Merge branch 'main' into HEAD

# Conflicts:
#	internal/service/ec2/errors.go

.changelog/26755.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+resource/aws_cloudwatch_event_connection: Add plan-time validation preventing empty `auth_parameters.oauth.oauth_http_parameters` or `auth_parameters.invocation_http_parameters`
+`body`, `header` and `query_string` configuration blocks
+```

.changelog/30493.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_elasticache_replication_group: Fix `unexpected state 'snapshotting'` errors when increasing or decreasing replica count
+```

.changelog/34233.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+provider: The `use_fips_endpoint` flag is now ignored for any service with a custom endpoint configured in `endpoints`.
+```

.changelog/34293.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_pipes_pipe: Mark `source_parameters.self_managed_kafka_parameters.credentials.basic_auth` as Optional
+```

.changelog/34819.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_elasticache_replication_group: Decrease replica count after other updates
+```

.changelog/35662.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_organizations_account: Allow import of accounts with IAM access to the AWS Billing and Cost Management console
+```

.changelog/35677.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+data-source/aws_iam_policy_document: Add `minified_json` attribute
+```

.changelog/36268.txt

@@ -0,0 +1,31 @@
+```release-note:bug
+resource/aws_securitylake_subscriber: Allow more than one log source
+```
+
+```release-note:bug
+resource/aws_securitylake_aws_log_source: Correctly handles unspecified `source_version`
+```
+
+```release-note:bug
+resource/aws_securitylake_aws_log_source: Prevents errors when creating multiple log sources concurrently
+```
+
+```release-note:bug
+resource/aws_securitylake_custom_log_source: Validates length of `source_name` parameter
+```
+
+```release-note:bug
+resource/aws_securitylake_custom_log_source: Prevents errors when creating multiple log sources concurrently
+```
+
+```release-note:bug
+resource/aws_securitylake_subscriber: Correctly handles unspecified `access_type`
+```
+
+```release-note:bug
+resource/aws_securitylake_subscriber: Correctly requires `source_name` parameter for `aws_log_source_resource` and `custom_log_source_resource`
+```
+
+```release-note:bug
+resource/aws_securitylake_subscriber: Correctly handles unspecified `source_version` parameter for `aws_log_source_resource` and `custom_log_source_resource`
+```

.changelog/36506.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_mq_broker: Do not reboot on changes to `maintenance_window_start_time` or `auto_minor_version_upgrade`
+```

.changelog/36511.txt

@@ -0,0 +1,23 @@
+```release-note:enhancement
+resource/aws_fsx_ontap_file_system: Support up to 12 `ha_pairs`
+```
+
+```release-note:enhancement
+resource/aws_fsx_ontap_file_system: Increase `storage_capacity` maximum to 1PiB
+```
+
+```release-note:enhancement
+resource/aws_fsx_ontap_file_system: Update `throughput_capacity_per_ha_pair` to support all values from `throughput_capacity`
+```
+
+```release-note:enhancement
+resource/aws_fsx_ontap_file_system: Add support for specifying 1 ha_pair with `SINGLE_AZ_1` and `MULTI_AZ_1` deployment types
+```
+
+```release-note:enhancement
+resource/aws_fsx_ontap_volume: Add `aggregate_configuration` configuration block
+```
+
+```release-note:enhancement
+resource/aws_fsx_ontap_volume: Add `size_in_bytes` and `volume_style` arguments
+```

.changelog/36600.txt

@@ -0,0 +1,11 @@
+```release-note:new-resource
+aws_datazone_domain
+```
+
+```release-note:new-resource
+aws_datazone_environment_blueprint_configuration
+```
+
+```release-note:new-data-source
+aws_datazone_environment_blueprint
+```

.changelog/36778.txt

@@ -0,0 +1,11 @@
+```release-note:bug
+data-source/aws_resourceexplorer2_search: Fix panic caused by bad mappping between Terraform and AWS schemas
+```
+
+```release-note:bug
+data-source/aws_resourceexplorer2_search: Fix 401 unauthorized error due to missing `view_arn` in the AWS API request
+```
+
+```release-note:bug
+data-source/aws_resourceexplorer2_search: Fix state persistence and data types
+```

.changelog/37002.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+data-source/aws_instance: Add `launch_time` attribute
+```

.changelog/37017.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_paymentcryptography_key
+```

.changelog/37018.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_ecs_account_setting_default: Add support for `fargateTaskRetirementWaitPeriod` value in `Name` argument
+```

.changelog/37019.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_ecs_service: Add `volume_configuration` argument
+```
+
+```release-note:enhancement
+resource/aws_ecs_task_definition: Add `configure_at_launch` parameter in `volume` argument
+```

.changelog/37020.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_paymentcryptography_key_alias
+```

.changelog/37092.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_kms_custom_key_store: Change `trust_anchor_certificate` to [ForceNew](https://developer.hashicorp.com/terraform/plugin/sdkv2/schemas/schema-behaviors#forcenew)
+```

.changelog/37130.txt

@@ -0,0 +1,4 @@
+
+```release-note:enhancement
+resource/aws_cloudwatch_event_target: Add `force_destroy` argument
+```

.changelog/37135.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_pipes_pipe: Add `log_configuration` argument
+```

.changelog/37140.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_kms_key: Add `rotation_period_in_days` argument
+```

.changelog/37158.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_bedrockagent_data_source
+```

.changelog/37176.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_vpc_endpoint_service_private_dns_verification
+```

.changelog/37182.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_elasticache_replication_group: Increase default Delete timeout to 45 minutes
+```
+
+```release-note:enhancement
+resource/aws_elasticache_replication_group: Use the configured Delete timeout when detaching from any global replication group
+```

.changelog/37185.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_bedrockagent_agent_knowledge_base_association
+```

.changelog/37205.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_bcmdataexports_export: Fix `table_configurations` expand/flatten
+```

.changelog/37218.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_chatbot_slack_workspace
+```

.changelog/37251.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+data-source/aws_rds_orderable_db_instance: Fix `InvalidParameterValue: Invalid value 3412 for MaxRecords. Must be between 20 and 1000` errors
+```

.changelog/37271.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+data-source/aws_rds_engine_version: Add `supports_limitless_database` attribute
+```

.changelog/37288.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_dynamodb_table_export: Add plan-time validation of `table_arn`
+```

.changelog/37306.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+data-source/aws_bedrock_foundation_models: Fix validation regex for the `by_provider` argument
+```

.changelog/37332.txt

@@ -0,0 +1,19 @@
+```release-note:enhancement
+resource/aws_securitylake_subscriber_notification: Deprecates `endpoint_id` in favor of `subscriber_endpoint`
+```
+
+```release-note:bug
+resource/aws_securitylake_subscriber_notification: Requires value for `configuration.https_notification_configuration.endpoint`
+```
+
+```release-note:enhancement
+resource/aws_securitylake_subscriber_notification: Better handles importing resource
+```
+
+```release-note:enhancement
+resource/aws_securitylake_subscriber_notification: Handles `configuration.https_notification_configuration.authorization_api_key_value` as sensitive value
+```
+
+```release-note:bug
+resource/aws_securitylake_subscriber_notification: No longer recreates resource when not needed
+```

.changelog/37347.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_glue_job: Fix `interface conversion: interface {} is nil, not map[string]interface {}` panic when `notify_delay_after` is empty (`null`)
+```

.changelog/37353.txt

@@ -0,0 +1,11 @@
+```release-note:bug
+resource/aws_fsx_ontap_storage_virtual_machine: Correctly set `tags` and `tags_all` on resource Read
+```
+
+```release-note:bug
+data-source/aws_fsx_ontap_storage_virtual_machine: Correctly set `tags` on Read
+```
+
+```release-note:bug
+resource/aws_fsx_openzfs_file_system: Correctly set `tags` and `tags_all` on resource Read
+```

.changelog/37361.txt

@@ -0,0 +1,9 @@
+```release-note:enhancement
+resource/aws_budgets_budget: Add `tags` argument
+```
+```release-note:enhancement
+resource/aws_budgets_budget_action: Add `tags` argument
+```
+```release-note:enhancement
+data-source/aws_budgets_budget: Add `tags` attribute
+```

.changelog/37394.txt

@@ -0,0 +1,9 @@
+```release-note:bug
+resource/aws_opensearch_domain: Wait for `auto_tune_options` to be applied during creation
+```
+```release-note:bug
+resource/aws_opensearch_domain: Fix handling of unset `auto_tune_options.rollback_on_disable` argument
+```
+```release-note:bug
+resource/aws_elasticsearch_domain: Fix handling of unset `auto_tune_options.rollback_on_disable` argument
+```

.changelog/37404.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/provider: Change the AWS SDK for Go v2 API client [`BackoffDelayer`](https://pkg.go.dev/github.com/aws/[email protected]/aws/retry#BackoffDelayer) to maintain behavioral compatibility with AWS SDK for Go v1
+```

.changelog/37405.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_bedrockagent_agent: Fix to use the configured `prepare_agent` value (or default value of `true` when omitted) for all create and update operations
+```

.changelog/37433.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lakeformation_data_cells_filter: Fix inconsistent `state` error when using `row_filter.all_rows_wildcard`
+```

.changelog/37450.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ram_principal_association: Correct plan-time validation of `principal` to fix `panic: unexpected format for ID parts ([...]), the following id parts indexes are blank ([1])`
+```

.changelog/37472.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_dynamodb_table: Fix `UnknownOperationException: Tagging is not currently supported in DynamoDB Local` errors on resource Read
+```

.changelog/37481.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_ssm_resource_data_sync: Add plan-time validation of `s3_destination.kms_key_arn`, `s3_destination.region` and `s3_destination.sync_format`
+```

.changelog/37483.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_iam_server_certificate: Now correctly reads tags after update and on read.
+```

.changelog/37510.txt

@@ -0,0 +1,15 @@
+```release-note:enhancement
+resource/aws_route53_health_check: Add plan-time validation of `cloudwatch_alarm_region`
+```
+
+```release-note:enhancement
+resource/aws_route53_vpc_association_authorization: Add plan-time validation of `vpc_region`
+```
+
+```release-note:enhancement
+resource/aws_route53_zone_association: Add plan-time validation of `vpc_region`
+```
+
+```release-note:enhancement
+resource/aws_route53_record: Add plan-time validation of `latency_routing_policy.region`
+```

.changelog/37534.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_vpc_endpoint_service: Fix destroy error when endpoint service is deleted out-of-band
+```

.changelog/37548.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_transfer_ssh_key: Add `ssh_key_id` attribute
+```

.changelog/37565.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_route53_record: Change region default to us-east-1
+```

.changelog/37570.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_dynamodb_table_replica: Correctly set `kms_key_arn` on Read
+```

.changelog/37573.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_api_gateway_deployment: Add `canary_settings` attribute
+```

.changelog/37581.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_m2_deployment: Fix `state` error on `deployment_id` during start/stop update
+```

.changelog/37587.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lightsail_instance: Fix crash when reading a resource that has a key-only tag
+```

.changelog/37588.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_wafv2_web_acl: Add `api_gateway`, `app_runner_service`, `cognito_user_pool`, and `verified_access_instance` configuration blocks to `association_config.request_body`
+```

.changelog/37593.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_kms_grant: Change `grant_token` to [`Sensitive`](https://developer.hashicorp.com/terraform/plugin/best-practices/sensitive-state#using-sensitive-flag-functionality)
+```

.changelog/37611.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_storagegateway_smb_file_share: Fix crash when `cache_attributes` is removed on update
+```

.changelog/37612.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_iam_openid_connect_provider: Allow `client_id_list` to be updated in-place
+```

.changelog/37618.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+data-source/aws_route53_traffic_policy_document: Add support for `application-load-balancer`, `elastic-beanstalk` and `network-load-balancer` `endpoint.type` values
+```

.changelog/37624.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lambda_function: Remove `replace_security_group_on_destroy` and `replacement_security_group_ids` deprecations, re-implement with alternate workflow
+```

.changelog/37626.txt

@@ -0,0 +1,2 @@
+```release-note:bug
+resource/aws_ssm_patch_baseline: Correct handling of `default_baseline`

.changelog/37628.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_vpc_endpoint_private_dns
+```

.changelog/37632.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_mwaa_environment: Add `max_webservers` and `min_webservers` attributes
+```

.changelog/37643.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_lambda_runtime_management_config
+```