Sync with hashicorp 12

.changelog/35941.txt

@@ -0,0 +1,15 @@
+```release-note:enhancement
+resource/aws_fis_experiment_template: Add plan-time validation of `log_configuration.cloudwatch_logs_configuration.log_group_arn`
+```
+
+```release-note:enhancement
+resource/aws_sfn_state_machine: Add plan-time validation of `logging_configuration.log_destination`
+```
+
+```release-note:enhancement
+resource/aws_prometheus_query_logging_configuration: Add plan-time validation of `destination.cloudwatch_logs.log_group_arn`
+```
+
+```release-note:enhancement
+resource/aws_prometheus_workspace: Add plan-time validation of `logging_configuration.log_group_arn`
+```

.changelog/39671.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+data-source/aws_route53_zone: Support filtering by `tags` only or by `vpc_id` only
+```

.changelog/41209.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_fis_experiment_template: Add support for `Functions` to `action.*.target`
+```

.changelog/41240.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lambda_invocation: Add import support
+```

.changelog/41275.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_db_instance: Fix blue/green deployments failing with "not in available state" by improving stability and handling `storage-config-upgrade` and `storage-initialization` statuses
+```

.changelog/42843.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_sagemaker_endpoint: Fix bug where `endpoint_config_name` was not correctly updated, causing the endpoint to retain the old configuration
+```

.changelog/43908.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_dynamodb_table: Add `global_table_witness` argument
+```

.changelog/44407.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_sagemaker_model: Add `container.additional_model_data_source` and `primary_container.additional_model_data_source` arguments
+```

.changelog/44626.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_opensearch_domain: Add `identity_center_options` configuration block
+```
+
+```release-note:enhancement
+data-source/aws_opensearch_domain: Add `identity_center_options` attribute
+```

.changelog/44782.txt

@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_networkflowmonitor_monitor
+```
+
+```release-note:new-resource
+aws_networkflowmonitor_scope
+```

.changelog/44800.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_ec2_allowed_images_settings
+```

.changelog/44806.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_observabilityadmin_centralization_rule_for_organization
+```

.changelog/44828.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resource/aws_bedrockagentcore_browser: Rename `network_configuration.network_mode_config` to `network_configuration.vpc_config`
+```

.changelog/44842.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_ecs_service: Add support for `LINEAR` and `CANARY` deployment strategies with `deployment_configuration.linear_configuration` and `deployment_configuration.canary_configuration` blocks
+```
+
+```release-note:enhancement
+data-source/aws_ecs_service: Add `capacity_provider_strategy`, `created_at`, `created_by`, `deployment_configuration`, `deployment_controller`, `deployments`, `enable_ecs_managed_tags`, `enable_execute_command`, `events`, `health_check_grace_period_seconds`, `iam_role`, `network_configuration`, `ordered_placement_strategy`, `pending_count`, `placement_constraints`, `platform_family`, `platform_version`, `propagate_tags`, `running_count`, `service_connect_configuration`, `service_registries`, `status`, and `task_sets` attributes
+```

.changelog/44899.txt

@@ -0,0 +1,11 @@
+```release-note:bug
+resource/aws_timestreaminfluxdb_db_cluster: Make `allocated_storage`, `bucket`, `organization`, `username`, and `password` optional to support InfluxDB V3 clusters
+```
+
+```release-note:enhancement
+resource/aws_timestreaminfluxdb_db_cluster: Add `engine_type` attribute
+```
+
+```release-note:enhancement
+resource/aws_timestreaminfluxdb_db_cluster: Add validation to ensure InfluxDB V2 clusters have required fields and InfluxDB V3 clusters (when using V3 parameter groups) do not have forbidden V2 fields. This functionality requires the `timestream-influxdb:GetDbParameterGroup` IAM permission
+```

.changelog/44934.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_connect_routing_profile: Add `media_concurrencies.cross_channel_behavior` argument
+```
+
+```release-note:enhancement
+data-source/aws_connect_routing_profile: Add `media_concurrencies.cross_channel_behavior` attribute
+```

.changelog/44944.txt

@@ -1,3 +1,3 @@
-```release-note:bug
+```release-note:enhancement
 provider: Support `us-isob-west-1` as a valid AWS Region
 ```

.changelog/44949.txt

@@ -0,0 +1,3 @@
+```release-note:new-ephemeral
+aws_ecr_authorization_token
+```

.changelog/44952.txt

@@ -0,0 +1,43 @@
+```release-note:bug
+resource/aws_redshift_cluster: Prevents errors with empty tag values.
+```
+
+```release-note:bug
+resource/aws_redshift_cluster_snapshot: Prevents errors with empty tag values.
+```
+
+```release-note:bug
+resource/aws_redshift_event_subscription: Prevents errors with empty tag values.
+```
+
+```release-note:bug
+resource/aws_redshift_hsm_client_certificate: Prevents errors with empty tag values.
+```
+
+```release-note:bug
+resource/aws_redshift_hsm_configuration: Prevents errors with empty tag values.
+```
+
+```release-note:bug
+resource/aws_redshift_integration: Prevents errors with empty tag values.
+```
+
+```release-note:bug
+resource/aws_redshift_parameter_group: Prevents errors with empty tag values.
+```
+
+```release-note:bug
+resource/aws_redshift_snapshot_copy_grant: Prevents errors with empty tag values.
+```
+
+```release-note:bug
+resource/aws_redshift_snapshot_schedule: Prevents errors with empty tag values.
+```
+
+```release-note:bug
+resource/aws_redshift_subnet_group: Prevents errors with empty tag values.
+```
+
+```release-note:bug
+resource/aws_redshift_usage_limit: Prevents errors with empty tag values.
+```

.changelog/44972.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_cloudfront_continuous_deployment_policy: Fix `Source type "...cloudfront.stagingDistributionDNSNamesModel" does not implement attr.Value` error. This fixes a regression introduced in [v6.17.0](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md#6170-october-16-2025)
+```

.changelog/44977.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_sagemaker_endpoint_configuration: Add `execution_role_arn` argument and make `model_name` optional in `production_variants` and `shadow_production_variants` blocks to support Inference Components
+```

.changelog/44982.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_opensearch_authorize_vpc_endpoint_access: Fix reading the resource when more than one principal is authorized. The [import ID](https://developer.hashicorp.com/terraform/language/block/import#id) has changed from `domain_name` to `domain_name` and `account` separated by a comma
+```

.changelog/44987.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_wafv2_web_acl_logging_configuration: Fix the validation for `redacted_fields.single_header.name`
+```

.changelog/44991.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_bedrockagentcore_gateway_target: Add `target_configuration.mcp.mcp_server` block
+```
+
+```release-note:enhancement
+resource/aws_bedrockagentcore_gateway_target: Make `credential_provider_configuration` block optional
+```

.changelog/44995.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cloudwatch_log_delivery_destination: Make `delivery_destination_type` and `delivery_destination_configuration` optional to support AWS X-Ray as a destination
+```

.changelog/44996.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_s3tables_table_bucket: Add tagging support
+```
+
+```release-note:enhancement
+resource/aws_s3tables_table: Add tagging support
+```

.changelog/45001.txt

@@ -0,0 +1,3 @@
+```release-note:new-action
+aws_dynamodb_create_backup
+```

.changelog/45003.txt

@@ -0,0 +1,6 @@
+```release-note:bug
+resource/aws_odb_cloud_vm_cluster: support for hyphen in odb cloud vm cluster hostname prefix.
+```
+```release-note:enhancement
+resource/aws_odb_cloud_vm_cluster: vm cluster creation using odb network ARN and exadata infrastructure ARN for resource sharing model.
+```

.changelog/45018.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_sns_topic: Fix `AuthorizationError ... is not authorized to perform: iam:PassRole on resource ...` IAM eventual consistency errors on Create and Update
+```

.changelog/45020.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_backup_logically_air_gapped_vault: Add `encryption_key_arn` argument
+```

.changelog/45022.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+provider: Fix situation where refreshes of removed infrastructure appear as errors rather than warnings
+```

.changelog/45023.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ec2_image_block_public_access: Add `region` argument
+```

.changelog/45024.txt

@@ -0,0 +1,23 @@
+```release-note:enhancement
+resource/aws_lambda_function: Add support for `java25` `runtime` value
+```
+
+```release-note:enhancement
+resource/aws_lambda_function: Add support for `nodejs24.x` `runtime` value
+```
+
+```release-note:enhancement
+resource/aws_lambda_function: Add support for `python3.14` `runtime` value
+```
+
+```release-note:enhancement
+resource/aws_lambda_layer_version: Add support for `java25` `compatible_runtimes` value
+```
+
+```release-note:enhancement
+resource/aws_lambda_layer_version: Add support for `nodejs24.x` `compatible_runtimes` value
+```
+
+```release-note:enhancement
+resource/aws_lambda_layer_version: Add support for `python3.14` `compatible_runtimes` value
+```

.changelog/45029.txt

@@ -0,0 +1,11 @@
+```release-note:bug
+resource/aws_emrcontainers_job_template: Fix `setting job_template_data: job_template_data.0.configuration_overrides.0.application_configuration.0: '' expected a map, got 'slice'` error
+```
+
+```release-note:bug
+resource/aws_emrcontainers_job_template: Fix `ValidationException: Value null at 'jobTemplateData.configurationOverrides.monitoringConfiguration.cloudWatchMonitoringConfiguration.logGroupName' failed to satisfy constraint: Member must not be null` error
+```
+
+```release-note:bug
+resource/aws_emrcontainers_job_template: Mark `job_template_data.job_driver.configuration_overrides.monitoring_configuration.persistent_app_ui` argument as computed
+```

.changelog/45030.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_invoicing_invoice_unit: Fix `Provider returned invalid result object after apply` error occurred when updating the resource
+```

.changelog/45050.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_apprunner_service: Prevents error when upgrading from provider pre-v6.0 without refreshing
+```

.changelog/45051.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_apprunner_service: Prevents error when upgrading from provider pre-v6.0 without refreshing
+```

.changelog/45064.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ec2_serial_console_access: Add `region` argument
+```

.changelog/45070.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_vpn_connection: Add `tunnel_bandwidth` argument to support higher bandwidth tunnels
+```

.changelog/45075.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_bedrockagent_knowledge_base: Add `storage_configuration.rds_configuration.field_mapping.custom_metadata_field` argument
+```

.changelog/45077.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_elastic_beanstalk_configuration_template: Fix updates not applying by including `ResourceName` for option settings and preventing duplicate add/remove operations
+```

.changelog/45083.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_quicksight_account_settings: Add `region` argument
+```

.changelog/45085.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_vpclattice_resource_configuration: Add `custom_domain_name` and `domain_verification_id` arguments and `domain_verification_arn` and `domain_verification_status` attributes to support custom domain names for resource configurations
+```
+
+```release-note:new-resource
+aws_vpclattice_domain_verification
+```

.changelog/45086.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_s3_directory_bucket: Fix plan-time `AWS resource not found during refresh` warnings causing resource replacement when `ReadOnly` `s3express:SessionMode` is enforced
+```

.changelog/45089.txt

@@ -0,0 +1,15 @@
+```release-note:enhancement
+resource/aws_lb_listener: Support `jwt-validation` as a valid `default_action.type` and add `default_action.jwt_validation` configuration block
+```
+
+```release-note:enhancement
+resource/aws_lb_listener_rule: Support `jwt-validation` as a valid `action.type` and add `action.jwt_validation` configuration block
+```
+
+```release-note:enhancement
+data-source/aws_lb_listener: Add `default_action.jwt_validation` attribute
+```
+
+```release-note:enhancement
+data-source/aws_lb_listener_rule: Add `action.jwt_validation` attribute
+```

.changelog/45091.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_bedrockagentcore_agent_runtime: Add `agent_runtime_artifact.code_configuration` block
+```
+
+```release-note:enhancement
+resource/aws_bedrockagentcore_agent_runtime: Make `agent_runtime_artifact.container_configuration` block optional
+```

.changelog/45092.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ssoadmin_account_assignment: Correct `target_type` argument to required
+```

.changelog/45105.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_s3_bucket_server_side_encryption_configuration: Add `rule.blocked_encryption_types` argument
+```
+
+```release-note:note
+resource/aws_s3_bucket_server_side_encryption_configuration: Starting in March 2026, Amazon S3 will introduce a new default bucket security setting by automatically disabling server-side encryption with customer-provided keys (SSE-C) for all new buckets. Use the `blocked_encryption_types` argument to manage this behavior for specific buckets.
+```

.changelog/45132.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_emr_managed_scaling_policy: Add `scaling_strategy` and `utilization_performance_index` arguments
+```

.changelog/45135.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_organizations_organization: Add `SECURITYHUB_POLICY` as a valid value for `enabled_policy_types` argument
+```

.ci/.golangci3.yml

@@ -5,6 +5,7 @@ linters:
     - goconst
     - gocritic
     - govet
+    - importas
     - ineffassign
     - makezero
     - misspell
@@ -25,6 +26,11 @@ linters:
         - opinionated
         - performance
         - style
+    importas:
+      no-unaliased: true
+      alias:
+        - pkg: github.com/hashicorp/terraform-provider-aws/internal/types
+          alias: inttypes
     mnd:
       checks:
         - argument