Merge branch 'main' into HEAD

# Conflicts:
#	internal/service/iot/topic_rule.go

.actrc

@@ -1,4 +1,4 @@
 # Needed for testing our workflows
 # The `full` variants are needed for Maven for TeamCity configuration validation
--P ubuntu-latest=ghcr.io/catthehacker/ubuntu:full-20.04
--P linux=ghcr.io/catthehacker/ubuntu:full-20.04
+-P ubuntu-latest=ghcr.io/catthehacker/ubuntu:act-22.04
+-P linux=ghcr.io/catthehacker/ubuntu:act-22.04

.archive/changelog/36595.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_dynamodb_resource_policy
+```

.changelog/14270.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_cloudformation_stack: CRLF line endings in `template_body` no longer cause erroneous diffs
+```
+
+```release-note:note
+provider: When using YAML or JSON documents, such as in `template_body` of `aws_cloudformation_stack`, CRLF was previously treated as different from LF but these are now treated as equivalent in many situations
+```

.changelog/25743.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_ec2_transit_gateway_peering_attachments
+```

.changelog/25967.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+data-source/aws_iam_policy_document: When using multiple principals, sort them to avoid differences based only on order
+```

.changelog/26399.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_drs_replication_configuration_template
+```

.changelog/26755.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+resource/aws_cloudwatch_event_connection: Add plan-time validation preventing empty `auth_parameters.oauth.oauth_http_parameters` or `auth_parameters.invocation_http_parameters`
+`body`, `header` and `query_string` configuration blocks
+```

.changelog/30399.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_dynamodb_table_export
+```

.changelog/30403.txt

@@ -0,0 +1,9 @@
+```release-note:bug
+resource/aws_elasticache_replication_group: Fix excessive delay on read
+```
+```release-note:enhancement
+resource/aws_elasticache_replication_group: Add `transit_encryption_mode` argument
+```
+```release-note:enhancement
+resource/aws_elasticache_replication_group: Changes to the `transit_encryption_enabled` argument can now be done in-place for engine versions > `7.0.5`
+```

.changelog/30493.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_elasticache_replication_group: Fix `unexpected state 'snapshotting'` errors when increasing or decreasing replica count
+```

.changelog/30862.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ce_cost_category: Allow up to 3 levels of `and`, `not` and `or` operand nesting for the `rule` argument
+```

.changelog/32027.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_memorydb_user: Support IAM authentication mode
+```

.changelog/33713.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_appautoscaling_scheduled_action: Always send `start_time` and `end_time` values on update when configured
+```

.changelog/34099.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_iam_instance_profile: Detect when the associated `role` no longer exists
+```

.changelog/34227.txt

@@ -0,0 +1,11 @@
+```release-note:bug
+resource/aws_quicksight_dashboard: Fix failure when updating a dashboard takes a while
+```
+
+```release-note:bug
+resource/aws_quicksight_template: Fix "a number is required" errors when state contains an empty string
+```
+
+```release-note:bug
+resource/aws_quicksight_template: Fix "Invalid address to set" errors
+```

.changelog/34233.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+provider: The `use_fips_endpoint` flag is now ignored for any service with a custom endpoint configured in `endpoints`.
+```

.changelog/34266.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_appstream_fleet: Add `desired_sessions` argument to the `compute_capacity` block.
+```
+
+```release-note:enhancement
+resource/aws_appstream_fleet: Add `max_sessions_per_instance` argument.
+```

.changelog/34293.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_pipes_pipe: Mark `source_parameters.self_managed_kafka_parameters.credentials.basic_auth` as Optional
+```

.changelog/34362.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cloudfront_origin_access_control: Add `lambda` and `mediapackagev2` as valid values for `origin_access_control_origin_type`
+```

.changelog/34370.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_rds_cluster: Add `enable_local_write_forwarding` argument to support Aurora MySQL local write forwarding
+```

.changelog/34382.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_appautoscaling_scheduled_action: Read correct resource by using `scalable_dimension` as an additional filter
+```

.changelog/34819.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_elasticache_replication_group: Decrease replica count after other updates
+```

.changelog/34905.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cloudwatch_event_rule: Add `force_destroy` attribute
+```

.changelog/34934.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_appautoscaling_policy: Fix errors when importing an MSK storage autoscaling policy
+```

.changelog/35149.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_batch_job_definition: Add update functions instead of ForceNew. Add `deregister_on_new_revision` to allow keeping prior versions ACTIVE when a new revision is published.
+```

.changelog/35168.txt

@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_networkfirewall_tls_inspection_configuration
+```
+
+```release-note:enhancement
+resource/aws_networkfirewall_logging_configuration: Add plan-time validation of `firewall_arn`
+```

.changelog/35231.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ecr_lifecycle_policy: Add missing `tagPatternList` change detection in policy JSON
+```

.changelog/35236.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cognito_user_pool: Add `pre_token_generation_config` configuration block
+```

.changelog/35311.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_m2_environment
+```

.changelog/35399.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_m2_application
+```

.changelog/35408.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_m2_deployment
+```

.changelog/35413.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_verifiedpermissions_policy
+```

.changelog/35662.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_organizations_account: Allow import of accounts with IAM access to the AWS Billing and Cost Management console
+```

.changelog/35670.txt

@@ -0,0 +1,6 @@
+```release-note:bug
+resource/aws_dms_replication_config: Fix persistent change in `replication_settings`
+```
+```release-note:bug
+resource/aws_dms_replication_task: Fix persistent change in `replication_task_settings`
+```

.changelog/35677.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+data-source/aws_iam_policy_document: Add `minified_json` attribute
+```

.changelog/35722.txt

@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_networkmonitor_monitor
+```
+
+```release-note:new-resource
+aws_networkmonitor_probe
+```

.changelog/35865.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_redshiftserverless_custom_domain_association
+```

.changelog/35960.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ssm_parameter: force create a new SSM parameter when `data_type` is updated.
+```

.changelog/35978.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_glue_data_catalog_encryption_settings: Add `data_catalog_encryption_settings.encryption_at_rest.catalog_encryption_service_role` argument
+```
+
+```release-note:enhancement
+data/aws_glue_data_catalog_encryption_settings: Add `data_catalog_encryption_settings.encryption_at_rest.catalog_encryption_service_role` attribute
+```

.changelog/35991.txt

@@ -0,0 +1,11 @@
+```release-note:new-resource
+aws_globalaccelerator_cross_account_attachment
+```
+
+```release-note:enhancement
+resource/aws_eip: Add `arn` attribute
+```
+
+```release-note:enhancement
+data-source/aws_eip: Add `arn` attribute
+```

.changelog/36062.txt

@@ -0,0 +1,19 @@
+```release-note:enhancement
+data-source/aws_ram_resource_share: `name` is Optional
+```
+
+```release-note:enhancement
+resource/aws_ram_resource_association: Add plan-time validation of `resource_arn` and `resource_share_arn`
+```
+
+```release-note:bug
+resource/aws_ram_principal_association: Remove from state on resource Read if `principal` is disassociated outside of Terraform 
+```
+
+```release-note:bug
+resource/aws_ram_principal_association: Prevent creation of duplicate Terraform resources
+```
+
+```release-note:bug
+resource/aws_ram_resource_association: Prevent creation of duplicate Terraform resources
+```

.changelog/36072.txt

@@ -0,0 +1,27 @@
+```release-note:bug
+resource/aws_datasync_location_azure_blob: Fix missing `container_url` attribute value and bad `subdirectory` attribute value from state read/refresh
+```
+
+```release-note:bug
+resource/aws_datasync_location_efs: Fix missing `efs_file_system_arn` attribute value from state read/refresh
+```
+
+```release-note:bug
+resource/aws_datasync_location_nfs: Fix missing `server_hostname` attribute value from state read/refresh
+```
+
+```release-note:bug
+resource/aws_datasync_location_s3: Fix missing `s3_bucket_arn` attribute value from state read/refresh
+```
+
+```release-note:bug
+resource/aws_datasync_location_smb: Fix missing `server_hostname` attribute value from state read/refresh
+```
+
+```release-note:enhancement
+resource/aws_datasync_location_hdfs: Add `kerberos_keytab_base64` and `kerberos_krb5_conf_base64` arguments
+```
+
+```release-note:bug
+resource/aws_datasync_location_hdfs: Mark `qop_configuration` as Computed
+```

.changelog/36236.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_vpn_connection: Correct plan-time validation of `tunnel1_inside_ipv6_cidr` and `tunnel2_inside_ipv6_cidr`
+```

.changelog/36264.txt

@@ -0,0 +1,11 @@
+```release-note:new-resource
+aws_lakeformation_data_cells_filter
+```
+
+```release-note:enhancement
+resource/aws_lakeformation_permissions: Add `data_cells_filter` attribute
+```
+
+```release-note:enhancement
+data-source/aws_lakeformation_permissions: Add `data_cells_filter` attribute
+```

.changelog/36268.txt

@@ -0,0 +1,31 @@
+```release-note:bug
+resource/aws_securitylake_subscriber: Allow more than one log source
+```
+
+```release-note:bug
+resource/aws_securitylake_aws_log_source: Correctly handles unspecified `source_version`
+```
+
+```release-note:bug
+resource/aws_securitylake_aws_log_source: Prevents errors when creating multiple log sources concurrently
+```
+
+```release-note:bug
+resource/aws_securitylake_custom_log_source: Validates length of `source_name` parameter
+```
+
+```release-note:bug
+resource/aws_securitylake_custom_log_source: Prevents errors when creating multiple log sources concurrently
+```
+
+```release-note:bug
+resource/aws_securitylake_subscriber: Correctly handles unspecified `access_type`
+```
+
+```release-note:bug
+resource/aws_securitylake_subscriber: Correctly requires `source_name` parameter for `aws_log_source_resource` and `custom_log_source_resource`
+```
+
+```release-note:bug
+resource/aws_securitylake_subscriber: Correctly handles unspecified `source_version` parameter for `aws_log_source_resource` and `custom_log_source_resource`
+```

.changelog/36277.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_servicecatalogappregistry_application
+```

.changelog/36285.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_route53domains_registered_domain: Add `billing_contact` and `billing_privacy` arguments
+```

.changelog/36288.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_apprunner_hosted_zone_id
+```

.changelog/36298.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+data-source/aws_opensearch_domain : Add `auto_tune_options.use_off_peak_window` attribute. This fixes a regression introduced in [v5.40.0](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md#5400-march--7-2024) causing `Invalid address to set` errors
+```

.changelog/36304.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_ec2_transit_gateway_peering_attachment: Add `state` attribute
+```
+
+```release-note:enhancement
+data-source/aws_ec2_transit_gateway_peering_attachment: Add `state` attribute
+```

.changelog/36307.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_medialive_input
+```

.changelog/36308.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ec2_instance: Remove [ForceNew](https://developer.hashicorp.com/terraform/plugin/sdkv2/schemas/schema-behaviors#forcenew) from `ipv6_address_count`
+```

.changelog/36309.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_ecs_service: Fix `panic: interface conversion: interface {} is nil, not map[string]interface {}` when `service_connect_configuration.service.timeout` is empty
+```
+
+```release-note:bug
+resource/aws_ecs_service: `service_connect_configuration.service.tls.issuer_cert_authority.aws_pca_authority_arn` is Required
+```

.changelog/36310.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_elasticache_replication_group: Fix bugs causing errors like `InvalidReplicationGroupState: Cluster not in available state to perform tagging operations.`
+```

.changelog/36311.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_cognito_identity_provider: Fix `InvalidParameterException: ActiveEncryptionCertificate is not a valid key for SAML identity provider details` errors on resource Update
+```

.changelog/36323.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_securitylake_subscriber_notification
+```