.configurationOverrides.monitoringConfiguration.cloudWatchMonitoringConfiguration.logGroupName' failed to satisfy constraint: Member must not be null error (#45029)
resource/aws_emrcontainers_job_template: Fix setting job_template_data: job_template_data.0.configuration_overrides.0.application_configuration.0: '' expected a map, got 'slice' error (#45029)
resource/aws_emrcontainers_job_template: Mark job_template_data.job_driver.configuration_overrides.monitoring_configuration.persistent_app_ui argument as computed (#45029)
resource/aws_invoicing_invoice_unit: Fix Provider returned invalid result object after apply error occurred when updating the resource (#45030)
resource/aws_opensearch_authorize_vpc_endpoint_access: Fix reading the resource when more than one principal is authorized. The import ID has changed from domain_name to domain_name and account separated by a comma (#44982)
resource/aws_redshift_cluster: Prevents errors with empty tag values. (#44952)
resource/aws_redshift_cluster_snapshot: Prevents errors with empty tag values. (#44952)
resource/aws_redshift_event_subscription: Prevents errors with empty tag values. (#44952)
resource/aws_redshift_hsm_client_certificate: Prevents errors with empty tag values. (#44952)
resource/aws_redshift_hsm_configuration: Prevents errors with empty tag values. (#44952)
resource/aws_redshift_integration: Prevents errors with empty tag values. (#44952)
resource/aws_redshift_parameter_group: Prevents errors with empty tag values. (#44952)
resource/aws_redshift_snapshot_copy_grant: Prevents errors with empty tag values. (#44952)
resource/aws_redshift_snapshot_schedule: Prevents errors with empty tag values. (#44952)
resource/aws_redshift_subnet_group: Prevents errors with empty tag values. (#44952)
resource/aws_redshift_usage_limit: Prevents errors with empty tag values. (#44952)
resource/aws_sagemaker_endpoint: Fix bug where endpoint_config_name was not correctly updated, causing the endpoint to retain the old configuration (#42843)
resource/aws_wafv2_web_acl_logging_configuration: Fix the validation for redacted_fields.single_header.name (#44987)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [aws](https://registry.terraform.io/providers/hashicorp/aws) ([source](https://github.com/hashicorp/terraform-provider-aws)) | required_provider | minor | `6.20.0` -> `6.21.0` | --- ### Release Notes <details> <summary>hashicorp/terraform-provider-aws (aws)</summary> ### [`v6.21.0`](https://github.com/hashicorp/terraform-provider-aws/blob/HEAD/CHANGELOG.md#6210-November-13-2025) [Compare Source](https://github.com/hashicorp/terraform-provider-aws/compare/v6.20.0...v6.21.0) BREAKING CHANGES: - resource/aws\_bedrockagentcore\_browser: Rename `network_configuration.network_mode_config` to `network_configuration.vpc_config` ([#44828](https://github.com/hashicorp/terraform-provider-aws/issues/44828)) FEATURES: - **New Action:** `aws_dynamodb_create_backup` ([#45001](https://github.com/hashicorp/terraform-provider-aws/issues/45001)) - **New Resource:** `aws_networkflowmonitor_monitor` ([#44782](https://github.com/hashicorp/terraform-provider-aws/issues/44782)) - **New Resource:** `aws_networkflowmonitor_scope` ([#44782](https://github.com/hashicorp/terraform-provider-aws/issues/44782)) - **New Resource:** `aws_observabilityadmin_centralization_rule_for_organization` ([#44806](https://github.com/hashicorp/terraform-provider-aws/issues/44806)) ENHANCEMENTS: - data-source/aws\_ecs\_service: Add `capacity_provider_strategy`, `created_at`, `created_by`, `deployment_configuration`, `deployment_controller`, `deployments`, `enable_ecs_managed_tags`, `enable_execute_command`, `events`, `health_check_grace_period_seconds`, `iam_role`, `network_configuration`, `ordered_placement_strategy`, `pending_count`, `placement_constraints`, `platform_family`, `platform_version`, `propagate_tags`, `running_count`, `service_connect_configuration`, `service_registries`, `status`, and `task_sets` attributes ([#44842](https://github.com/hashicorp/terraform-provider-aws/issues/44842)) - resource/aws\_bedrockagentcore\_gateway\_target: Add `target_configuration.mcp.mcp_server` block ([#44991](https://github.com/hashicorp/terraform-provider-aws/issues/44991)) - resource/aws\_bedrockagentcore\_gateway\_target: Make `credential_provider_configuration` block optional ([#44991](https://github.com/hashicorp/terraform-provider-aws/issues/44991)) - resource/aws\_cloudwatch\_log\_delivery\_destination: Make `delivery_destination_type` and `delivery_destination_configuration` optional to support AWS X-Ray as a destination ([#44995](https://github.com/hashicorp/terraform-provider-aws/issues/44995)) - resource/aws\_ecs\_service: Add support for `LINEAR` and `CANARY` deployment strategies with `deployment_configuration.linear_configuration` and `deployment_configuration.canary_configuration` blocks ([#44842](https://github.com/hashicorp/terraform-provider-aws/issues/44842)) - resource/aws\_lambda\_function: Add support for `java25` `runtime` value ([#45024](https://github.com/hashicorp/terraform-provider-aws/issues/45024)) - resource/aws\_lambda\_function: Add support for `nodejs24.x` `runtime` value ([#45024](https://github.com/hashicorp/terraform-provider-aws/issues/45024)) - resource/aws\_lambda\_function: Add support for `python3.14` `runtime` value ([#45024](https://github.com/hashicorp/terraform-provider-aws/issues/45024)) - resource/aws\_lambda\_layer\_version: Add support for `java25` `compatible_runtimes` value ([#45024](https://github.com/hashicorp/terraform-provider-aws/issues/45024)) - resource/aws\_lambda\_layer\_version: Add support for `nodejs24.x` `compatible_runtimes` value ([#45024](https://github.com/hashicorp/terraform-provider-aws/issues/45024)) - resource/aws\_lambda\_layer\_version: Add support for `python3.14` `compatible_runtimes` value ([#45024](https://github.com/hashicorp/terraform-provider-aws/issues/45024)) - resource/aws\_s3tables\_table: Add tagging support ([#44996](https://github.com/hashicorp/terraform-provider-aws/issues/44996)) - resource/aws\_s3tables\_table\_bucket: Add tagging support ([#44996](https://github.com/hashicorp/terraform-provider-aws/issues/44996)) - resource/aws\_sagemaker\_endpoint\_configuration: Add `execution_role_arn` argument and make `model_name` optional in `production_variants` and `shadow_production_variants` blocks to support Inference Components ([#44977](https://github.com/hashicorp/terraform-provider-aws/issues/44977)) - resource/aws\_sns\_topic: Fix `AuthorizationError ... is not authorized to perform: iam:PassRole on resource ...` IAM eventual consistency errors on Create and Update ([#45018](https://github.com/hashicorp/terraform-provider-aws/issues/45018)) BUG FIXES: - provider: Fix situation where refreshes of removed infrastructure appear as errors rather than warnings ([#45022](https://github.com/hashicorp/terraform-provider-aws/issues/45022)) - resource/aws\_apprunner\_service: Prevents error when upgrading from provider pre-v6.0 without refreshing ([#45050](https://github.com/hashicorp/terraform-provider-aws/issues/45050)) - resource/aws\_apprunner\_service: Prevents error when upgrading from provider pre-v6.0 without refreshing ([#45051](https://github.com/hashicorp/terraform-provider-aws/issues/45051)) - resource/aws\_ec2\_image\_block\_public\_access: Add `region` argument ([#45023](https://github.com/hashicorp/terraform-provider-aws/issues/45023)) - resource/aws\_ec2\_serial\_console\_access: Add `region` argument ([#45064](https://github.com/hashicorp/terraform-provider-aws/issues/45064)) - resource/aws\_emrcontainers\_job\_template: Fix `ValidationException: Value null at 'jobTemplateData.configurationOverrides.monitoringConfiguration.cloudWatchMonitoringConfiguration.logGroupName' failed to satisfy constraint: Member must not be null` error ([#45029](https://github.com/hashicorp/terraform-provider-aws/issues/45029)) - resource/aws\_emrcontainers\_job\_template: Fix `setting job_template_data: job_template_data.0.configuration_overrides.0.application_configuration.0: '' expected a map, got 'slice'` error ([#45029](https://github.com/hashicorp/terraform-provider-aws/issues/45029)) - resource/aws\_emrcontainers\_job\_template: Mark `job_template_data.job_driver.configuration_overrides.monitoring_configuration.persistent_app_ui` argument as computed ([#45029](https://github.com/hashicorp/terraform-provider-aws/issues/45029)) - resource/aws\_invoicing\_invoice\_unit: Fix `Provider returned invalid result object after apply` error occurred when updating the resource ([#45030](https://github.com/hashicorp/terraform-provider-aws/issues/45030)) - resource/aws\_opensearch\_authorize\_vpc\_endpoint\_access: Fix reading the resource when more than one principal is authorized. The [import ID](https://developer.hashicorp.com/terraform/language/block/import#id) has changed from `domain_name` to `domain_name` and `account` separated by a comma ([#44982](https://github.com/hashicorp/terraform-provider-aws/issues/44982)) - resource/aws\_redshift\_cluster: Prevents errors with empty tag values. ([#44952](https://github.com/hashicorp/terraform-provider-aws/issues/44952)) - resource/aws\_redshift\_cluster\_snapshot: Prevents errors with empty tag values. ([#44952](https://github.com/hashicorp/terraform-provider-aws/issues/44952)) - resource/aws\_redshift\_event\_subscription: Prevents errors with empty tag values. ([#44952](https://github.com/hashicorp/terraform-provider-aws/issues/44952)) - resource/aws\_redshift\_hsm\_client\_certificate: Prevents errors with empty tag values. ([#44952](https://github.com/hashicorp/terraform-provider-aws/issues/44952)) - resource/aws\_redshift\_hsm\_configuration: Prevents errors with empty tag values. ([#44952](https://github.com/hashicorp/terraform-provider-aws/issues/44952)) - resource/aws\_redshift\_integration: Prevents errors with empty tag values. ([#44952](https://github.com/hashicorp/terraform-provider-aws/issues/44952)) - resource/aws\_redshift\_parameter\_group: Prevents errors with empty tag values. ([#44952](https://github.com/hashicorp/terraform-provider-aws/issues/44952)) - resource/aws\_redshift\_snapshot\_copy\_grant: Prevents errors with empty tag values. ([#44952](https://github.com/hashicorp/terraform-provider-aws/issues/44952)) - resource/aws\_redshift\_snapshot\_schedule: Prevents errors with empty tag values. ([#44952](https://github.com/hashicorp/terraform-provider-aws/issues/44952)) - resource/aws\_redshift\_subnet\_group: Prevents errors with empty tag values. ([#44952](https://github.com/hashicorp/terraform-provider-aws/issues/44952)) - resource/aws\_redshift\_usage\_limit: Prevents errors with empty tag values. ([#44952](https://github.com/hashicorp/terraform-provider-aws/issues/44952)) - resource/aws\_sagemaker\_endpoint: Fix bug where `endpoint_config_name` was not correctly updated, causing the endpoint to retain the old configuration ([#42843](https://github.com/hashicorp/terraform-provider-aws/issues/42843)) - resource/aws\_wafv2\_web\_acl\_logging\_configuration: Fix the validation for `redacted_fields.single_header.name` ([#44987](https://github.com/hashicorp/terraform-provider-aws/issues/44987)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2025-11-13 21:07:25 +00:00