v0.9.0

[0.9.0] - 2026-10-01

Added

• cloudflare-tunnel: Manage the Access app and allow policy per route (#34) (#34)
• ebs-volume: Add opt-in daily DLM snapshots per volume (#33) (#33)
• automation-roles: Allow EC2 in additional_regions beyond deploy_region

v0.8.0

[0.8.0] - 2026-08-26

Fixed

• ec2: [breaking] Stop tagging externally-attached EBS volumes

v0.7.0

[0.7.0] - 2026-08-26

Added

• cloudflare-tunnel: Manage tunnel ingress routes and DNS as code

Fixed

• Added tag & untag instance profile perms

v0.6.0

[0.6.0] - 2026-06-30

Added

• vpc: Add azs output for consumer-side AZ wiring
• ebs-volume: Add standalone persistent EBS data volume component
• automation-roles: Allow CI role to manage scoped iam policies
• iam-policy: Add generic IAM policy factory component

Fixed

• ci: Guard against pre-commit Terraform hooks silently skipping changed .tf
• release: Annotate the vX.Y.Z tag so tagging survives tag.gpgsign

v0.5.0

[0.5.0] - 2026-06-29

Added

• ec2: Add iam_role_policy_arns passthrough for scoped role policies
• automation-roles: GitHub-OIDC → IAM role component for CI
• ec2: Add ami_ssm_parameter for per-instance OS selection
• ec2: Wrap ec2-instance + security-group modules, add named ingress

Fixed

• hooks: Gh-format-guard inspects --body-file content
• ec2: Take VPC CIDR from input, drop live aws_vpc lookup
• automation-roles: Grant ec2:* scoped to deploy_region
• vpc,ec2: Encrypt root EBS, doc + guard NAT/az_count
• compute-engine: Clarify output keying in docs, validate instances keys
• compute-engine: Support multiple VMs via instances map

Changed

• compute-engine: Replace with AWS ec2 component (EC2 + SSM)
• vpc: Rename from network, rewrite as AWS VPC wrapper
• compute-engine: Name VMs -, drop component infix
• compute-engine: Require project_id, default access_members empty

Removed

• components: Restore GCP network + compute-engine alongside AWS