chore: Update from hashicorp/terraform-provider-aws (v6.20.0)

.changelog/24730.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_servicecatalog_portfolio_share: Add global mutex lock around create and delete operations to prevent `ThrottlingException` errors
+```

.changelog/26702.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_glue_catalog_table: Add `partition_keys.parameters` argument, fixing `Invalid address to set: []string{"partition_keys", "0", "parameters"}` errors
+```
+
+```release-note:bug
+data-source/aws_glue_catalog_table: Add `partition_keys.parameters` attribute
+```

.changelog/33624.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_cognito_risk_configuration: Make `account_takeover_risk_configuration.notify_configuration` optional
+```

.changelog/33796.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_dlm_lifecycle_policy: Add `policy_details.schedule.cross_region_copy_rule.target_region` argument
+```
+
+```release-note:enhancement
+resource/aws_dlm_lifecycle_policy: Make `policy_details.schedule.cross_region_copy_rule.target` optional
+```

.changelog/35012.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_glue_job: Ensure that `timeout` is unconfigured for Ray jobs
+```
+
+```release-note:bug
+resource/aws_glue_job: Allow Ray jobs to be updated
+```

.changelog/36628.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_athena_database: Add `workgroup` argument
+```

.changelog/36874.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_securitylake_data_lake: Allow `meta_store_role_arn` to be updated in-place
+```

.changelog/37286.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_rds_global_cluster
+```

.changelog/38336.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_spot_instance_request: Change `network_interface.network_card_index` to Computed
+```

.changelog/38527.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_instance: Add `placement_group_id` argument
+```
+
+```release-note:enhancement
+data-source/aws_instance: Add `placement_group_id` attribute
+```

.changelog/38717.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_athena_workgroup: Add `configuration.identity_center_configuration` argument
+```

.changelog/40035.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_codebuild_project: Add `auto_retry_limit` argument
+```

.changelog/40148.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_batch_compute_environment: Allow in-place updates of compute environments that have the `SPOT_PRICE_CAPACITY_OPTIMIZED` strategy
+```

.changelog/41055.txt

@@ -0,0 +1,15 @@
+```release-note:enhancement
+resource/aws_dlm_lifecycle_policy: Add `default_policy` argument
+```
+
+```release-note:enhancement
+resource/aws_dlm_lifecycle_policy: Add `copy_tags`, `create_interval`, `exclusions`, `extend_deletion`, `policy_language`, `resource_type` and `retain_interval` attributes to `policy_details` configuration block
+```
+
+```release-note:enhancement
+resource/aws_dlm_lifecycle_policy: Add `policy_details.create_rule.scripts` argument
+```
+
+```release-note:enhancement
+resource/aws_dlm_lifecycle_policy:Add `policy_details.schedule.archive_rule` argument
+```

.changelog/41308.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_dynamodb_table: Add `warm_throughput` and `global_secondary_index.warm_throughput` arguments
+```
+
+```release-note:enhancement
+data-source/aws_dynamodb_table: Add `warm_throughput` and `global_secondary_index.warm_throughput` attributes
+```

.changelog/41364.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_s3_bucket_metadata_configuration
+```

.changelog/41702.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cognito_resource_server: Allow `name` to be updated in-place
+```

.changelog/42188.txt

@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_network_interface: Add `attachment.network_card_index` argument
+```
+
+```release-note:enhancement
+resource/aws_network_interface_attachment: Add `network_card_index` argument
+```
+
+```release-note:enhancement
+data-source/aws_network_interface: Add `attachment.network_card_index` attribute
+```

.changelog/42201.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_bedrockagent_flow
+```

.changelog/42382.txt

@@ -0,0 +1,6 @@
+```release-note:new-resource
+aws_timestreaminfluxdb_db_cluster
+```
+```release-note:bug
+resource/aws_timestreaminfluxdb_db_instance: Fix tag-only update errors
+```

.changelog/42397.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_controltower_baseline
+```

.changelog/42483.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_eks_cluster: Supports null `compute_config.node_role_arn` when disabling auto mode or built-in node pools
+```

.changelog/42577.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_ecr_images
+```

.changelog/42591.txt

@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_nat_gateway_eip_association
+```
+
+```release-note:enhancement
+resource/aws_nat_gateway: Change `secondary_allocation_ids` to Optional and Computed
+```

.changelog/42595.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ssm_parameter: Fix `version` not being updated when `description` changes
+```

.changelog/42636.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_elasticache_global_replication_group: Change `engine` to Optional and Computed
+```

.changelog/42639.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cognito_user_pool: Allow `name` to be updated in-place
+```

.changelog/42708.txt

@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_transfer_web_app
+```
+
+```release-note:new-resource
+aws_transfer_web_app_customization
+```

.changelog/42740.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_wafv2_web_acl: Fix performance of update when the WebACL has a large number of rules
+```

.changelog/42829.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lambda_function: Reset non-API attributes (`source_code_hash`, `s3_bucket`, `s3_key`, `s3_object_version` and `filename`) to their previous values when an update operation fails
+```

.changelog/42877.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ssm_parameter: Fix `Provider produced inconsistent final plan` errors when changing from using `value` to using `value_wo`
+```

.changelog/42928.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_eks_cluster: Allow `remote_network_config` to be updated in-place, enabling support for EKS hybrid nodes on existing clusters
+```

.changelog/43125.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_dms_endpoint: Add `oracle_settings` configuration block for authentication method
+```
+
+```release-note:enhancement
+resource/aws_dms_replication_instance: Add `dns_name_servers` attribute and `kerberos_authentication_settings` configuration block for Kerberos authentication settings
+```

.changelog/43150.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+data-source/aws_bedrock_inference_profiles: Add `type` argument
+```

.changelog/43155.txt

@@ -0,0 +1,6 @@
+```release-note:enhancement
+resource/aws_lb_listener_rule: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_alb_listener_rule: Add resource identity support
+```

.changelog/43158.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_instance: Recompute `ipv6_addresses` when `ipv6_address_count` is updated
+```

.changelog/43161.txt

@@ -0,0 +1,6 @@
+```release-note:enhancement
+resource/aws_lb_listener: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_alb_listener: Add resource identity support
+```

.changelog/43171.txt

@@ -0,0 +1,6 @@
+```release-note:enhancement
+resource/aws_lb_target_group: Add resource identity support
+```
+```release-note:enhancement
+resource/aws_alb_target_group: Add resource identity support
+```

.changelog/43186.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lb_trust_store: Add resource identity support
+```

.changelog/43200.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_globalaccelerator_accelerator: Add resource identity support
+```

.changelog/43202.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_sns_topic: Add resource identity support
+```

.changelog/43207.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_acm_certificate: Support `options.export` argument to issue an exportable certificate
+```

.changelog/43215.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_api_gateway_resource: Recompute `path` when `path_part` is updated
+```

.changelog/43240.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_dynamodb_table: Add `replica.deletion_protection_enabled` argument
+```

.changelog/43241.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_ecs_service: Remove Terraform default for `availability_zone_rebalancing` and change the attribute to Optional and Computed. This allow ECS to default to `ENABLED` for new resources compatible with *AvailabilityZoneRebalancing* and maintain an existing service's `availability_zone_rebalancing` value during update when not configured. If an existing service never had an `availability_zone_rebalancing` value configured and is updated, ECS will treat this as `DISABLED`
+```

.changelog/43262.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_vpc_ipam_pool_cidr: Fix netmask_length not being saved and diffed correctly
+```

.changelog/43302.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_emrserverless_application: Add `runtime_configuration` argument
+```

.changelog/43317.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_emrserverless_application: Add `monitoring_configuration` argument
+```

.changelog/43337.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_batch_compute_environment: Fix `inconsistent final plan` error when `compute_resource.launch_template.version` is unknown during an update
+```

.changelog/43355.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_bedrockagent_agent_action_group: Correctly set `parent_action_group_signature` on Read
+```

.changelog/43358.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lexv2models_slot: Fix error when `sub_slot_setting.slot_specification.value_elicitation_setting.prompt_specification.prompt_attempts_specification` and `value_elicitation_setting.prompt_specification.prompt_attempts_specification` have default values
+```

.changelog/43377.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_lakeformation_resource: Support `with_privileged_access` argument
+```
+
+```release-note:enhancement
+data-source/aws_lakeformation_resource: Support `hybrid_access_enabled`, `with_federation` and `with_privileged_access` attributes
+```

.changelog/43381.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cloudwatch_log_metric_filter: Add `apply_on_transformed_logs` argument
+```

.changelog/43382.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_datazone_environment_blueprint_configuration: Fix `Inappropriate value for attribute "regional_parameters"` errors during planning. This fixes a regression introduced in [v6.0.0](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md#600-june-18-2025)
+```

.changelog/43391.txt

@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_fsx_s3_access_point_attachment
+```
+
+```release-note:new-data-source
+aws_s3_access_point
+```

.changelog/43396.txt

@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_cognito_log_delivery_configuration
+```
+
+```release-note:note
+resource/aws_cognito_log_delivery_configuration: Because we cannot easily test all this functionality, it is best effort and we ask for community help in testing
+```

.changelog/43397.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_wafv2_rule_group: Add `rules_json` argument
+```

.changelog/43400.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_datasync_location_object_storage: Make `agent_arns` optional
+``` 

.changelog/43405.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ec2_transit_gateway_route_table_propagation: Don't mark `transit_gateway_attachment_id` as [ForceNew](https://developer.hashicorp.com/terraform/plugin/sdkv2/schemas/schema-behaviors#forcenew) if the value is known not to change
+```

.changelog/43408.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_workspacesweb_trust_store
+```

.changelog/43415.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_s3_bucket_public_access_block: Add `skip_destroy` argument
+```

.changelog/43416.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lambda_function: Fix `waiting for Lambda Function (...) version publish: unexpected state '', wanted target 'Successful'` errors on Update. This fixes a regression introduced in [v6.2.0](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md#620-july--2-2025)
+```

.changelog/43423.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_globalaccelerator_custom_routing_accelerator: Add resource identity support
+```

.changelog/43430.txt

@@ -0,0 +1,15 @@
+```release-note:new-resource
+aws_networkfirewall_firewall_transit_gateway_attachment_accepter
+```
+
+```release-note:enhancement
+resource/aws_networkfirewall_firewall: Add `availability_zone_change_protection`, `availability_zone_mapping`, and `transit_gateway_id` arguments and `firewall_status.transit_gateway_attachment_sync_states` and `transit_gateway_owner_account_id` attributes
+```
+
+```release-note:enhancement
+resource/aws_networkfirewall_firewall: Mark `subnet_mapping` and `vpc_id` as Optional
+```
+
+```release-note:enhancement
+data-source/aws_networkfirewall_firewall: Add `availability_zone_change_protection`, `availability_zone_mapping`, `firewall_status.sync_states.attachment.status_message`, `firewall_status.transit_gateway_attachment_sync_states`, `transit_gateway_id`, and `transit_gateway_owner_account_id` attributes
+```

.changelog/43434.txt

@@ -0,0 +1,12 @@
+```release-note:enhancement
+resource/aws_ecs_service: `deployment_controller.type` changes no longer force a replacement
+```
+```release-note:enhancement
+resource/aws_ecs_service: Add `deployment_configuration` argument
+```
+```release-note:enhancement
+resource/aws_ecs_service: Add `load_balancer.advanced_configuration` argument
+```
+```release-note:enhancement
+resource/aws_ecs_service: Add `service.client_alias.test_traffic_rules` argument
+```

.changelog/43436.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_dx_gateway_association: Add `transit_gateway_attachment_id` attribute. This functionality requires the `ec2:DescribeTransitGatewayAttachments` IAM permission
+```