Update AWS provider/module and generated content (#919)

github-actions[bot] · bendrucker · web-flow · commit 862736e9f368 · 2025-07-28T16:37:19.000Z
Co-authored-by: bendrucker &lt;808808+bendrucker@users.noreply.github.com&gt;
diff --git a/docs/rules/README.md b/docs/rules/README.md
@@ -1315,7 +1315,6 @@ These rules enforce best practices and naming conventions:
 |aws_storagegateway_cache_invalid_disk_id|✔|
 |aws_storagegateway_cache_invalid_gateway_arn|✔|
 |aws_storagegateway_cached_iscsi_volume_invalid_gateway_arn|✔|
-|aws_storagegateway_cached_iscsi_volume_invalid_network_interface_id|✔|
 |aws_storagegateway_cached_iscsi_volume_invalid_snapshot_id|✔|
 |aws_storagegateway_cached_iscsi_volume_invalid_source_volume_arn|✔|
 |aws_storagegateway_cached_iscsi_volume_invalid_target_name|✔|
@@ -1348,7 +1347,6 @@ These rules enforce best practices and naming conventions:
 |aws_storagegateway_stored_iscsi_volume_invalid_disk_id|✔|
 |aws_storagegateway_stored_iscsi_volume_invalid_gateway_arn|✔|
 |aws_storagegateway_stored_iscsi_volume_invalid_kms_key|✔|
-|aws_storagegateway_stored_iscsi_volume_invalid_network_interface_id|✔|
 |aws_storagegateway_stored_iscsi_volume_invalid_snapshot_id|✔|
 |aws_storagegateway_stored_iscsi_volume_invalid_target_name|✔|
 |aws_storagegateway_tape_pool_invalid_pool_name|✔|
diff --git a/rules/models/aws-sdk-ruby b/rules/models/aws-sdk-ruby
@@ -1 +1 @@
-Subproject commit a48b1eafc6445b19a32942c8b2fd6e3f35ccaf90
+Subproject commit e6cf4fbc430b1e3b92d94d771d3edef3b486431f
diff --git a/rules/models/aws_accessanalyzer_analyzer_invalid_type.go b/rules/models/aws_accessanalyzer_analyzer_invalid_type.go
@@ -29,6 +29,8 @@ func NewAwsAccessanalyzerAnalyzerInvalidTypeRule() *AwsAccessanalyzerAnalyzerInv
 			"ORGANIZATION",
 			"ACCOUNT_UNUSED_ACCESS",
 			"ORGANIZATION_UNUSED_ACCESS",
+			"ACCOUNT_INTERNAL_ACCESS",
+			"ORGANIZATION_INTERNAL_ACCESS",
 		},
 	}
 }
diff --git a/rules/models/aws_datasync_location_nfs_invalid_server_hostname.go b/rules/models/aws_datasync_location_nfs_invalid_server_hostname.go
@@ -27,7 +27,7 @@ func NewAwsDatasyncLocationNfsInvalidServerHostnameRule() *AwsDatasyncLocationNf
 		resourceType:  "aws_datasync_location_nfs",
 		attributeName: "server_hostname",
 		max:           255,
-		pattern:       regexp.MustCompile(`^(([a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9\-]*[A-Za-z0-9])$`),
+		pattern:       regexp.MustCompile(`^(([a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9\-:]*[A-Za-z0-9])$`),
 	}
 }
 
@@ -81,7 +81,7 @@ func (r *AwsDatasyncLocationNfsInvalidServerHostnameRule) Check(runner tflint.Ru
 			if !r.pattern.MatchString(val) {
 				runner.EmitIssue(
 					r,
-					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^(([a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9\-]*[A-Za-z0-9])$`),
+					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^(([a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9\-:]*[A-Za-z0-9])$`),
 					attribute.Expr.Range(),
 				)
 			}
diff --git a/rules/models/aws_datasync_location_nfs_invalid_server_hostname_test.go b/rules/models/aws_datasync_location_nfs_invalid_server_hostname_test.go
@@ -24,7 +24,7 @@ resource "aws_datasync_location_nfs" "foo" {
 			Expected: helper.Issues{
 				{
 					Rule:    NewAwsDatasyncLocationNfsInvalidServerHostnameRule(),
-					Message: fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage("nfs^example^com"), `^(([a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9\-]*[A-Za-z0-9])$`),
+					Message: fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage("nfs^example^com"), `^(([a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9\-:]*[A-Za-z0-9])$`),
 				},
 			},
 		},
diff --git a/rules/models/aws_datasync_location_smb_invalid_server_hostname.go b/rules/models/aws_datasync_location_smb_invalid_server_hostname.go
@@ -27,7 +27,7 @@ func NewAwsDatasyncLocationSmbInvalidServerHostnameRule() *AwsDatasyncLocationSm
 		resourceType:  "aws_datasync_location_smb",
 		attributeName: "server_hostname",
 		max:           255,
-		pattern:       regexp.MustCompile(`^(([a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9\-]*[A-Za-z0-9])$`),
+		pattern:       regexp.MustCompile(`^(([a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9\-:]*[A-Za-z0-9])$`),
 	}
 }
 
@@ -81,7 +81,7 @@ func (r *AwsDatasyncLocationSmbInvalidServerHostnameRule) Check(runner tflint.Ru
 			if !r.pattern.MatchString(val) {
 				runner.EmitIssue(
 					r,
-					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^(([a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9\-]*[A-Za-z0-9])$`),
+					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^(([a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9\-:]*[A-Za-z0-9])$`),
 					attribute.Expr.Range(),
 				)
 			}
diff --git a/rules/models/aws_guardduty_member_invalid_email.go b/rules/models/aws_guardduty_member_invalid_email.go
@@ -3,6 +3,9 @@
 package models
 
 import (
+	"fmt"
+	"regexp"
+
 	"github.com/terraform-linters/tflint-plugin-sdk/hclext"
 	"github.com/terraform-linters/tflint-plugin-sdk/logger"
 	"github.com/terraform-linters/tflint-plugin-sdk/tflint"
@@ -16,6 +19,7 @@ type AwsGuarddutyMemberInvalidEmailRule struct {
 	attributeName string
 	max           int
 	min           int
+	pattern       *regexp.Regexp
 }
 
 // NewAwsGuarddutyMemberInvalidEmailRule returns new rule with default attributes
@@ -24,7 +28,8 @@ func NewAwsGuarddutyMemberInvalidEmailRule() *AwsGuarddutyMemberInvalidEmailRule
 		resourceType:  "aws_guardduty_member",
 		attributeName: "email",
 		max:           64,
-		min:           1,
+		min:           6,
+		pattern:       regexp.MustCompile(`^See rules in parameter description$`),
 	}
 }
 
@@ -78,7 +83,14 @@ func (r *AwsGuarddutyMemberInvalidEmailRule) Check(runner tflint.Runner) error {
 			if len(val) < r.min {
 				runner.EmitIssue(
 					r,
-					"email must be 1 characters or higher",
+					"email must be 6 characters or higher",
+					attribute.Expr.Range(),
+				)
+			}
+			if !r.pattern.MatchString(val) {
+				runner.EmitIssue(
+					r,
+					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^See rules in parameter description$`),
 					attribute.Expr.Range(),
 				)
 			}
diff --git a/rules/models/aws_iam_access_key_invalid_status.go b/rules/models/aws_iam_access_key_invalid_status.go
@@ -27,6 +27,7 @@ func NewAwsIAMAccessKeyInvalidStatusRule() *AwsIAMAccessKeyInvalidStatusRule {
 		enum: []string{
 			"Active",
 			"Inactive",
+			"Expired",
 		},
 	}
 }
diff --git a/rules/models/aws_iam_user_ssh_key_invalid_status.go b/rules/models/aws_iam_user_ssh_key_invalid_status.go
@@ -27,6 +27,7 @@ func NewAwsIAMUserSSHKeyInvalidStatusRule() *AwsIAMUserSSHKeyInvalidStatusRule {
 		enum: []string{
 			"Active",
 			"Inactive",
+			"Expired",
 		},
 	}
 }
diff --git a/rules/models/aws_instance_invalid_type.go b/rules/models/aws_instance_invalid_type.go
@@ -970,6 +970,20 @@ func NewAwsInstanceInvalidTypeRule() *AwsInstanceInvalidTypeRule {
 			"r8gd.48xlarge",
 			"r8gd.metal-24xl",
 			"r8gd.metal-48xl",
+			"c8gn.medium",
+			"c8gn.large",
+			"c8gn.xlarge",
+			"c8gn.2xlarge",
+			"c8gn.4xlarge",
+			"c8gn.8xlarge",
+			"c8gn.12xlarge",
+			"c8gn.16xlarge",
+			"c8gn.24xlarge",
+			"c8gn.48xlarge",
+			"c8gn.metal-24xl",
+			"c8gn.metal-48xl",
+			"f2.6xlarge",
+			"p6e-gb200.36xlarge",
 		},
 	}
 }
diff --git a/rules/models/aws_launch_configuration_invalid_type.go b/rules/models/aws_launch_configuration_invalid_type.go
@@ -970,6 +970,20 @@ func NewAwsLaunchConfigurationInvalidTypeRule() *AwsLaunchConfigurationInvalidTy
 			"r8gd.48xlarge",
 			"r8gd.metal-24xl",
 			"r8gd.metal-48xl",
+			"c8gn.medium",
+			"c8gn.large",
+			"c8gn.xlarge",
+			"c8gn.2xlarge",
+			"c8gn.4xlarge",
+			"c8gn.8xlarge",
+			"c8gn.12xlarge",
+			"c8gn.16xlarge",
+			"c8gn.24xlarge",
+			"c8gn.48xlarge",
+			"c8gn.metal-24xl",
+			"c8gn.metal-48xl",
+			"f2.6xlarge",
+			"p6e-gb200.36xlarge",
 		},
 	}
 }
diff --git a/rules/models/aws_launch_template_invalid_instance_type.go b/rules/models/aws_launch_template_invalid_instance_type.go
@@ -970,6 +970,20 @@ func NewAwsLaunchTemplateInvalidInstanceTypeRule() *AwsLaunchTemplateInvalidInst
 			"r8gd.48xlarge",
 			"r8gd.metal-24xl",
 			"r8gd.metal-48xl",
+			"c8gn.medium",
+			"c8gn.large",
+			"c8gn.xlarge",
+			"c8gn.2xlarge",
+			"c8gn.4xlarge",
+			"c8gn.8xlarge",
+			"c8gn.12xlarge",
+			"c8gn.16xlarge",
+			"c8gn.24xlarge",
+			"c8gn.48xlarge",
+			"c8gn.metal-24xl",
+			"c8gn.metal-48xl",
+			"f2.6xlarge",
+			"p6e-gb200.36xlarge",
 		},
 	}
 }
diff --git a/rules/models/aws_organizations_policy_invalid_type.go b/rules/models/aws_organizations_policy_invalid_type.go
@@ -32,6 +32,7 @@ func NewAwsOrganizationsPolicyInvalidTypeRule() *AwsOrganizationsPolicyInvalidTy
 			"AISERVICES_OPT_OUT_POLICY",
 			"CHATBOT_POLICY",
 			"DECLARATIVE_POLICY_EC2",
+			"SECURITYHUB_POLICY",
 		},
 	}
 }
diff --git a/rules/models/aws_route53_health_check_invalid_cloudwatch_alarm_region.go b/rules/models/aws_route53_health_check_invalid_cloudwatch_alarm_region.go
@@ -71,6 +71,7 @@ func NewAwsRoute53HealthCheckInvalidCloudwatchAlarmRegionRule() *AwsRoute53Healt
 			"us-isof-east-1",
 			"ap-southeast-7",
 			"ap-east-2",
+			"eu-isoe-west-1",
 		},
 	}
 }
diff --git a/rules/models/aws_route53_resolver_endpoint_invalid_direction.go b/rules/models/aws_route53_resolver_endpoint_invalid_direction.go
@@ -27,6 +27,7 @@ func NewAwsRoute53ResolverEndpointInvalidDirectionRule() *AwsRoute53ResolverEndp
 		enum: []string{
 			"INBOUND",
 			"OUTBOUND",
+			"INBOUND_DELEGATION",
 		},
 	}
 }
diff --git a/rules/models/aws_route53_resolver_rule_invalid_rule_type.go b/rules/models/aws_route53_resolver_rule_invalid_rule_type.go
@@ -28,6 +28,7 @@ func NewAwsRoute53ResolverRuleInvalidRuleTypeRule() *AwsRoute53ResolverRuleInval
 			"FORWARD",
 			"SYSTEM",
 			"RECURSIVE",
+			"DELEGATE",
 		},
 	}
 }
diff --git a/rules/models/aws_route53_zone_association_invalid_vpc_region.go b/rules/models/aws_route53_zone_association_invalid_vpc_region.go
@@ -71,6 +71,7 @@ func NewAwsRoute53ZoneAssociationInvalidVpcRegionRule() *AwsRoute53ZoneAssociati
 			"us-isof-east-1",
 			"ap-southeast-7",
 			"ap-east-2",
+			"eu-isoe-west-1",
 		},
 	}
 }
diff --git a/rules/models/aws_s3_bucket_object_invalid_server_side_encryption.go b/rules/models/aws_s3_bucket_object_invalid_server_side_encryption.go
@@ -26,6 +26,7 @@ func NewAwsS3BucketObjectInvalidServerSideEncryptionRule() *AwsS3BucketObjectInv
 		attributeName: "server_side_encryption",
 		enum: []string{
 			"AES256",
+			"aws:fsx",
 			"aws:kms",
 			"aws:kms:dsse",
 		},
diff --git a/rules/models/aws_s3_bucket_object_invalid_storage_class.go b/rules/models/aws_s3_bucket_object_invalid_storage_class.go
@@ -36,6 +36,7 @@ func NewAwsS3BucketObjectInvalidStorageClassRule() *AwsS3BucketObjectInvalidStor
 			"GLACIER_IR",
 			"SNOW",
 			"EXPRESS_ONEZONE",
+			"FSX_OPENZFS",
 		},
 	}
 }
diff --git a/rules/models/aws_s3_object_copy_invalid_server_side_encryption.go b/rules/models/aws_s3_object_copy_invalid_server_side_encryption.go
@@ -26,6 +26,7 @@ func NewAwsS3ObjectCopyInvalidServerSideEncryptionRule() *AwsS3ObjectCopyInvalid
 		attributeName: "server_side_encryption",
 		enum: []string{
 			"AES256",
+			"aws:fsx",
 			"aws:kms",
 			"aws:kms:dsse",
 		},
diff --git a/rules/models/aws_s3_object_copy_invalid_storage_class.go b/rules/models/aws_s3_object_copy_invalid_storage_class.go
@@ -36,6 +36,7 @@ func NewAwsS3ObjectCopyInvalidStorageClassRule() *AwsS3ObjectCopyInvalidStorageC
 			"GLACIER_IR",
 			"SNOW",
 			"EXPRESS_ONEZONE",
+			"FSX_OPENZFS",
 		},
 	}
 }
diff --git a/rules/models/provider.go b/rules/models/provider.go
@@ -1233,7 +1233,6 @@ var Rules = []tflint.Rule{
 	NewAwsStoragegatewayCacheInvalidDiskIDRule(),
 	NewAwsStoragegatewayCacheInvalidGatewayArnRule(),
 	NewAwsStoragegatewayCachedIscsiVolumeInvalidGatewayArnRule(),
-	NewAwsStoragegatewayCachedIscsiVolumeInvalidNetworkInterfaceIDRule(),
 	NewAwsStoragegatewayCachedIscsiVolumeInvalidSnapshotIDRule(),
 	NewAwsStoragegatewayCachedIscsiVolumeInvalidSourceVolumeArnRule(),
 	NewAwsStoragegatewayCachedIscsiVolumeInvalidTargetNameRule(),
@@ -1266,7 +1265,6 @@ var Rules = []tflint.Rule{
 	NewAwsStoragegatewayStoredIscsiVolumeInvalidDiskIDRule(),
 	NewAwsStoragegatewayStoredIscsiVolumeInvalidGatewayArnRule(),
 	NewAwsStoragegatewayStoredIscsiVolumeInvalidKmsKeyRule(),
-	NewAwsStoragegatewayStoredIscsiVolumeInvalidNetworkInterfaceIDRule(),
 	NewAwsStoragegatewayStoredIscsiVolumeInvalidSnapshotIDRule(),
 	NewAwsStoragegatewayStoredIscsiVolumeInvalidTargetNameRule(),
 	NewAwsStoragegatewayTapePoolInvalidPoolNameRule(),
diff --git a/tools/provider-schema/.terraform.lock.hcl b/tools/provider-schema/.terraform.lock.hcl
diff --git a/tools/provider-schema/schema.json b/tools/provider-schema/schema.json

Original file line number	Diff line number	Diff line change
`@@ -29,6 +29,8 @@ func NewAwsAccessanalyzerAnalyzerInvalidTypeRule() *AwsAccessanalyzerAnalyzerInv`
`29`	`29`	`"ORGANIZATION",`
`30`	`30`	`"ACCOUNT_UNUSED_ACCESS",`
`31`	`31`	`"ORGANIZATION_UNUSED_ACCESS",`
	`32`	`+ "ACCOUNT_INTERNAL_ACCESS",`
	`33`	`+ "ORGANIZATION_INTERNAL_ACCESS",`
`32`	`34`	`},`
`33`	`35`	`}`
`34`	`36`	`}`
Original file line number	Diff line number	Diff line change
`@@ -27,7 +27,7 @@ func NewAwsDatasyncLocationNfsInvalidServerHostnameRule() *AwsDatasyncLocationNf`
`27`	`27`	`resourceType: "aws_datasync_location_nfs",`
`28`	`28`	`attributeName: "server_hostname",`
`29`	`29`	`max: 255,`
`30`		- pattern: regexp.MustCompile(`^(([a-zA-Z0-9\-][a-zA-Z0-9])\.)([A-Za-z0-9\-]*[A-Za-z0-9])$`),
	`30`	+ pattern: regexp.MustCompile(`^(([a-zA-Z0-9\-][a-zA-Z0-9])\.)([A-Za-z0-9\-:]*[A-Za-z0-9])$`),
`31`	`31`	`}`
`32`	`32`	`}`
`33`	`33`
`@@ -81,7 +81,7 @@ func (r *AwsDatasyncLocationNfsInvalidServerHostnameRule) Check(runner tflint.Ru`
`81`	`81`	`if !r.pattern.MatchString(val) {`
`82`	`82`	`runner.EmitIssue(`
`83`	`83`	`r,`
`84`		- fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^(([a-zA-Z0-9\-][a-zA-Z0-9])\.)([A-Za-z0-9\-]*[A-Za-z0-9])$`),
	`84`	+ fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^(([a-zA-Z0-9\-][a-zA-Z0-9])\.)([A-Za-z0-9\-:]*[A-Za-z0-9])$`),
`85`	`85`	`attribute.Expr.Range(),`
`86`	`86`	`)`
`87`	`87`	`}`
Original file line number	Diff line number	Diff line change
`@@ -24,7 +24,7 @@ resource "aws_datasync_location_nfs" "foo" {`
`24`	`24`	`Expected: helper.Issues{`
`25`	`25`	`{`
`26`	`26`	`Rule: NewAwsDatasyncLocationNfsInvalidServerHostnameRule(),`
`27`		- Message: fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage("nfs^example^com"), `^(([a-zA-Z0-9\-][a-zA-Z0-9])\.)([A-Za-z0-9\-]*[A-Za-z0-9])$`),
	`27`	+ Message: fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage("nfs^example^com"), `^(([a-zA-Z0-9\-][a-zA-Z0-9])\.)([A-Za-z0-9\-:]*[A-Za-z0-9])$`),
`28`	`28`	`},`
`29`	`29`	`},`
`30`	`30`	`},`
Original file line number	Diff line number	Diff line change
`@@ -27,6 +27,7 @@ func NewAwsIAMAccessKeyInvalidStatusRule() *AwsIAMAccessKeyInvalidStatusRule {`
`27`	`27`	`enum: []string{`
`28`	`28`	`"Active",`
`29`	`29`	`"Inactive",`
	`30`	`+ "Expired",`
`30`	`31`	`},`
`31`	`32`	`}`
`32`	`33`	`}`
Original file line number	Diff line number	Diff line change
`@@ -27,6 +27,7 @@ func NewAwsIAMUserSSHKeyInvalidStatusRule() *AwsIAMUserSSHKeyInvalidStatusRule {`
`27`	`27`	`enum: []string{`
`28`	`28`	`"Active",`
`29`	`29`	`"Inactive",`
	`30`	`+ "Expired",`
`30`	`31`	`},`
`31`	`32`	`}`
`32`	`33`	`}`