v20.2.3

[v20.2.3] 2025-12-02

Notable Changes

• CUMULUS-4272
  • The tf-modules/cumulus-rds-tf module now allows specifying an existing security group.
    This enhancement enables DAACs to migrate their existing RDS deployments to Aurora while
    reusing their existing security group, ensuring compatibility with existing
    data-persistence-tf and cumulus-tf modules.

Fixed

• CUMULUS-4279
  • Updated the ProvisionPostgresDatabase Lambda to grant create and usage privileges
    on the public schema of the user database to the database user.
    This change is required because, starting with PostgreSQL 15, new databases assign ownership
    of the public schema to the pg_database_owner role. Existing clusters upgraded from versions
    prior to v15 preserve the previous ownership of the public schema.
• CUMULUS-4275
  • Fixed unit tests broken by updated HTTP error messages in got

Added

• CUMULUS-4272

  • Added input_security_group_id variable to tf-modules/cumulus-rds-tf module to allow
    specifying an existing security group when creating or restoring an Aurora PostgreSQL RDS cluster.

• CUMULUS-4354

  • Added an optional terraform-configurable lambda level env variable allow_provider_mismatch_on_rule_filter to message-consumer and sqs-message-consumer to check
    whether to consider rule/message provider mismatches
  • Added a rule.meta.allowProviderMismatchOnRuleFilter check to filterRulesByRuleParams as a rule-level fallback to check
    whether to consider rule/message provider mismatches for the specific rule
  • (Small note as of 12-17-2025): There is a Cumulus-side bug with this in the way terraform and lambda reads the environment variable, so users will need to set allow_provider_mismatch_on_rule_filter = true in the appropriate message-consumer's lambda environment variables in the AWS console for this to work, this has been fixed in CUMULUS-4458 and will be included in a future release)