Merge branch 'main' into copilot/fix-7855e918-4f89-4206-9e30-02dc9febbc48

Author: tobio

.buildkite/release.yml

@@ -1,7 +1,7 @@
 steps:
   - label: Release
     agents:
-      image: "golang:1.25.4@sha256:e68f6a00e88586577fafa4d9cefad1349c2be70d21244321321c407474ff9bf2"
+      image: "golang:1.25.4@sha256:698183780de28062f4ef46f82a79ec0ae69d2d22f7b160cf69f71ea8d98bf25d"
       cpu: "16"
       memory: "24G"
       ephemeralStorage: "20G"

.github/workflows/copilot-setup-steps.yml

@@ -23,8 +23,8 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
         with:
           go-version-file: 'go.mod'
           cache: true

.github/workflows/test.yml

@@ -18,8 +18,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
         with:
           go-version-file: 'go.mod'
           cache: true
@@ -34,8 +34,8 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
         with:
           go-version-file: 'go.mod'
           cache: true
@@ -139,8 +139,8 @@ jobs:
           - version: '8.4.3'
             runner: ubuntu-22.04
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
         with:
           go-version-file: 'go.mod'
           cache: true

CHANGELOG.md

@@ -1,11 +1,19 @@
 ## [Unreleased]
 
+- Support `.bedrock` and `.gen-ai` connectors ([#1467](https://github.com/elastic/terraform-provider-elasticstack/pull/1467))
+- Support the `solution` attribute in `elasticstack_kibana_space` from 8.16 ([#1486](https://github.com/elastic/terraform-provider-elasticstack/pull/1486)) 
+
+## [0.12.2] - 2025-11-19
 - Fix `elasticstack_elasticsearch_snapshot_lifecycle` metadata type conversion causing terraform apply to fail ([#1409](https://github.com/elastic/terraform-provider-elasticstack/issues/1409))
 - Add new `elasticstack_elasticsearch_ml_anomaly_detection_job` resource ([#1329](https://github.com/elastic/terraform-provider-elasticstack/pull/1329))
 - Add new `elasticstack_elasticsearch_ml_datafeed` resource ([#1340](https://github.com/elastic/terraform-provider-elasticstack/pull/1340))
 - Add `space_ids` attribute to all Fleet resources to support space-aware Fleet resource management ([#1390](https://github.com/elastic/terraform-provider-elasticstack/pull/1390))
+- Add back missing import support for `elasticstack_elasticsearch_security_role_mapping` ([#1441](https://github.com/elastic/terraform-provider-elasticstack/pull/1441))
 - Add new `elasticstack_elasticsearch_ml_job_state` resource ([#1337](https://github.com/elastic/terraform-provider-elasticstack/pull/1337))
 - Add new `elasticstack_elasticsearch_ml_datafeed_state` resource ([#1422](https://github.com/elastic/terraform-provider-elasticstack/pull/1422))
+- Add `output_id` to `elasticstack_fleet_integration_policy` resource ([#1445](https://github.com/elastic/terraform-provider-elasticstack/pull/1445))
+- Make `hosts` attribute required in `elasticstack_fleet_output` resource ([#1450](https://github.com/elastic/terraform-provider-elasticstack/pull/1450/files)) 
+- Fix `elasticstack_kibana_security_detection_rule` to properly respect `space_id`
 
 ## [0.12.1] - 2025-10-22
 - Fix regression restricting the characters in an `elasticstack_elasticsearch_role_mapping` `name`. ([#1373](https://github.com/elastic/terraform-provider-elasticstack/pull/1373))
@@ -534,7 +542,8 @@ resource "elasticstack_fleet_output" "output" {
 - Initial set of docs
 - CI integration
 
-[Unreleased]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.12.1...HEAD
+[Unreleased]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.12.2...HEAD
+[0.12.2]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.12.1...v0.12.2
 [0.12.1]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.12.0...v0.12.1
 [0.12.0]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.18...v0.12.0
 [0.11.19]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.18...v0.11.19

Makefile

@@ -1,7 +1,7 @@
 .DEFAULT_GOAL = help
 SHELL := /bin/bash
 
-VERSION ?= 0.12.1
+VERSION ?= 0.12.2
 
 NAME = elasticstack
 BINARY = terraform-provider-${NAME}
@@ -46,6 +46,12 @@ build-ci: ## build the terraform provider
 .PHONY: build
 build: lint build-ci ## build the terraform provider
 
+# run acceptance tests against the docker container that has been started with `make docker-kibana` (or `make docker-elasticsearch`)
+# To run specific test (e.g. TestAccResourceActionConnector) execute `make testacc-vs-docker TESTARGS='-run ^TestAccResourceKibanaConnectorBedrock$$'`
+.PHONY: testacc-vs-docker
+testacc-vs-docker:
+	@ ELASTICSEARCH_ENDPOINTS=http://localhost:9200 KIBANA_ENDPOINT=http://localhost:5601 ELASTICSEARCH_USERNAME=$(ELASTICSEARCH_USERNAME) ELASTICSEARCH_PASSWORD=$(ELASTICSEARCH_PASSWORD) make testacc
+
 .PHONY: testacc
 testacc: ## Run acceptance tests
 	TF_ACC=1 go tool gotestsum --format testname --rerun-fails=3 --packages="-v ./..." -- -count $(ACCTEST_COUNT) -parallel $(ACCTEST_PARALLELISM) $(TESTARGS) -timeout $(ACCTEST_TIMEOUT)
@@ -130,7 +136,7 @@ install: build ## Install built provider into the local terraform cache
 
 .PHONY: tools
 tools: $(GOBIN)  ## Download golangci-lint locally if necessary.
-	@[[ -f $(GOBIN)/golangci-lint ]] || curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOBIN) v2.6.1
+	@[[ -f $(GOBIN)/golangci-lint ]] || curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOBIN) v2.6.2
 
 .PHONY: golangci-lint
 golangci-lint:

docs/resources/fleet_integration_policy.md

@@ -63,6 +63,8 @@ resource "elasticstack_fleet_integration_policy" "sample" {
   agent_policy_id     = elasticstack_fleet_agent_policy.sample.policy_id
   integration_name    = elasticstack_fleet_integration.sample.name
   integration_version = elasticstack_fleet_integration.sample.version
+  // Optional: specify a custom output to send data to
+  // output_id           = "my-custom-output-id"
 
   input {
     input_id = "tcp-tcp"
@@ -102,6 +104,7 @@ resource "elasticstack_fleet_integration_policy" "sample" {
 - `enabled` (Boolean) Enable the integration policy.
 - `force` (Boolean) Force operations, such as creation and deletion, to occur.
 - `input` (Block List) Integration inputs. (see [below for nested schema](#nestedblock--input))
+- `output_id` (String) The ID of the output to send data to. When not specified, the default output of the agent policy will be used.
 - `policy_id` (String) Unique identifier of the integration policy.
 - `space_ids` (Set of String) The Kibana space IDs where this integration policy is available. When set, must match the space_ids of the referenced agent policy. If not set, will be inherited from the agent policy. Note: The order of space IDs does not matter as this is a set.
 - `vars_json` (String, Sensitive) Integration-level variables as JSON.

docs/resources/fleet_output.md

@@ -200,6 +200,7 @@ resource "elasticstack_fleet_output" "kafka_round_robin" {
 
 ### Required
 
+- `hosts` (List of String) A list of hosts.
 - `name` (String) The name of the output.
 - `type` (String) The output type.
 
@@ -210,7 +211,6 @@ resource "elasticstack_fleet_output" "kafka_round_robin" {
 - `config_yaml` (String, Sensitive) Advanced YAML configuration. YAML settings here will be added to the output section of each agent policy.
 - `default_integrations` (Boolean) Make this output the default for agent integrations.
 - `default_monitoring` (Boolean) Make this output the default for agent monitoring.
-- `hosts` (List of String) A list of hosts.
 - `kafka` (Attributes) Kafka-specific configuration. (see [below for nested schema](#nestedatt--kafka))
 - `output_id` (String) Unique identifier of the output.
 - `space_ids` (Set of String) The Kibana space IDs where this output is available. When set, the output will be created and managed within the specified space. Note: The order of space IDs does not matter as this is a set.

docs/resources/kibana_action_connector.md

@@ -52,6 +52,44 @@ resource "elasticstack_kibana_action_connector" "slack-api-connector" {
     token = "<your-token>"
   })
 }
+
+resource "elasticstack_kibana_action_connector" "bedrock-connector" {
+  name              = "aws-bedrock"
+  connector_type_id = ".bedrock"
+  config = jsonencode({
+    apiUrl       = "https://bedrock-runtime.us-east-1.amazonaws.com"
+    defaultModel = "anthropic.claude-v2"
+  })
+  secrets = jsonencode({
+    accessKey = "<your-aws-access-key>"
+    secret    = "<your-aws-secret-key>"
+  })
+}
+
+resource "elasticstack_kibana_action_connector" "genai-openai-connector" {
+  name              = "openai"
+  connector_type_id = ".gen-ai"
+  config = jsonencode({
+    apiProvider  = "OpenAI"
+    apiUrl       = "https://api.openai.com/v1"
+    defaultModel = "gpt-4"
+  })
+  secrets = jsonencode({
+    apiKey = "<your-openai-api-key>"
+  })
+}
+
+resource "elasticstack_kibana_action_connector" "genai-azure-connector" {
+  name              = "azure-openai"
+  connector_type_id = ".gen-ai"
+  config = jsonencode({
+    apiProvider = "Azure OpenAI"
+    apiUrl      = "https://my-resource.openai.azure.com/openai/deployments/my-deployment"
+  })
+  secrets = jsonencode({
+    apiKey = "<your-azure-api-key>"
+  })
+}
 ```
 
 <!-- schema generated by tfplugindocs -->

examples/resources/elasticstack_fleet_integration_policy/resource.tf

@@ -32,6 +32,8 @@ resource "elasticstack_fleet_integration_policy" "sample" {
   agent_policy_id     = elasticstack_fleet_agent_policy.sample.policy_id
   integration_name    = elasticstack_fleet_integration.sample.name
   integration_version = elasticstack_fleet_integration.sample.version
+  // Optional: specify a custom output to send data to
+  // output_id           = "my-custom-output-id"
 
   input {
     input_id = "tcp-tcp"

examples/resources/elasticstack_kibana_action_connector/resource.tf

@@ -37,3 +37,41 @@ resource "elasticstack_kibana_action_connector" "slack-api-connector" {
     token = "<your-token>"
   })
 }
+
+resource "elasticstack_kibana_action_connector" "bedrock-connector" {
+  name              = "aws-bedrock"
+  connector_type_id = ".bedrock"
+  config = jsonencode({
+    apiUrl       = "https://bedrock-runtime.us-east-1.amazonaws.com"
+    defaultModel = "anthropic.claude-v2"
+  })
+  secrets = jsonencode({
+    accessKey = "<your-aws-access-key>"
+    secret    = "<your-aws-secret-key>"
+  })
+}
+
+resource "elasticstack_kibana_action_connector" "genai-openai-connector" {
+  name              = "openai"
+  connector_type_id = ".gen-ai"
+  config = jsonencode({
+    apiProvider  = "OpenAI"
+    apiUrl       = "https://api.openai.com/v1"
+    defaultModel = "gpt-4"
+  })
+  secrets = jsonencode({
+    apiKey = "<your-openai-api-key>"
+  })
+}
+
+resource "elasticstack_kibana_action_connector" "genai-azure-connector" {
+  name              = "azure-openai"
+  connector_type_id = ".gen-ai"
+  config = jsonencode({
+    apiProvider = "Azure OpenAI"
+    apiUrl      = "https://my-resource.openai.azure.com/openai/deployments/my-deployment"
+  })
+  secrets = jsonencode({
+    apiKey = "<your-azure-api-key>"
+  })
+}