github crossplane-contrib/provider-upjet-aws v2.8.0
on GitHub

5 hours ago

v2.8.0

Summary

  • Terraform AWS provider bumped to 6.65.0 (from 6.55.0)
  • New s3files API group, plus two new bedrockagentcore resources
  • Credential cache improvements — the credentials cache now covers WebIdentity and
    assume-role setups
  • Lower memory usage for provider pods
  • Several bugfixes and dependency bumps

Field paths below apply to both the cluster-scoped (*.aws.upbound.io) and namespaced
(*.aws.m.upbound.io) variants of each resource unless a version is called out.

⚠️ Bugfix API change

Harness.bedrockagentcore — some spec fields moved to status

Following fields were configurable in the CRD but were never actually accepted as input by AWS.
They are gone from spec.forProvider / spec.initProvider and are now reported under
status.atProvider instead:

  • environment.agentcoreRuntimeEnvironment.agentRuntimeArn (and its Ref/Selector)
  • environment.agentcoreRuntimeEnvironment.agentRuntimeId
  • environment.agentcoreRuntimeEnvironment.agentRuntimeName
  • environment.agentcoreRuntimeEnvironment.networkConfiguration.networkModeConfig.requireServiceS3Endpoint

Your resources keep working — nothing is lost. If your manifests set these fields, the API
server simply drops them on apply.

⚠️ If you have compositions or functions reading from
status.atProvider.environment or status.atProvider.memory, repoint them to the new
status.atProvider.environmentActual and status.atProvider.memoryActual, which now carry
the complete observed values.

Go module consumers only

⚠️All Harness.bedrockagentcore systemPrompt[].textSecretRef values are now a pointer
type. No YAML/API change, only Go code building or reading this field needs updating.

Other notable changes

directconnect — new 4-byte ASN field

BGPPeer, HostedPrivateVirtualInterface, HostedPublicVirtualInterface and
HostedTransitVirtualInterface gained bgpAsnLong, which supports 4-byte ASNs.
Exactly one of bgpAsn or bgpAsnLong may be set — setting both is now rejected.
Existing resources using only bgpAsn are unaffected.

⚠️ for ASNs in the old range (up to 2147483646), AWS reports the value back in the
bgpAsn field regardless of which one you set. If you create a resource with bgpAsnLong
using a small ASN, switch it to bgpAsn to avoid a resource that never settles.

RDS: new IAM permission needed for an opt-in field

Instance, Cluster and ClusterInstance in rds gained warningEventCategories. If you
set it, the provider needs rds:DescribeEvents on your ProviderConfig's IAM principal —
it isn't part of a typical RDS policy. The field only affects reporting, not your database.
Leave it unset and nothing changes.

Secret.secretsmanager — replica removal now actually happens

Clearing all replica entries used to be silently ignored, so the replicas stayed. That's
fixed. If you previously removed replica entries and assumed they were gone, they will
be deleted on the next reconcile. Check those resources before upgrading.

CatalogTable.glue — more fields get filled in automatically

Several storageDescriptor and viewDefinition fields are now returned by AWS, so
late-initialization will write AWS's values into your spec.forProvider if you left them
unset. Expect your stored manifests to gain fields you didn't write.

Deprecated fields

Still present and working, but plan to migrate:

Resource Deprecated Use instead
MemoryStrategy.bedrockagentcore spec.forProvider.namespaces spec.forProvider.namespaceTemplates
MemoryStrategy.bedrockagentcore spec.forProvider.memoryExecutionRoleArn the same field on the Memory resource

Switching namespaces to namespaceTemplates with the same value is a no-op — AWS mirrors
the two.

🆕 New resources

A new s3files API group:

Resource Group
AccessPoint s3files
FileSystem s3files
FileSystemPolicy s3files
MountTarget s3files
SynchronizationConfiguration s3files

And two additions to bedrockagentcore:

Resource Group
BrowserProfile bedrockagentcore
GatewayRule bedrockagentcore

🚀 Improvements

Extended credential cache for provider configs with assumeRoleChain configuration

The credentials cache was previously for only IRSA ProviderConfigs. It now also covers:

  • Web identity ProviderConfigs
  • Static credentials combined with an assume-role chain
  • Web identity combined with an assume-role chain

Pod identity and Upbound sources are not cached yet.
Plain static credentials aren't cached, as they do not benefit.

If your credentials rotate outside the ProviderConfig — a Secret's contents change, a
projected token is refreshed — the cache notices and fetches fresh credentials. When in
doubt it refetches rather than reusing anything stale. Cached credentials also carry a
5-minute validity margin so long-running AWS calls don't fail on expiry, with jitter so
many ProviderConfigs don't all refresh at once.

Cache decisions are now logged with a clear reason and the ProviderConfig's name.

Lower memory usage

Provider pods now strip the large, unused schema section from the CRDs they cache, which
noticeably reduces memory.

🐞 Bug fixes

  • Global Accelerator references now resolve. EndpointGroup.listenerArn and
    Listener.acceleratorArn were resolving to the wrong value and never matched what the
    field expected. Both now resolve correctly.
  • Stack.appstream never stopped updating. AWS returns every default user setting even
    when you specify only a few, which looked like a permanent difference. Resolved resources
    now settle.
  • fsx file systems never stopped updating. An unset finalBackupTags field caused an
    endless update loop on LustreFileSystem, OntapVolume, OpenzfsFileSystem and
    WindowsFileSystem.
  • Replicator.kafka could be flagged for replacement on every reconcile after the new
    Kafka cluster fields were added. Fixed.
  • Failed creates could publish a fake external name. For some resources, a create that
    failed (often due to a permission that hadn't propagated yet) briefly wrote a placeholder
    ID into the crossplane.io/external-name annotation — and other resources referencing
    it could pick up that placeholder    . Nothing is written now until the real ID exists.
  • SynchronizationConfiguration.s3files failed on first create. It tried to update
    instead of create. Fixed.
  • Activity.sfn external names were malformed. The generated ARN used a / instead of
    a : before the activity name, so it never matched the real AWS resource.
  • ClusterAuth.eks now works with more management policy combinations — any set that
    includes Create, Update and Observe. LateInitialize and Delete are optional.

Upstream fixes that come with the provider bump

  • ReplicationGroup.elasticache — no longer shows a permanent difference when changes are
    waiting for the next maintenance window.
  • Broker.mq — no more phantom sharedResources difference on ActiveMQ brokers.
  • LustreFileSystem.fsx — no more permanent difference on data read cache size.
  • CatalogTable.glue — no more permanent difference on validated Athena views.
  • Stack.appstream — embedHostDomains is now actually sent on update.
  • App.amplify / Branch.amplify — clearing environment variables no longer errors out.
  • RuleGroup.wafv2 / WebACL.wafv2 — header names containing . are accepted again.
  • Instance.rds — restoring a multi-AZ SQL Server instance from a snapshot works.
  • GlobalCluster.rds — re-creating the resource no longer hits a timing error.

🔁 Behavior changes worth knowing

Not breaking, but the resource behaves differently than before:

  • Harness.bedrockagentcore retries its own failed creates. When AWS rejects the create
    because an IAM role hasn't propagated yet, the provider deletes the partial resource and
    tries again. Expect a longer time to Ready and extra delete/create pairs in CloudTrail —
    worth knowing if you alert on unexpected deletions.
  • These no longer replace the resource, they update in place: enabling object lock on
    Bucket.s3, lowering warm throughput on Table.dynamodb, changing
    secondaryPrivateIpAddressCount on a private NATGateway.ec2, and adding indexed keys to
    Memory.bedrockagentcore. Indexed key ordering no longer matters either.
  • MemoryStrategy.bedrockagentcore now replaces the resource when you change its name.
  • Cluster.elasticache rejects transitEncryptionEnabled for Redis and Valkey before
    calling AWS. AWS already rejected it — you just get the error sooner.
  • Harness.bedrockagentcore may report a model.*.maxTokens value in status even if
    you never set one.
  • Codepipeline rejects setting both outputArtifacts and
    outputArtifactsForComputeAction on the same action.

✨ New capabilities

Fields that are no longer required

Existing manifests stay valid; new ones can omit these:

Resource Field
MemoryStrategy.bedrockagentcore namespaces
Harness.bedrockagentcore systemPrompt[].textSecretRef
PrivateVirtualInterface.directconnect, TransitVirtualInterface.directconnect bgpAsn
BGPPeer.directconnect, Hosted{Private,Public,Transit}VirtualInterface.directconnect bgpAsn
SecretRotation.secretsmanager rotationRules
AccessLogSubscription.vpclattice destinationArn
LBListenerRule.elbv2 condition.sourceIp.values

New cross-resource references

You can now wire these fields with a Ref or Selector instead of hardcoding a value:

Resource Field Points at
PrivateVirtualInterface.directconnect dxGatewayId Gateway.directconnect
HostedPrivateVirtualInterfaceAccepter.directconnect dxGatewayId Gateway.directconnect
GatewayAssociation.directconnect proposalId GatewayAssociationProposal.directconnect
AccessLogSubscription.vpclattice destinationArn Bucket.s3
Server.transfer function Function.lambda
DataCatalogEncryptionSettings.glue catalogEncryptionServiceRole Role.iam
Scraper.amp OpenSearch exporter domainArn Domain.opensearch
MemoryStrategy.bedrockagentcore self-managed payload delivery bucket Bucket.s3
MemoryStrategy.bedrockagentcore self-managed topicArn Topic.sns
SecretRotation.secretsmanager externalSecretRotationRoleArn Role.iam
Directory.workspaces access endpoint vpcEndpointId VPCEndpoint.ec2
Replicator.kafka log delivery log group / delivery stream / bucket Group.cloudwatchlogs, DeliveryStream.firehose, Bucket.s3
OAuth2CredentialProvider.bedrockagentcore client secret secretId, on every vendor block Secret.secretsmanager

New fields

Paths are relative to spec.forProvider, and are mirrored on spec.initProvider and
status.atProvider unless noted. Nested additions under a listed parent aren't repeated.

From TF provider 6.63.0

Kind.Group New field(s)
Scraper.amp destination.cloudwatch[].datasetArn, exporter[].opensearch[].domainArn
AutoscalingGroup.autoscaling instanceLifecyclePolicy.retentionTriggers.terminateHookAbandon
APIKeyCredentialProvider.bedrockagentcore apiKeySecretConfig.{secretId,jsonKey}, apiKeySecretSource — supply the API key from an existing Secrets Manager secret instead of inline
Oauth2CredentialProvider.bedrockagentcore oauth2ProviderConfig.{custom,github,google,microsoft,salesforce,slack}Oauth2ProviderConfig.clientSecretConfig.{secretId,jsonKey}, …clientSecretSource
GatewayTarget.bedrockagentcore targetConfiguration.mcp.mcpServer.{mcpToolSchema.*,resourcePriority}, targetConfiguration.mcp.connector.*, targetConfiguration.http.agentcoreRuntime.schema.source.*, targetConfiguration.http.passthrough.*, targetConfiguration.inference.{connector.source.connectorId,provider.*}
Harness.bedrockagentcore memory.disabled, memory.managedMemoryConfiguration.{encryptionKeyArn,eventExpiryDuration,strategies}; status-only environmentActual.*, memoryActual.*
MemoryStrategy.bedrockagentcore namespaceTemplates, configuration.reflection.*, configuration.selfManagedConfiguration.*, reflectionConfiguration.namespaceTemplates, memoryRecordSchema.metadataSchema.*
Codepipeline.codepipeline stage.action.commands, stage.action.outputArtifactsForComputeAction.{name,files} (mutually exclusive with stage.action.outputArtifacts — setting both now errors), stage.action.outputVariables
PrivateVirtualInterface.directconnect, TransitVirtualInterface.directconnect bgpAsnLong (32-bit ASN; use instead of bgpAsn), rateLimit, prefixPoolAllocatedCountIpv4, prefixPoolAllocatedCountIpv6
PublicVirtualInterface.directconnect, Hosted{Private,Public,Transit}VirtualInterface.directconnect rateLimit; hosted private/transit also gain status-only prefixPoolAllocatedCountIpv4 / …Ipv6
Hosted{Private,Transit}VirtualInterfaceAccepter.directconnect prefixPoolAllocatedCountIpv4, prefixPoolAllocatedCountIpv6
Connection.directconnect status-only state, prefixPoolSizeIpv4/…Ipv6, prefixPoolUnallocatedCountIpv4/…Ipv6, rateLimiterStatus.*
Lag.directconnect status-only rateLimiterStatus.{inUse,maxAllowed,remaining,totalBandwidth}
LifecyclePolicy.dlm policyDetails.parameters.excludeDataVolumeTags
FlowLog.ec2 tagFieldSpecification[].{resourceType,tagKeys}
LaunchTemplate.ec2 networkInterfaces.enaQueueCount
CapacityProvider.ecs managedInstancesProvider.instanceLaunchTemplate.capacityReservations.{reservationPreference,reservationGroupArn}, …localStorageConfiguration.useLocalStorage; RESERVED added as a valid capacityOptionType
Cluster.eks kubeApiServerConfig.{eventTtl,serviceNodePortRange.*}, kubeControllerManagerConfig.*, kubeSchedulerConfig.nodeResourcesFit.scoringStrategy.*
NodeGroup.eks warmPoolConfig.{minSize,maxGroupPreparedCapacity,poolState,reuseOnScaleIn}
PodIdentityAssociation.eks policy (inline session policy)
LBListenerRule.elbv2 condition.sourceIp.ipAddressType
OntapFileSystem.fsx, WindowsFileSystem.fsx networkType
CatalogTableOptimizer.glue configuration[].compactionConfiguration[].icebergConfiguration[].{strategy,minInputFiles,deleteFileThreshold}
Cluster.kafka status-only bootstrapBrokersIpv6, bootstrapBrokersSaslIamIpv6, bootstrapBrokersSaslScramIpv6, bootstrapBrokersTlsIpv6
SecurityConfig.opensearchserverless iamFederationOptions.{userAttribute,groupAttribute}, iamIdentityCenterOptions.{instanceArn,userAttribute,groupAttribute}
Secret.secretsmanager type (managed external secrets)
SecretRotation.secretsmanager rotationEnabled (previously observation-only, now settable), externalSecretRotationMetadata[].{key,value,valueRef}, externalSecretRotationRoleArn
Service.vpclattice idleTimeoutSeconds
Directory.workspaces workspaceAccessProperties.accessEndpointConfig.{internetFallbackProtocols,accessEndpoints[].{accessEndpointType,vpcEndpointId}}

From TF provider 6.64.0

Kind.Group New field(s)
HostedConfigurationVersion.appconfig versionLabel — optional label for the configuration version
Harness.bedrockagentcore model.litellmModelConfig (new model provider), model.{bedrock,gemini,openai}ModelConfig.additionalParams, model.{bedrock,openai}ModelConfig.apiFormat, skill[].{awsSkills,git,s3}
MetricAlarm.cloudwatch warmUpConfiguration — delays alarm evaluation after creation; the alarm stays in INSUFFICIENT_DATA and takes no actions during warm-up
CapacityProvider.ecs managedInstancesProvider.autoRepairConfiguration — ECS managed auto repair
Replicator.kafka (v1beta1) kafkaCluster[].{apacheKafkaCluster,clientAuthentication,encryptionInTransit}, replicationInfoList.{sourceKafkaClusterId,targetKafkaClusterId} — self-managed and on-premises Apache Kafka clusters are now usable as replication source or target, not just MSK
Instance.rds, Cluster.rds, ClusterInstance.rds warningEventCategories — requires rds:DescribeEvents, see the action-required section above

From TF provider 6.65.0

Kind.Group New field(s)
OAuth2CredentialProvider.bedrockagentcore New provider vendors as sibling blocks under oauth2ProviderConfig, each carrying the same clientIdSecretRef / clientSecretSecretRef / clientSecretSource / clientSecretConfig / write-only set as the existing vendors: atlassianOauth2ProviderConfig (set credentialProviderVendor: AtlassianOauth2), linkedinOauth2ProviderConfig (LinkedinOauth2), and includedOauth2ProviderConfig — a generic block for AWS-known vendors (XOauth2, FacebookOauth2, SpotifyOauth2, …) that also exposes issuer, authorizationEndpoint, tokenEndpoint
OAuth2CredentialProvider.bedrockagentcore On oauth2ProviderConfig.customOauth2ProviderConfig: clientAuthenticationMethod (CLIENT_SECRET_BASIC / CLIENT_SECRET_POST / AWS_IAM_ID_TOKEN_JWT), onBehalfOfTokenExchangeConfig (RFC 8693 token exchange / RFC 7523 JWT grant), privateKeyJwtConfig, privateEndpoint (exactly one of managedVpcResource or selfManagedLatticeResource), privateEndpointOverride[], oauthDiscovery.authorizationServerMetadata.tokenEndpointAuthMethods
OAuth2CredentialProvider.bedrockagentcore On oauth2ProviderConfig.microsoftOauth2ProviderConfig: tenantIdSecretRef, tenantIdWoSecretRef, tenantIdWoVersion (Microsoft Entra tenant ID; the plain and write-only variants are mutually exclusive) — spec-only
OAuth2CredentialProvider.bedrockagentcore status-only: callbackUrl (register on the OAuth2 provider as an allowed redirect target), oauth2ProviderConfig.*.oauthDiscovery.authorizationServerMetadata.tokenEndpointAuthMethods
BGPPeer.directconnect, Hosted{Private,Public,Transit}VirtualInterface.directconnect bgpAsnLong — 4-byte-capable BGP ASN as an asplain decimal string, 1–4294967294. Exactly one of bgpAsn / bgpAsnLong — see the action-required section above

Upstream notes that isolated-tenant OAuth2 vendors (OktaOauth2, PingOneOauth2,
OneLoginOauth2) still fail at create with Missing TokenEndpoint; support is planned
in a follow-up.

🔐 Dependency and security updates

Dependency v2.7.0 v2.8.0
Go toolchain 1.26.5 1.26.8
google.golang.org/grpc v1.82.1 v1.83.2
golang.org/x/net v0.57.0 v0.59.0
golang.org/x/crypto v0.54.0 v0.57.0
Kubernetes libraries v0.35.3 v0.36.2
sigs.k8s.io/controller-runtime v0.23.3 v0.24.1
AWS SDK for Go v2 v1.42.1 v1.46.0
alpine runtime image 3.24.1 3.24.2

Full PR list

New Contributors

Full Changelog: v2.7.0...v2.8.0

Check out latest releases or
releases around crossplane-contrib/provider-upjet-aws v2.8.0

Don't miss a new provider-upjet-aws release

NewReleases is sending notifications on new releases.

Get notifications