Merge remote-tracking branch 'origin/main' into copilot/add-default-data-view-resource

* origin/main: (32 commits)
  chore(deps): update kibana-openapi-spec digest to c99d51c (#1487)
  [Feature] Introduce elasticsearch alias resource with atomic write index management and nested attributes (#1343)
  Support setting solution for 8.16+ on Cloud (#1486)
  Refactor all Kibana connector acceptance tests to use ConfigDirectory pattern (#1484)
  Support .bedrock and .gen-ai connectors (#1467)
  Bump golang.org/x/crypto from 0.41.0 to 0.45.0 in /libs/go-kibana-rest (#1481)
  Bump golang.org/x/crypto from 0.42.0 to 0.45.0 (#1480)
  fix(deps): update module github.com/go-resty/resty/v2 to v2.17.0 (#1478)
  chore(deps): update kibana-openapi-spec digest to f1d0789 (#1479)
  chore(deps): update kibana-openapi-spec digest to 5841714 (#1477)
  chore(deps): update golang:1.25.4 docker digest to 6981837 (#1476)
  chore(deps): update kibana-openapi-spec digest to 67de5ef (#1475)
  chore(deps): update golangci/golangci-lint-action digest to e7fa5ac (#1474)
  chore(deps): update kibana-openapi-spec digest to b4553b6 (#1472)
  chore(deps): update actions/checkout action to v6 (#1470)
  Support publishing experimental resources/datasources within the framework provider (#1464)
  chore(deps): update actions/setup-go digest to 4dc6199 (#1466)
  fix(deps): update module github.com/elastic/elastic-transport-go/v8 to v8.8.0 (#1459)
  Prepare 0.12.2 Release (#1458)
  Support spaces for detection rules (#1457)
  ...

Author: tobio

.buildkite/release.yml

@@ -1,7 +1,7 @@
 steps:
   - label: Release
     agents:
-      image: "golang:1.25.4@sha256:e68f6a00e88586577fafa4d9cefad1349c2be70d21244321321c407474ff9bf2"
+      image: "golang:1.25.4@sha256:698183780de28062f4ef46f82a79ec0ae69d2d22f7b160cf69f71ea8d98bf25d"
       cpu: "16"
       memory: "24G"
       ephemeralStorage: "20G"

.github/workflows/copilot-setup-steps.yml

@@ -23,8 +23,8 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
         with:
           go-version-file: 'go.mod'
           cache: true

.github/workflows/test.yml

@@ -18,8 +18,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
         with:
           go-version-file: 'go.mod'
           cache: true
@@ -34,8 +34,8 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
         with:
           go-version-file: 'go.mod'
           cache: true
@@ -139,8 +139,8 @@ jobs:
           - version: '8.4.3'
             runner: ubuntu-22.04
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
         with:
           go-version-file: 'go.mod'
           cache: true

CHANGELOG.md

@@ -1,11 +1,60 @@
 ## [Unreleased]
 
+### Breaking changes
+
+#### `elasticstack_elasticsearch_index.alias` block has changed to a set attribute. 
+
+The `alias` block in the `elasticstack_elasticsearch_index` resource has been moved to an attribute. 
+This transition provides better support for future changes in both the provider and the underlying Terraform framework. 
+
+Existing usage of the `alias` block must be migrated to the attribute syntax. For example:
+
+```hcl
+alias {
+  name = "my_alias_1"
+}
+
+alias {
+  name = "my_alias_2"
+  filter = jsonencode({
+    term = { "user.id" = "developer" }
+  })
+}
+```
+
+becomes 
+
+```hcl
+alias = [
+  {
+    name = "my_alias_1"
+  },
+  {
+    name = "my_alias_2"
+    filter = jsonencode({
+      term = { "user.id" = "developer" }
+    })
+  }
+]
+```
+
+### Changes
+
+- Support `.bedrock` and `.gen-ai` connectors ([#1467](https://github.com/elastic/terraform-provider-elasticstack/pull/1467))
+- Support the `solution` attribute in `elasticstack_kibana_space` from 8.16 ([#1486](https://github.com/elastic/terraform-provider-elasticstack/pull/1486)) 
+- Add `elasticstack_elasticsearch_alias` resource ([#1343](https://github.com/elastic/terraform-provider-elasticstack/pull/1343))
+
+## [0.12.2] - 2025-11-19
 - Fix `elasticstack_elasticsearch_snapshot_lifecycle` metadata type conversion causing terraform apply to fail ([#1409](https://github.com/elastic/terraform-provider-elasticstack/issues/1409))
 - Add new `elasticstack_elasticsearch_ml_anomaly_detection_job` resource ([#1329](https://github.com/elastic/terraform-provider-elasticstack/pull/1329))
 - Add new `elasticstack_elasticsearch_ml_datafeed` resource ([#1340](https://github.com/elastic/terraform-provider-elasticstack/pull/1340))
 - Add `space_ids` attribute to all Fleet resources to support space-aware Fleet resource management ([#1390](https://github.com/elastic/terraform-provider-elasticstack/pull/1390))
+- Add back missing import support for `elasticstack_elasticsearch_security_role_mapping` ([#1441](https://github.com/elastic/terraform-provider-elasticstack/pull/1441))
 - Add new `elasticstack_elasticsearch_ml_job_state` resource ([#1337](https://github.com/elastic/terraform-provider-elasticstack/pull/1337))
 - Add new `elasticstack_elasticsearch_ml_datafeed_state` resource ([#1422](https://github.com/elastic/terraform-provider-elasticstack/pull/1422))
+- Add `output_id` to `elasticstack_fleet_integration_policy` resource ([#1445](https://github.com/elastic/terraform-provider-elasticstack/pull/1445))
+- Make `hosts` attribute required in `elasticstack_fleet_output` resource ([#1450](https://github.com/elastic/terraform-provider-elasticstack/pull/1450/files)) 
+- Fix `elasticstack_kibana_security_detection_rule` to properly respect `space_id`
 
 ## [0.12.1] - 2025-10-22
 - Fix regression restricting the characters in an `elasticstack_elasticsearch_role_mapping` `name`. ([#1373](https://github.com/elastic/terraform-provider-elasticstack/pull/1373))
@@ -534,7 +583,8 @@ resource "elasticstack_fleet_output" "output" {
 - Initial set of docs
 - CI integration
 
-[Unreleased]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.12.1...HEAD
+[Unreleased]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.12.2...HEAD
+[0.12.2]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.12.1...v0.12.2
 [0.12.1]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.12.0...v0.12.1
 [0.12.0]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.18...v0.12.0
 [0.11.19]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.18...v0.11.19

Makefile

@@ -1,7 +1,7 @@
 .DEFAULT_GOAL = help
 SHELL := /bin/bash
 
-VERSION ?= 0.12.1
+VERSION ?= 0.12.2
 
 NAME = elasticstack
 BINARY = terraform-provider-${NAME}
@@ -46,6 +46,12 @@ build-ci: ## build the terraform provider
 .PHONY: build
 build: lint build-ci ## build the terraform provider
 
+# run acceptance tests against the docker container that has been started with `make docker-kibana` (or `make docker-elasticsearch`)
+# To run specific test (e.g. TestAccResourceActionConnector) execute `make testacc-vs-docker TESTARGS='-run ^TestAccResourceKibanaConnectorBedrock$$'`
+.PHONY: testacc-vs-docker
+testacc-vs-docker:
+	@ ELASTICSEARCH_ENDPOINTS=http://localhost:9200 KIBANA_ENDPOINT=http://localhost:5601 ELASTICSEARCH_USERNAME=$(ELASTICSEARCH_USERNAME) ELASTICSEARCH_PASSWORD=$(ELASTICSEARCH_PASSWORD) make testacc
+
 .PHONY: testacc
 testacc: ## Run acceptance tests
 	TF_ACC=1 go tool gotestsum --format testname --rerun-fails=3 --packages="-v ./..." -- -count $(ACCTEST_COUNT) -parallel $(ACCTEST_PARALLELISM) $(TESTARGS) -timeout $(ACCTEST_TIMEOUT)
@@ -130,7 +136,7 @@ install: build ## Install built provider into the local terraform cache
 
 .PHONY: tools
 tools: $(GOBIN)  ## Download golangci-lint locally if necessary.
-	@[[ -f $(GOBIN)/golangci-lint ]] || curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOBIN) v2.6.1
+	@[[ -f $(GOBIN)/golangci-lint ]] || curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOBIN) v2.6.2
 
 .PHONY: golangci-lint
 golangci-lint:

docs/resources/elasticsearch_index.md

@@ -20,16 +20,14 @@ provider "elasticstack" {
 resource "elasticstack_elasticsearch_index" "my_index" {
   name = "my-index"
 
-  alias {
+  alias = [{
     name = "my_alias_1"
-  }
-
-  alias {
+    }, {
     name = "my_alias_2"
     filter = jsonencode({
       term = { "user.id" = "developer" }
     })
-  }
+  }]
 
   mappings = jsonencode({
     properties = {
@@ -59,7 +57,7 @@ resource "elasticstack_elasticsearch_index" "my_index" {
 
 ### Optional
 
-- `alias` (Block Set) Aliases for the index. (see [below for nested schema](#nestedblock--alias))
+- `alias` (Attributes Set) Aliases for the index. (see [below for nested schema](#nestedatt--alias))
 - `analysis_analyzer` (String) A JSON string describing the analyzers applied to the index.
 - `analysis_char_filter` (String) A JSON string describing the char_filters applied to the index.
 - `analysis_filter` (String) A JSON string describing the filters applied to the index.
@@ -135,7 +133,7 @@ resource "elasticstack_elasticsearch_index" "my_index" {
 - `id` (String) Internal identifier of the resource
 - `settings_raw` (String) All raw settings fetched from the cluster.
 
-<a id="nestedblock--alias"></a>
+<a id="nestedatt--alias"></a>
 ### Nested Schema for `alias`
 
 Required:

docs/resources/elasticsearch_index_alias.md

@@ -0,0 +1,60 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "elasticstack_elasticsearch_index_alias Resource - terraform-provider-elasticstack"
+subcategory: "Index"
+description: |-
+  Manages an Elasticsearch alias. See the alias documentation https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-aliases.html for more details.
+---
+
+# elasticstack_elasticsearch_index_alias (Resource)
+
+Manages an Elasticsearch alias. See the [alias documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-aliases.html) for more details.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) The alias name.
+
+### Optional
+
+- `read_indices` (Attributes Set) Set of read indices for the alias. (see [below for nested schema](#nestedatt--read_indices))
+- `write_index` (Attributes) The write index for the alias. Only one write index is allowed per alias. (see [below for nested schema](#nestedatt--write_index))
+
+### Read-Only
+
+- `id` (String) Generated ID of the alias resource.
+
+<a id="nestedatt--read_indices"></a>
+### Nested Schema for `read_indices`
+
+Required:
+
+- `name` (String) Name of the read index.
+
+Optional:
+
+- `filter` (String) Query used to limit documents the alias can access.
+- `index_routing` (String) Value used to route indexing operations to a specific shard.
+- `is_hidden` (Boolean) If true, the alias is hidden.
+- `routing` (String) Value used to route indexing and search operations to a specific shard.
+- `search_routing` (String) Value used to route search operations to a specific shard.
+
+
+<a id="nestedatt--write_index"></a>
+### Nested Schema for `write_index`
+
+Required:
+
+- `name` (String) Name of the write index.
+
+Optional:
+
+- `filter` (String) Query used to limit documents the alias can access.
+- `index_routing` (String) Value used to route indexing operations to a specific shard.
+- `is_hidden` (Boolean) If true, the alias is hidden.
+- `routing` (String) Value used to route indexing and search operations to a specific shard.
+- `search_routing` (String) Value used to route search operations to a specific shard.

docs/resources/fleet_integration_policy.md

@@ -63,6 +63,8 @@ resource "elasticstack_fleet_integration_policy" "sample" {
   agent_policy_id     = elasticstack_fleet_agent_policy.sample.policy_id
   integration_name    = elasticstack_fleet_integration.sample.name
   integration_version = elasticstack_fleet_integration.sample.version
+  // Optional: specify a custom output to send data to
+  // output_id           = "my-custom-output-id"
 
   input {
     input_id = "tcp-tcp"
@@ -102,6 +104,7 @@ resource "elasticstack_fleet_integration_policy" "sample" {
 - `enabled` (Boolean) Enable the integration policy.
 - `force` (Boolean) Force operations, such as creation and deletion, to occur.
 - `input` (Block List) Integration inputs. (see [below for nested schema](#nestedblock--input))
+- `output_id` (String) The ID of the output to send data to. When not specified, the default output of the agent policy will be used.
 - `policy_id` (String) Unique identifier of the integration policy.
 - `space_ids` (Set of String) The Kibana space IDs where this integration policy is available. When set, must match the space_ids of the referenced agent policy. If not set, will be inherited from the agent policy. Note: The order of space IDs does not matter as this is a set.
 - `vars_json` (String, Sensitive) Integration-level variables as JSON.

docs/resources/fleet_output.md

@@ -200,6 +200,7 @@ resource "elasticstack_fleet_output" "kafka_round_robin" {
 
 ### Required
 
+- `hosts` (List of String) A list of hosts.
 - `name` (String) The name of the output.
 - `type` (String) The output type.
 
@@ -210,7 +211,6 @@ resource "elasticstack_fleet_output" "kafka_round_robin" {
 - `config_yaml` (String, Sensitive) Advanced YAML configuration. YAML settings here will be added to the output section of each agent policy.
 - `default_integrations` (Boolean) Make this output the default for agent integrations.
 - `default_monitoring` (Boolean) Make this output the default for agent monitoring.
-- `hosts` (List of String) A list of hosts.
 - `kafka` (Attributes) Kafka-specific configuration. (see [below for nested schema](#nestedatt--kafka))
 - `output_id` (String) Unique identifier of the output.
 - `space_ids` (Set of String) The Kibana space IDs where this output is available. When set, the output will be created and managed within the specified space. Note: The order of space IDs does not matter as this is a set.

docs/resources/kibana_action_connector.md

@@ -52,6 +52,44 @@ resource "elasticstack_kibana_action_connector" "slack-api-connector" {
     token = "<your-token>"
   })
 }
+
+resource "elasticstack_kibana_action_connector" "bedrock-connector" {
+  name              = "aws-bedrock"
+  connector_type_id = ".bedrock"
+  config = jsonencode({
+    apiUrl       = "https://bedrock-runtime.us-east-1.amazonaws.com"
+    defaultModel = "anthropic.claude-v2"
+  })
+  secrets = jsonencode({
+    accessKey = "<your-aws-access-key>"
+    secret    = "<your-aws-secret-key>"
+  })
+}
+
+resource "elasticstack_kibana_action_connector" "genai-openai-connector" {
+  name              = "openai"
+  connector_type_id = ".gen-ai"
+  config = jsonencode({
+    apiProvider  = "OpenAI"
+    apiUrl       = "https://api.openai.com/v1"
+    defaultModel = "gpt-4"
+  })
+  secrets = jsonencode({
+    apiKey = "<your-openai-api-key>"
+  })
+}
+
+resource "elasticstack_kibana_action_connector" "genai-azure-connector" {
+  name              = "azure-openai"
+  connector_type_id = ".gen-ai"
+  config = jsonencode({
+    apiProvider = "Azure OpenAI"
+    apiUrl      = "https://my-resource.openai.azure.com/openai/deployments/my-deployment"
+  })
+  secrets = jsonencode({
+    apiKey = "<your-azure-api-key>"
+  })
+}
 ```
 
 <!-- schema generated by tfplugindocs -->