feat!: Upgrade AWS provider and min required Terraform version to `6.18` and `1.11` respectively #525

bryantbiggs · 2025-11-11T16:49:57Z

Description

List of backwards incompatible changes

Terraform v1.11 is now minimum supported version to support write-only (wo_*) attributes.
AWS provider v6.18 is now minimum supported version
The underlying aws_security_group_rule resources has been replaced with aws_vpc_security_group_ingress_rule and aws_vpc_security_group_egress_rule to allow for more flexibility in defining security group rules.
master_password is no longer supported and only the write-only equivalent is supported (master_password_wo and master_password_wo_version) (#513)
security_group_rules has been split into security_group_ingress_rules and security_group_egress_rules to better match the AWS API and allow for more flexibility in defining security group rules

Additional changes

Added

Support for region argument to specify the AWS region for the resources created if different from the provider region.

Modified

Variable definitions now contain detailed object types in place of the previously used any type
copy_tags_to_snapshot default value is now true (#521)
db_cluster_parameter_group_parameters was previously of type list(map(...)), now of type map(object(...))with name being optional and defaulting to the map key if not provided
preferred_maintenance_window and preferred_backup_window default values are now null (#524)

Removed

None

Variable and output changes

Removed variables:
- auto_minor_version_upgrade -> still available within the instances variable definition
- ca_cert_identifier -> available within the instances variable definition
- monitoring_interval -> still available within the instances variable definition
- performance_insights_enabled -> still available within the instances variable definition
- performance_insights_kms_key_id -> still available within the instances variable definition
- performance_insights_retention_period -> still available within the instances variable definition
- iam_role_managed_policy_arns -> deprecated argument on aws_iam_role resource
- iam_role_force_detach_policies -> hardcode to true
Renamed variables:
- instance_class -> cluster_instance_class
- db_cluster_db_instance_parameter_group_name -> cluster_db_instance_parameter_group_name
- role_associations was previously iam_roles
- master_password replaced with master_password_wo and master_password_wo_version
- The variables for DB shard group have been nested under a single, top-level shard_group variable:
  - create_shard_group removed - set shard_group to null to disable or provide an object to enable
  - compute_redundancy -> shard_group.compute_redundancy
  - db_shard_group_identifier -> shard_group.identifier
  - max_acu -> shard_group.max_acu
  - min_acu -> shard_group.min_acu
  - publicly_accessible -> shard_group.publicly_accessible
  - shard_group_tags -> shard_group.tags
  - shard_group_timeouts -> shard_group.timeouts
- The variables for the cluster activity stream have been nested under a single, top-level cluster_activity_stream variable:
  - create_db_cluster_activity_stream removed - set cluster_activity_stream to null to disable or provide an object to enable
  - db_cluster_activity_stream_mode -> cluster_activity_stream.mode
  - db_cluster_activity_stream_kms_key_id -> cluster_activity_stream.kms_key_id
  - engine_native_audit_fields_included -> cluster_activity_stream.include_audit_fields
- The variables for the cluster parameter group have been nested under a single, top-level cluster_parameter_group variable:
  - create_db_cluster_parameter_group removed - set cluster_parameter_group to null to disable or provide an object to enable
  - db_cluster_parameter_group_name -> cluster_parameter_group.name
  - db_cluster_parameter_group_use_name_prefix -> cluster_parameter_group.use_name_prefix
  - db_cluster_parameter_group_description -> cluster_parameter_group.description
  - db_cluster_parameter_group_family -> cluster_parameter_group.family
  - db_cluster_parameter_group_parameters -> cluster_parameter_group.parameters
- The variables for the instance parameter group have been nested under a single, top-level db_parameter_group variable:
  - create_db_parameter_group removed - set db_parameter_group to null to disable or provide an object to enable
  - db_parameter_group_name -> db_parameter_group.name
    - A variable cluster_parameter_group_name has been retained for when users want to provide an existing cluster parameter group name.
  - db_parameter_group_use_name_prefix -> db_parameter_group.use_name_prefix
  - db_parameter_group_description -> db_parameter_group.description
  - db_parameter_group_family -> db_parameter_group.family
  - db_parameter_group_parameters -> db_parameter_group.parameters
Added variables:
- region

Motivation and Context

Resolves feat: Enhanced region support #509
Resolves feat: Ephemeral password support #513
Resolves Support AWS provider v6 #519
Resolves default copy_tags_to_snapshot to true #521
Resolves fix: Don't use a specific default value for preferred maintenance/backup windows for clusters #524

Breaking Changes

Yes

How Has This Been Tested?

I have updated at least one of the examples/* to demonstrate and validate my change(s)
I have tested and validated these changes using one or more of the provided examples/* projects
I have executed pre-commit run -a on my pull request

…18` and `1.11` respectively

…nto single top level variable

…red_backup_window` to `null`

…`master_password_wo_version`

…te `aws_security_group_ingress_rule`/`aws_security_group_egress_rule`

modules/dsql/variables.tf

examples/dsql/main.tf

main.tf

antonbabenko

I don't have anything to add.

@magreenbaum Thank you for helping with the review!

main.tf

magreenbaum · 2025-11-14T20:42:16Z

examples/limitless/main.tf

+  }

  # aurora limitless clusters do not support managed master user password
-  manage_master_user_password = false


I think we need to keep this since manage_master_user_password defaults to true.

good catch - added in ee41836

main.tf

magreenbaum · 2025-11-15T03:32:30Z

examples/global-cluster/main.tf

+  cluster_instance_class    = "db.r8g.large"
  instances                 = { for i in range(2) : i => {} }


cluster_instance_class sets db_cluster_instance_class which is only for non-aurora multi-az rds clusters and seems to cause errors if using with aurora: hashicorp/terraform-provider-aws#30596 (comment)

Suggested change

cluster_instance_class = "db.r8g.large"

instances = { for i in range(2) : i => {} }

instances = { for i in range(2) : i => { instance_class = "db.r8g.large"} }

ah, good to know! we are overloading the use of cluster_instance_class similar to the cluster monitoring and performance insights variables. however, we can guard against the use of setting db_cluster_instance_class on the cluster when the cluster is not intended to be an RDS mult-az cluster ee41836

magreenbaum · 2025-11-15T03:33:52Z

examples/global-cluster/main.tf

+  cluster_instance_class    = "db.r8g.large"
  instances                 = { for i in range(2) : i => {} }


Or maybe we should keep the instance_class var 🤔

Suggested change

cluster_instance_class = "db.r8g.large"

instances = { for i in range(2) : i => {} }

cluster_instance_class = "db.r8g.large"

instances = { for i in range(2) : i => { instance_class = "db.r8g.large"} }

magreenbaum · 2025-11-15T04:13:53Z

examples/serverless/main.tf

  }

-  instance_class = "db.serverless"
+  cluster_instance_class = "db.serverless"


Similar here in this file

modules/dsql/main.tf

magreenbaum · 2025-11-15T04:31:06Z

examples/serverless/main.tf


  name              = "${local.name}-postgresql"
  engine            = "aurora-postgresql"
  engine_mode       = "serverless"


serverless v1 is no longer supported / able to be created: https://repost.aws/questions/QUhcMVoChXRm2HLi8F-yih1g/announcement-support-for-aurora-serverless-v1-ending-soon

removed in ee41836

Co-authored-by: Melissa Greenbaum <[email protected]>

magreenbaum

Thank you!!

antonbabenko

Great stuff!

## [10.0.0](v9.16.1...v10.0.0) (2025-11-15) ### ⚠ BREAKING CHANGES * Upgrade AWS provider and min required Terraform version to `6.18` and `1.11` respectively (#525) ### Features * Upgrade AWS provider and min required Terraform version to `6.18` and `1.11` respectively ([#525](#525)) ([2bf4622](2bf4622))

antonbabenko · 2025-11-15T17:25:14Z

This PR is included in version 10.0.0 🎉

bryantbiggs added 10 commits November 10, 2025 08:06

feat!: Upgrade AWS provider and min required Terraform version to `6.…

d364ef1

…18` and `1.11` respectively

chore: Add initial upgrade guide to capture changes

b7a7de1

feat: Add support for region resource level argument

a6dff14

feat: Update variable type definitions, consolidate variable groups i…

d000a88

…nto single top level variable

fix: Set default value for preferred_maintenance_window and `prefer…

206ce5d

…red_backup_window` to `null`

feat: Replace master_password with write-only master_password_wo/…

1e835c1

…`master_password_wo_version`

feat: Update DSQL sub-module and example

c280e4c

fix: Switch from the prior single aws_security_group_rule to separa…

05bb4e8

…te `aws_security_group_ingress_rule`/`aws_security_group_egress_rule`

chore: Update example versions

e7180d6

chore: Update UPGRADE guide and examples following validation

696f58f

bryantbiggs force-pushed the feat/upgrade branch from 17cca40 to 696f58f Compare November 13, 2025 22:56

bryantbiggs requested review from antonbabenko and magreenbaum November 13, 2025 22:58

bryantbiggs marked this pull request as ready for review November 13, 2025 23:00

chore: Ensure local zones are not picked up when deploying examples

2e7a600

magreenbaum reviewed Nov 14, 2025

View reviewed changes

modules/dsql/variables.tf Show resolved Hide resolved

examples/dsql/main.tf Outdated Show resolved Hide resolved

main.tf Outdated Show resolved Hide resolved

antonbabenko reviewed Nov 14, 2025

View reviewed changes

fix: Updates from review

42cb1ad

bryantbiggs force-pushed the feat/upgrade branch from 449d8c6 to 42cb1ad Compare November 14, 2025 13:18

magreenbaum reviewed Nov 15, 2025

View reviewed changes

bryantbiggs and others added 2 commits November 15, 2025 07:31

Apply suggestions from code review

7604cb8

Co-authored-by: Melissa Greenbaum <[email protected]>

fix: Updates from review

ee41836

magreenbaum approved these changes Nov 15, 2025

View reviewed changes

bryantbiggs requested a review from antonbabenko November 15, 2025 15:30

antonbabenko approved these changes Nov 15, 2025

View reviewed changes

bryantbiggs merged commit 2bf4622 into terraform-aws-modules:master Nov 15, 2025
15 checks passed

bryantbiggs deleted the feat/upgrade branch November 15, 2025 17:41

		cluster_instance_class = "db.r8g.large"
		instances = { for i in range(2) : i => {} }

Uh oh!

feat!: Upgrade AWS provider and min required Terraform version to 6.18 and 1.11 respectively #525

feat!: Upgrade AWS provider and min required Terraform version to 6.18 and 1.11 respectively #525

Uh oh!

Conversation

bryantbiggs commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

List of backwards incompatible changes

Additional changes

Added

Modified

Removed

Variable and output changes

Motivation and Context

Breaking Changes

How Has This Been Tested?

Uh oh!

Uh oh!

Uh oh!

Uh oh!

antonbabenko left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

magreenbaum left a comment

Choose a reason for hiding this comment

Uh oh!

antonbabenko left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

antonbabenko commented Nov 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

feat!: Upgrade AWS provider and min required Terraform version to `6.18` and `1.11` respectively #525

feat!: Upgrade AWS provider and min required Terraform version to `6.18` and `1.11` respectively #525

bryantbiggs commented Nov 11, 2025 •

edited

Loading