6.56.0 - Terraform Provider Aws

6.56.0 (July 22, 2026)

FEATURES:

New Action: aws_elasticache_apply_service_update (#48963)
New Data Source: aws_elasticache_service_update_actions (#48958)
New Data Source: aws_s3_buckets (#48965)
New List Resource: aws_eks_addon (#49067)
New List Resource: aws_s3_bucket_notification (#48974)
New List Resource: aws_secretsmanager_secret_policy (#49058)

ENHANCEMENTS:

data-source/aws_eks_node_group: Add warm_pool_config attribute (#48977)
data-source/aws_msk_bootstrap_brokers: Add bootstrap_brokers_ipv6, bootstrap_brokers_sasl_iam_ipv6, bootstrap_brokers_sasl_scram_ipv6, and bootstrap_brokers_tls_ipv6 attributes to expose IPv6 bootstrap broker URLs (#48975)
data-source/aws_opensearchserverless_security_config: Add iam_federation_options block (#48495)
data-source/aws_opensearchserverless_security_config: Add iam_identity_center_options block (#48495)
provider: Web identity tokens can be configured via the TF_AWS_WEB_IDENTITY_TOKEN environment variable. Any value configured via assume_role_with_web_identity.web_identity_token takes precedence (#48736)
resource/aws_autoscaling_group: Add instance_lifecycle_policy configuration block (#48973)
resource/aws_bedrockagent_data_source: Add data_source_configuration.managed_knowledge_base_connector_configuration block (#48904)
resource/aws_bedrockagent_data_source: Add timeouts.update with a default value of 30m (#48904)
resource/aws_bedrockagent_knowledge_base: Add vector_knowledge_base_configuration.bedrock_embedding_model_configuration.audio and vector_knowledge_base_configuration.bedrock_embedding_model_configuration.video configuration blocks (#48538)
resource/aws_bedrockagent_knowledge_base: Add support for Managed Knowledge Base type (type = "MANAGED") with managed_knowledge_base_configuration block (#48904)
resource/aws_cloudwatch_log_subscription_filter: Add @source.log as a valid value for emit_system_fields (#48956)
resource/aws_eks_node_group: Add warm_pool_config configuration block (#48977)
resource/aws_flow_log: Add tag_field_specification configuration block (#48913)
resource/aws_guardduty_detector_feature: Support AI_PROTECTION and AI_ANALYST feature names (#48972)
resource/aws_guardduty_organization_configuration_feature: Support AI_PROTECTION and AI_ANALYST feature names (#48972)
resource/aws_msk_cluster: Add bootstrap_brokers_ipv6, bootstrap_brokers_sasl_iam_ipv6, bootstrap_brokers_sasl_scram_ipv6, and bootstrap_brokers_tls_ipv6 attributes to expose IPv6 bootstrap broker URLs (#48975)
resource/aws_opensearch_package_association: Add import support (#46690)
resource/aws_opensearchserverless_security_config: Add iam_federation_options configuration block (#48495)
resource/aws_opensearchserverless_security_config: Add iam_identity_center_options configuration block (#48495)
resource/aws_s3tables_table: Add metadata.iceberg.properties argument (#48635)

BUG FIXES:

provider: Fix "one of assume_role_with_web_identity.0.web_identity_token,assume_role_with_web_identity.0.web_identity_token_file must be specified" errors, allowing any AWS_WEB_IDENTITY_TOKEN_FILE environment variable value to be used (#48736)
resource/aws_bedrockagent_data_source: Short-circuit waiting for creation if the resource reaches a FAILED state (#48904)
resource/aws_datazone_domain: Fixed AccessDeniedException error when deleting (#48516)
resource/aws_fsx_lustre_file_system: Fix perpetual diff in data_read_cache_configuration.size when sizing_mode is PROPORTIONAL_TO_THROUGHPUT_CAPACITY and size is not specified (#49023)
resource/aws_mq_broker: Fix perpetual shared_resources diffs for ActiveMQ brokers (#48962)
resource/aws_mq_configuration: Retry ConflictException: Configuration ID [...] is in use errors on delete (#48962)
resource/aws_sagemaker_endpoint: Prevents Cannot create already existing endpoint error when retrying creation. (#48966)
resource/aws_subnet: Wait for IPAM to release its CIDR on delete (#46523)
resource/aws_vpc_ipam_pool: Fix "Error: reading EC2 VPC" when creating an IPAM VPC resource planning pool for a VPC in another account. (#46483)