v3.7.0

Release notes (since v3.6.2)

🐛 Fixes

• Lambda Function URL dual-auth (fixes #71). AWS changed Lambda Function URL authorization in October 2025 — callers must now be authorized for both lambda:InvokeFunctionUrl and lambda:InvokeFunction. Freshly provisioned zones using REGIONAL_LAMBDA_WITH_OAC (or the wildcard allow_any_principal path) returned 403 on every CloudFront request. This release adds a companion aws_lambda_permission alongside every existing InvokeFunctionUrl grant, with identical scoping (qualifier, source_arn, function_url_auth_type), across tf-aws-lambda, tf-aws-open-next-zone, and tf-aws-open-next-multi-zone.
• Cache-Control headers on immutable assets (#69, thanks @ericvoorhis). Immutable assets were not receiving their Cache-Control response headers. Fixed.

⚠️ Breaking / required upgrades

• AWS provider ≥ 6.0.0 is now required (fixes #70). >= 6.29.0 for tf-aws-open-next-zone (needed for the new DynamoDB GSI key_schema block).
  • Replaces deprecated data.aws_region.current.name with data.aws_region.current.region.
  • Replaces deprecated hash_key / range_key on the DynamoDB GSI with key_schema blocks.
  • Action required: run terraform init -upgrade in each root module to refresh the .terraform.lock.hcl.