v0.13.1

🚀 Enhancements

chore: upgrade actions to Node 24 runtime (SHA-pinned) John C. Bland II (@johncblandii) (#69)

## what

• Bump GitHub Actions references in the workflows to versions running on the Node 24 runtime,
  SHA-pinned with precise version comments:
  • actions/checkout@v4 → @3d3c42e5... # v7.0.1
  • actions/setup-node@v4 → @82076278... # v7.0.0
  • docker/metadata-action@v5 → @dc802804... # v6.2.0
  • aws-actions/configure-aws-credentials@v4 → @e6de0542... # v6.2.3

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in cloudposse/.github#261
• Every pinned SHA was verified against its upstream tag

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

🤖 Automatic Updates

Fix go version in tests Erik Osterman (Cloud Posse) (@osterman) (#67)

## what - Update go `1.24`

why

• Error loading shared library libresolv.so.2 in Go 1.20

References

• https://sweetops.slack.com/archives/G014YEKDH4K/p1746672149263629
• golang/go#59305 (comment)
• cloudposse/terraform-aws-cloudfront-s3-cdn#294

Replace Makefile with atmos.yaml Erik Osterman (Cloud Posse) (@osterman) (#66)

## what - Remove `Makefile` - Add `atmos.yaml`

why

• Replace build-harness with atmos for readme genration

References

• DEV-3229 Migrate from build-harness to atmos

Replace Makefile with atmos.yaml Erik Osterman (Cloud Posse) (@osterman) (#65)

## what - Remove `Makefile` - Add `atmos.yaml`

why

• Replace build-harness with atmos for readme genration

References

• DEV-3229 Migrate from build-harness to atmos

v0.13.0

Use modules.cptest.test-automation.app instead of testing.cloudposse.co Igor Rodionov (@goruha) (#64)

## what * Use `modules.cptest.test-automation.app` instead of `testing.cloudposse.co`

why

• New test account uses modules.cptest.test-automation.app as test DNS zone

Sync github Max Lobur (@max-lobur) (#43)

Rebuild github dir from the template

🚀 Enhancements

Upgrade terraform-external-module-artifact to 0.8.0 for ARM compatibility Luk (@lukvdborne) (#63)

what

terraform-external-module-artifact 0.7.1 still relies on hashicorp/template which is not compatible with ARM.

0.8.0 is: cloudposse/terraform-external-module-artifact@0.7.1...0.8.0

why

hashicorp/template is not compatible with ARM64. The latest release of this module switched to template/cloudposse, but the external module that is called in lambda.tf still uses hashicorp/template in version 0.7.1. Upgrading to 0.8.0 solves this issue.

There are no breaking changes between 0.7.1 and 0.8.0.

references

cloudposse/terraform-external-module-artifact@0.7.1...0.8.0

🤖 Automatic Updates

Migrate new test account Erik Osterman (Cloud Posse) (@osterman) (#61)

## what - Update `.github/settings.yml` - Update `.github/chatops.yml` files

why

• Re-apply .github/settings.yml from org level to get terratest environment
• Migrate to new test account

References

• DEV-388 Automate clean up of test account in new organization
• DEV-387 Update terratest to work on a shared workflow instead of a dispatch action
• DEV-386 Update terratest to use new testing account with GitHub OIDC

Update .github/settings.yml Erik Osterman (Cloud Posse) (@osterman) (#60)

## what - Update `.github/settings.yml` - Drop `.github/auto-release.yml` files

why

• Re-apply .github/settings.yml from org level
• Use organization level auto-release settings

references

• DEV-1242 Add protected tags with Repository Rulesets on GitHub

Update release workflow to allow pull-requests: write Erik Osterman (Cloud Posse) (@osterman) (#59)

## what - Update workflow (`.github/workflows/release.yaml`) to have permission to comment on PR

why

• So we can support commenting on PRs with a link to the release

Update GitHub Workflows to use shared workflows from '.github' repo Erik Osterman (Cloud Posse) (@osterman) (#58)

## what - Update workflows (`.github/workflows`) to use shared workflows from `.github` repo

why

• Reduce nested levels of reusable workflows

Update GitHub Workflows to Fix ReviewDog TFLint Action Erik Osterman (Cloud Posse) (@osterman) (#57)

## what - Update workflows (`.github/workflows`) to add `issue: write` permission needed by ReviewDog `tflint` action

why

• The ReviewDog action will comment with line-level suggestions based on linting failures

Update GitHub workflows Erik Osterman (Cloud Posse) (@osterman) (#56)

## what - Update workflows (`.github/workflows/settings.yaml`)

why

• Support new readme generation workflow.
• Generate banners

Use GitHub Action Workflows from `cloudposse/.github` Repo Erik Osterman (Cloud Posse) (@osterman) (#54)

## what

• Install latest GitHub Action Workflows

why

• Use shared workflows from cldouposse/.github repository
• Simplify management of workflows from centralized hub of configuration

Add GitHub Settings Erik Osterman (Cloud Posse) (@osterman) (#51)

## what - Install a repository config (`.github/settings.yaml`)

why

• Programmatically manage GitHub repo settings

Update Scaffolding Erik Osterman (Cloud Posse) (@osterman) (#49)

## what - Reran `make readme` to rebuild `README.md` from `README.yaml` - Migrate to square badges - Add scaffolding for repo settings and Mergify

why

• Upstream template changed in the .github repo
• Work better with repository rulesets
• Modernize look & feel

v0.12.0

• No changes

v0.11.1

git.io->cloudposse.tools update dylanbannon (#38)

what and why

Change all references to git.io/build-harness into cloudposse.tools/build-harness, since git.io redirects will stop working on April 29th, 2022.

References

• DEV-143

🚀 Enhancements

Use cloudposse/template for arm support RB (@nitrocode) (#41)

what

• Use cloudposse/template for arm support

why

• The new cloudposse/template provider has a darwin arm binary for M1 laptops

references

• https://github.com/cloudposse/terraform-provider-template
• https://registry.terraform.io/providers/cloudposse/template/latest

• Closes #36

v0.11.0

fix: Adding environment variable Leo (중광) Przybylski (@r351574nc3) (#35)

what

• Setting environment variable AWS_EC2_METADATA_DISABLED: true as a solution

why

• github actions is unable to push artifacts to s3 because of an error with the awscli.

references

• aws/aws-cli#5234 (comment)
• related to #13

v0.10.1

🤖 Automatic Updates

Update context.tf Cloud Posse Bot (CI/CD) (@cloudpossebot) (#34)

what

This is an auto-generated PR that updates the context.tf file to the latest version from cloudposse/terraform-null-label

why

To support all the features of the context interface.

v0.10.0

Update Terraform cloudposse/module-artifact/external to v0.7.0 Hugo Samayoa (@htplbc) (#30)

what

• Update terraform-external-module-artifact to 0.7.0

why

• Support latest context.tf

v0.9.0

context.tf updated to v0.24.1, minimum required Terraform version bumped to 0.13.0 when needed, readme updated Maxim Mironenko (@maximmi) (#29)

what

• update context.tf to v0.24.1
• minimum required Terraform version bumped to 0.13.0
• readme updated, Bridgecrew compliance badges added

why

• It allows for setting the letter case of tag names and labels, back compatibility with context v0.22.0 and below
• we have dropped support for Terraform 0.12
• To be able see and fix the recommendations from Bridgecrew so we can position our modules as standards compliant

Supersedes and closes #27
Supersedes and closes #28

v0.8.0

mfa_delete removed Maxim Mironenko (@maximmi) (#26)

what

• mfa_delete removed
• Bridgecrew check Ensure S3 bucket has MFA delete enabled skipped

why

• Because terraform doesn't support this argument to be toggled (hashicorp/terraform-provider-aws#629).
• To satisfy Bridgecrew compliance scan

references

• hashicorp/terraform-provider-aws#629

v0.7.0

readme updated, BridgeCrew compliance checks fixed Maxim Mironenko (@maximmi) (#25)

what

• BridgeCrew compliance checks fix
• readme updated
• default behaviour changed: S3 bucket MFA delete enabled by default
• default behaviour changed: S3 Bucket Versioning enabled by default
• default behaviour changed: X-ray tracing mode for Lambda set to PassThrough
• default behaviour changed: Encryption of the S3 bucket enabled by default

why

• To be able to position our modules as standards compliant
• stay in sync with code
• To comply BridgeCrew check

references

• https://docs.bridgecrew.io/docs/s3_16-enable-versioning
• https://docs.bridgecrew.io/docs/s3_13-enable-logging
• https://docs.bridgecrew.io/docs/s3_14-data-encrypted-at-rest
• https://docs.bridgecrew.io/docs/s3_13-enable-logging
• https://docs.bridgecrew.io/docs/s3_14-data-encrypted-at-rest