[dependabot]

Bumps the version-updates group with 1 update in the /infrastructure/bootstrap directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/live directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/alb directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/cache directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/database directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/ecr-cache directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/kms directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/networking directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/networking/modules/nacl directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/networking/modules/vpc-endpoint directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/parameters directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/security directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/service directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/storage directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/storage/modules/s3-bucket directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/storage/modules/shared-data-bucket directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/tasks directory: hashicorp/aws.
Bumps the version-updates group with 1 update in the /infrastructure/modules/tasks/modules/task directory: hashicorp/aws.

Updates hashicorp/aws from 6.66.0 to 6.67.0

Release notes

Sourced from hashicorp/aws's releases.

v6.67.0

6.67.0 (September 30, 2026)

NOTES:

• resource/aws_route53_record: Batched reads is experimental. The behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#48525)

FEATURES:

• New Ephemeral Resource: aws_bedrockruntime_apply_guardrail (#50155)
• New List Resource: aws_default_security_group (#50120)
• New List Resource: aws_directory_service_ip_route (#50138)
• New List Resource: aws_directoryservicedata_user (#50001)
• New List Resource: aws_ec2_transit_gateway_route_table_propagation (#50193)
• New Resource: aws_directory_service_ip_route (#50138)
• New Resource: aws_directory_service_ip_routes_exclusive (#50204)
• New Resource: aws_directoryservicedata_user (#50001)

ENHANCEMENTS:

• resource/aws_apprunner_custom_domain_association: Add validation to prevent trailing dot on domain_name (#50189)
• resource/aws_apprunner_custom_domain_association: Add validation to require enable_www_subdomain to be false for wildcard domain (#50189)
• resource/aws_bedrockagentcore_workload_identity: Add tags and tags_all attributes (#49746)
• resource/aws_bedrockagentcore_workload_identity: Add resource identity support (#49746)
• resource/aws_default_security_group: Add Resource Identity support (#50120)
• resource/aws_ec2_transit_gateway_route_table_propagation: Add Resource Identity support (#50193)
• resource/aws_route53_record: Add the TF_AWS_ROUTE53_RECORD_BATCH_READS environment variable to reduce AWS API calls when managing many records in a zone (#48525)
• resource/aws_sns_topic: Add maximum_message_size argument (#50111)

BUG FIXES:

• list-resource/aws_dynamodb_table_replica: Fix eventual consistency error when replacing resource. (#50133)
• resource/aws_apprunner_custom_domain_association: Populate dns_target when importing (#50206)
• resource/aws_autoscaling_group: Fix interface conversion: interface {} is nil, not map[string]interface {} panics when capacity_reservation_target is empty (#50084)
• resource/aws_bedrockagentcore_harness: Fix "inconsistent result after apply" when environment_variables is unset (#50088)
• resource/aws_config_aggregate_authorization: Fix region to authorized_aws_region migration incorrectly forcing resource replacement (#49851)
• resource/aws_rds_global_cluster: Wait for source cluster promotion to complete when source_db_cluster_identifier is specified, fixing race condition with downstream resources (#48076)

Changelog

Sourced from hashicorp/aws's changelog.

6.67.0 (September 30, 2026)

NOTES:

• resource/aws_route53_record: Batched reads is experimental. The behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#48525)

FEATURES:

• New Ephemeral Resource: aws_bedrockruntime_apply_guardrail (#50155)
• New List Resource: aws_default_security_group (#50120)
• New List Resource: aws_directory_service_ip_route (#50138)
• New List Resource: aws_directoryservicedata_user (#50001)
• New List Resource: aws_ec2_transit_gateway_route_table_propagation (#50193)
• New Resource: aws_directory_service_ip_route (#50138)
• New Resource: aws_directory_service_ip_routes_exclusive (#50204)
• New Resource: aws_directoryservicedata_user (#50001)

ENHANCEMENTS:

• resource/aws_apprunner_custom_domain_association: Add validation to prevent trailing dot on domain_name (#50189)
• resource/aws_apprunner_custom_domain_association: Add validation to require enable_www_subdomain to be false for wildcard domain (#50189)
• resource/aws_bedrockagentcore_workload_identity: Add tags and tags_all attributes (#49746)
• resource/aws_bedrockagentcore_workload_identity: Add resource identity support (#49746)
• resource/aws_default_security_group: Add Resource Identity support (#50120)
• resource/aws_ec2_transit_gateway_route_table_propagation: Add Resource Identity support (#50193)
• resource/aws_route53_record: Add the TF_AWS_ROUTE53_RECORD_BATCH_READS environment variable to reduce AWS API calls when managing many records in a zone (#48525)
• resource/aws_sns_topic: Add maximum_message_size argument (#50111)

BUG FIXES:

• list-resource/aws_dynamodb_table_replica: Fix eventual consistency error when replacing resource. (#50133)
• resource/aws_apprunner_custom_domain_association: Populate dns_target when importing (#50206)
• resource/aws_autoscaling_group: Fix interface conversion: interface {} is nil, not map[string]interface {} panics when capacity_reservation_target is empty (#50084)
• resource/aws_bedrockagentcore_harness: Fix "inconsistent result after apply" when environment_variables is unset (#50088)
• resource/aws_config_aggregate_authorization: Fix region to authorized_aws_region migration incorrectly forcing resource replacement (#49851)
• resource/aws_rds_global_cluster: Wait for source cluster promotion to complete when source_db_cluster_identifier is specified, fixing race condition with downstream resources (#48076)

Commits

• e449e05 chore: prepare v6.67.0 release (#50214)
• 1444675 Update CHANGELOG.md for #50204
• de921e3 Merge pull request #50204 from hashicorp/f-ds-ip-routes-exclusive
• 2c79a82 Merge pull request #50138 from hashicorp/f-ad-add-ip
• df82274 Merge remote-tracking branch 'origin/f-ad-add-ip' into f-ds-ip-routes-exclusive
• 886c0fa ds/ip_route: keep flatten a plain copy; preserve equivalent CIDR spelling in ...
• 80dd996 Update CHANGELOG.md for #50001
• 106ecf5 Merge remote-tracking branch 'origin/f-ad-add-ip' into f-ds-ip-routes-exclusive
• c948f4f Merge pull request #50001 from hashicorp/f-new-resource-aws_directoryserviced...
• 5ee8b00 ds/ip_routes_exclusive: use shared VPC test template
• Additional commits viewable in compare view

Updates hashicorp/aws from 6.66.0 to 6.67.0

Release notes

Sourced from hashicorp/aws's releases.

v6.67.0

6.67.0 (September 30, 2026)

NOTES:

• resource/aws_route53_record: Batched reads is experimental. The behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#48525)

FEATURES:

• New Ephemeral Resource: aws_bedrockruntime_apply_guardrail (#50155)
• New List Resource: aws_default_security_group (#50120)
• New List Resource: aws_directory_service_ip_route (#50138)
• New List Resource: aws_directoryservicedata_user (#50001)
• New List Resource: aws_ec2_transit_gateway_route_table_propagation (#50193)
• New Resource: aws_directory_service_ip_route (#50138)
• New Resource: aws_directory_service_ip_routes_exclusive (#50204)
• New Resource: aws_directoryservicedata_user (#50001)

ENHANCEMENTS:

• resource/aws_apprunner_custom_domain_association: Add validation to prevent trailing dot on domain_name (#50189)
• resource/aws_apprunner_custom_domain_association: Add validation to require enable_www_subdomain to be false for wildcard domain (#50189)
• resource/aws_bedrockagentcore_workload_identity: Add tags and tags_all attributes (#49746)
• resource/aws_bedrockagentcore_workload_identity: Add resource identity support (#49746)
• resource/aws_default_security_group: Add Resource Identity support (#50120)
• resource/aws_ec2_transit_gateway_route_table_propagation: Add Resource Identity support (#50193)
• resource/aws_route53_record: Add the TF_AWS_ROUTE53_RECORD_BATCH_READS environment variable to reduce AWS API calls when managing many records in a zone (#48525)
• resource/aws_sns_topic: Add maximum_message_size argument (#50111)

BUG FIXES:

• list-resource/aws_dynamodb_table_replica: Fix eventual consistency error when replacing resource. (#50133)
• resource/aws_apprunner_custom_domain_association: Populate dns_target when importing (#50206)
• resource/aws_autoscaling_group: Fix interface conversion: interface {} is nil, not map[string]interface {} panics when capacity_reservation_target is empty (#50084)
• resource/aws_bedrockagentcore_harness: Fix "inconsistent result after apply" when environment_variables is unset (#50088)
• resource/aws_config_aggregate_authorization: Fix region to authorized_aws_region migration incorrectly forcing resource replacement (#49851)
• resource/aws_rds_global_cluster: Wait for source cluster promotion to complete when source_db_cluster_identifier is specified, fixing race condition with downstream resources (#48076)

Changelog

Sourced from hashicorp/aws's changelog.

6.67.0 (September 30, 2026)

NOTES:

• resource/aws_route53_record: Batched reads is experimental. The behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#48525)

FEATURES:

• New Ephemeral Resource: aws_bedrockruntime_apply_guardrail (#50155)
• New List Resource: aws_default_security_group (#50120)
• New List Resource: aws_directory_service_ip_route (#50138)
• New List Resource: aws_directoryservicedata_user (#50001)
• New List Resource: aws_ec2_transit_gateway_route_table_propagation (#50193)
• New Resource: aws_directory_service_ip_route (#50138)
• New Resource: aws_directory_service_ip_routes_exclusive (#50204)
• New Resource: aws_directoryservicedata_user (#50001)

ENHANCEMENTS:

• resource/aws_apprunner_custom_domain_association: Add validation to prevent trailing dot on domain_name (#50189)
• resource/aws_apprunner_custom_domain_association: Add validation to require enable_www_subdomain to be false for wildcard domain (#50189)
• resource/aws_bedrockagentcore_workload_identity: Add tags and tags_all attributes (#49746)
• resource/aws_bedrockagentcore_workload_identity: Add resource identity support (#49746)
• resource/aws_default_security_group: Add Resource Identity support (#50120)
• resource/aws_ec2_transit_gateway_route_table_propagation: Add Resource Identity support (#50193)
• resource/aws_route53_record: Add the TF_AWS_ROUTE53_RECORD_BATCH_READS environment variable to reduce AWS API calls when managing many records in a zone (#48525)
• resource/aws_sns_topic: Add maximum_message_size argument (#50111)

BUG FIXES:

• list-resource/aws_dynamodb_table_replica: Fix eventual consistency error when replacing resource. (#50133)
• resource/aws_apprunner_custom_domain_association: Populate dns_target when importing (#50206)
• resource/aws_autoscaling_group: Fix interface conversion: interface {} is nil, not map[string]interface {} panics when capacity_reservation_target is empty (#50084)
• resource/aws_bedrockagentcore_harness: Fix "inconsistent result after apply" when environment_variables is unset (#50088)
• resource/aws_config_aggregate_authorization: Fix region to authorized_aws_region migration incorrectly forcing resource replacement (#49851)
• resource/aws_rds_global_cluster: Wait for source cluster promotion to complete when source_db_cluster_identifier is specified, fixing race condition with downstream resources (#48076)

Commits

• e449e05 chore: prepare v6.67.0 release (#50214)
• 1444675 Update CHANGELOG.md for #50204
• de921e3 Merge pull request #50204 from hashicorp/f-ds-ip-routes-exclusive
• 2c79a82 Merge pull request #50138 from hashicorp/f-ad-add-ip
• df82274 Merge remote-tracking branch 'origin/f-ad-add-ip' into f-ds-ip-routes-exclusive
• 886c0fa ds/ip_route: keep flatten a plain copy; preserve equivalent CIDR spelling in ...
• 80dd996 Update CHANGELOG.md for #50001
• 106ecf5 Merge remote-tracking branch 'origin/f-ad-add-ip' into f-ds-ip-routes-exclusive
• c948f4f Merge pull request #50001 from hashicorp/f-new-resource-aws_directoryserviced...
• 5ee8b00 ds/ip_routes_exclusive: use shared VPC test template
• Additional commits viewable in compare view

Updates hashicorp/aws from 6.66.0 to 6.67.0

Release notes

Sourced from hashicorp/aws's releases.

v6.67.0

6.67.0 (September 30, 2026)

NOTES:

• resource/aws_route53_record: Batched reads is experimental. The behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#48525)

FEATURES:

• New Ephemeral Resource: aws_bedrockruntime_apply_guardrail (#50155)
• New List Resource: aws_default_security_group (#50120)
• New List Resource: aws_directory_service_ip_route (#50138)
• New List Resource: aws_directoryservicedata_user (#50001)
• New List Resource: aws_ec2_transit_gateway_route_table_propagation (#50193)
• New Resource: aws_directory_service_ip_route (#50138)
• New Resource: aws_directory_service_ip_routes_exclusive (#50204)
• New Resource: aws_directoryservicedata_user (#50001)

ENHANCEMENTS:

• resource/aws_apprunner_custom_domain_association: Add validation to prevent trailing dot on domain_name (#50189)
• resource/aws_apprunner_custom_domain_association: Add validation to require enable_www_subdomain to be false for wildcard domain (#50189)
• resource/aws_bedrockagentcore_workload_identity: Add tags and tags_all attributes (#49746)
• resource/aws_bedrockagentcore_workload_identity: Add resource identity support (#49746)
• resource/aws_default_security_group: Add Resource Identity support (#50120)
• resource/aws_ec2_transit_gateway_route_table_propagation: Add Resource Identity support (#50193)
• resource/aws_route53_record: Add the TF_AWS_ROUTE53_RECORD_BATCH_READS environment variable to reduce AWS API calls when managing many records in a zone (#48525)
• resource/aws_sns_topic: Add maximum_message_size argument (#50111)

BUG FIXES:

• list-resource/aws_dynamodb_table_replica: Fix eventual consistency error when replacing resource. (#50133)
• resource/aws_apprunner_custom_domain_association: Populate dns_target when importing (#50206)
• resource/aws_autoscaling_group: Fix interface conversion: interface {} is nil, not map[string]interface {} panics when capacity_reservation_target is empty (#50084)
• resource/aws_bedrockagentcore_harness: Fix "inconsistent result after apply" when environment_variables is unset (#50088)
• resource/aws_config_aggregate_authorization: Fix region to authorized_aws_region migration incorrectly forcing resource replacement (#49851)
• resource/aws_rds_global_cluster: Wait for source cluster promotion to complete when source_db_cluster_identifier is specified, fixing race condition with downstream resources (#48076)

Changelog

Sourced from hashicorp/aws's changelog.

6.67.0 (September 30, 2026)

NOTES:

• resource/aws_route53_record: Batched reads is experimental. The behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#48525)

FEATURES:

• New Ephemeral Resource: aws_bedrockruntime_apply_guardrail (#50155)
• New List Resource: aws_default_security_group (#50120)
• New List Resource: aws_directory_service_ip_route (#50138)
• New List Resource: aws_directoryservicedata_user (#50001)
• New List Resource: aws_ec2_transit_gateway_route_table_propagation (#50193)
• New Resource: aws_directory_service_ip_route (#50138)
• New Resource: aws_directory_service_ip_routes_exclusive (#50204)
• New Resource: aws_directoryservicedata_user (#50001)

ENHANCEMENTS:

• resource/aws_apprunner_custom_domain_association: Add validation to prevent trailing dot on domain_name (#50189)
• resource/aws_apprunner_custom_domain_association: Add validation to require enable_www_subdomain to be false for wildcard domain (#50189)
• resource/aws_bedrockagentcore_workload_identity: Add tags and tags_all attributes (#49746)
• resource/aws_bedrockagentcore_workload_identity: Add resource identity support (#49746)
• resource/aws_default_security_group: Add Resource Identity support (#50120)
• resource/aws_ec2_transit_gateway_route_table_propagation: Add Resource Identity support (#50193)
• resource/aws_route53_record: Add the TF_AWS_ROUTE53_RECORD_BATCH_READS environment variable to reduce AWS API calls when managing many records in a zone (#48525)
• resource/aws_sns_topic: Add maximum_message_size argument (#50111)

BUG FIXES:

• list-resource/aws_dynamodb_table_replica: Fix eventual consistency error when replacing resource. (#50133)
• resource/aws_apprunner_custom_domain_association: Populate dns_target when importing (#50206)
• resource/aws_autoscaling_group: Fix interface conversion: interface {} is nil, not map[string]interface {} panics when capacity_reservation_target is empty (#50084)
• resource/aws_bedrockagentcore_harness: Fix "inconsistent result after apply" when environment_variables is unset (#50088)
• resource/aws_config_aggregate_authorization: Fix region to authorized_aws_region migration incorrectly forcing resource replacement (#49851)
• resource/aws_rds_global_cluster: Wait for source cluster promotion to complete when source_db_cluster_identifier is specified, fixing race condition with downstream resources (#48076)

Commits

• e449e05 chore: prepare v6.67.0 release (#50214)
• 1444675 Update CHANGELOG.md for #50204
• de921e3 Merge pull request #50204 from hashicorp/f-ds-ip-routes-exclusive
• 2c79a82 Merge pull request #50138 from hashicorp/f-ad-add-ip
• df82274 Merge remote-tracking branch 'origin/f-ad-add-ip' into f-ds-ip-routes-exclusive
• 886c0fa ds/ip_route: keep flatten a plain copy; preserve equivalent CIDR spelling in ...
• 80dd996 Update CHANGELOG.md for #50001
• 106ecf5 Merge remote-tracking branch 'origin/f-ad-add-ip' into f-ds-ip-routes-exclusive
• c948f4f Merge pull request #50001 from hashicorp/f-new-resource-aws_directoryserviced...
• 5ee8b00 ds/ip_routes_exclusive: use shared VPC test template
• Additional commits viewable in compare view

Updates hashicorp/aws from 6.66.0 to 6.67.0

Release notes

Sourced from hashicorp/aws's releases.

v6.67.0

6.67.0 (September 30, 2026)

NOTES:

• resource/aws_route53_record: Batched reads is experimental. The behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#48525)

FEATURES:

• New Ephemeral Resource: aws_bedrockruntime_apply_guardrail (#50155)
• New List Resource: aws_default_security_group (#50120)
• New List Resource: aws_directory_service_ip_route (#50138)
• New List Resource: aws_directoryservicedata_user (#50001)
• New List Resource: aws_ec2_transit_gateway_route_table_propagation (#50193)
• New Resource: aws_directory_service_ip_route (#50138)
• New Resource: aws_directory_service_ip_routes_exclusive (#50204)
• New Resource: aws_directoryservicedata_user (#50001)

ENHANCEMENTS:

• resource/aws_apprunner_custom_domain_association: Add validation to prevent trailing dot on domain_name (#50189)
• resource/aws_apprunner_custom_domain_association: Add validation to require enable_www_subdomain to be false for wildcard domain (#50189)
• resource/aws_bedrockagentcore_workload_identity: Add tags and tags_all attributes (#49746)
• resource/aws_bedrockagentcore_workload_identity: Add resource identity support (#49746)
• resource/aws_default_security_group: Add Resource Identity support (#50120)
• resource/aws_ec2_transit_gateway_route_table_propagation: Add Resource Identity support (#50193)
• resource/aws_route53_record: Add the TF_AWS_ROUTE53_RECORD_BATCH_READS environment variable to reduce AWS API calls when managing many records in a zone (#48525)
• resource/aws_sns_topic: Add maximum_message_size argument (#50111)

BUG FIXES:

• list-resource/aws_dynamodb_table_replica: Fix eventual consistency error when replacing resource. (#50133)
• resource/aws_apprunner_custom_domain_association: Populate dns_target when importing (#50206)
• resource/aws_autoscaling_group: Fix interface conversion: interface {} is nil, not map[string]interface {} panics when capacity_reservation_target is empty (#50084)
• resource/aws_bedrockagentcore_harness: Fix "inconsistent result after apply" when environment_variables is unset (#50088)
• resource/aws_config_aggregate_authorization: Fix region to authorized_aws_region migration incorrectly forcing resource replacement (#49851)
• resource/aws_rds_global_cluster: Wait for source cluster promotion to complete when source_db_cluster_identifier is specified, fixing race condition with downstream resources (#48076)

Changelog

Sourced from hashicorp/aws's changelog.

6.67.0 (September 30, 2026)

NOTES:

• resource/aws_route53_record: Batched reads is experimental. The behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#48525)

FEATURES:

• New Ephemeral Resource: aws_bedrockruntime_apply_guardrail (#50155)
• New List Resource: aws_default_security_group (#50120)
• New List Resource: aws_directory_service_ip_route (#50138)
• New List Resource: aws_directoryservicedata_user (#50001)
• New List Resource: aws_ec2_transit_gateway_route_table_propagation (#50193)
• New Resource: aws_directory_service_ip_route (#50138)
• New Resource: aws_directory_service_ip_routes_exclusive (#50204)
• New Resource: aws_directoryservicedata_user (#50001)

ENHANCEMENTS:

• resource/aws_apprunner_custom_domain_association: Add validation to prevent trailing dot on domain_name (#50189)
• resource/aws_apprunner_custom_domain_association: Add validation to require enable_www_subdomain to be false for wildcard domain (#50189)
• resource/aws_bedrockagentcore_workload_identity: Add tags and tags_all attributes (#49746)
• resource/aws_bedrockagentcore_workload_identity: Add resource identity support (#49746)
• resource/aws_default_security_group: Add Resource Identity support (#50120)
• resource/aws_ec2_transit_gateway_route_table_propagation: Add Resource Identity support (#50193)
• resource/aws_route53_record: Add the TF_AWS_ROUTE53_RECORD_BATCH_READS environment variable to reduce AWS API calls when managing many records in a zone (#48525)
• resource/aws_sns_topic: Add maximum_message_size argument (#50111)

BUG FIXES:

• list-resource/aws_dynamodb_table_replica: Fix eventual consistency error when replacing resource. (#50133)
• resource/aws_apprunner_custom_domain_association: Populate dns_target when importing (#50206)
• resource/aws_autoscaling_group: Fix interface conversion: interface {} is nil, not map[string]interface {} panics when capacity_reservation_target is empty (#50084)
• resource/aws_bedrockagentcore_harness: Fix "inconsistent result after apply" when environment_variables is unset (#50088)
• resource/aws_config_aggregate_authorization: Fix region to authorized_aws_region migration incorrectly forcing resource replacement (#49851)
• resource/aws_rds_global_cluster: Wait for source cluster promotion to complete when source_db_cluster_identifier is specified, fixing race condition with downstream resources (#48076)

Commits

• e449e05 chore: prepare v6.67.0 release (#50214)
• 1444675 Update CHANGELOG.md for #50204
• de921e3 Merge pull request #50204 from hashicorp/f-ds-ip-routes-exclusive
• 2c79a82 Merge pull request #50138 from hashicorp/f-ad-add-ip
• df82274 Merge remote-tracking branch 'origin/f-ad-add-ip' into f-ds-ip-routes-exclusive
• 886c0fa ds/ip_route: keep flatten a plain copy; preserve equivalent CIDR spelling in ...
• 80dd996 Update CHANGELOG.md for #50001
• 106ecf5 Merge remote-tracking branch 'origin/f-ad-add-ip' into f-ds-ip-routes-exclusive
• c948f4f Merge pull request #50001 from hashicorp/f-new-resource-aws_directoryserviced...
• 5ee8b00 ds/ip_routes_exclusive: use shared VPC test template
• Additional commits viewable in compare view

Updates hashicorp/aws from 6.66.0 to 6.67.0

Release notes

Sourced from hashicorp/aws's releases.

v6.67.0

6.67.0 (September 30, 2026)

NOTES:

• resource/aws_route53_record: Batched reads is experimental. The behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#48525)

FEATURES:

• New Ephemeral Resource: aws_bedrockruntime_apply_guardrail (#50155)
• New List Resource: aws_default_security_group (#50120)
• New List Resource: aws_directory_service_ip_route (#50138)
• New List Resource: aws_directoryservicedata_user (#50001)
• New List Resource: aws_ec2_transit_gateway_route_table_propagation (#50193)
• New Resource: aws_directory_service_ip_route (#50138)
• New Resource: aws_directory_service_ip_routes_exclusive (#50204)
• New Resource: aws_directoryservicedata_user (#50001)

ENHANCEMENTS:

• resource/aws_apprunner_custom_domain_association: Add validation to prevent trailing dot on domain_name (#50189)
• resource/aws_apprunner_custom_domain_association: Add validation to require enable_www_subdomain to be false for wildcard domain (#50189)
• resource/aws_bedrockagentcore_workload_identity: Add tags and tags_all attributes (#49746)
• resource/aws_bedrockagentcore_workload_identity: Add resource identity support (#49746)
• resource/aws_default_security_group: Add Resource Identity support (#50120)
• resource/aws_ec2_transit_gateway_route_table_propagation: Add Resource Identity support (#50193)
• resource/aws_route53_record: Add the TF_AWS_ROUTE53_RECORD_BATCH_READS environment variable to reduce AWS API calls when managing many records in a zone (#48525)
• resource/aws_sns_topic: Add maximum_message_size argument (#50111)

BUG FIXES:

• list-resource/aws_dynamodb_table_replica: Fix eventual consistency error when replacing resource. (#50133)
• resource/aws_apprunner_custom_domain_association: Populate dns_target when importing (#50206)
• resource/aws_autoscaling_group: Fix interface conversion: interface {} is nil, not map[string]interface {} panics when capacity_reservation_target is empty (#50084)
• resource/aws_bedrockagentcore_harness: Fix "inconsistent result after apply" when environment_variables is unset (#50088)
• resource/aws_config_aggregate_authorization: Fix region to authorized_aws_region migration incorrectly forcing resource replacement (#49851)
• resource/aws_rds_global_cluster: Wait for source cluster promotion to complete when source_db_cluster_identifier is specified, fixing race condition with downstream resources (#48076)

Changelog

Sourced from hashicorp/aws's changelog.

6.67.0 (September 30, 2026)

NOTES:

• resource/aws_route53_record: Batched reads is experimental. The behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#48525)

FEATURES:

• New Ephemeral Resource: aws_bedrockruntime_apply_guardrail (#50155)
• New List Resource: aws_default_security_group (#50120)
• New List Resource: aws_directory_service_ip_route (#50138)
• New List Resource: aws_directoryservicedata_user (#50001)
• New List Resource: aws_ec2_transit_gateway_route_table_propagation (#50193)
• New Resource: aws_directory_service_ip_route (#50138)
• New Resource: aws_directory_service_ip_routes_exclusive (#50204)
• New Resource: aws_directoryservicedata_user (#50001)

ENHANCEMENTS:

• resource/aws_apprunner_custom_domain_association: Add validation to prevent trailing dot on domain_name (#50189)
• resource/aws_apprunner_custom_domain_association: Add validation to require enable_www_subdomain to be false for wildcard domain (#50189)
• resource/aws_bedrockagentcore_workload_identity: Add tags and tags_all attributes (#49746...

  Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: OWASP/Nest
• Branch: main
• File: .coderabbit.yaml
• Commit: 1e6c6b4
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 474265f1-cb22-478c-9943-f67cb7cb3b22

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.60%. Comparing base (1e6c6b4) to head (565a028).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5733   +/-   ##
=======================================
  Coverage   98.60%   98.60%           
=======================================
  Files         551      551           
  Lines       18430    18430           
  Branches     2685     2685           
=======================================
  Hits        18172    18172           
  Misses        126      126           
  Partials      132      132           

Flag	Coverage Δ
backend	98.99% <ø> (ø)
frontend	97.36% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1e6c6b4...565a028. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud