hashicorp/terraform-provider-aws

Documentation Link(s) aws_backup_selection Description The documentation for resources and selection_tag does not explain how the two arguments interact when both are configured. It is unclear whether selection_tag further filters the resources defined by resources, whether they are evaluated independently, or whether wildcard resource patterns cause tag conditions to be ignored. Current descriptions: resources - (Optional) An array of strings that either contain Amazon Resource Names (ARNs) or match patterns of resources to assign to a backup plan. selection_tag - (Optional) Tag-based conditions used to specify a set of resources to assign to a backup plan. We observed that when resources = ["*"] and a selection_tag condition are both configured, the tag condition does not appear to narrow the selection. Instead, all resources matching the wildcard are selected. The same behavior has been reported in #41274 when using a service-scoped wildcard such as arn:aws:s3:::*. Because this be

Documentation Link(s) aws_cloudwatch_event_target Description The several examples in the linked show the aws_cloudwatch_event_target resource's rule referencing the id property of a aws_cloudwatch_event_rule resource, when it needs to reference the name property. This issue appears on the API Gateway target, Input Transformer Usage - JSON Object, Input Transformer Usage - Simple String, and AppSync Usage examples. References The argument reference specifies that the rule argument refers to the name of the rule, not the ID. Would you like to implement a fix? No

Documentation Link(s) https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_cluster#transit_encryption_enabled-1 Description As per the terraform docs, aws_elasticache_cluster supports transit_encryption_enabled optional parameter: transit_encryption_enabled - (Optional) Enable encryption in-transit. Supported with Memcached versions 1.6.12 and later, Redis OSS versions 3.2.6, 4.0.10 and later, running in a VPC. See the ElastiCache in-transit encryption documentation for more details. If we try to create aws_elasticache_cluster with transit_encryption_enabled = true then it fails, AWS API returns error : InvalidParameterCombination: Encryption feature is not supported for engine REDIS. Error: % terraform apply plan aws_vpc.test: Creating... aws_vpc.test: Creation complete after 1s [id=vpc-0cf3da48569000000] aws_subnet.test: Creating... aws_subnet.test: Creation complete after 1s [id=subnet-0569d807834000000] aws_elasticache_subnet_group.test: Creat

Terraform and AWS Provider Version Terraform / Provider versions: Terraform 1.14.x; hashicorp/aws - reproduced on both v5.100.0 and v6.53.0. Affected Resource(s) or Data Source(s) aws_storagegateway_smb_file_share Expected Behavior cache_attributes.cache_stale_timeout_in_seconds should accept 0 on aws_storagegateway_smb_file_share. The AWS Storage Gateway API documents 0 as a valid value meaning "cache refresh turned off" (Valid Values: 0 or 300-2,592,000), and it's what the console sets when "Automatic cache refresh from S3" is set to None. Terraform should be able to both create and update a share with this value so that cache refresh can be disabled, and so that shares already set to 0 (via console/CLI) can be managed without a permanent diff. Actual Behavior The provider validates the field as IntBetween(300, 2592000), so 0 is rejected at plan time and Terraform cannot set it - even though the AWS API accepts it. This has two consequences: A share's cache refresh cannot be disable

Description The AWS API allows for a JSON-valued field named additionalParams in the model.bedrock_model_config block, which is passed directly through to the underlying model. Currently, we're working around this with a null_resource and a local provisioner that directly invokes aws aws bedrock-agentcore-control update-harness and passing in the additionalParams value there, but this is obviously suboptimal Affected Resource(s) or Data Source(s) aws_bedrockagentcore_harness Potential Terraform Configuration resource "aws_bedrockagentcore_harness" "main" { model { bedrock_model_config { model_id = "global.anthropic.claude-sonnet-4-6" max_tokens = 16384 temperature = 1.0 additionalParams = jsonencode({ additionalModelRequestFields = { thinking = { type = "enabled", budget_tokens = 2048 } } }) } } } References https://github.com/aws/aws-sdk-go-v2/blob/service/bedrockagentcorecontrol/v1.43.0/service/bedrockagentco