chore(deps): update terraform cloudposse/s3-bucket/aws to v4 (release/v1) by renovate[bot] · Pull Request #130 · cloudposse/terraform-aws-s3-log-storage

renovate · 2025-08-26T00:02:55Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/s3-bucket/aws (source)	module	major	`3.1.3` → `4.15.0`

Release Notes

cloudposse/terraform-aws-s3-bucket (cloudposse/s3-bucket/aws)

`v4.15.0`

Compare Source

feat: enable Object Lock without a default retention rule @Benbentwo (#295)

what

Add a new object_lock_enabled (bool, default false) variable that enables S3 Object Lock on the bucket without configuring a bucket-wide default retention rule.
Convert the default_retention rule in aws_s3_bucket_object_lock_configuration.default to a dynamic block that is only rendered when object_lock_configuration is set.
Object Lock is still enabled implicitly whenever object_lock_configuration is provided, so existing configurations are unchanged.

why

Today the only way to set the bucket's object_lock_enabled flag is to pass object_lock_configuration, and doing so always creates an aws_s3_bucket_object_lock_configuration with a hardcoded rule { default_retention { … } }.
That makes the common WORM pattern impossible with this module: enable Object Lock on the bucket, then apply a retention period or legal hold per object at write time. With the current module every object is forced under a bucket-wide default retention.
AWS itself fully supports enabling Object Lock with no default retention (PutObjectLockConfiguration with ObjectLockEnabled=Enabled and no Rule). This change lets the module express that.

usage

# Enable Object Lock, no bucket-wide default retention — holds applied per object
module "bucket" {
  source  = "cloudposse/s3-bucket/aws"
  # ...
  versioning_enabled  = true
  object_lock_enabled = true
}

backward compatibility

Fully backward compatible. local.object_lock_enabled becomes local.enabled && (var.object_lock_enabled || var.object_lock_configuration != null), so any existing config that passes object_lock_configuration produces an identical plan (bucket flag on + the same default_retention rule).

references

AWS docs: S3 Object Lock overview — retention periods and legal holds are per-object; a bucket default retention is optional.

`v4.14.0`

Compare Source

feat(outputs): add bucket_hosted_zone_id output @RoseSecurity (#293)

what

Create a new bucket_hosted_zone_id output

why

Add the ability to output the Route 53 Hosted Zone ID for this bucket's region.

references

Closes #290

`v4.13.0`

Compare Source

feat: add bucket_namespace argument @QuentinBtd (#291)

what

Add bucket_namespace argument

why

AWS added regional namespaces for bucket.

references

https://registry.terraform.io/providers/hashicorp/aws/6.37.0/docs/resources/s3_bucket.html#bucket_namespace-7
https://aws.amazon.com/fr/blogs/aws/introducing-account-regional-namespaces-for-amazon-s3-general-purpose-buckets/

`v4.12.0`

Compare Source

🐛 Bug Fixes

Add blocked_encryption_types variable to fix perpetual SSE config drift @duality72 (#289)

what

Adds a new blocked_encryption_types variable (type list(string), default null) to the module.
Wires it into the rule block of aws_s3_bucket_server_side_encryption_configuration.
Documents the variable in variables.tf and the inputs table in README.md.

why

Fixes #287.

On hashicorp/aws provider >= 6.22.0, GetBucketEncryption returns blocked_encryption_types = ["NONE"] by default. The module's encryption rule omits the field, which the provider treats as an empty list. The two do not round-trip, so terraform plan shows a perpetual in-place update on aws_s3_bucket_server_side_encryption_configuration — applying does not stabilize the plan.

Exposing the field as an opt-in variable lets callers on provider >= 6.22.0 silence the drift by setting blocked_encryption_types = ["NONE"], without forcing a provider floor bump on callers still on older providers.

design note: why `null` default, not `["NONE"]`

The module's current provider floor is hashicorp/aws >= 4.9.0. The blocked_encryption_types argument was added to the AWS provider in v6.22.0. Defaulting to ["NONE"] would break every caller on provider < 6.22.0 with an "Unsupported argument" error.

There is no clean way to conditionally default based on resolved provider version (Terraform does not expose required_providers versions as HCL values). The null default mirrors the pattern used elsewhere in cloudposse modules for attributes gated behind newer provider versions: safe default, opt-in for callers who know they're on a new enough provider.

reviewer guide

variables.tf — new variable "blocked_encryption_types" block added immediately after bucket_key_enabled. Note the default = null and the description explaining the provider-version nuance.
main.tf (~line 86) — one new line inside the rule block: blocked_encryption_types = var.blocked_encryption_types. When the variable is null, the provider omits the attribute (standard Terraform null-handling), preserving existing behavior for all current callers.
README.md (inputs table, alphabetical position before bucket_key_enabled) — new row documenting the variable. Matches the style of adjacent rows.

test plan

terraform fmt -check passes
terraform validate passes with the current provider floor
Reviewer: confirm on provider >= 6.22.0 that setting blocked_encryption_types = ["NONE"] eliminates the drift described in #287
Reviewer: confirm on provider < 6.22.0 that the default (null) keeps behavior unchanged — no "Unsupported argument" error

`v4.11.0`

Compare Source

Add S3 Intelligent-Tiering archive configuration support @milldr (#286)

What

Add aws_s3_bucket_intelligent_tiering_configuration resource and intelligent_tiering_configuration variable to support configuring archive access tiers within the INTELLIGENT_TIERING storage class.

Why

The module already supports INTELLIGENT_TIERING as a lifecycle transition storage class, but there's no way to configure the archive access tiers (Archive Access, Deep Archive Access) that control when objects within Intelligent-Tiering are moved to cheaper archive storage. This is needed for cost optimization on buckets with infrequently accessed data.

Ref

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration

🤖 Automatic Updates

Fix go version in tests @osterman (#276)

what

Update go 1.24

why

Error loading shared library libresolv.so.2 in Go 1.20

References

Replace Makefile with atmos.yaml @osterman (#275)

what

Remove Makefile
Add atmos.yaml

why

Replace build-harness with atmos for readme genration

References

DEV-3229 Migrate from build-harness to atmos

`v4.10.0`

Compare Source

feat: Add filter_prefix, filter_suffix config options for queues and topics @vonZeppelin (#261)

what

Adds missing filter_prefix and filter_suffix options in event notifications config for queues and topics.
set lambda list filter arguments to optional

Signed-off-by: Leonid Bogdanov <leonidbogdanov86@gmail.com>

references

`v4.9.0`

Compare Source

feat: add s3 request payment config @nitrocode (#259)

what

add s3 request payment config

why

make requester pay

references

`v4.8.0`

Compare Source

feat: support eventbridge bucket notification @nitrocode (#255)

what

support eventbridge bucket notification

why

Emit s3 events to eventbridge

references

Closes #254

`v4.7.3`

Compare Source

🚀 Enhancements

fix: use new destination.bucket key in policy @nitrocode (#256)

what

use new destination.bucket key in policy

why

Support both deprecated destination_bucket and new destination.bucket
Previous changes created destination.bucket and left destination_bucket for backwards compatibility, as stated in variables.tf, and forgot to include the new value in the IAM policy

references

Closes #215

🐛 Bug Fixes

fix: use new destination.bucket key in policy @nitrocode (#256)

what

use new destination.bucket key in policy

why

Support both deprecated destination_bucket and new destination.bucket
Previous changes created destination.bucket and left destination_bucket for backwards compatibility, as stated in variables.tf, and forgot to include the new value in the IAM policy

references

Closes #215

`v4.7.2`

Compare Source

🚀 Enhancements

fix: correct bucket name to fix broken `-replication` role @amila-ku (#250)

what

Fixes replication IAM role name that gets created as '-replication'

why

Replication IAM role name gets created as '-replication'. This made the replication role unsusable.
Used Terraform version: 1.8.0

references

Resolves #251

`v4.7.1`

Compare Source

🚀 Enhancements

fix: s3 lambda event notification assignments @mpajuelofernandez (#253)

what

It seems there is a typo kind if error here

dynamic "lambda_function" {
    for_each = var.event_notification_details.lambda_list
    content {
      lambda_function_arn = lambda_function.value.arn
      events              = lambda.value.events
      filter_prefix       = lambda_function.value.filter_prefix
      filter_suffix       = lambda_function.value.filter_suffix
    }
  }

I think it should be

dynamic "lambda_function" {
    for_each = var.event_notification_details.lambda_list
    content {
      lambda_function_arn = lambda_function.value.arn
      events              = lambda_function.value.events
      filter_prefix       = lambda_function.value.filter_prefix
      filter_suffix       = lambda_function.value.filter_suffix
    }
  }

why

The S3 notification can not be created unless this is fixed

references

This should fix #252

🐛 Bug Fixes

fix: s3 lambda event notification assignments @mpajuelofernandez (#253)

what

It seems there is a typo kind if error here

dynamic "lambda_function" {
    for_each = var.event_notification_details.lambda_list
    content {
      lambda_function_arn = lambda_function.value.arn
      events              = lambda.value.events
      filter_prefix       = lambda_function.value.filter_prefix
      filter_suffix       = lambda_function.value.filter_suffix
    }
  }

I think it should be

dynamic "lambda_function" {
    for_each = var.event_notification_details.lambda_list
    content {
      lambda_function_arn = lambda_function.value.arn
      events              = lambda_function.value.events
      filter_prefix       = lambda_function.value.filter_prefix
      filter_suffix       = lambda_function.value.filter_suffix
    }
  }

why

The S3 notification can not be created unless this is fixed

references

This should fix #252

🤖 Automatic Updates

Update terratest to '>= 0.46.0' @osterman (#235)

what

Update terratest >= 0.46.0

why

Support OpenTofu for testing

References

https://github.com/gruntwork-io/terratest/releases/tag/v0.46.0
DEV-374 Add opentofu to all our Terragrunt Testing GHA matrix

Migrate new test account @osterman (#248)

what

Update .github/settings.yml
Update .github/chatops.yml files

why

Re-apply .github/settings.yml from org level to get terratest environment
Migrate to new test account

References

DEV-388 Automate clean up of test account in new organization
DEV-387 Update terratest to work on a shared workflow instead of a dispatch action
DEV-386 Update terratest to use new testing account with GitHub OIDC

Update .github/settings.yml @osterman (#247)

what

Update .github/settings.yml
Drop .github/auto-release.yml files

why

Re-apply .github/settings.yml from org level
Use organization level auto-release settings

references

DEV-1242 Add protected tags with Repository Rulesets on GitHub

Update .github/settings.yml @osterman (#246)

what

Update .github/settings.yml
Drop .github/auto-release.yml files

why

Re-apply .github/settings.yml from org level
Use organization level auto-release settings

references

DEV-1242 Add protected tags with Repository Rulesets on GitHub

`v4.7.0`

Compare Source

Make sure replica_kms_key_id is truly empty @stephan242 (#244)

references

closes #243

`v4.6.0`

Compare Source

Addition of S3 bucket event notification resource and Addition of S3 directory optional resource @mayank0202 (#240)

Issue - GH-239

what

This feature will make s3 event notifications which will have 3 options to trigger lambda or queue or topic so we can define a resource from this documentation.
aws_s3_bucket_notification

we also added s3 directory bucket which is a new feature in aws so addition of optional resource can be done if someone needs to use that with the help of terraform
aws_s3_directory_bucket

why

Enhanced Event-Driven Architecture: The introduction of S3 event notifications allows the S3 bucket to trigger Lambda functions, SQS queues, or SNS topics. This facilitates seamless integration with other AWS services and enables real-time processing of data, which is crucial for building event-driven architectures.
New AWS Feature Adoption: The addition of the aws_s3_directory_bucket resource reflects the latest AWS capabilities, ensuring that our infrastructure is up-to-date with current AWS offerings. This optional resource allows users to leverage new AWS features as they become available, promoting flexibility and future-proofing our Terraform configurations.
Improved Flexibility: By providing options to trigger different AWS services (Lambda, SQS, SNS), the solution becomes more versatile, catering to a wide range of use cases and workflows. This flexibility can lead to more efficient and effective data processing pipelines.
Reduced Operational Overhead: Automating responses to S3 events using Lambda functions, queues, or topics can significantly reduce manual intervention and operational overhead. This leads to improved efficiency and allows teams to focus on higher-value tasks.

references

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_notification
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_directory_bucket
https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-overview.html

`v4.5.0`

Compare Source

feat: Add missed tags @MaxymVlasov (#241)

what

Add tags to resources where they missed

`v4.4.0`

Compare Source

226: Add Expected Bucket Owner @houserx-ioannis (#238)

what

This PR addresses #226 about not being able to specify expected bucket owner in various S3 resources.

why

From AWS docs:

Because Amazon S3 identifies buckets based on their names, an application that uses an incorrect bucket name in a request could inadvertently perform operations against a different bucket than expected. To help avoid unintentional bucket interactions in situations like this, you can use bucket owner condition. Bucket owner condition enables you to verify that the target bucket is owned by the expected AWS account, providing an additional layer of assurance that your S3 operations are having the effects you intend.

references

#226

`v4.3.0`

Compare Source

Enforce the usage of modern TLS versions (1.2 or higher) for S3 connections @amontalban (#237)

what

This variables adds a policy to the bucket to deny connections that do not use TLS 1.2 or higher.

why

This is required by our security team.

references

https://repost.aws/knowledge-center/s3-enforce-modern-tls

🚀 Enhancements

Bump github.com/hashicorp/go-getter from 1.7.1 to 1.7.4 in /test/src @dependabot (#230)

Bumps github.com/hashicorp/go-getter from 1.7.1 to 1.7.4.

Release notes

Sourced from github.com/hashicorp/go-getter's releases.

v1.7.4

What's Changed

Escape user-provided strings in git commands hashicorp/go-getter#483

Fixed a bug in .netrc handling if the file does not exist hashicorp/go-getter#433

Full Changelog: https://github.com/hashicorp/go-getter/compare/v1.7.3...v1.7.4

v1.7.3

What's Changed

SEC-090: Automated trusted workflow pinning (2023-04-21) by @hashicorp-tsccr in hashicorp/go-getter#432

SEC-090: Automated trusted workflow pinning (2023-09-11) by @hashicorp-tsccr in hashicorp/go-getter#454

SEC-090: Automated trusted workflow pinning (2023-09-18) by @hashicorp-tsccr in hashicorp/go-getter#458

don't change GIT_SSH_COMMAND when there is no sshKeyFile by @jbardin in hashicorp/go-getter#459

New Contributors

@hashicorp-tsccr made their first contribution in hashicorp/go-getter#432

Full Changelog: https://github.com/hashicorp/go-getter/compare/v1.7.2...v1.7.3

v1.7.2

What's Changed

Don't override GIT_SSH_COMMAND when not needed by @nl-brett-stime hashicorp/go-getter#300

Full Changelog: https://github.com/hashicorp/go-getter/compare/v1.7.1...v1.7.2

Commits

268c11c escape user provide string to git (#483)
975961f Merge pull request #433 from adrian-bl/netrc-fix
0298a22 Merge pull request #459 from hashicorp/jbardin/setup-git-env
c70d9c9 don't change GIT_SSH_COMMAND if there's no keyfile
3d5770f Merge pull request #458 from hashicorp/tsccr-auto-pinning/trusted/2023-09-18
0688979 Result of tsccr-helper -log-level=info -pin-all-workflows .
e66f244 Merge pull request #454 from hashicorp/tsccr-auto-pinning/trusted/2023-09-11
e80b3dc Result of tsccr-helper -log-level=info -pin-all-workflows .
2d49e24 Merge pull request #432 from hashicorp/tsccr-auto-pinning/trusted/2023-04-21
5ccb39a Make addAuthFromNetrc ignore ENOTDIR errors
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

🤖 Automatic Updates

Bump github.com/hashicorp/go-getter from 1.7.1 to 1.7.4 in /test/src @dependabot (#230)

Bumps github.com/hashicorp/go-getter from 1.7.1 to 1.7.4.

Release notes

Sourced from github.com/hashicorp/go-getter's releases.

v1.7.4

What's Changed

Escape user-provided strings in git commands hashicorp/go-getter#483

Fixed a bug in .netrc handling if the file does not exist hashicorp/go-getter#433

Full Changelog: https://github.com/hashicorp/go-getter/compare/v1.7.3...v1.7.4

v1.7.3

What's Changed

SEC-090: Automated trusted workflow pinning (2023-04-21) by @hashicorp-tsccr in hashicorp/go-getter#432

SEC-090: Automated trusted workflow pinning (2023-09-11) by @hashicorp-tsccr in hashicorp/go-getter#454

SEC-090: Automated trusted workflow pinning (2023-09-18) by @hashicorp-tsccr in hashicorp/go-getter#458

don't change GIT_SSH_COMMAND when there is no sshKeyFile by @jbardin in hashicorp/go-getter#459

New Contributors

@hashicorp-tsccr made their first contribution in hashicorp/go-getter#432

Full Changelog: https://github.com/hashicorp/go-getter/compare/v1.7.2...v1.7.3

v1.7.2

What's Changed

Don't override GIT_SSH_COMMAND when not needed by @nl-brett-stime hashicorp/go-getter#300

Full Changelog: https://github.com/hashicorp/go-getter/compare/v1.7.1...v1.7.2

Commits

268c11c escape user provide string to git (#483)
975961f Merge pull request #433 from adrian-bl/netrc-fix
0298a22 Merge pull request #459 from hashicorp/jbardin/setup-git-env
c70d9c9 don't change GIT_SSH_COMMAND if there's no keyfile
3d5770f Merge pull request #458 from hashicorp/tsccr-auto-pinning/trusted/2023-09-18
0688979 Result of tsccr-helper -log-level=info -pin-all-workflows .
e66f244 Merge pull request #454 from hashicorp/tsccr-auto-pinning/trusted/2023-09-11
e80b3dc Result of tsccr-helper -log-level=info -pin-all-workflows .
2d49e24 Merge pull request #432 from hashicorp/tsccr-auto-pinning/trusted/2023-04-21
5ccb39a Make addAuthFromNetrc ignore ENOTDIR errors
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Update release workflow to allow pull-requests: write @osterman (#234)

what

Update workflow (.github/workflows/release.yaml) to have permission to comment on PR

why

So we can support commenting on PRs with a link to the release

Update GitHub Workflows to use shared workflows from '.github' repo @osterman (#233)

what

Update workflows (.github/workflows) to use shared workflows from .github repo

why

Reduce nested levels of reusable workflows

Update GitHub Workflows to Fix ReviewDog TFLint Action @osterman (#232)

what

Update workflows (.github/workflows) to add issue: write permission needed by ReviewDog tflint action

why

The ReviewDog action will comment with line-level suggestions based on linting failures

Update GitHub workflows @osterman (#231)

what

Update workflows (.github/workflows/settings.yaml)

why

Support new readme generation workflow.
Generate banners

Bump golang.org/x/net from 0.8.0 to 0.23.0 in /test/src @dependabot (#229)

Bumps golang.org/x/net from 0.8.0 to 0.23.0.

Commits

c48da13 http2: fix TestServerContinuationFlood flakes
762b58d http2: fix tipos in comment
ba87210 http2: close connections when receiving too many headers
ebc8168 all: fix some typos
3678185 http2: make TestCanonicalHeaderCacheGrowth faster
448c44f http2: remove clientTester
c7877ac http2: convert the remaining clientTester tests to testClientConn
d8870b0 http2: use synthetic time in TestIdleConnTimeout
d73acff http2: only set up deadline when Server.IdleTimeout is positive
89f602b http2: validate client/outgoing trailers
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Use GitHub Action Workflows from `cloudposse/.github` Repo @osterman (#227)

what

Install latest GitHub Action Workflows

why

Use shared workflows from cldouposse/.github repository
Simplify management of workflows from centralized hub of configuration

Add GitHub Settings @osterman (#221)

what

Install a repository config (.github/settings.yaml)

why

Programmatically manage GitHub repo settings

Update README.md and docs @cloudpossebot (#218)

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

Update Scaffolding @osterman (#219)

what

Reran make readme to rebuild README.md from README.yaml
Migrate to square badges
Add scaffolding for repo settings and Mergify

why

Upstream template changed in the .github repo
Work better with repository rulesets
Modernize look & feel

`v4.2.0`

Compare Source

Added IP-based statement in bucket policy @soya-miyoshi (#216)

what

Allows users to specify a list of source IP addresses from which access to the S3 bucket is allowed.
Adds dynamic statement that uses the NotIpAddress condition to deny access from any IP address not listed in the source_ip_allow_list variable.

why

Use cases:

Restricting access to specific physical locations, such as an office or home network

references

`v4.1.0`

Compare Source

🚀 Enhancements

fix: use for_each instead of count in aws_s3_bucket_logging @wadhah101 (#212)

what

Replaced the count with a for_each inside aws_s3_bucket_logging.default

there's no point in the try since the type is clearly defined as list

why

When the bucket_name within logging attribute is dynamically defined, like in the case of referencing a bucket created by terraform for logging

  logging = [
    {
      bucket_name = module.logging_bucket.bucket_id
      prefix      = "data/"
    }
  ]

we get this error

For each can work better in this case and will solve the previous error

references

🤖 Automatic Updates

Update README.md and docs @cloudpossebot (#214)

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

Update README.md and docs @cloudpossebot (#213)

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

Update README.md and docs @cloudpossebot (#209)

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

`v4.0.1`

Compare Source

🐛 Bug Fixes

Fix bug in setting dynamic `encryption_configuration` value @LawrenceWarren (#206)

what

When trying to create an S3 bucket, the following error is encountered:

Error: Invalid dynamic for_each value

  on .terraform/main.tf line 225, in resource "aws_s3_bucket_replication_configuration" "default":
 225:           for_each = try(compact(concat(
 226:             [try(rule.value.destination.encryption_configuration.replica_kms_key_id, "")],
 227:             [try(rule.value.destination.replica_kms_key_id, "")]
 228:           ))[0], [])
    ├────────────────
    │ rule.value.destination.encryption_configuration is null
    │ rule.value.destination.replica_kms_key_id is "arn:aws:kms:my-region:my-account-id:my-key-alias"

Cannot use a string value in for_each. An iterable collection is required.

This is caused in my case by having s3_replication_rules.destination.encryption_configuration.replica_kms_key_id set.

why

There is a bug when trying to create an S3 bucket, which causes an error that stops the bucket being created
- Basically, there are two attributes that do the same thing (for backwards compatability)
  - s3_replication_rules.destination.encryption_configuration.replica_kms_key_id (newer)
  - s3_replication_rules.destination.replica_kms_key_id (older)
- There is logic to:
  - A) use the newer of these two attributes
  - B) fall back to the older of the attributes if it is set and the newer is not
  - C) fall back to an empty array if nothing is set
- There is a bug in steps A/B, where by selecting one or the other, we end up with the string value, and not an iterable
- The simplest solution, which I have tested successfully on existing buckets, is to wrap the output of that logic in a list
This error is easily replicable by trying compact(concat([try("string", "")], [try("string", "")]))[0] in the Terraform console, which is a simplified version of the existing logic used above
The table below demonstrates the possible values of the existing code - you can see the outputs for value 2, value 3, and value 4 are not lists:

Key	Value 1	Value 2	Value 3	Value 4
newer	`null`	`"string1"`	`null`	`"string1"`
older	`null`	`null`	`"string2"`	`"string2"`
output	`[]`	`"string1"`	`"string2"`	`"string1"`

`v4.0.0`

Compare Source

Bug fixes and enhancements combined into a single breaking release @aknysh (#202)

Breaking Changes

Terraform version 1.3.0 or later is now required.

`policy` input removed

The deprecated policy input has been removed. Use source_policy_documents instead.

Convert from

policy = data.aws_iam_policy_document.log_delivery.json

to

source_policy_documents = [data.aws_iam_policy_document.log_delivery.json]

Do not use list modifiers like sort, compact, or distinct on the list, or it will trigger an Error: Invalid count argument. The length of the list must be known at plan time.

Logging configuration converted to list

To fix #182, the logging input has been converted to a list. If you have a logging configuration, simply surround it with brackets.

Replication rules brought into alignment with Terraform resource

Previously, the s3_replication_rules input had some deviations from the aws_s3_bucket_replication_configuration Terraform resource. Via the use of optional attributes, the input now closely matches the resource while providing backward compatibility, with a few exceptions.

Replication source_selection_criteria.sse_kms_encrypted_objects was documented as an object with one member, enabled, of type bool. However, it only worked when set to the string "Enabled". It has been replaced with the resource's choice of status of type String.
Previously, Replication Time Control could not be set directly. It was implicitly enabled by enabling Replication Metrics. We preserve that behavior even though we now add a configuration block for replication_time. To enable Metrics without Replication Time Control, you must set replication_time.status = "Disabled".

These are not changes, just continued deviations from the resources:

existing_object_replication cannot be set.
token to allow replication to be enabled on an Object Lock-enabled bucket cannot be set.

what

Remove local local.source_policy_documents and deprecated variable policy (because of that, pump the module to a major version)
Convert lifecycle_configuration_rules and s3_replication_rules from loosely typed objects to fully typed objects with optional attributes.
Use local bucket_id variable
Remove comments suppressing Bridgecrew rules
Update tests to Golang 1.20

why

The number of policy documents needs to be known at plan time. Default value of policy was empty, meaning it had to be removed based on content, which would not be known at plan time if the policy input was being generated.
Closes #167,

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

mergify · 2025-08-26T00:03:34Z

/terratest

renovate Bot added the auto-update This PR was automatically generated label Aug 26, 2025

renovate Bot requested review from a team as code owners August 26, 2025 00:02

renovate Bot requested review from Hans Donner (hans-d) and Kevin (kevcube) and removed request for a team August 26, 2025 00:02

renovate Bot force-pushed the renovate/release/v1-cloudposse-s3-bucket-aws-4.x branch from e89b894 to e7dbf08 Compare February 26, 2026 23:11

renovate Bot force-pushed the renovate/release/v1-cloudposse-s3-bucket-aws-4.x branch 2 times, most recently from 3131016 to bbc3dee Compare April 22, 2026 20:02

renovate Bot force-pushed the renovate/release/v1-cloudposse-s3-bucket-aws-4.x branch from bbc3dee to a86c5f4 Compare June 27, 2026 07:11

chore(deps): update terraform cloudposse/s3-bucket/aws to v4

b8e478c

renovate Bot force-pushed the renovate/release/v1-cloudposse-s3-bucket-aws-4.x branch from a86c5f4 to b8e478c Compare July 21, 2026 03:39

Navigation Menu

Uh oh!

Uh oh!

chore(deps): update terraform cloudposse/s3-bucket/aws to v4 (release/v1) - #130

chore(deps): update terraform cloudposse/s3-bucket/aws to v4 (release/v1)#130
renovate[bot] wants to merge 1 commit into
release/v1from
renovate/release/v1-cloudposse-s3-bucket-aws-4.x

renovate Bot commented Aug 26, 2025 •

edited

Loading

v1.7.4

What's Changed

v1.7.3

What's Changed

New Contributors

v1.7.2

What's Changed

v1.7.4

What's Changed

v1.7.3

What's Changed

New Contributors

v1.7.2

What's Changed

Uh oh!

mergify Bot commented Aug 26, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

renovate Bot commented Aug 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

what

why

usage

backward compatibility

references

what

why

references

what

why

references

🐛 Bug Fixes

what

why

design note: why null default, not ["NONE"]

reviewer guide

test plan

What

Why

Ref

🤖 Automatic Updates

what

why

References

what

why

References

what

references

what

why

references

what

why

references

🚀 Enhancements

what

why

references

🐛 Bug Fixes

what

why

references

🚀 Enhancements

what

why

references

🚀 Enhancements

what

why

references

🐛 Bug Fixes

what

why

references

🤖 Automatic Updates

what

why

References

what

why

References

what

why

references

what

why

references

references

what

why

references

what

what

renovate Bot commented Aug 26, 2025 •

edited

Loading

design note: why `null` default, not `["NONE"]`