Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.12.26 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.15.1 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.15.1 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
Added a new module monorepo-helpers that contains scripts that help with adapting CI/CD pipelines for infrastructure code to monorepo setups. These scripts can be used to setup pipelines that only run tests on the infrastructure modules that changed (as opposed to always running all tests on every change). Refer to the module docs for more info.
You can now filter in or out deleted folders when calling git-updated-folders. This can be used to implement destroy workflows in your pipelines. Refer to the updated documentation for more information about this feature.
We have changed an upstream module that creates S3 buckets to require MFA when performing delete operations. From this release, only the bucket owner that is logged in as AWS root account can enable MFA Delete feature and perform DELETE actions on S3 buckets. This is a more secure default and the one recommended by the CIS AWS Foundations v1.4 benchmark. This is a backwards incompatible change, so please see the migration guide below. This applies to the cloudtrail, aws-config-multi-region and account baseline modules.
Dependency updates
Update dependency gruntwork-io/terraform-aws-security to v0.50.0
Update dependency gruntwork-io/terraform-aws-service-catalog to v0.50.0
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.15.1 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.15.1 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
The default Kubernetes version deployed by the control plane module has been updated to 1.21. If you wish to maintain backward compatibility with your existing setup, you will want to configure the kubernetes_version parameter to the version of Kubernetes you are currently using. Note that 1.21 requires kubergrunt version 0.7.3 and above.
The default cluster-autoscaler version has been updated to 1.21. If you wish to maintain backward compatibility with your existing setup, you will want to configure the cluster_autoscaler_version input variable.
Updated eks-aws-auth-merger and eks-k8s-role-mapping modules to use kubernetes terraform provider version 2.x. You must update your provider configuration to be compatible with version 2.x. Refer to the official upgrade guide for more information.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.15.1 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
Added ability to pass in an IAM role ARN directly to avoid depending on a data source in the workers modules, which can be a source of perpetual diffs.
Fix undocumented variable multi_instance_overrides so you can also set weighted_capacity. Also add field to documentation.
Note that this introduces a format change - if you were using multi_instance_overrides before, you will need to update your code to use the new format. If you had:
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.15.1 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.15.1 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.15.1 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
api-gateway-proxy: This module can be used to deploy API Gateway to proxy all requests to lambda functions without having to define each method. This module supports basic path based routing for configuring multiple lambda functions under a single API Gateway.
api-gateway-proxy-methods: This is a helper module to setup proxy methods to a lambda function on API Gateway.
Refer to the module docs and examples for more information on these new modules.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.12.26 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.15.1 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
You can now configure deduplication and FIFO throughput limits on the sqs module using the new deduplication_scope and fifo_throughput_limit input variables, respectively.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.15.1 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.15.1 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.15.1 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
Set MFA Delete to false by default. This release reverts v0.50.0. There is a manual step required to enable MFA Delete in the S3 bucket, so it is not possible to create a bucket with mfa_delete = true by default. Read more about it at the private-s3-bucket README.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.12.26 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
We have removed the opt_out_regions input variable from all the multi-region modules (e.g., aws-config-multi-region). This should have been done in v0.51.0, but was accidentally missed. If you were setting this variable before, please remove it from your code, and instead, exclude those regions from opt_in_regions (which is now a required parameter).
We have updated the examples to not include ap-northeast-3 in opt_in_regions. This is a brand new AWS region and many services, such as AWS Config, are not yet fully supported in that region. We recommend excluding it from your opt_in_regions variables too, as otherwise, you may get a number of confusing errors.
We have refactored all our multi-region modules (the ones that have -multi-region in the name) to no longer create nested provider blocks. Instead, providers must be passed in now via the providers map. This reduces the number of providers that Terraform must instantiate, making the multi-region modules much faster and more stable to use. It also gives you full control over how to authenticate to your various AWS accounts. However, this is a backwards incompatible change, so make sure to read the migration guide below.
To update the multi-region modules, we updated the Golang generator code too. It no longer creates nested provider blocks or the local.all_regions variable and no longer supports a SeedRegion param. However, it does support new params to configure Terraform and AWS provider version constraints. These changes are also backwards incompatible, so make sure to read the migration guide below.
We've fixed small bugs in the aws-config, aws-config-bucket, and kms-master-key modules so they no longer create data sources when create_resources is set to false.
Set mfa_delete = true for S3 buckets [BACKWARDS INCOMPATIBLE]
For the private-s3-bucket module, and all modules that depend on it (e.g., aws-config-bucket, cloudtrail-bucket), we have changed the default for MFA delete to be enabled. This is a more secure default and the one recommended by the CIS AWS Foundations v1.4 benchmark. This is a backwards incompatible change, so please see the migration guide below.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.12.26 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
Updated modules to use kubernetes terraform provider version 2.x. You must update your provider configuration to be compatible with version 2.x. Refer to the official upgrade guide for more information.
For terraform, update your kubernetes provider block.
For terragrunt, update your generate block to support kubernetes provider 2.x.
Update dependency versions: We have updated the versions of a number of dependencies in this repo. Most of these are related to our on-going Terraform 1.0 upgrade. We still have a few more modules to go, so we recommend waiting a little longer, and waiting for our official announcement and upgrade guide before upgrading to 1.0. Here are the versions that have been updated in this release:
Update dependency gruntwork-io/terraform-aws-ci to v0.38.0
Update dependency gruntwork-io/terraform-aws-data-storage to v0.21.0
Update dependency gruntwork-io/terraform-aws-monitoring to v0.30.0
Update dependency gruntwork-io/terraform-aws-eks to v0.43.0
Update account-baseline-xxx modules to new multi-region approach. In v0.51.0 of terraform-aws-security, we refactored how we build multi-region modules—that is, those modules that deploy resources across every single AWS region, such as aws-config-multi-region—to no longer create nested provider blocks, and instead, have users pass in providers via the providers map. In this release, we have updated the account-baseline-xxx modules (e.g., account-baseline-root) to use this new release of terraform-aws-security and to use the same behavior with providers. This reduces the number of providers that Terraform must instantiate, making the account-baseline-xxx modules much faster and more stable to use. It also gives you full control over how to authenticate to your various AWS accounts. However, this is a backwards incompatible change, so make sure to read the migration guide below.
Update dependency versions: We have updated the versions of a number of dependencies in this repo. Most of these are related to our on-going Terraform 1.0 upgrade. We still have a few more modules to go, so we recommend waiting a little longer, and waiting for our official announcement and upgrade guide before upgrading to 1.0. Here are the versions that have been updated in this release:
Update dependency gruntwork-io/terraform-aws-messaging to v0.7.0
Update dependency gruntwork-io/terraform-aws-lambda to v0.13.0
Update dependency gruntwork-io/kubergrunt to v0.7.3
Update dependency gruntwork-io/terratest to v0.37.1
Update dependency gruntwork-io/terraform-aws-ci to v0.37.8
Update dependency gruntwork-io/terraform-aws-data-storage to v0.20.5
Update dependency gruntwork-io/terraform-aws-asg to v0.15.0
Update dependency gruntwork-io/terraform-aws-vpc to v0.17.0
Update dependency gruntwork-io/terraform-aws-server to v0.13.0
Update dependency gruntwork-io/terraform-aws-load-balancer to v0.27.0
Update dependency gruntwork-io/terraform-aws-cache to v0.16.0
Update dependency gruntwork-io/terraform-aws-ecs to v0.30.1
Update dependency gruntwork-io/terraform-aws-static-assets to v0.11.0
Update dependency gruntwork-io/terraform-aws-openvpn to v0.16.0
Update dependency gruntwork-io/terraform-aws-server to v0.12.3
Update dependency gruntwork-io/terraform-aws-monitoring to v0.29.3
Update dependency gruntwork-io/terraform-aws-ci to v0.37.7
Update dependency gruntwork-io/terragrunt to v0.31.1
Update dependency gruntwork-io/terraform-aws-vpc to v0.16.0. This is a backward incompatible update. Refer to the underlying release note for more information on the update.
Update dependency gruntwork-io/terraform-aws-eks to v0.42.2
Updated docs and comments for a few variables in eks-cluster and route53.
All packer templates have been updated to take in an availability_zone variable, which can be used to specify which AZ to use when spinning up the build instance. This is useful to avoid problematic AZs that do not have standard instance types available.
Added ability to associate multiple VPCs to private route 53 hosted zone. This is a backward incompatible change. Refer to the migration guide below for how to update to this version.
Update dependency gruntwork-io/terraform-aws-eks to v0.42.1. With this change, you can now configure self managed workers to use multiple instance types for a single pool (using the newly exposed multi_instances_overrides attribute).
You can now attach custom security group rules to the EKS worker pool managed by eks-cluster and eks-workers. For eks-workers module, use the new custom_ingress_security_group_rules and custom_egress_security_group_rules input variables. For eks-cluster, use the new custom_worker_ingress_security_group_rules and custom_worker_egress_security_group_rules input variables.
Add new module for managing IAM Users and Groups only in Landing Zone. Refer to the module docs for more information on when you might want to use this over the same feature in account-baseline-security.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.15.1 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.12.26 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.12.26 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.
Fixed bug with configuring default NACLs, where default NACLs were applied and configured even when apply_default_nacl_rules was false. Now the default NACLs are only touched and updated if apply_default_nacl_rules is true.
NOTE: This change is backward compatible, but marked as backward incompatible for informational purposes. When updating to this version with apply_default_nacl_rules = false (the default), the resource aws_default_network_acl.default will be destroyed. This resource is a special resource in Terraform, where destroying the resource has no effect on AWS. The default NACL will remain intact in AWS, with the last rule that was applied to it.
Terraform 1.0 upgrade: We have verified that this repo is compatible with Terraform 1.0.x!
From this release onward, we will only be running tests with Terraform 1.0.x against this repo, so we recommend updating to 1.0.x soon!
To give you more time to upgrade, for the time being, all modules will still support Terraform 0.15.1 and above, as that version has several features in it (required_providers with source URLs) that make it more forwards compatible with 1.0.x.
Once all Gruntwork repos have been upgrade to work with 1.0.x, we will publish a migration guide with a version compatibility table and announce it all via the Gruntwork Newsletter.