Skip to content

chore(deps): update terraform modules (major)#187

Open
renovate[bot] wants to merge 11 commits intomasterfrom
renovate/major-terraform-modules
Open

chore(deps): update terraform modules (major)#187
renovate[bot] wants to merge 11 commits intomasterfrom
renovate/major-terraform-modules

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Feb 8, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
terraform-aws-modules/ec2-instance/aws (source) module major ~> 5.0~> 6.0
terraform-aws-modules/eks/aws (source) module major 19.21.021.15.1
terraform-aws-modules/s3-bucket/aws (source) module major 4.11.05.10.0

Release Notes

terraform-aws-modules/terraform-aws-ec2-instance (terraform-aws-modules/ec2-instance/aws)

v6.3.0

Compare Source

Features

v6.2.0

Compare Source

Features

v6.1.5

Compare Source

Bug Fixes
  • Always pull a value from SSM data source since a computed value cannot be used in conditional logic (#​466) (36fbf06)

v6.1.4

Compare Source

Bug Fixes
  • Allow computed values for name, make timeouts dynamic/optional (#​461) (baf0ba2)

v6.1.3

Compare Source

Bug Fixes

v6.1.2

Compare Source

Bug Fixes
  • Use computed local.security_group_name in the security group Name tag (#​458) (541cc3d)

v6.1.1

Compare Source

Bug Fixes
  • Avoid setting Name tag when a value has not been provided for name (#​452) (c227866)

v6.1.0

Compare Source

Features

v6.0.2

Compare Source

Bug Fixes
  • Set default value for root_block_device.tags to null (#​444) (f1b5273)

v6.0.1

Compare Source

Bug Fixes

v6.0.0

Compare Source

⚠ BREAKING CHANGES
  • Upgrade AWS provider and min required Terraform version to 6.0 and 1.10 respectively (#​436)
Features
  • Upgrade AWS provider and min required Terraform version to 6.0 and 1.10 respectively (#​436) (bfd5ed3)
terraform-aws-modules/terraform-aws-eks (terraform-aws-modules/eks/aws)

v21.15.1

Compare Source

Bug Fixes

v21.15.0

Compare Source

Features

v21.14.0

Compare Source

Features
  • Add support for EKS managed node group update_config.update_strategy (#​3626) (617dba6)

v21.13.0

Compare Source

Features

v21.12.0

Compare Source

Features

v21.11.0

Compare Source

Features

v21.10.1

Compare Source

Bug Fixes
  • Update minimum required version of AWS provider for provisioned control plane (#​3603) (dc4de4f)

v21.10.0

Compare Source

Features

v21.9.0

Compare Source

Features

v21.8.0

Compare Source

Features
  • Allow using inline policy for Karpenter controller role to mitigate policy size LimitExceeded error (#​3563) (0659a8d), closes #​3512

v21.7.0

Compare Source

Features
  • Add recommended security group rule for port 10251 to match EKS addon for metrics-server (#​3562) (de8c550)

v21.6.1

Compare Source

Bug Fixes

v21.6.0

Compare Source

Features
  • Use aws_service_principal data source for deriving IAM service prinicpals (#​3539) (0b0ca66)

v21.5.0

Compare Source

Features
  • Allow for additional policy statements on sqs queue policy (#​3543) (67557e8)

v21.4.0

Compare Source

Features

v21.3.2

Compare Source

Bug Fixes
  • Incorporate AWS provider v6.15 corrections for EKS Auto Mode to support enabling/disabling EKS Auto Mode without affecting non-Auto Mode users (#​3526) (f5f6dae)

v21.3.1

Compare Source

Bug Fixes

v21.3.0

Compare Source

Features
  • Support EKS Auto Mode custom node pools only creation (#​3514) (165d7c8)

v21.2.0

Compare Source

Features
  • Update Karpenter controller policy and permissions to match upstream project (#​3510) (131db39)

v21.1.5

Compare Source

Bug Fixes
  • Ensure module created security group is included on any network interfaces created (#​3495) (fa1d422)

v21.1.4

Compare Source

Bug Fixes
  • Ensure module created security group is included on any network interfaces created (#​3493) (e5cff84)

v21.1.3

Compare Source

Bug Fixes
  • Correct addon timeout lookup/override logic to support global and addon specific settings (#​3492) (b236208)

v21.1.2

Compare Source

Bug Fixes
  • Remediate type mismatch for EFA interfaces and ensure correct (local) definition is used (#​3491) (3959b65)

v21.1.1

Compare Source

Bug Fixes
  • Correct metadata options loop condition due to variable definition defaults (#​3490) (b40968a)

v21.1.0

Compare Source

Features
  • Add support for deletion protection functionality in the cluster (#​3475) (83c9cd1)

v21.0.9

Compare Source

Bug Fixes
  • Allow disabling instance refresh on self-managed node groups (part deux) (#​3478) (ca8f37e)

v21.0.8

Compare Source

Bug Fixes
  • Allow disabling instance refresh on self-managed node groups (#​3473) (6a887ad)

v21.0.7

Compare Source

Bug Fixes
  • Correct access policy logic to support not providing a policy to associate (#​3464) (39be61d)

v21.0.6

Compare Source

Bug Fixes
  • Allow instance_requirements to be set in self-managed node groups (#​3455) (5322bf7)

v21.0.5

Compare Source

Bug Fixes
  • Correct addon logic lookup to pull latest addon version (#​3449) (55d7fa2)

v21.0.4

Compare Source

Bug Fixes
  • Correct encryption configuration enable logic; avoid creating Auto Mode policy when Auto Mode is not enabled (#​3439) (6b8a3d9)

v21.0.3

Compare Source

Bug Fixes
  • Correct variable defaults for ami_id and kubernetes_version (#​3437) (8807e0b)

v21.0.2

Compare Source

Bug Fixes
  • Move encryption_config default for resources out of type definition and to default variable value to allow disabling encryption (#​3436) (b37368f)

v21.0.1

Compare Source

Bug Fixes
  • Correct logic to try to use module created IAM role before falli… (#​3433) (97d4ebb)

v21.0.0

Compare Source

⚠ BREAKING CHANGES
  • Upgrade min AWS provider and Terraform versions to 6.0 and 1.5.7 respectively (#​3412)
Features
  • Upgrade min AWS provider and Terraform versions to 6.0 and 1.5.7 respectively (#​3412) (416515a)

v20.37.2

Compare Source

Bug Fixes
  • Allow for both amazonaws.com.cn and amazonaws.com conditions in PassRole as required for AWS CN (#​3422) (83b68fd)

v20.37.1

Compare Source

Bug Fixes
  • Restrict AWS provider max version due to v6 provider breaking changes (#​3384) (681a868)

v20.37.0

Compare Source

Features

v20.36.1

Compare Source

Bug Fixes
  • Ensure additional_cluster_dns_ips is passed through from root module (#​3376) (7a83b1b)

v20.36.0

Compare Source

Features

v20.35.0

Compare Source

Features
  • Default to not changing autoscaling schedule values at the scheduled time (#​3322) (abf76f6)

v20.34.0

Compare Source

Features
  • Add capacity reservation permissions to Karpenter IAM policy (#​3318) (770ee99)

v20.33.1

Compare Source

Bug Fixes
  • Allow "EC2" access entry type for EKS Auto Mode custom node pools (#​3281) (3e2ea83)

v20.33.0

Compare Source

Features

v20.32.0

Compare Source

Features

v20.31.6

Compare Source

Bug Fixes

v20.31.5

Compare Source

Bug Fixes

v20.31.4

Compare Source

Bug Fixes
  • Auto Mode custom tag policy should apply to cluster role, not node role (#​3242) (a07013a)

v20.31.3

Compare Source

Bug Fixes
  • Update min provider version to remediate cluster replacement when enabling EKS Auto Mode (#​3240) (012e51c)

v20.31.2

Compare Source

Bug Fixes
  • Avoid trying to attach the node role when Auto Mode nodepools are not specified (#​3239) (ce34f1d)

v20.31.1

Compare Source

Bug Fixes
  • Create EKS Auto Mode role when Auto Mode is enabled, regardless of built-in node pool use (#​3234) (e2846be)

v20.31.0

Compare Source

Features

v20.30.1

Compare Source

Bug Fixes
  • Coalesce local resolve_conflicts_on_create_default value to a boolean since default is null (#​3221) (35388bb)

v20.30.0

Compare Source

Features
  • Improve addon dependency chain and decrease time to provision addons (due to retries) (#​3218) (ab2207d)

v20.29.0

Compare Source

Features
  • Add support for pod identity association on EKS addons (#​3203) (a224334)

v20.28.0

Compare Source

Features
  • Add support for creating efa-only network interfaces (#​3196) (c6da22c)

v20.27.0

Compare Source

Features

v20.26.1

Compare Source

Bug Fixes
  • Use dynamic partition data source to determine DNS suffix for Karpenter EC2 pass role permission (#​3193) (dea6c44)

v20.26.0

Compare Source

Features
  • Add support for desired_capacity_type (named desired_size_type) on self-managed node group (#​3166) (6974a5e)

v20.25.0

Compare Source

Features
  • Add support for newly released AL2023 accelerated AMI types (#​3177) (b2a8617)
Bug Fixes

v20.24.3

Compare Source

Bug Fixes
  • Add primary_ipv6 parameter to self-managed-node-group (#​3169) (fef6555)

v20.24.2

Compare Source

Bug Fixes

v20.24.1

Compare Source

Bug Fixes
  • Correct Karpenter EC2 service principal DNS suffix in non-commercial regions (#​3157) (47ab3eb)

v20.24.0

Compare Source

Features
  • Add support for Karpenter v1 controller IAM role permissions (#​3126) (e317651)

v20.23.0

Compare Source

Features
  • Add new output values for OIDC issuer URL and provider that are dual-stack compatible (#​3120) (72668ac)

v20.22.1

Compare Source

Bug Fixes

v20.22.0

Compare Source

Features
  • Enable update in place for node groups with cluster placement group strategy (#​3045) (75db486)

v20.21.0

Compare Source

Features

v20.20.0

Compare Source

Features

v20.19.0

Compare Source

Features

v20.18.0

Compare Source

Features

v20.17.2

Compare Source

Bug Fixes

v20.17.1

Compare Source

Bug Fixes
  • Invoke aws_iam_session_context data source only when required (#​3058) (f02df92)

v20.17.0

Compare Source

Features
  • Add support for ML capacity block reservations with EKS managed node group(s) (#​3091) (ae3379e)

v20.16.0

Compare Source

Features

v20.15.0

Compare Source

Features

v20.14.0

Compare Source

Features
  • Require users to supply OS via ami_type and not via platform which is unable to distinquish between the number of variants supported today (#​3068) (ef657bf)

v20.13.1

Compare Source

Bug Fixes
  • Correct syntax for correctly ignoring bootstrap_cluster_creator_admin_permissions and not all of access_config (#​3056) (1e31929)

v20.13.0

Compare Source

Features
  • Starting with 1.30, do not use the cluster OIDC issuer URL by default in the identity provider config (#​3055) (00f076a)

v20.12.0

Compare Source

Features
  • Support additional cluster DNS IPs with Bottlerocket based AMIs (#​3051) (541dbb2)

v20.11.1

Compare Source

Bug Fixes
  • Ignore changes to bootstrap_cluster_creator_admin_permissions which is disabled by default (#​3042) (c65d308)

v20.11.0

Compare Source

Features
  • Add SourceArn condition to Fargate profile trust policy (#​3039) (a070d7b)

v20.10.0

Compare Source

Features
  • Add support for Pod Identity assocation on Karpenter sub-module (#​3031) (cfcaf27)

v20.9.0

Compare Source

Features
  • Propagate ami_type to self-managed node group; allow using ami_type only (#​3030) (74d3918)

v20.8.5

Compare Source

Bug Fixes
  • Forces cluster outputs to wait until access entries are complete (#​3000) (e2a39c0)

v20.8.4

Compare Source

Bug Fixes
  • Pass nodeadm user data variables from root module down to nodegroup sub-modules (#​2981) (84effa0)

v20.8.3

Compare Source

Bug Fixes
  • Ensure the correct service CIDR and IP family is used in the rendered user data

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies label Feb 8, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Feb 8, 2026

Terraform plan in examples/03-aws-github-actions-oidc

No changes. Your infrastructure matches the configuration.
No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

📝 Plan generated in terraform-plan-03-aws-github-actions-oidc #341

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Feb 8, 2026

Terraform plan in examples/01-minimal-aws-cloudformation-bootstrap

No changes. Your infrastructure matches the configuration.
No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

📝 Plan generated in terraform-plan-01-minimal-aws-cloudformation-bootstrap #346

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Feb 8, 2026

Terraform plan in examples/02-minimal-gcp-tf-bootstrap

No changes. Your infrastructure matches the configuration.
No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

📝 Plan generated in terraform-plan-02-minimal-gcp-tf-bootstrap #356

@renovate renovate bot force-pushed the renovate/major-terraform-modules branch 2 times, most recently from 1614138 to 66325ff Compare February 17, 2026 17:21
@renovate renovate bot force-pushed the renovate/major-terraform-modules branch from 66325ff to 9407e71 Compare February 27, 2026 13:03
@marekaf marekaf force-pushed the renovate/major-terraform-modules branch from 9407e71 to d24e293 Compare March 3, 2026 20:32
@renovate
Copy link
Copy Markdown
Contributor Author

renovate bot commented Mar 3, 2026

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 3, 2026

Terraform plan in examples/04-aws-wireguard-vpn

Plan: 4 to add, 0 to change, 0 to destroy. Changes to Outputs.
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create

Terraform will perform the following actions:

  # module.wireguard_vpn.module.ec2_instance.aws_instance.this[0] will be created
+   resource "aws_instance" "this" {
+       ami                                  = "ami-05dff77713a4fa273"
+       arn                                  = (known after apply)
+       associate_public_ip_address          = true
+       availability_zone                    = (known after apply)
+       disable_api_stop                     = (known after apply)
+       disable_api_termination              = (known after apply)
+       ebs_optimized                        = (known after apply)
+       enable_primary_ipv6                  = (known after apply)
+       force_destroy                        = false
+       get_password_data                    = false
+       host_id                              = (known after apply)
+       host_resource_group_arn              = (known after apply)
+       iam_instance_profile                 = (known after apply)
+       id                                   = (known after apply)
+       instance_initiated_shutdown_behavior = (known after apply)
+       instance_lifecycle                   = (known after apply)
+       instance_state                       = (known after apply)
+       instance_type                        = "t2.micro"
+       ipv6_address_count                   = (known after apply)
+       ipv6_addresses                       = (known after apply)
+       key_name                             = (known after apply)
+       monitoring                           = true
+       outpost_arn                          = (known after apply)
+       password_data                        = (known after apply)
+       placement_group                      = (known after apply)
+       placement_group_id                   = (known after apply)
+       placement_partition_number           = (known after apply)
+       primary_network_interface_id         = (known after apply)
+       private_dns                          = (known after apply)
+       private_ip                           = (known after apply)
+       public_dns                           = (known after apply)
+       public_ip                            = (known after apply)
+       region                               = "eu-west-1"
+       secondary_private_ips                = (known after apply)
+       security_groups                      = (known after apply)
+       source_dest_check                    = true
+       spot_instance_request_id             = (known after apply)
+       subnet_id                            = "************************"
+       tags                                 = {
+           "Name" = "wireguard-vpn"
        }
+       tags_all                             = {
+           "Name" = "wireguard-vpn"
        }
+       tenancy                              = (known after apply)
+       user_data_base64                     = (known after apply)
+       user_data_replace_on_change          = false
+       volume_tags                          = {
+           "Name" = "wireguard-vpn"
        }
+       vpc_security_group_ids               = (known after apply)

+       capacity_reservation_specification (known after apply)

+       cpu_options (known after apply)

+       credit_specification {}

+       ebs_block_device (known after apply)

+       enclave_options {
+           enabled = (known after apply)
        }

+       ephemeral_block_device (known after apply)

+       instance_market_options (known after apply)

+       maintenance_options (known after apply)

+       metadata_options {
+           http_endpoint               = "enabled"
+           http_protocol_ipv6          = "disabled"
+           http_put_response_hop_limit = 1
+           http_tokens                 = "********"
+           instance_metadata_tags      = (known after apply)
        }

+       network_interface (known after apply)

+       primary_network_interface (known after apply)

+       private_dns_name_options (known after apply)

+       root_block_device (known after apply)

+       secondary_network_interface (known after apply)
    }

  # module.wireguard_vpn.module.ec2_instance.aws_security_group.this[0] will be created
+   resource "aws_security_group" "this" {
+       arn                    = (known after apply)
+       description            = "Managed by Terraform"
+       egress                 = (known after apply)
+       id                     = (known after apply)
+       ingress                = (known after apply)
+       name                   = (known after apply)
+       name_prefix            = "wireguard-vpn-"
+       owner_id               = (known after apply)
+       region                 = "eu-west-1"
+       revoke_rules_on_delete = false
+       tags                   = {
+           "Name" = "wireguard-vpn"
        }
+       tags_all               = {
+           "Name" = "wireguard-vpn"
        }
+       vpc_id                 = "*********************"
    }

  # module.wireguard_vpn.module.ec2_instance.aws_vpc_security_group_egress_rule.this["ipv4_default"] will be created
+   resource "aws_vpc_security_group_egress_rule" "this" {
+       arn                    = (known after apply)
+       cidr_ipv4              = "0.0.0.0/0"
+       description            = "Allow all IPv4 traffic"
+       id                     = (known after apply)
+       ip_protocol            = "-1"
+       region                 = "eu-west-1"
+       security_group_id      = (known after apply)
+       security_group_rule_id = (known after apply)
+       tags                   = {
+           "Name" = "wireguard-vpn-ipv4_default"
        }
+       tags_all               = {
+           "Name" = "wireguard-vpn-ipv4_default"
        }
    }

  # module.wireguard_vpn.module.ec2_instance.aws_vpc_security_group_egress_rule.this["ipv6_default"] will be created
+   resource "aws_vpc_security_group_egress_rule" "this" {
+       arn                    = (known after apply)
+       cidr_ipv6              = "::/0"
+       description            = "Allow all IPv6 traffic"
+       id                     = (known after apply)
+       ip_protocol            = "-1"
+       region                 = "eu-west-1"
+       security_group_id      = (known after apply)
+       security_group_rule_id = (known after apply)
+       tags                   = {
+           "Name" = "wireguard-vpn-ipv6_default"
        }
+       tags_all               = {
+           "Name" = "wireguard-vpn-ipv6_default"
        }
    }

Plan: 4 to add, 0 to change, 0 to destroy.

Changes to Outputs:
+   vpn_config    = (known after apply)

Warning: Deprecated attribute

  on /tmp/terraform-data-dir/modules/vpc/vpc-flow-logs.tf line 28, in locals:
  28:     "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"

The attribute "name" is deprecated. Refer to the provider documentation for
details.

📝 Plan generated in terraform-plan-04-aws-wireguard-vpn #149

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 3, 2026

Terraform plan in examples/05-aws-complete

Error: Invalid for_each argument
Error: Invalid for_each argument

  on /tmp/terraform-data-dir/modules/eks.eks/main.tf line 298, in resource "aws_eks_access_entry" "this":
 298:   for_each = { for k, v in local.merged_access_entries : k => v if local.create }
    ├────────────────
    │ local.create is true
    │ local.merged_access_entries will be known only after apply

The "for_each" map includes keys derived from resource attributes that cannot
be determined until apply, and so Terraform cannot determine the full set of
keys that will identify the instances of this resource.

When working with unknown values in for_each, it's better to define the map
keys statically in your configuration and place apply-time results only in
the map values.

Alternatively, you could use the -target planning option to first apply only
the resources that the for_each value depends on, and then apply a second
time to fully converge.

❌ Failed to generate plan in terraform-plan-05-aws-complete #275

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 3, 2026

Terraform plan in examples/06-minimal-aws-terraform-bootstrap

No changes. Your infrastructure matches the configuration.
No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

📝 Plan generated in terraform-plan-06-minimal-aws-terraform-bootstrap #219

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant