crossplane-contrib/provider-upjet-aws v2.7.0

on GitHub

Summary

• Bumps TF AWS provider 6.55.0
• New managed resources across
  account, bedrock, bedrockagentcore, cloudwatchlogs, lambda and
  opensearchserverless API groups
• Bugfixes and enhancements and CVE remediations
• Bumps upjet v2.4.1-0.20260728103920-4f6e6e10dff2
• Bumps crossplane-runtime v2.3.3

⚠️ Breaking bugfix API changes

KeyPair.lightsail — status.atProvider.privateKey removed (#2136)

The upstream Terraform provider changed private_key on aws_lightsail_key_pair from a
regular attribute to a Sensitive attribute. Consequently:

• status.atProvider.privateKey is removed from the CRD
• The private key is now written to the connection details secret after creation
  instead.

The private key is only available at creation time and cannot be re-read from AWS.
Back up existing keys before upgrading, and make sure a
writeConnectionSecretToRef is configured for new
KeyPair resources.

Go module consumers: crossplane-runtime v2.3 changes (#2171)

All generated API types moved their common Crossplane types from
github.com/crossplane/crossplane-runtime/v2/apis/common/v1 to
github.com/crossplane/crossplane/apis/v2/core/v2. Every *Ref, *Selector,
*SecretRef and SecretKeySelector field changed its Go type
(v1.Reference → v2.Reference, v1.Selector → v2.Selector,
v1.SecretKeySelector → xpv2.SecretKeySelector, …).

This is not a CRD/YAML-level change — the schema is identical, so
existing manifests and stored objects are unaffected.
It is a notification for anyone importing this provider's apis/... packages in Go
(e.g. function or composition authors, custom controllers). Please update imports accordingly if needed.

⚠️ Field Deprecations (#2136)

Following fields still work but will be removed in the next major version as underlying TF
versions deprecated them. Use the new replacements on external consumers where possible.

Cluster.elasticache — valkey removed from spec.forProvider.engine (#2136)

valkey was never a valid engine for the Cluster resource; it was accepted by the CRD
enum but rejected by AWS. Aligned with the AWS SDK to avoid confusion
(see hashicorp/terraform-provider-aws#41181).
Valkey engines continue to be created via ReplicationGroup.elasticache or
ServerlessCache.elasticache.

🆕 New managed resources

🔼 Terraform AWS provider version bump

• #2136 — 6.34.0 → 6.53.0. The single largest change in this release; the
  KeyPair.lightsail, Cluster.elasticache, required→optional and deprecation items above
  all originate here. Also backports new fields into cluster-scoped v1beta1 APIs,
  configures singleton-list conversions for newly added nested blocks, and fixes example
  manifests the new provider version rejected (Broker.mq, Cluster.elasticache, kafka).
• #2151 — 6.53.0 → 6.55.0. Additive at the API level (no removed CRD properties, no
  new required-field rules, no new deprecations). Carries three fixes not implied by the
  title:
  • Table.dynamodb — in-place GSI/attribute updates no longer fail validation.
  • Broker.mq — a spurious empty shared_resources diff is dropped, preventing a no-op
    update.
  • SecurityConfig.opensearchserverless — samlOptions now uses a regular singleton-list
    conversion after TF 6.x switched it to a list-nested block. No CRD API change.
• #2176 — VaultLockConfiguration.backup now supports updates. The retention arguments
  are no longer ForceNew, so changing retention on an unlocked vault applies in place
  instead of looping on upjet's assertNoForceNew refusal (EXT-338). Adds
  status.atProvider.locked / lockDate and the first example manifests for this kind.
• #2177 — InstanceState.rds stopped → available transitions (fixes #2100).
  spec.forProvider.state can now bring a stopped RDS instance back up. Also adds the
  missing password secrets to the instancestate.yaml examples; Go bumped to 1.26.5.

🐞 Bug fixes

• #2185 — Streaming configuration propagation to DynamoDB global-table replicas in MRSC mode
  When streaming is enabled via spec.forProvider.streamEnabled: true in Table.dynamodb in
  MRSC mode, the configuration is now properly propagated to all the replica tables.
• #2182 — Perpetual diff on DB parameter groups when only applyMethod differs
  (fixes #1286, #1444). Affects ParameterGroup / ClusterParameterGroup in the rds,
  docdb and neptune groups: AWS silently ignores apply-method-only changes, so
  applyMethod never round-tripped. A shared custom diff now suppresses the parameter
  diff when all parameter changes are ApplyMethod-only; value changes and
  additions/removals are untouched.
• #2140 — Perpetual reconcile loop on LBListenerRule.elbv2 with action.forward.
  target_group_arn was late-inited into spec but stripped from state on the next Observe,
  producing a diff on every cycle. Fixed with a forced per-action late-init (which also
  backfills order and forward.stickiness) plus a custom diff that suppresses the
  resulting spurious ARN add/remove. Real user-driven ARN changes still apply.
• #2137 — Stale tag keys in status.atProvider.tags / tagsAll. A tag key removed from
  or renamed in spec.forProvider.tags kept appearing in status indefinitely. The external
  AWS resource was always correct — only observed state was wrong.
• #2117 — External-name oscillation on VPC endpoint associations (fixes #2116).
  aws_vpc_endpoint_subnet_association and aws_vpc_endpoint_route_table_association
  flipped the crossplane.io/external-name annotation between the Terraform ID and the
  import ID on every reconciliation, causing perpetual updates, delete/recreate cycles and
  AWS 429 throttling. Both forms are now derived deterministically from the named fields.
• #2122 — Conversion webhooks not served by non-leader replicas. Webhook registration
  was gated behind leader election, so followers could not serve conversion requests. It now
  happens eagerly on all pods, with reconciler setup still deferred to the leader.
• #2156 — Missing performanceInsightsKmsKeyId reference on RDS Instance/Cluster
  (fixes #2155). Adds the cross-resource reference to aws_kms_key (all versions, both
  scopes) with the generated Ref/Selector fields, plus KMS example manifests.

🔧 Upjet & crossplane-runtime bumps and their transitive effects

Directly consumed by changes in this release

• #678 — conversion webhook registration
  decoupled from leader election. Consumed by #2122.
• #693 — custom setup-aggregator and
  terraformed templates, plus the new Terraform.ResourceSchema template variable
  (replacing Terraform.SchemaVersion). Consumed by #2137 (tags fix) and #2140
  (forced late-init).
• #698 — Plugin Framework external client:
  fixes "Unexpected Identity Change" errors during Observe for Framework resources with
  Terraform resource identity, and makes external-name resolution error out when
  FrameworkResourceWithComputedIdentifier returns the placeholder stub instead of a real
  identifier. Relevant to the bedrockagentcore and opensearchserverless resources added
  here. Consumed by #2151.
• #664 — migrates common API imports to
  crossplane/apis/v2 for runtime 2.3.x. Consumed by #2171; this is the source of the
  Go-level v1.Reference → v2.Reference change described under Breaking changes.

Observable schema/behavior effects in the shipped CRDs

• #660 — SSA list-map markers are no longer
  emitted on observation (status.atProvider) fields. Visible in this release as
  LBListener.elbv2 status.atProvider.defaultAction losing x-kubernetes-list-type: map
  / x-kubernetes-list-map-keys: [index] and the injected index default. Removing those
  markers from a status field is schema-compatible; it stops server-side-apply from treating
  observed lists as associative maps.
• crossplane-runtime 2.3.x adds status.lastHandledReconcileAt to every MR CRD in the
  provider ("holds the value of the most recent reconcile-requested-at annotation token that
  the controller has processed"). This accounts for the bulk of the 2038 modified CRD files.
• #684 — XValidation rules are omitted for
  required fields that have references, so a field satisfied purely by a
  *Ref/*Selector no longer trips the "is a required parameter" CEL rule.
• #672 — configurable Description on SSA
  InjectedKey.

🔐 Security / CVE remediations

✨ Non-breaking Resource API changes

Non-breaking API relaxations (#2136)

The following fields were Required → Optional (the generated
is a required parameter CEL validation rules were dropped). Existing manifests keep
working; validation is simply looser now:

New Cross-resource references

New cross-resource references generated in this release:

New fields

New top-level spec.forProvider fields from the Terraform provider bumps (non-exhaustive —
nested additions are not listed):

👥 Project

• #2163 — jonasz-lasut added as a maintainer

Full PR list