Fix conflicting AWS provider version constraints in Terraform

[Copilot]

The AWS provider was pinned to ~> 6.26.0 (i.e. < 6.27.0) in versions.tf, while EKS module 21.10.1 requires >= 6.28.0 — making terraform init impossible to satisfy.

Changes

• aws/versions.tf: Relaxed AWS provider constraint from ~> 6.26.0 → ~> 6.28, resolving the conflict while still preventing accidental major version upgrades:

  aws = {
    source  = "hashicorp/aws"
    version = "~> 6.28"
  }

• aws/.terraform.lock.hcl: Regenerated via terraform init -upgrade; AWS provider now locked to 6.34.0 with updated hashes.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• checkpoint-api.hashicorp.com
  • Triggering command: /usr/local/bin/terraform terraform --version (dns block)
  • Triggering command: /usr/local/bin/terraform terraform init -upgrade (dns block)
  • Triggering command: /usr/local/bin/terraform terraform fmt -check (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Terraform on aws no longer works</issue_title>
<issue_description>It looks like we have moved to a new terraform provider.
using terraform i get:

terraform --version                                                                                 <aws:owasp-wrongsecret>
Terraform v1.14.6
on darwin_arm64
+ provider registry.terraform.io/hashicorp/aws v6.26.0
+ provider registry.terraform.io/hashicorp/cloudinit v2.3.3
+ provider registry.terraform.io/hashicorp/http v3.5.0
+ provider registry.terraform.io/hashicorp/null v3.2.2
+ provider registry.terraform.io/hashicorp/random v3.7.2
+ provider registry.terraform.io/hashicorp/time v0.10.0
+ provider registry.terraform.io/hashicorp/tls v4.0.5

terraform init -upgrade                                                                               <aws:owasp-wrongsecret>
Initializing the backend...
Upgrading modules...
Downloading registry.terraform.io/terraform-aws-modules/iam/aws 6.4.0 for ebs_csi_irsa_role...
- ebs_csi_irsa_role in .terraform/modules/ebs_csi_irsa_role/modules/iam-role-for-service-accounts
Downloading registry.terraform.io/terraform-aws-modules/eks/aws 21.10.1 for eks...
- eks in .terraform/modules/eks
- eks.eks_managed_node_group in .terraform/modules/eks/modules/eks-managed-node-group
- eks.eks_managed_node_group.user_data in .terraform/modules/eks/modules/_user_data
- eks.fargate_profile in .terraform/modules/eks/modules/fargate-profile
Downloading registry.terraform.io/terraform-aws-modules/kms/aws 4.0.0 for eks.kms...
- eks.kms in .terraform/modules/eks.kms
- eks.self_managed_node_group in .terraform/modules/eks/modules/self-managed-node-group
- eks.self_managed_node_group.user_data in .terraform/modules/eks/modules/_user_data
Downloading registry.terraform.io/terraform-aws-modules/vpc/aws 6.5.1 for vpc...
- vpc in .terraform/modules/vpc
Initializing provider plugins...
- Finding hashicorp/tls versions matching ">= 4.0.0"...
- Finding hashicorp/time versions matching ">= 0.9.0"...
- Finding hashicorp/null versions matching ">= 3.0.0"...
- Finding hashicorp/cloudinit versions matching ">= 2.0.0"...
- Finding hashicorp/aws versions matching ">= 6.0.0, >= 6.23.0, ~> 6.26.0, >= 6.28.0"...
- Finding hashicorp/random versions matching "~> 3.7.0"...
- Finding hashicorp/http versions matching "~> 3.5.0"...
- Installing hashicorp/tls v4.2.1...
- Installed hashicorp/tls v4.2.1 (signed by HashiCorp)
- Installing hashicorp/time v0.13.1...
- Installed hashicorp/time v0.13.1 (signed by HashiCorp)
- Installing hashicorp/null v3.2.4...
- Installed hashicorp/null v3.2.4 (signed by HashiCorp)
- Installing hashicorp/cloudinit v2.3.7...
- Installed hashicorp/cloudinit v2.3.7 (signed by HashiCorp)
- Using previously-installed hashicorp/random v3.7.2
- Using previously-installed hashicorp/http v3.5.0
╷
│ Error: Failed to query available provider packages
│ 
│ Could not retrieve the list of available versions for provider hashicorp/aws: no available releases match the given constraints >= 6.0.0, >= 6.23.0, ~> 6.26.0, >= 6.28.0
│ 
│ To see which modules are currently depending on hashicorp/aws and what versions are specified, run the following command:
│     terraform providers
╵

in the aws folder. can you help me migrate/upgrade to the right tf providers again to make it work?</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Terraform on aws no longer works #2424

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.