chore: Update from hashicorp/terraform-provider-aws (v6.6.0)

.changelog/36628.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_athena_database: Add `workgroup` argument
+```

.changelog/36874.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_securitylake_data_lake: Allow `meta_store_role_arn` to be updated in-place
+```

.changelog/41364.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_s3_bucket_metadata_configuration
+```

.changelog/41702.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cognito_resource_server: Allow `name` to be updated in-place
+```

.changelog/42201.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_bedrockagent_flow
+```

.changelog/42577.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_ecr_images
+```

.changelog/42591.txt

@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_nat_gateway_eip_association
+```
+
+```release-note:enhancement
+resource/aws_nat_gateway: Change `secondary_allocation_ids` to Optional and Computed
+```

.changelog/42639.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cognito_user_pool: Allow `name` to be updated in-place
+```

.changelog/43125.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_dms_endpoint: Add `oracle_settings` configuration block for authentication method
+```
+
+```release-note:enhancement
+resource/aws_dms_replication_instance: Add `dns_name_servers` attribute and `kerberos_authentication_settings` configuration block for Kerberos authentication settings
+```

.changelog/43150.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+data-source/aws_bedrock_inference_profiles: Add `type` argument
+```

.changelog/43155.txt

@@ -0,0 +1,6 @@
+```release-note:enhancement
+resource/aws_lb_listener_rule: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_alb_listener_rule: Add resource identity support
+```

.changelog/43158.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_instance: Recompute `ipv6_addresses` when `ipv6_address_count` is updated
+```

.changelog/43161.txt

@@ -0,0 +1,6 @@
+```release-note:enhancement
+resource/aws_lb_listener: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_alb_listener: Add resource identity support
+```

.changelog/43171.txt

@@ -0,0 +1,6 @@
+```release-note:enhancement
+resource/aws_lb_target_group: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_alb_target_group: Add resource identity support
+```

.changelog/43186.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lb_trust_store: Add resource identity support
+```

.changelog/43200.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_globalaccelerator_accelerator: Add resource identity support
+```

.changelog/43202.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_sns_topic: Add resource identity support
+```

.changelog/43207.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_acm_certificate: Support `options.export` argument to issue an exportable certificate
+```

.changelog/43215.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_api_gateway_resource: Recompute `path` when `path_part` is updated
+```

.changelog/43355.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_bedrockagent_agent_action_group: Correctly set `parent_action_group_signature` on Read
+```

.changelog/43358.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lexv2models_slot: Fix error when `sub_slot_setting.slot_specification.value_elicitation_setting.prompt_specification.prompt_attempts_specification` and `value_elicitation_setting.prompt_specification.prompt_attempts_specification` have default values
+```

.changelog/43377.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_lakeformation_resource: Support `with_privileged_access` argument
+```
+
+```release-note:enhancement
+data-source/aws_lakeformation_resource: Support `hybrid_access_enabled`, `with_federation` and `with_privileged_access` attributes
+```

.changelog/43381.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cloudwatch_log_metric_filter: Add `apply_on_transformed_logs` argument
+```

.changelog/43382.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_datazone_environment_blueprint_configuration: Fix `Inappropriate value for attribute "regional_parameters"` errors during planning. This fixes a regression introduced in [v6.0.0](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md#600-june-18-2025)
+```

.changelog/43391.txt

@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_fsx_s3_access_point_attachment
+```
+
+```release-note:new-data-source
+aws_s3_access_point
+```

.changelog/43396.txt

@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_cognito_log_delivery_configuration
+```
+
+```release-note:note
+resource/aws_cognito_log_delivery_configuration: Because we cannot easily test all this functionality, it is best effort and we ask for community help in testing
+```

.changelog/43397.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_wafv2_rule_group: Add `rules_json` argument
+```

.changelog/43400.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_datasync_location_object_storage: Make `agent_arns` optional
+``` 

.changelog/43405.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ec2_transit_gateway_route_table_propagation: Don't mark `transit_gateway_attachment_id` as [ForceNew](https://developer.hashicorp.com/terraform/plugin/sdkv2/schemas/schema-behaviors#forcenew) if the value is known not to change
+```

.changelog/43415.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_s3_bucket_public_access_block: Add `skip_destroy` argument
+```

.changelog/43416.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lambda_function: Fix `waiting for Lambda Function (...) version publish: unexpected state '', wanted target 'Successful'` errors on Update. This fixes a regression introduced in [v6.2.0](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md#620-july--2-2025)
+```

.changelog/43423.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_globalaccelerator_custom_routing_accelerator: Add resource identity support
+```

.changelog/43430.txt

@@ -0,0 +1,15 @@
+```release-note:new-resource
+aws_networkfirewall_firewall_transit_gateway_attachment_accepter
+```
+
+```release-note:enhancement
+resource/aws_networkfirewall_firewall: Add `availability_zone_change_protection`, `availability_zone_mapping`, and `transit_gateway_id` arguments and `firewall_status.transit_gateway_attachment_sync_states` and `transit_gateway_owner_account_id` attributes
+```
+
+```release-note:enhancement
+resource/aws_networkfirewall_firewall: Mark `subnet_mapping` and `vpc_id` as Optional
+```
+
+```release-note:enhancement
+data-source/aws_networkfirewall_firewall: Add `availability_zone_change_protection`, `availability_zone_mapping`, `firewall_status.sync_states.attachment.status_message`, `firewall_status.transit_gateway_attachment_sync_states`, `transit_gateway_id`, and `transit_gateway_owner_account_id` attributes
+```

.changelog/43434.txt

@@ -0,0 +1,12 @@
+```release-note:enhancement
+resource/aws_ecs_service: `deployment_controller.type` changes no longer force a replacement
+```
+```release-note:enhancement
+resource/aws_ecs_service: Add `deployment_configuration` argument
+```
+```release-note:enhancement
+resource/aws_ecs_service: Add `load_balancer.advanced_configuration` argument
+```
+```release-note:enhancement
+resource/aws_ecs_service: Add `service.client_alias.test_traffic_rules` argument
+```

.changelog/43436.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_dx_gateway_association: Add `transit_gateway_attachment_id` attribute. This functionality requires the `ec2:DescribeTransitGatewayAttachments` IAM permission
+```

.changelog/43440.txt

@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_dms_endpoint: Add `postgres_settings.authentication_method` and `postgres_settings.service_access_role_arn` arguments
+```
+
+```release-note:enhancement
+data-source/aws_dms_endpoint: Add `postgres_settings.authentication_method` and `postgres_settings.service_access_role_arn` attributes
+```
+
+```release-note:enhancement
+resource/aws_dms_endpoint: Add plan-time validation of `postgres_settings.database_mode`, `postgres_settings.map_long_varchar_as`, and `postgres_settings.plugin_name` arguments
+```

.changelog/43450.txt

@@ -0,0 +1,6 @@
+```release-note:enhancement
+resource/aws_glue_registry: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_glue_schema: Add resource identity support
+```

.changelog/43453.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_cloudwatch_event_bus: Add `log_config` argument
+```
+
+```release-note:enhancement
+data-source/aws_cloudwatch_event_bus: Add `log_config` attribute
+```

.changelog/43454.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_batch_compute_environment: Add `compute_resources.ec2_configuration.image_kubernetes_version` argument
+```

.changelog/43471.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_bedrockagent_flow: Remove `definition.connection` and `definition.node` list length limits
+```

.changelog/43501.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_quicksight_account_subscription: Add import support. This resource can now be imported via the `aws_account_id` argument.
+```

.changelog/43502.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_ecs_service: Improve stabilization logic to handle both new deployments and in-place updates correctly. This fixes a regression introduced in [v6.4.0](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md#640-july-17-2025)
+```
+
+```release-note:note
+resource/aws_ecs_service: Acceptance tests cannot fully reproduce scenarios with deployments older than 3 months. Community feedback on this fix is appreciated, particularly for long-running ECS services with in-place updates
+```

.changelog/43503.txt

@@ -0,0 +1,12 @@
+```release-note:enhancement
+resource/aws_iam_openid_connect_provider: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_iam_policy: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_iam_saml_provider: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_iam_service_linked_role: Add resource identity support
+```

.changelog/43506.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_wafv2_web_acl: Add `statement.rate_based_statement.custom_key.asn` argument
+```

.changelog/43516.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+provider: Prevent planned `forces replacement` on `region` for numerous resource types when upgrading from a pre-v6.0.0 provider version and `-refresh=false` is in effect
+```

.changelog/43517.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+feature/aws_bedrock_guardrail: Add `cross_region_config`, `content_policy_config.tier_config`, and `topic_policy_config.tier_config` arguments
+```

.changelog/43523.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_appsync_api_cache: Fix "missing required field" error during update
+```

.changelog/43525.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_inspector2_enabler: Support `CODE_REPOSITORY` as a valid value for `resource_types`
+```
+
+```release-note:enhancement
+resource/aws_inspector2_organization_configuration: Add `auto_enable.code_repository` argument
+```

.changelog/43539.txt

@@ -0,0 +1,12 @@
+```release-note:enhancement
+resource/aws_globalaccelerator_custom_routing_endpoint_group: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_globalaccelerator_custom_routing_listener: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_globalaccelerator_endpoint_group: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_globalaccelerator_listener: Add resource identity support
+```

.changelog/43540.txt

@@ -0,0 +1,21 @@
+```release-note:enhancement
+resource/aws_imagebuilder_container_recipe: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_imagebuilder_distribution_configuration: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_imagebuilder_image: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_imagebuilder_image_pipeline: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_imagebuilder_image_recipe: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_imagebuilder_infrastructure_configuration: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_imagebuilder_workflow: Add resource identity support
+```

.changelog/43542.txt

@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_inspector_assessment_target: Add resource identity support
+```
+
+```release-note:enhancement
+resource/aws_inspector_assessment_template: Add resource identity support
+```
+
+```release-note:enhancement
+resource/aws_inspector_resource_group: Add resource identity support
+```

.changelog/43557.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_connect_phone_number_contact_flow_association
+```

.changelog/43558.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ecs_service: Fix unspecified `test_listener_rule` incorrectly being set as empty string in `load_balancer.advanced_configuration` block
+```

.changelog/43560.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_ssm_patch_baseline: Add `available_security_updates_compliance_status` argument
+```
+
+```release-note:enhancement
+data-source/aws_ssm_patch_baseline: Add `available_security_updates_compliance_status` argument
+```

.changelog/43562.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_ssm_service_setting: Support short format (with `/ssm/` prefix) for `setting_id`
+```

.changelog/43576.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_cloudwatch_log_delivery_destination: Fix update failure when tags are set
+```

.ci/.tflint.hcl

@@ -29,3 +29,8 @@ rule "aws_acm_certificate_lifecycle" {
 rule "aws_accessanalyzer_analyzer_invalid_type" {
   enabled = false
 }
+
+# Avoids errant findings related to directory paths in generated configuration files
+rule "aws_iam_saml_provider_invalid_saml_metadata_document" {
+  enabled = false
+}