v2.7.0

Summary

• Bumps TF AWS provider 6.55.0
• New managed resources across
  account, bedrock, bedrockagentcore, cloudwatchlogs, lambda and
  opensearchserverless API groups
• Bugfixes and enhancements and CVE remediations
• Bumps upjet v2.4.1-0.20260728103920-4f6e6e10dff2
• Bumps crossplane-runtime v2.3.3

---

⚠️ Breaking bugfix API changes

KeyPair.lightsail — status.atProvider.privateKey removed (#2136)

The upstream Terraform provider changed private_key on aws_lightsail_key_pair from a
regular attribute to a Sensitive attribute. Consequently:

• status.atProvider.privateKey is removed from the CRD
• The private key is now written to the connection details secret after creation
  instead.

The private key is only available at creation time and cannot be re-read from AWS.
Back up existing keys before upgrading, and make sure a
writeConnectionSecretToRef is configured for new
KeyPair resources.

Go module consumers: crossplane-runtime v2.3 changes (#2171)

All generated API types moved their common Crossplane types from
github.com/crossplane/crossplane-runtime/v2/apis/common/v1 to
github.com/crossplane/crossplane/apis/v2/core/v2. Every *Ref, *Selector,
*SecretRef and SecretKeySelector field changed its Go type
(v1.Reference → v2.Reference, v1.Selector → v2.Selector,
v1.SecretKeySelector → xpv2.SecretKeySelector, …).

This is not a CRD/YAML-level change — the schema is identical, so
existing manifests and stored objects are unaffected.
It is a notification for anyone importing this provider's apis/... packages in Go
(e.g. function or composition authors, custom controllers). Please update imports accordingly if needed.

⚠️ Field Deprecations (#2136)

Following fields still work but will be removed in the next major version as underlying TF
versions deprecated them. Use the new replacements on external consumers where possible.

Kind	Group	Deprecated field	Replacement
S3Endpoint	dms	spec.forProvider.kmsKeyArn	spec.forProvider.serverSideEncryptionKmsKeyId
SecretVersion	secretsmanager	status.atProvider.arn	status.atProvider.secretArn

Cluster.elasticache — valkey removed from spec.forProvider.engine (#2136)

valkey was never a valid engine for the Cluster resource; it was accepted by the CRD
enum but rejected by AWS. Aligned with the AWS SDK to avoid confusion
(see hashicorp/terraform-provider-aws#41181).
Valkey engines continue to be created via ReplicationGroup.elasticache or
ServerlessCache.elasticache.

---

🆕 New managed resources

Kind	Group	Terraform resource	PR
PrimaryContact	account	aws_account_primary_contact	#2181
Guardrail	bedrock	aws_bedrock_guardrail	#2152
Evaluator	bedrockagentcore	aws_bedrockagentcore_evaluator	#2143
Harness	bedrockagentcore	aws_bedrockagentcore_harness	#2143
OnlineEvaluationConfig	bedrockagentcore	aws_bedrockagentcore_online_evaluation_config	#2143
Policy	bedrockagentcore	aws_bedrockagentcore_policy	#2143
PolicyEngine	bedrockagentcore	aws_bedrockagentcore_policy_engine	#2143
ResourcePolicy	bedrockagentcore	aws_bedrockagentcore_resource_policy	#2143
AccountPolicy	cloudwatchlogs	aws_cloudwatch_log_account_policy	#2127
RuntimeManagementConfig	lambda	aws_lambda_runtime_management_config	#2164
CollectionGroup	opensearchserverless	aws_opensearchserverless_collection_group	#2160

---

🔼 Terraform AWS provider version bump

• #2136 — 6.34.0 → 6.53.0. The single largest change in this release; the
  KeyPair.lightsail, Cluster.elasticache, required→optional and deprecation items above
  all originate here. Also backports new fields into cluster-scoped v1beta1 APIs,
  configures singleton-list conversions for newly added nested blocks, and fixes example
  manifests the new provider version rejected (Broker.mq, Cluster.elasticache, kafka).
• #2151 — 6.53.0 → 6.55.0. Additive at the API level (no removed CRD properties, no
  new required-field rules, no new deprecations). Carries three fixes not implied by the
  title:
  • Table.dynamodb — in-place GSI/attribute updates no longer fail validation.
  • Broker.mq — a spurious empty shared_resources diff is dropped, preventing a no-op
    update.
  • SecurityConfig.opensearchserverless — samlOptions now uses a regular singleton-list
    conversion after TF 6.x switched it to a list-nested block. No CRD API change.
• #2176 — VaultLockConfiguration.backup now supports updates. The retention arguments
  are no longer ForceNew, so changing retention on an unlocked vault applies in place
  instead of looping on upjet's assertNoForceNew refusal (EXT-338). Adds
  status.atProvider.locked / lockDate and the first example manifests for this kind.
• #2177 — InstanceState.rds stopped → available transitions (fixes #2100).
  spec.forProvider.state can now bring a stopped RDS instance back up. Also adds the
  missing password secrets to the instancestate.yaml examples; Go bumped to 1.26.5.

---

🐞 Bug fixes

• #2185 — Streaming configuration propagation to DynamoDB global-table replicas in MRSC mode
  When streaming is enabled via spec.forProvider.streamEnabled: true in Table.dynamodb in
  MRSC mode, the configuration is now properly propagated to all the replica tables.
• #2182 — Perpetual diff on DB parameter groups when only applyMethod differs
  (fixes #1286, #1444). Affects ParameterGroup / ClusterParameterGroup in the rds,
  docdb and neptune groups: AWS silently ignores apply-method-only changes, so
  applyMethod never round-tripped. A shared custom diff now suppresses the parameter
  diff when all parameter changes are ApplyMethod-only; value changes and
  additions/removals are untouched.
• #2140 — Perpetual reconcile loop on LBListenerRule.elbv2 with action.forward.
  target_group_arn was late-inited into spec but stripped from state on the next Observe,
  producing a diff on every cycle. Fixed with a forced per-action late-init (which also
  backfills order and forward.stickiness) plus a custom diff that suppresses the
  resulting spurious ARN add/remove. Real user-driven ARN changes still apply.
• #2137 — Stale tag keys in status.atProvider.tags / tagsAll. A tag key removed from
  or renamed in spec.forProvider.tags kept appearing in status indefinitely. The external
  AWS resource was always correct — only observed state was wrong.
• #2117 — External-name oscillation on VPC endpoint associations (fixes #2116).
  aws_vpc_endpoint_subnet_association and aws_vpc_endpoint_route_table_association
  flipped the crossplane.io/external-name annotation between the Terraform ID and the
  import ID on every reconciliation, causing perpetual updates, delete/recreate cycles and
  AWS 429 throttling. Both forms are now derived deterministically from the named fields.
• #2122 — Conversion webhooks not served by non-leader replicas. Webhook registration
  was gated behind leader election, so followers could not serve conversion requests. It now
  happens eagerly on all pods, with reconciler setup still deferred to the leader.
• #2156 — Missing performanceInsightsKmsKeyId reference on RDS Instance/Cluster
  (fixes #2155). Adds the cross-resource reference to aws_kms_key (all versions, both
  scopes) with the generated Ref/Selector fields, plus KMS example manifests.

---

🔧 Upjet & crossplane-runtime bumps and their transitive effects

Directly consumed by changes in this release

• #678 — conversion webhook registration
  decoupled from leader election. Consumed by #2122.
• #693 — custom setup-aggregator and
  terraformed templates, plus the new Terraform.ResourceSchema template variable
  (replacing Terraform.SchemaVersion). Consumed by #2137 (tags fix) and #2140
  (forced late-init).
• #698 — Plugin Framework external client:
  fixes "Unexpected Identity Change" errors during Observe for Framework resources with
  Terraform resource identity, and makes external-name resolution error out when
  FrameworkResourceWithComputedIdentifier returns the placeholder stub instead of a real
  identifier. Relevant to the bedrockagentcore and opensearchserverless resources added
  here. Consumed by #2151.
• #664 — migrates common API imports to
  crossplane/apis/v2 for runtime 2.3.x. Consumed by #2171; this is the source of the
  Go-level v1.Reference → v2.Reference change described under Breaking changes.

Observable schema/behavior effects in the shipped CRDs

• #660 — SSA list-map markers are no longer
  emitted on observation (status.atProvider) fields. Visible in this release as
  LBListener.elbv2 status.atProvider.defaultAction losing x-kubernetes-list-type: map
  / x-kubernetes-list-map-keys: [index] and the injected index default. Removing those
  markers from a status field is schema-compatible; it stops server-side-apply from treating
  observed lists as associative maps.
• crossplane-runtime 2.3.x adds status.lastHandledReconcileAt to every MR CRD in the
  provider ("holds the value of the most recent reconcile-requested-at annotation token that
  the...

v2.6.0

Summary

This release includes security fixes, new AWS resources, bug fixes, and dependency updates.

Security Fixes

• Remediated critical vulnerabilities in golang.org/x/crypto (GO-2026-5006, GO-2026-5023, GO-2026-5017, GO-2026-5020, GO-2026-5005, GO-2026-5021, GO-2026-5019, GO-2026-5013, GO-2026-5018, GO-2026-5033, GO-2026-5014, GO-2026-5015, GO-2026-5016)
• Remediated vulnerabilities in golang.org/x/net (GO-2026-5026, GO-2026-4559, GO-2026-4918, GO-2026-5028, GO-2026-5025, GO-2026-5027, GO-2026-5029, GO-2026-5030)
• Remediated vulnerability in golang.org/x/sys (GO-2026-5024)
• Updated google.golang.org/grpc for security fixes
• Updated AWS SDK dependencies for security patches
• Updated go.opentelemetry.io/otel to v1.41.0

New Resources

• Capability.eks - EKS cluster capability management
• VPCConnection.kafka - MSK VPC connection support
• BucketAbac.s3 - S3 Bucket Attribute-Based Access Control
• VectorBucket.s3 - S3 vector database support
• VPCIPv6CidrBlockAssociation.ec2 - IPv6 CIDR block management for VPCs
• MultiRegionCluster.memorydb - MemoryDB multi-region cluster support
• MalwareProtectionPlan.guardduty - GuardDuty malware protection
• DBCluster.timestreaminfluxdb - Timestream for InfluxDB database cluster
• Monitor, Probe.networkmonitor - Network monitoring resources
• CapacityBlockReservation.ec2 - EC2 capacity block reservations

Enhancements

• Added ProviderConfig ReconciliationPolicy API for configurable exponential failure rate limiting
• Added reference fields for kmsKeyArn in Table.dynamodb
• Bumped Upjet to support Terraform Plugin Framework resources with Identity
• Updated to Crossplane Runtime v2.2.0 and controller-runtime v0.23.3
• Added API conversion roundtrip tests
• Bumped storage controller versions for multi-version CRDs

Bug Fixes

• Fixed update loop for route53.Record resource
• Fixed update loop for Table.dynamodb by adding CustomDiff
• Fixed airflowConfigurationOptions parameter in Environment.mwaa
• Fixed Function.lambda reconciliation loop when CodeSha256 is omitted
• Fixed ECS TaskDefinition cold-start observe with managementPolicies
• Fixed clustermode field backport for v1beta1 ReplicationGroup.elasticache
• Fixed data race on managed resource status

Dependency Updates

• Go: v1.25.9 → v1.25.11
• Alpine base image: v3.23.4
• Crossplane: v2.2.1
• Various GitHub Actions updates

v2.5.0

v2.5.0

This release bumps the underlying TF provider to v6.34.0 and includes new AWS resources, bug fixes, and infrastructure improvements.

⚠️ Breaking changes

• SerialConsoleAccess/ec2
  • spec.forProvider.regionis now a required parameter and this resource is region-aware.
• AccountAssignment/ssoadmin
  • spec.forProvider.targetType is now explicitly required at the MR API. This is technically not a breaking change and no change at the resource behavior, as it was always required to create the resource and was being validated during the external AWS call. The validation is now enforced earlier at the CRD-level, at admission time.

✨ New Resources

Following resources are added with version v1beta1 with both cluster-scoped and namespaced variants.

• Bedrock Agent Core
  • AgentRuntime/bedrockagentcore
  • AgentRuntimeEndpoint/bedrockagentcore
  • APIKeyCredentialProvider/bedrockagentcore
  • Browser/bedrockagentcore
  • CodeInterpreter/bedrockagentcore
  • Gateway/bedrockagentcore
  • GatewayTarget/bedrockagentcore
  • Memory/bedrockagentcore
  • MemoryStrategy/bedrockagentcore
  • Oauth2CredentialProvider/bedrockagentcore
  • TokenVaultCmk/bedrockagentcore
  • WorkloadIdentity/bedrockagentcore
• CloudFront
  • VPCOrigin/cloudfront
• CodeBuild
  • Project/codebuild
  • ReportGroup/codebuild
  • SourceCredential/codebuild
  • Webhook/codebuild
• ECR
  • RepositoryCreationTemplate/ecr
• EMR Containers
  • VirtualCluster/emrcontainers
• Route53 Resolver
  • QueryLogConfig/route53resolver
  • QueryLogConfigAssociation/route53resolver
• Route53 Profiles
  • Association/route53profiles
  • Profile/route53profiles
  • ResourceAssociation/route53profiles
• WAFv2
  • WebACLRuleGroupAssociation/wafv2

Non-Breaking field changes

• CapacityProvider/ecs
  • spec.forProvider.autoScalingGroupProvider becomes optional. Previously required; now supports the new managedInstancesProvider alternative introduced for ECS capacity providers.
• Proxy/rds
  • spec.forProvider.auth becomes optional. A new defaultAuthScheme argument was added, allowing proxy creation without explicitly specifying the auth block.
• Connector/transfer
  • spec.forProvider.url becomes optional. Required for standard connectors but not for the newly supported VPC Lattice connector type.
• WindowsFileSystem/fsx
  • spec.initProvider.selfManagedActiveDirectory.passwordSecretRef becomes optional. Upstream made both password and username optional/computed to support more flexible AD configurations.

🐛 Bug Fixes

• Following resources in apigateway group were operational but had oscillation with external names in different format and fixed. No behavior changes.
  • GatewayResponse/apigateway
  • Integration/apigateway
  • IntegrationResponse/apigateway
  • Method/apigateway
  • MethodResponse/apigateway
  • MethodSettings/apigateway
  • Stage/apigateway
• Fixed conversions for ReplicationGroup/elasticache v1beta2 (cluster-scoped)
• Fixed Cluster/redshift and Cluster.rds resource configurations (cluster-scoped)
• Fixed SerialConsoleAccess.ec2 resource to correctly handle regional behavior

⚙️ Enhancements

Cluster/memorydb: Added reference/selector fields for parameterGroupName, aclName and subnetGroupName parameters

🚧 Infrastructure Updates

• Bumped underlying Terraform provider version to v6.34.0
• Updated Go version to 1.25.8 and golangci-lint for compatibility
• Updated GH action CI workflow dependencies

v2.4.0

New Resources

• aws_vpc_endpoint_connection_accepter
• aws_oam_sink
• aws_route53_resolver_dnssec_config

Bug Fixes

• ecs.Service resource's update loop and external name configuration was fixed.
• For localstack configurations, use 12-digit fallback account ID instead of 9-digit.

What's Changed

• Add aws_vpc_endpoint_connection_accepter resource by @ey22 in #1935
• fix: use 12-digit fallback account ID by @viren-nadkarni in #1915
• Add aws_route53_resolver_dnssec_config resource by @ey22 in #1942
• Fix ecs.Service resource's external name configuration and update loop issue by @sergenyalcin in #1950
• Add aws_oam_sink resource by @ey22 in #1947

New Contributors

• @ey22 made their first contribution in #1935
• @viren-nadkarni made their first contribution in #1915

v2.3.0

The v2.3.0 release introduces a new resource, bug fixes, enhancements, and dependency updates.

• Bug fix: [Bug]: Module for v2 should include v2 #1928
• Bug fix: Fixes update loop of the mq.User by adding new plan modifiers #1934
• New Resource: Scraper.amp #1918
• CVE fixes and dependency updates
  • CVE-2025-47914
  • CVE-2025-58181

What's Changed

• Update actions/cache digest to 0057852 by @renovate[bot] in #1887
• upjet bump: remove deprecated OverrideFields from resource configurations by @erhancagirici in #1931
• Add Support for Scraper resource in amp provider by @nujragan93 in #1918
• update Go module to contain /v2 by @erhancagirici in #1928
• Bump go mod dependencies to fix CVEs by @turkenf in #1932
• conditionally select GHA runners by @jastang in #1881
• Consume latest mq.User update loop fix by @sergenyalcin in #1934

New Contributors

• @nujragan93 made their first contribution in #1918

Full Changelog: v2.2.0...v2.3.0

v2.2.0

The v2.2.0 release introduces new resources, bug fixes, enhancements, and dependency updates.

• Added a readiness check for the controller-manager Webhook server to ensure the provider’s conversion webhook is not marked as ready until the server is fully started #1880
• Fixed the race on the registered conversion paths in conversion.Convert crossplane/upjet#545
• Fixed: [Bug]: [Bug]: Unable to provision namespace-scoped RDS with passwordSecretRef defined #1855
• Fixed: [Bug]: [Bug]: Updating from 1.19.1 to 1.20.1 breaks lambda with older versions #1714
• Add EFS filesystem ID into the connection secret #1810

Support for New Resources

• Cluster.dsql
• ClusterPeering.dsql => This resource does not conform to XRM. Updates are not supported, and deletion is a no-op.
• ClusterPolicy.kafka
• Endpoint.verifiedaccess
• Group.verifiedaccess
• Instance.verifiedaccess
• InstanceLoggingConfiguration.verifiedaccess
• InstanceTrustProviderAttachment.verifiedaccess
• TrustProvider.verifiedaccess
• AccessLogSubscription.vpclattice
• AuthPolicy.vpclattice
• ListenerRule.vpclattice
• ResourcePolicy.vpclattice
• ServiceNetworkResourceAssociation.vpclattice
• ServiceNetworkServiceAssociation.vpclattice
• ServiceNetworkVPCAssociation.vpclattice
• TargetGroupAttachment.vpclattice

What's Changed

• Run uptest conditionally on oracle-vm-16cpu-64gb-x86-64 in crossplane-contrib repo by @ulucinar in #1884
• fix(owners): set correct mail-address by @haarchri in #1885
• Move myself to emeritus maintainer status by @mbbush in #1886
• Add webhook server readyz checker by @ulucinar in #1880
• Bump dependencies by @sergenyalcin in #1883
• Fix converted singleton lists in the generated example manifests by @ulucinar in #1888
• Bump build submodule to 4c898574f9ee55d16c2df2550fc723d4979c7d7b by @sergenyalcin in #1889
• Configure VerifiedAccess provider and add example by @larhauga in #1706
• Add EFS filesystem ID to connection secret by @ctenberge-oneid in #1810
• Add remaining VPCLattice resources and related examples by @mirrajabi in #1874
• Add erhancagirici as codeowner by @sergenyalcin in #1892
• fix: namespaced MR aware PasswordGenerator configuration by @sergenyalcin in #1890
• Remove TargetGroupAttachment target.id reference fields by @sergenyalcin in #1891
• Bump Go dependency github.com/crossplane/upjet/v2 to commit 8d73164bb9bd by @ulucinar in #1895
• Add support for kafka Cluster Policy resource by @turkenf in #1899
• Add ulucinar as codeowner by @sergenyalcin in #1902
• Add support for dsql(2) resources by @turkenf in #1900

New Contributors

• @ctenberge-oneid made their first contribution in #1810
• @mirrajabi made their first contribution in #1874

Full Changelog: v2.1.1...v2.2.0

v2.1.1

This release sets the metadata.uid and metadata.generation fields in effective provider configs to ensure correct cache key calculations when multiple IRSA provider configs with different role chains are used. It also fixes unnecessary diffs in the Route53 Record resource by ignoring trailing dots in record names, and a few improvements.

What's Changed

• examples: remove namespace from spec.writeConnectionSecretToRef for namespaced MRs by @erhancagirici in #1869
• fix: set UID and generation at effective provider config by @erhancagirici in #1871
• Bump uptest to v2 by @sergenyalcin in #1872
• fix: ignore diff for trailing dots in Record.route53 names by @erhancagirici in #1877

Full Changelog: v2.1.0...v2.1.1

v2.1.0

The v2.1.0 release introduces the Terraform provider upgrade from 6.3.0 to 6.13.0, new resources, bug fixes, enhancements, and dependency updates.

Support for New Resources

• CatalogTableOptimizer.glue.aws.upbound.io/v1beta1
• ResourceGateway.vpclattice.aws.upbound.io/v1beta1
• ResourceConfiguration.vpclattice.aws.upbound.io/v1beta1
• Listener.vpclattice.aws.upbound.io/v1beta1
• ServiceNetwork.vpclattice.aws.upbound.io/v1beta1
• TargetGroup.vpclattice.aws.upbound.io/v1beta1

Bug Fixes

• [Bug]: provider-aws-glue v1.5.0 doesn't create the partition index
• [Bug]: RDS instances not syncing due to wrong AZ in spec
• [Bug]: FSX Ontap Filesystem update fails after changing storage capacity

API Change

• ec2.SpotInstanceRequest: the networkCardIndex field has been removed from the networkInterface block in both forProvider and initProvider, aligning with upstream Terraform AWS provider changes. This fixes an issue where AWS rejected spot instance requests including this field and aligns with the AWS API behavior.

What's Changed

• fix: add namespaced APIs to AWS global groups by @erhancagirici in #1841
• chore(ci): update github runners to oci gh arc runners by @koksay in #1838
• Glue: Add glue catalog table optimizer by @stevendborrelli in #1797
• Update actions/checkout action to v5 by @renovate[bot] in #1837
• Fix Elasticache ReplicationGroup conversion from v1beta2 to v1beta1 by @walt-grata in #1847
• Nest examples by API group for building images by @jastang in #1856
• Update custom diff for partition_index in glue CatalogTable by @turkenf in #1848
• Ignore lateinitialize for availability_zone field in rds instance resource by @turkenf in #1861
• Bump Terraform provider version to v6.13.0 by @turkenf in #1864
• fix(fsx): ignore DiskIopsConfiguration in late initialization to prevent conflicts by @kaessert in #1827
• Configure vpclattice(5) resources and add examples by @turkenf in #1867
• Use a wildcard for Make variable SUBPACKAGES to represent all family packages by @ulucinar in #1868
• fix: remove namespace from writeConnectionSecretToRef examples by @cz4rny in #1863

New Contributors

• @koksay made their first contribution in #1838
• @walt-grata made their first contribution in #1847
• @kaessert made their first contribution in #1827
• @cz4rny made their first contribution in #1863

Full Changelog: v2.0.0...v2.1.0

v2.0.0

Release v2.0.0

Caution

This release introduces breaking changes and significant internal upgrades. Please review the release notes thoroughly, make the necessary changes to your manifests, and test thoroughly before upgrading.

Before using any Crossplane v2 capabilities in the provider, we encourage you to familiarize yourself with the changes in v2.

This release introduces:

• Compatibility with Crossplane v2
• Support for Crossplane v2 namespace-scoped Managed Resources (MRs) alongside existing cluster-scoped MRs.
• Upgrade to crossplane-runtime v2.0.0.
• Upgrade to Upjet v2.0.0.
• Upgrade of the underlying Terraform AWS provider to v6.3.0, introducing resource-level API changes.
• Removal of External Secret Store support.

Please review the breaking changes carefully before upgrading.

Breaking API Changes

Warning

Make adjustments to any impacted resources in your Control Plane when upgrading to this provider version.

The following resources have changed due to the underlying Terraform provider upgrade to version v6.3.0:

Deprecated Resources

• Pipeline.elastictranscoder.aws.upbound.io/v1beta1
• Pipeline.elastictranscoder.aws.upbound.io/v1beta2
• Preset.elastictranscoder.aws.upbound.io/v1beta1
• Preset.elastictranscoder.aws.upbound.io/v1beta2
• Feature.evidently.aws.upbound.io/v1beta1
• Feature.evidently.aws.upbound.io/v1beta2
• Project.evidently.aws.upbound.io/v1beta1
• Project.evidently.aws.upbound.io/v1beta2
• Segment.evidently.aws.upbound.io/v1beta1

Removed Providers & Resources

• The opsworks and simpledb providers were removed in this release, along with all resources belonging to these providers.

Resource base changes

• AlternateContact.account.aws.upbound.io/v1beta1:
  • spec.forProvider.region has been removed.
• Regions.account.aws.upbound.io/v1beta1:
  • spec.forProvider.region has been removed.
• Account.apigateway.aws.upbound.io/v1beta1:
  • spec.forProvider.resetOnDelete has been removed.
  • spec.initProvider.resetOnDelete has been removed.
  • spec.atProvider.resetOnDelete has been removed.
• Deployment.apigateway.aws.upbound.io/v1beta1:
  • spec.forProvider.canarySettings has been removed.
  • spec.forProvider.stageDescription has been removed.
  • spec.forProvider.stageName has been removed.
  • spec.initProvider.canarySettings has been removed.
  • spec.initProvider.stageDescription has been removed.
  • spec.initProvider.stageName has been removed.
  • spec.atProvider.canarySettings has been removed.
  • spec.atProvider.executionArn has been removed.
  • spec.atProvider.invokeUrl has been removed.
  • spec.atProvider.stageDescription has been removed.
  • spec.atProvider.stageName has been removed.
• GlobalSettings.backup.aws.upbound.io/v1beta1:
  • spec.forProvider.region has been removed.
• JobQueues.batch.aws.upbound.io/v1beta1:
  • spec.forProvider.computeEnvironments has been removed.
  • spec.initProvider.computeEnvironments has been removed.
  • spec.atProvider.computeEnvironments has been removed.
• BudgetActions.budgets.aws.upbound.io/v1beta1 and v1beta2:
  • spec.forProvider.region has been removed.
• Budgets.budgets.aws.upbound.io/v1beta1 and v1beta2:
  • spec.forProvider.region has been removed.
• AnomalyMonitor.ce.aws.upbound.io/v1beta1:
  • spec.forProvider.region has been removed.
• For all cloudfront.aws.upbound.io resources:
  • spec.forProvider.region has been removed.
• ResponseHeadersPolicy.cloudfront.aws.upbound.io/v1beta1:
  • spec.forProvider.etag has been removed.
  • spec.initProvider.region has been removed.
• DomainPermissionsPolicy.codeartifact.aws.upbound.io/v1beta1:
  • spec.forProvider.policyDocument is not required anymore.
• User.connect.aws.upbound.io/v1beta1:
  • spec.forProvider.securityProfileIds is not required anymore.
• ReportDefinition.cur.aws.upbound.io/v1beta1:
  • spec.forProvider.region has been removed.
  • spec.forProvider.s3Prefix is required now.
• GatewayAssociation.directconnect.aws.upbound.io/v1beta1:
  • spec.forProvider.vpnGatewayId has been removed.
  • spec.initProvider.vpnGatewayId has been removed.
  • spec.atProvider.vpnGatewayId has been removed.
• Gateway.directconnect.aws.upbound.io/v1beta1:
  • spec.forProvider.region has been removed.
• Endpoint.dms.aws.upbound.io/v1beta1 and v1beta2:
  • spec.forProvider.s3Settings has been removed.
  • spec.initProvider.s3Settings has been removed.
  • spec.atProvider.s3Settings has been removed.
• EIP.ec2.aws.upbound.io/v1beta1:
  • spec.forProvider.vpc has been removed.
  • spec.initProvider.vpc has been removed.
  • spec.atProvider.vpc has been removed.
• FlowLog.ec2.aws.upbound.io/v1beta1 and v1beta2:
  • spec.forProvider.logGroupName has been removed.
  • spec.initProvider.logGroupName has been removed.
  • spec.atProvider.logGroupName has been removed.
• Instance.ec2.aws.upbound.io/v1beta1 and v1beta2:
  • spec.forProvider.cpuCoreCount has been removed.
  • spec.forProvider.cpuThreadsPerCore has been removed.
  • spec.initProvider.cpuCoreCount has been removed.
  • spec.initProvider.cpuThreadsPerCore has been removed.
  • spec.atProvider.cpuCoreCount has been removed.
  • spec.atProvider.cpuThreadsPerCore has been removed.
• LaunchTemplate.ec2.aws.upbound.io/v1beta1 and v1beta2:
  • spec.forProvider.elasticGpuSpecifications has been removed.
  • spec.forProvider.elasticInferenceAccelerator has been removed.
  • spec.initProvider.elasticGpuSpecifications has been removed.
  • spec.initProvider.elasticInferenceAccelerator has been removed.
  • spec.atProvider.elasticGpuSpecifications has been removed.
  • spec.atProvider.elasticInferenceAccelerator has been removed.
• SerialConsoleAccess.ec2.aws.upbound.io/v1beta1:
  • spec.forProvider.region has been removed.
• SpotInstanceRequest.ec2.aws.upbound.io/v1beta1 and v1beta2:
  • spec.forProvider.blockDurationMinutes has been removed.
  • spec.forProvider.cpuCoreCount has been removed.
  • spec.forProvider.cpuThreadsPerCore has been removed.
  • spec.initProvider.blockDurationMinutes has been removed.
  • spec.initProvider.cpuCoreCount has been removed.
  • spec.initProvider.cpuThreadsPerCore has been removed.
  • spec.atProvider.blockDurationMinutes has been removed.
  • spec.atProvider.cpuCoreCount has been removed.
  • spec.atProvider.cpuThreadsPerCore has been removed.
• Service.ecs.aws.upbound.io/v1beta1:
  • spec.forProvider.managedEbsVolume has been removed.
  • spec.forProvider.name has been removed.
  • spec.forProvider.volumeConfiguration object type changed to list.
  • spec.initProvider.managedEbsVolume has been removed.
  • spec.initProvider.name has been removed.
  • spec.initProvider.volumeConfiguration object type changed to list.
  • spec.atProvider.managedEbsVolume has been removed.
  • spec.atProvider.name has been removed.
  • spec.atProvider.volumeConfiguration object type changed to list.
• TaskDefinition.ecs.aws.upbound.io/v1beta1 and v1beta2:
  • spec.forProvider.inferenceAccelerator has been removed.
  • spec.initProvider.inferenceAccelerator has been removed.
  • spec.atProvider.inferenceAccelerator has been removed.
• Addon.eks.aws.upbound.io/v1beta1:
  • spec.forProvider.resolveConflicts has been removed.
  • spec.initProvider.resolveConflicts has been removed.
  • spec.atProvider.resolveConflicts has been removed.
• LustreFileSystem.fsx.aws.upbound.io/v1beta1:
  • spec.forProvider.iops has been removed.
  • spec.forProvider.mode has been removed.
  • spec.forProvider.metadataConfiguration object type changed to list.
  • spec.initProvider.iops has been removed.
  • spec.initProvider.mode has been removed.
  • spec.initProvider.metadataConfiguration object type changed to list.
  • spec.atProvider.iops has been removed.
  • spec.atProvider.mode has been removed.
  • spec.atProvider.metadataConfiguration object type changed to list.
• For all globalaccelerator.aws.upbound.io resources:
  • spec.forProvider.region has been removed.
• LayerVersionPermission.lambda.aws.upbound.io/v1beta1:
  • spec.forProvider.layerName is not required anymore.
  • spec.forProvider.versionNumber is not required anymore.
• For all networkmanager.aws.upbound.io resources:
  • spec.forProvider.region has been removed.
• CoreNetwork.networkmanager.aws.upbound.io/v1beta1:
  • spec.forProvider.basePolicyRegion has been removed.
  • spec.initProvider.basePolicyRegion has been removed.
  • spec.atProvider.basePolicyRegion has been removed.
• Domain.opensearch.aws.upbound/v1beta1 and v1beta2:
  • spec.atProvider.kibanaEndpoint has been removed.
• SecurityConfig.opensearchserverless.aws.upbound/v1beta1:
  • spec.forProvider.samlOptions is not required anymore.
• For all organizations.aws.upbound.io resources:
  • spec.forProvider.region has been removed.
• Cluster.redshift.aws.upbound.io/v1beta1:
  • spec.forProvider.clusterPublicKey has been removed.
  • spec.forProvider.clusterRevisionNumber has been removed.
  • spec.forProvider.endpoint has been removed.
  • spec.forProvider.logging has been removed.
  • spec.forProvider.snapshotCopy has been removed.
  • spec.forProvider.encrypted bool type changed to string.
  • `spec.initProvider.cluste...

v1.23.0

The 1.23.0 release introduces new resources, bug fixes, security fixes, and dependency updates.

Support for New Resources

• InstanceState.rds.aws.upbound.io/v1beta1
• QueryLog.route53.aws.upbound.io/v1beta1

What's Changed

• Update actions/setup-go action to v5.5.0 by @renovate in #1782
• Fix update loop in backup selection resource and add an example by @turkenf in #1793
• Configure the route53 QueryLog resource and add an example by @turkenf in #1800
• RDS: Add support for InstanceState by @ytsarev in #1794
• Update module github.com/cloudflare/circl to v1.6.1 [SECURITY] by @renovate in #1802

Full Changelog: v1.22.0...v1.23.0