Merge tag 'v4.0.0' into v4+sylr

v4.0.0

.changelog/12141.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_s3_bucket_cors_configuration
+```

.changelog/14218.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_ec2_client_vpn_endpoint
+```

.changelog/15806.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_vpn_connection: Mark `customer_gateway_configuration` as [`Sensitive`](https://www.terraform.io/plugin/sdkv2/best-practices/sensitive-state#using-the-sensitive-flag)
+```

.changelog/17031.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_vpn_connection: Add the ability to revert changes to unconfigured tunnel options made outside of Terraform to their [documented default values](https://docs.aws.amazon.com/vpn/latest/s2svpn/VPNTunnels.html)
+```

.changelog/17382.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+data-source/aws_vpc_peering_connections: Return empty array instead of error when no connections found.
+```

.changelog/18807.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_network_acl_association
+```

.changelog/19919.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_cognito_user
+```

.changelog/20482.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_elasticache_cluster: Either `engine` or `replication_group_id` must be specified
+```

.changelog/20587.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+provider: Add support for `shared_config_file` parameter
+```
+
+```release-note:enhancement
+provider: Updates AWS authentication to use AWS SDK for Go v2 <https://aws.github.io/aws-sdk-go-v2/docs/>
+```

.changelog/20661.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_mq_broker: `auto_minor_version_upgrade` and `host_instance_type` can be changed without recreating broker
+```

.changelog/20688.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_ec2_client_vpn_authorization_rule: Don't raise an error when `InvalidClientVpnEndpointId.NotFound` is returned during refresh
+```
+
+```release-note:enhancement
+resource/aws_ec2_client_vpn_authorization_rule: Configurable Create and Delete timeouts
+```

.changelog/20689.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_ec2_client_vpn_network_association: Configurable Create and Delete timeouts
+```

.changelog/21076.txt

@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_api_gateway_domain_name: Add `ownership_verification_certificate_arn` argument.
+```
+
+```release-note:enhancement
+resource/aws_apigatewayv2_domain_name: Add `domain_name_configuration.ownership_verification_certificate_arn` argument.
+```
+
+```release-note:enhancement
+resource/aws_s3_bucket_versioning: Add eventual consistency handling to help ensure bucket versioning is stabilized.
+```

.changelog/21219.txt

@@ -0,0 +1,67 @@
+```release-note:note
+data-source/aws_security_groups: If no security groups match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_route_tables: The type of the `ids` attribute has changed from Set to List. If no route tables match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_network_interfaces: The type of the `ids` attribute has changed from Set to List. If no network interfaces match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_network_acls: The type of the `ids` attribute has changed from Set to List. If no NACLs match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_ec2_transit_gateway_route_tables: The type of the `ids` attribute has changed from Set to List. If no transit gateway route tables match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_ec2_coip_pools: The type of the `pool_ids` attribute has changed from Set to List. If no COIP pools match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_ec2_local_gateway_route_tables: The type of the `ids` attribute has changed from Set to List. If no local gateway route tables match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_ec2_local_gateway_virtual_interface_groups: The type of the `ids` and `local_gateway_virtual_interface_ids` attributes has changed from Set to List. If no local gateway virtual interface groups match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_ec2_local_gateways: The type of the `ids` attribute has changed from Set to List. If no local gateways match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_ebs_volumes: The type of the `ids` attribute has changed from Set to List. If no volumes match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_cognito_user_pools: The type of the `ids` and `arns` attributes has changed from Set to List. If no volumes match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_ip_ranges: If no ranges match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_efs_access_points: The type of the `ids` and `arns` attributes has changed from Set to List. If no access points match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_emr_release_labels: The type of the `ids` attribute has changed from Set to List. If no release labels match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_inspector_rules_packages: If no rules packages match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_db_event_categories: The type of the `ids` attribute has changed from Set to List. If no event categories match the specified criteria an empty list is returned (previously an error was raised)
+```
+
+```release-note:note
+data-source/aws_ssoadmin_instances: The type of the `identity_store_ids` and `arns` attributes has changed from Set to List. If no instances match the specified criteria an empty list is returned (previously an error was raised)
+```

.changelog/21732.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_wafv2_web_acl: Support `version` on `managed_rule_group_statement`
+```

.changelog/22043.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+data-source/aws_cloudwatch_log_group: Automatically trim `:*` suffix from `arn` attribute
+```

.changelog/22178.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_db_instance: Fix error with reboot of replica
+```

.changelog/22253.txt

@@ -0,0 +1,11 @@
+```release-note:note
+resource/aws_default_subnet: If no default subnet exists in the specified Availability Zone one is now created. The `force_destroy` destroy argument has been added (defaults to `false`). Setting this argument to `true` deletes the default subnet on `terraform destroy`
+```
+
+```release-note:note
+resource/aws_default_vpc: If no default VPC exists in the current AWS Region one is now created. The `force_destroy` destroy argument has been added (defaults to `false`). Setting this argument to `true` deletes the default VPC on `terraform destroy`
+```
+
+```release-note:note
+data-source/aws_vpcs: The type of the `ids` attributes has changed from Set to List. If no VPCs match the specified criteria an empty list is returned (previously an error was raised)
+```

.changelog/22375.txt

@@ -0,0 +1,11 @@
+```release-note:breaking-change
+resource/aws_connect_hours_of_operation: The hours_of_operation_arn attribute is renamed to arn
+```
+
+```release-note:breaking-change
+data-source/aws_connect_hours_of_operation: The hours_of_operation_arn attribute is renamed to arn
+```
+
+```release-note:note
+resource/aws_connect_hours_of_operation: Timeout support has been removed as it is not needed for this resource
+```

.changelog/22537.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_s3_bucket: The `acl` and `grant` arguments have been deprecated and are now read-only. Use the `aws_s3_bucket_acl` resource instead.
+```

.changelog/22538.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_s3_bucket: The `policy` argument has been deprecated and is now read-only. Use the `aws_s3_bucket_policy` resource instead.
+```

.changelog/22579.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_s3_bucket_lifecycle_configuration
+```

.changelog/22581.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_s3_bucket: The `lifecycle_rule` argument has been deprecated and is now read-only. Use the `aws_s3_bucket_lifecycle_configuration` resource instead.
+```

.changelog/22599.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_s3_bucket: The `logging` argument has been deprecated and is now read-only. Use the `aws_s3_bucket_logging` resource instead.
+```

.changelog/22604.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_s3_bucket: The `replication_configuration` argument has been deprecated and is now read-only. Use the `aws_s3_bucket_replication_configuration` resource instead.
+```

.changelog/22605.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_s3_bucket: The `server_side_encryption_configuration` argument has been deprecated and is now read-only. Use the `aws_s3_bucket_server_side_encryption_configuration` resource instead.
+```

.changelog/22606.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_s3_bucket: The `versioning` argument has been deprecated and is now read-only. Use the `aws_s3_bucket_versioning` resource instead.
+```

.changelog/22608.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_s3_bucket_logging
+```

.changelog/22609.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_s3_bucket_server_side_encryption_configuration
+```

.changelog/22610.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_s3_bucket: The `acceleration_status` argument has been deprecated and is now read-only. Use the `aws_s3_bucket_accelerate_configuration` resource instead.
+```

.changelog/22611.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_s3_bucket: The `cors_rule` argument has been deprecated and is now read-only. Use the `aws_s3_bucket_cors_configuration` resource instead.
+```

.changelog/22612.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_s3_bucket: The `object_lock_configuration` `rule` argument has been deprecated and is now read-only. Use the `aws_s3_bucket_object_lock_configuration` resource instead.
+```

.changelog/22613.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_s3_bucket: The `request_payer` argument has been deprecated and is now read-only. Use the `aws_s3_bucket_request_payment_configuration` resource instead.
+```

.changelog/22614.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_s3_bucket: The `website`, `website_domain`, and `website_endpoint` arguments have been deprecated and are now read-only. Use the `aws_s3_bucket_website_configuration` resource instead.
+```

.changelog/22617.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_s3_bucket_accelerate_configuration
+```

.changelog/22620.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_cloudfront_realtime_log_config
+```

.changelog/22644.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_s3_bucket_object_lock_configuration
+```

.changelog/22648.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_s3_bucket_website_configuration
+```

.changelog/22649.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_s3_bucket_request_payment_configuration
+```

.changelog/22662.txt

@@ -0,0 +1,7 @@
+```release-note:note
+resource/aws_autoscaling_attachment: The `alb_target_group_arn` argument has been deprecated. All configurations using `alb_target_group_arn` should be updated to use the new `lb_target_group_arn` argument instead
+```
+
+```release-note:enhancement
+resource/aws_autoscaling_attachment: Add `lb_target_group_arn` argument
+```

.changelog/22663.txt

@@ -0,0 +1,3 @@
+```release-note:note
+resource/aws_autoscaling_group: The `tags` argument has been deprecated. All configurations using `tags` should be updated to use the `tag` argument instead
+```

.changelog/22664.txt

@@ -0,0 +1,7 @@
+```release-note:note
+resource/aws_route: The `instance_id` argument has been deprecated. All configurations using `instance_id` should be updated to use the `network_interface_id` argument instead
+```
+
+```release-note:note
+resource/aws_route_table: The `instance_id` argument of the `route` configuration block has been deprecated. All configurations using `route` `instance_id` should be updated to use the `route` `network_interface_id` argument instead
+```

.changelog/22666.txt

@@ -0,0 +1,23 @@
+```release-note:note
+resource/aws_elasticache_replication_group: The `number_cache_clusters` argument has been deprecated. All configurations using `number_cache_clusters` should be updated to use the `num_cache_clusters` argument instead
+```
+
+```release-note:enhancement
+resource/aws_elasticache_replication_group: Add `num_cache_clusters` argument
+```
+
+```release-note:note
+resource/aws_elasticache_replication_group: The `replication_group_description` argument has been deprecated. All configurations using `replication_group_description` should be updated to use the `description` argument instead
+```
+
+```release-note:enhancement
+resource/aws_elasticache_replication_group: Add `description` argument
+```
+
+```release-note:note
+resource/aws_elasticache_replication_group: The `cluster_mode` argument has been deprecated. All configurations using `cluster_mode` should be updated to use the root-level `num_node_groups` and `replicas_per_node_group` arguments instead
+```
+
+```release-note:enhancement
+resource/aws_elasticache_replication_group: Add `num_node_groups` and `replicas_per_node_group` arguments
+```

.changelog/22667.txt

@@ -0,0 +1,11 @@
+```release-note:note
+data-source/aws_elasticache_replication_group: The `replication_group_description` attribute has been deprecated. All configurations using `replication_group_description` should be updated to use the `description` attribute instead
+```
+
+```release-note:note
+data-source/aws_elasticache_replication_group: The `number_cache_clusters` attribute has been deprecated. All configurations using `number_cache_clusters` should be updated to use the `num_cache_clusters` attribute instead
+```
+
+```release-note:enhancement
+data-source/aws_elasticache_replication_group: Add `description`, `num_cache_clusters`, `num_node_groups`, and `replicas_per_node_group` attributes
+```

.changelog/22668.txt

@@ -0,0 +1,7 @@
+```release-note:note
+resource/aws_db_instance The `name` argument has been deprecated. All configurations using `name` should be updated to use the `db_name` argument instead
+```
+
+```release-note:enhancement
+resource/aws_db_instance: Add `db_name` argument
+```

.changelog/22743.txt

@@ -0,0 +1,3 @@
+```release-note:note
+data-source/aws_subnet_ids: The `aws_subnet_ids` data source has been deprecated and will be removed in a future version. Use the `aws_subnets` data source instead
+```

.changelog/22783.txt

@@ -0,0 +1,3 @@
+```release-note:note
+resource/aws_ecs_cluster: The `capacity_providers` and `default_capacity_provider_strategy` arguments have been deprecated. Use the `aws_ecs_cluster_capacity_providers` resource instead.
+ ```

.changelog/22793.txt

@@ -0,0 +1,19 @@
+```release-note:enhancement
+resource/aws_ec2_client_vpn_endpoint: Add `session_timeout_hours` argument
+```
+
+```release-note:bug-fix
+resource/aws_ec2_client_vpn_endpoint: Prevent `InvalidParameterValue: DNS servers config is conflicting` error when disabling DNS servers
+```
+
+```release-note:enhancement
+resource/aws_ec2_client_vpn_endpoint: Add `vpn_port` argument
+```
+
+```release-note:enhancement
+resource/aws_ec2_client_vpn_endpoint: Add `client_connect_options` argument
+```
+
+```release-note:enhancement
+resource/aws_ec2_client_vpn_endpoint: Add `client_login_banner_options` argument
+```

.changelog/22803.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_cloudwatch_event_target: The `ecs_target` `launch_type` argument no longer has a default value (previously was `EC2`)
+```

.changelog/22804.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+provider: Add `ec2_metadata_service_endpoint`, `ec2_metadata_service_endpoint_mode`, `use_dualstack_endpoint`, `use_fips_endpoint` arguments
+```

.changelog/22805.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_batch_compute_environment: No `compute_resources` configuration block can be specified when `type` is `UNMANAGED`
+```

.changelog/22806.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_route_table_association: Handle nil 'AssociationState' in ISO regions
+```