v2.3.0

feat: support additional flow log parameters @RoseSecurity (#93)

## what

• Ran pre-commit hooks against all files
• Added three additional VPC flow log resource parameters and added one as an input to the tests

why

• Support additional parameters for more granular control of VPC flow logs

references

• Terraform Docs

Summary by CodeRabbit

• New Features

  • Added VPC Flow Logs configuration options: custom log format, aggregation interval control, and subnet attachment support.

• Chores

  • Fixed formatting and whitespace inconsistencies across configuration and documentation files.
  • Updated test fixtures to include VPC Flow Logs configuration parameters.

v2.2.0

fix: Terraform 1.5.7 compatibility for nullable variable validations @johncblandii (#86)

Terraform 1.5.7 does not short-circuit `||` in `validation` blocks, so expressions like `length(null)` and `for ... in null` raise errors even when guarded by a null check. This wraps the right-hand side of each `||` in `try(..., false)` across all 4 validation blocks for `nat_gateway_public_subnet_indices` and `nat_gateway_public_subnet_names`. Zero behavior change on Terraform 1.6+.

Summary by CodeRabbit

• Improvements
  • Enhanced validation logic for network gateway subnet configurations to more gracefully handle edge cases and prevent unnecessary planning errors.

v2.1.2

chore: update remote-state to 2.0.0 and switch to standalone account-map @Benbentwo (#84)

## Summary - Update `cloudposse/stack-config/yaml//modules/remote-state` from `1.8.0` to `2.0.0` - Switch vendor.yaml `account-map` source from `cloudposse/terraform-aws-components` monorepo to standalone `cloudposse-terraform-components/aws-account-map` at `v1.537.2` - Required for compatibility with `cloudposse/utils` provider v2.x (remote-state v1.8.0 constrains utils to `< 2.0.0`)

Test plan

• Verify terraform init succeeds
• Verify terraform plan produces no unexpected changes

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Updated pinned remote-state module to a newer version.
  • Switched vendored account-map source and bumped its vendored version.
  • Bumped vendored vpc-flow-logs-bucket version.
  • Added/initialized a git submodule reference.

• Tests

  • Removed an environment-specific fixture variable from flow-logs test fixtures.
  • Simplified test fixture backend paths to fixed relative locations.

🚀 Enhancements

chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 in /test @[dependabot[bot]](https://github.com/apps/dependabot) (#81)

Bumps [filippo.io/edwards25519](https://github.com/FiloSottile/edwards25519) from 1.1.0 to 1.1.1.

Commits

• d1c650a extra: initialize receiver in MultiScalarMult
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

🤖 Automatic Updates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#85)

## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 in /test @[dependabot[bot]](https://github.com/apps/dependabot) (#81)

Bumps [filippo.io/edwards25519](https://github.com/FiloSottile/edwards25519) from 1.1.0 to 1.1.1.

Commits

• d1c650a extra: initialize receiver in MultiScalarMult
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

v2.1.1

🤖 Automatic Updates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#80)

## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

chore(deps): update terraform cloudposse/dynamic-subnets/aws to v3.1.1 @[renovate[bot]](https://github.com/apps/renovate) (#79)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/dynamic-subnets/aws (source)	module	patch	3.1.0 → 3.1.1

---

Release Notes

cloudposse/terraform-aws-dynamic-subnets (cloudposse/dynamic-subnets/aws)

v3.1.1

Compare Source

🚀 Enhancements

fix(validation): safely handle null values for *_subnets_per_az_count using can() @​nacholiya (#​231)

What

Fixes validation logic for private_subnets_per_az_count and public_subnets_per_az_count by wrapping numeric comparison in can().

Why

Terraform 1.5+ may evaluate expressions differently when values are null.
Using can() prevents invalid comparisons when the variable is null.

References

Fixes #​230

🐛 Bug Fixes

fix(validation): safely handle null values for *_subnets_per_az_count using can() @​nacholiya (#​231)

What

Fixes validation logic for private_subnets_per_az_count and public_subnets_per_az_count by wrapping numeric comparison in can().

Why

Terraform 1.5+ may evaluate expressions differently when values are null.
Using can() prevents invalid comparisons when the variable is null.

References

Fixes #​230

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

v2.1.0

chore: update terraform-aws-dynamic-subnets to v3.1.0 @johncblandii (#76)

## Summary Updates the CloudPosse dynamic subnets module from v3.0.1 to v3.1.0, which adds a new `nat_gateway_private_ips` output for accessing NAT Gateway private IP addresses. This is a non-breaking update that enables users to configure internal networking like security group rules and route debugging.

Summary by CodeRabbit

• New Features

  • NAT Gateway outputs now include private IP addresses in addition to gateway IDs, providing enhanced subnet configuration visibility.

• Documentation

  • Module version updated to v3.1.0 across configuration and documentation.
  • Added documentation for NAT Gateway private IP address outputs.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

🤖 Automatic Updates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#78)

## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#75)

## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

chore(deps): update tflint plugin terraform-linters/tflint-ruleset-aws to v0.45.0 @[renovate[bot]](https://github.com/apps/renovate) (#74)

This PR contains the following updates:

Package	Type	Update	Change
terraform-linters/tflint-ruleset-aws	plugin	minor	0.44.0 -> 0.45.0

---

Release Notes

terraform-linters/tflint-ruleset-aws (terraform-linters/tflint-ruleset-aws)

v0.45.0

Compare Source

What's Changed

Breaking Changes

• Remove aws_route53_record_invalid_zone_id rule by @​wata727 in #​979

Enhancements

• Update AWS provider/module and generated content by @​github-actions[bot] in #​981
• Update AWS provider/module and generated content by @​github-actions[bot] in #​990
• Update AWS provider/module and generated content by @​github-actions[bot] in #​999
• Update AWS provider/module and generated content by @​github-actions[bot] in #​1000
• Update AWS provider/module and generated content by @​github-actions[bot] in #​1004
• Update AWS provider/module and generated content by @​github-actions[bot] in #​1005
• Update AWS provider/module and generated content by @​github-actions[bot] in #​1011
• Update AWS provider/module and generated content by @​github-actions[bot] in #​1021

Bug Fixes

• dms_s3_endpoint: fix enum validations by @​bendrucker in #​991
• resource_missing_tags: handle explicit refs to default provider by @​bendrucker in #​1003

Chores

• Bump the aws-sdk group with 7 updates by @​dependabot[bot] in #​980
• Bump the aws-sdk group with 7 updates by @​dependabot[bot] in #​982
• Bump github.com/hashicorp/aws-sdk-go-base/v2 from 2.0.0-beta.67 to 2.0.0-beta.68 by @​dependabot[bot] in #​983
• Bump the aws-sdk group with 7 updates by @​dependabot[bot] in #​987
• Bump golang.org/x/net from 0.46.0 to 0.47.0 by @​dependabot[bot] in #​988
• Replace Ruby SDK models with official Smithy repository by @​bendrucker in #​901
• generator: add tests and improve error handling by @​bendrucker in #​992
• Bump actions/setup-go from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​996
• Bump actions/checkout from 5.0.0 to 6.0.0 by @​dependabot[bot] in #​995
• Bump the aws-sdk group with 7 updates by @​dependabot[bot] in #​997
• Bump peter-evans/create-pull-request from 7.0.8 to 7.0.9 by @​dependabot[bot] in #​994
• Bump the aws-sdk group with 7 updates by @​dependabot[bot] in #​1001
• Bump actions/checkout from 6.0.0 to 6.0.1 by @​dependabot[bot] in #​1006
• Bump github.com/aws/smithy-go from 1.23.2 to 1.24.0 by @​dependabot[bot] in #​1009
• Bump the aws-sdk group with 7 updates by @​dependabot[bot] in #​1008
• Bump peter-evans/create-pull-request from 7.0.9 to 7.0.11 by @​dependabot[bot] in #​1007
• Bump peter-evans/create-pull-request from 7.0.11 to 8.0.0 by @​dependabot[bot] in #​1012
• Bump github.com/hashicorp/aws-sdk-go-base/v2 from 2.0.0-beta.68 to 2.0.0-beta.69 by @​dependabot[bot] in #​1014
• Bump golang.org/x/net from 0.47.0 to 0.48.0 by @​dependabot[bot] in #​1015
• Bump the aws-sdk group with 7 updates by @​dependabot[bot] in #​1013
• Bump actions/attest-build-provenance from 3.0.0 to 3.1.0 by @​dependabot[bot] in #​1022
• Bump the aws-sdk group with 2 updates by @​dependabot[bot] in #​1023
• Bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.278.0 to 1.279.0 in the aws-sdk group by @​dependabot[bot] in #​1024
• Bump github.com/hashicorp/aws-sdk-go-base/v2 from 2.0.0-beta.69 to 2.0.0-beta.70 by @​dependabot[b...

v2.0.0

Update `dynamic-subnets` module to v3 @aknysh (#70)

## what

• Updated terraform-aws-dynamic-subnets module from v2.4.2 to v3.0.1
• Added 6 new variables for enhanced subnet configuration:
  • public_subnets_per_az_count and public_subnets_per_az_names for independent public subnet control
  • private_subnets_per_az_count and private_subnets_per_az_names for independent private subnet control
  • nat_gateway_public_subnet_indices for index-based NAT Gateway placement
  • nat_gateway_public_subnet_names for name-based NAT Gateway placement
• Updated AWS Provider requirement from >= 4.9.0, < 6.0.0 to >= 5.0.0 (drops support for v4.x)
• Updated Go to 1.25 and all test dependencies to latest versions (Terratest v0.52.0)
• Added 14 new outputs to expose all dynamic-subnets v3.0.0 capabilities
• Improved test code with helper functions, centralized constants, and fixed S3 cleanup order bug
• Updated README.yaml with comprehensive usage examples and breaking change notice
• Created detailed PRD documenting all changes, migration guide, and backward compatibility considerations

why

• Cost Optimization: New NAT Gateway placement features enable strategic placement to reduce costs by up to 67% (e.g., $270/month savings for 3 AZs by placing NAT in only one public subnet per AZ instead of all public subnets)
• Architectural Flexibility: Separate public/private subnet configuration allows different subnet counts and names per type (e.g., 2 public subnets + 3 private subnets per AZ)
• Enhanced Control: Index-based and name-based NAT placement provides precise control over NAT Gateway location for cost and architecture optimization
• AWS Provider v6.x Support: Updated provider constraint removes upper bound to support latest AWS Provider versions
• Configuration Backward Compatible: All existing Terraform configurations continue to work unchanged (on AWS Provider v5.0+) - new variables default to null and trigger legacy behavior
• Enhanced Outputs: Subnet stats outputs now include NAT Gateway IDs, enabling easier integration with Network Firewall and other resources
• Test Reliability: Go 1.25 and updated dependencies provide latest security fixes and improved test reliability

Configuration Backward Compatibility:
✅ All existing Terraform configurations work unchanged (assuming AWS Provider v5.0+)

• Legacy variables (subnets_per_az_count, subnets_per_az_names) continue to work
• When new variables are not set, behavior is identical to v2.4.2
• No resources will be recreated for existing configurations
• No state migration required

Real-World Cost Savings Example (3 AZs, us-east-1):

• Old: 6 NAT Gateways (2 per AZ) = ~$270/month
• New: 3 NAT Gateways (1 per AZ) = ~$135/month
• Savings: $135/month ($1,620/year)

Key Features:

• Independent control over public and private subnet counts per AZ
• Flexible NAT Gateway placement (index-based or name-based)
• Named subnets with different naming schemes for public vs private
• NAT Gateway IDs exposed in subnet stats outputs
• Configuration backward compatible with existing deployments (on AWS Provider v5.0+)

references

• Dynamic Subnets v3.0.1 Release: https://github.com/cloudposse/terraform-aws-dynamic-subnets/releases/tag/v3.0.1
• Dynamic Subnets PR #226: cloudposse/terraform-aws-dynamic-subnets#226
• Comprehensive PRD: docs/prd/upgrade-to-dynamic-subnets-v3.md
• AWS Provider v5.0 Migration Guide: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/guides/version-5-upgrade
• AWS NAT Gateway Pricing: https://aws.amazon.com/vpc/pricing/

Summary by CodeRabbit

• New Features
  • Per‑AZ independent public/private subnet counts & names, named subnets, flexible NAT placement (by index or name), VPC Endpoints, optional Shield, additional NAT/network & IPv6 subnet outputs, AZ route‑table maps.
• Documentation
  • Expanded README, upgrade PRD, migration notes, cost‑optimized, HA and production examples, and v3.0.1 release notes.
• Bug Fixes
  • NAT routing fix; NAT IDs exposed in outputs.
• Breaking Changes
  • AWS provider minimum bumped to v5.0+.
• Tests
  • Expanded VPC test suite, new fixtures, and mutual‑exclusivity validation for NAT placement.

v1.539.2

🤖 Automatic Updates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#71)

## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

chore(deps): update terraform cloudposse/dynamic-subnets/aws to v3 @[renovate[bot]](https://github.com/apps/renovate) (#69)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/dynamic-subnets/aws (source)	module	major	2.4.2 -> 3.0.1

---

Release Notes

cloudposse/terraform-aws-dynamic-subnets (cloudposse/dynamic-subnets/aws)

v3.0.1

Compare Source

🚀 Enhancements

Fix NAT routing when max_nats limits NATs to fewer AZs @​aknysh (#​227)

what

• Fixed critical bug in NAT Gateway routing when max_nats is set to fewer than the number of Availability Zones
• Added modulo operation to route table mapping formulas to clamp NAT indices to available NATs
• Created new example limited-nat-gateways demonstrating the max_nats feature
• Added 3 new test functions providing 100% test coverage for max_nats feature
• Added comprehensive documentation including PRD with diagrams and decision tree

why

Critical Bug: When max_nats < num_azs, Terraform failed with "Invalid index" error because route tables in AZs without NATs attempted to reference non-existent NAT Gateway indices.

Example Failure:

Configuration: 3 AZs, max_nats=1 (only 1 NAT in AZ-a)
Error: aws_nat_gateway.default[1] - Invalid index
Route tables in AZ-b and AZ-c tried to access NAT[1] and NAT[2] which don't exist

Root Cause: The route table mapping formula calculated:

az_index * nats_per_az + subnet_offset

This produced indices [0, 1, 2] but only NAT[0] existed.

Fix: Added modulo operation to wrap indices to available NATs:

(az_index * nats_per_az + subnet_offset) % total_nats

Now produces [0, 0, 0] - all route to the single NAT.

Test Coverage Gap: The max_nats feature had ZERO test coverage. None of the 6 existing examples tested this scenario. The bug was discovered by the aws-vpc component test suite, not by this module's own tests.

Changes Include:

1. Bug Fix (main.tf):

   • Fixed private_route_table_to_nat_map calculation
   • Fixed public_route_table_to_nat_map calculation
   • Added explanatory comments and example scenarios

2. New Test Example (examples/limited-nat-gateways):

   • Tests 3 AZs with max_nats=1 (the failing scenario)
   • Tests 3 AZs with max_nats=2 (between scenario)
   • Includes comprehensive README with cost analysis
   • Documents use case: Dev/test cost optimization

3. Test Coverage (test/src/examples_limited_nat_gateways_test.go):

   • TestExamplesLimitedNatGateways - Tests max_nats=1
   • TestExamplesLimitedNatGatewaysTwoNats - Tests max_nats=2
   • TestExamplesLimitedNatGatewaysDisabled - Tests enabled=false
   • Brings max_nats test coverage from 0% to 100%

4. Documentation:

   • Test Coverage Analysis: Comprehensive audit of all tests, identifies gaps
   • PRD: Detailed problem statement, solution, cost analysis
   • NAT Placement Diagrams: 4 strategy diagrams with ASCII art
   • Decision Tree: Guides users to optimal configuration
   • Best Practices: Recommendations by environment type

Cost Implications:
The max_nats feature enables significant cost savings in non-production environments:

• Standard (3 NATs): $97.20/month
• Limited (1 NAT): $32.40/month
• Savings: $64.80/month per environment (67% reduction)
• 10 dev environments: $7,776/year savings

This bug blocked users from utilizing this cost optimization feature.

references

• Related to #​226 (Separate Public/Private Subnet Configuration)
• Discovered by: cloudposse-terraform-components/aws-vpc test suite
• Affects: All users attempting to use max_nats < num_azs for cost optimization
• Test Coverage Analysis: /docs/test-coverage-analysis.md
• Detailed PRD: /docs/prd/fix-max-nats-routing.md

v3.0.0

Compare Source

Separate Public/Private Subnet Configuration and Enhance NAT Gateway Placement @​aknysh (#​226)

what

• Add ability to configure different numbers of public and private subnets per Availability Zone independently
• Add controlled NAT Gateway placement by subnet index to reduce costs
• Add intuitive NAT Gateway placement by subnet name for better usability
• Fix critical NAT Gateway placement bug causing wrong AZ distribution
• Fix cross-AZ routing issue where private subnets routed to NATs in different AZs
• Add comprehensive examples demonstrating cost-optimized and high-availability configurations
• Add full test coverage with Terratest for all new features
• Maintain 100% backward compatibility with existing configurations

why

User Pain Points:

• Users were forced to create equal numbers of public and private subnets, even when workloads didn't require it
• NAT Gateways were created in every public subnet, resulting in unnecessarily high AWS costs (~$32/month per NAT)
• No control over which public subnets received NAT Gateways
• Index-based configuration was not intuitive for users who assigned names to subnets
• Critical bugs caused NAT Gateways to be placed in wrong AZs and private subnets to route across AZ boundaries

Business Impact:

• Cost Optimization: Reducing from 6 NATs to 3 NATs saves $96/month (50% reduction)
• Flexibility: Users can now match subnet configuration to their actual workload requirements
• Reliability: Fixes ensure NAT Gateways are correctly distributed across AZs and routing stays within same AZ
• Usability: Name-based placement is more intuitive and maintainable than index-based placement

Key Features:

1. Separate Public/Private Subnet Counts: New variables public_subnets_per_az_count, public_subnets_per_az_names, private_subnets_per_az_count, private_subnets_per_az_names allow independent control while falling back to original variables for backward compatibility

2. Controlled NAT Placement by Index: Variable nat_gateway_public_subnet_indices (default [0]) specifies which subnet position(s) in each AZ receive NAT Gateways, enabling cost optimization

3. Named NAT Placement: Variable nat_gateway_public_subnet_names allows intuitive placement like ["loadbalancer"] instead of remembering indices

4. Bug Fixes: Corrected NAT Gateway global index calculation and route table mapping to ensure proper AZ distribution and same-AZ routing

Examples Included:

• examples/separate-public-private-subnets/: Cost-optimized with 1 NAT per AZ (~$110/month)
• examples/redundant-nat-gateways/: High-availability with 2 NATs per AZ (~$140/month)

Test Coverage:

• Full Terratest coverage for both examples
• Tests for name-based and index-based NAT placement
• Tests for disabled state (no resources created)
• Verification of all outputs, subnet counts, NAT counts, and route table mappings

references

• Comprehensive PRD: docs/prd/separate-public-private-subnets-and-nat-placement.md

🤖 Automatic Updates

Fix go version in tests @​osterman (#​222)

what

• Update go 1.24

why

• Error loading shared library libresolv.so.2 in Go 1.20

References

• https://sweetops.slack.com/archives/G014YEKDH4K/p1746672149263629
• https://github.com/golang/go/issues/59305#issuecomment-1488478737
• https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/pull/294/#issuecomment-2859195553

Replace Makefile with atmos.yaml @​osterman (#​221)

what

• Remove Makefile
• Add atmos.yaml

why

• Replace build-harness with atmos for readme genration

References

• DEV-3229 Migrate from build-harness to atmos

Migrate new test account @​osterman (#​215)

what

• Update .github/settings.yml
• Update .github/chatops.yml files

why

• Re-apply .github/settings.yml from org level to get terratest environment
• Migrate to new test account

References

• DEV-388 Automate clean up of test account in new organization
• DEV-387 Update terratest to work on a shared workflow instead of a dispatch action
• DEV-386 Update terratest to use new testing account with GitHub OIDC

Update .github/settings.yml @​osterman (#​214)

what

• Update .github/settings.yml
• Drop .github/auto-release.yml files

why

• Re-apply .github/settings.yml from org level
• Use organization level auto-release settings

references

• DEV-1242 Add protected tags with Repository Rulesets on GitHub

Update release workflow to allow pull-requests: write @​osterman (#​211)

what

• Update ...

v1.539.1

🚀 Enhancements

fix: VPC Endpoint Outputs @milldr (#64)

## what - Fixed outputs for VPC Endpoints - Added tests

why

• #62 used an index incorrectly. Added a test to catch this next time

references

• .

Summary by CodeRabbit

• New Features

  • VPC endpoint outputs now use service-keyed maps for both interface and gateway endpoints, improving clarity and direct access.
  • Outputs include S3 and DynamoDB endpoint IDs and prefix list IDs.
  • Interface endpoint security group ID is exposed via outputs.

• Tests

  • Added end-to-end test for a VPC with endpoints, validating gateway/interface endpoint outputs and formats.
  • Introduced test fixtures and stack import for the VPC-with-endpoints use case.

🤖 Automatic Updates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#65)

## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

v1.539.0

feature: Expose VPC Endpoint Outputs @milldr (#62)

## what

• Added new outputs for gateway VPC endpoints, including S3 and DynamoDB endpoint IDs and prefix list IDs, enhancing visibility and integration with other modules.
• Added output for the security group ID associated with interface VPC endpoints, improving security management and automation.

why

• We want to refer to these outputs in another component

references

.

Summary by CodeRabbit

• New Features
  • Added outputs to expose Gateway VPC Endpoints (S3, DynamoDB) and interface endpoint security group ID for easier retrieval.
• Documentation
  • Removed a minor formatting artifact from the README.
• Chores
  • Updated ignore rules to exclude the account-map directory from version control.

🤖 Automatic Updates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#63)

## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

v1.538.4

🚀 Enhancements

chore(deps): bump github.com/ulikunitz/xz from 0.5.11 to 0.5.14 in /test @[dependabot[bot]](https://github.com/apps/dependabot) (#59)

Bumps [github.com/ulikunitz/xz](https://github.com/ulikunitz/xz) from 0.5.11 to 0.5.14.

Commits

• 7184815 Preparation of release v0.5.14
• 88ddf1d Address Security Issue GHSA-jc7w-c686-c4v9
• c8314b8 Add new package xio with WriteCloserStack
• 4f11dce Update README.md and SECURITY.md to address security questions
• f56ebbf TODO.md: fix a typo
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

🤖 Automatic Updates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#61)

## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

chore(deps): update terraform cloudposse/vpc/aws to v3 @[renovate[bot]](https://github.com/apps/renovate) (#60)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/vpc/aws (source)	module	major	2.3.0 -> 3.0.0

---

Release Notes

cloudposse/terraform-aws-vpc (cloudposse/vpc/aws)

v3.0.0

Compare Source

🤖 Automatic Updates

chore(deps): update terraform aws to v6 (main) @​[renovate[bot]](https://redirect.github.com/apps/renovate) (#​159)

This PR contains the following updates:

Package	Type	Update	Change
aws (source)	required_provider	major	>= 4.9.0, < 6.0 -> < 6.13

---

Release Notes

hashicorp/terraform-provider-aws (aws)

v6.12.0

Compare Source

NOTES:

• resource/aws_s3_bucket_acl: The access_control_policy.grant.grantee.display_name attribute is deprecated. AWS has ended support for this attribute. API responses began inconsistently returning it on July 15, 2025, and will stop returning it entirely on November 21, 2025. This attribute will be removed in a future major version. (#​44090)
• resource/aws_s3_bucket_acl: The access_control_policy.owner.display_name attribute is deprecated. AWS has ended support for this attribute. API responses began inconsistently returning it on July 15, 2025, and will stop returning it entirely on November 21, 2025. This attribute will be removed in a future major version. (#​44090)
• resource/aws_s3_bucket_logging: The target_grant.grantee.display_name attribute is deprecated. AWS has ended support for this attribute. API responses began inconsistently returning it on July 15, 2025, and will stop returning it entirely on November 21, 2025. This attribute will be removed in a future major version. (#​44090)

FEATURES:

• New Resource: aws_cognito_managed_login_branding (#​43817)

ENHANCEMENTS:

• data-source/aws_efs_mount_target: Add ip_address_type and ipv6_address attributes (#​44079)
• data-source/aws_instance: Add placement_group_id attribute (#​38527)
• data-source/aws_lambda_function: Add source_kms_key_arn attribute (#​44080)
• data-source/aws_launch_template: Add placement.group_id attribute (#​44097)
• provider: Support ap-southeast-6 as a valid AWS Region (#​44127)
• resource/aws_ecs_service: Remove Terraform default for availability_zone_rebalancing and change the attribute to Optional and Computed. This allow ECS to default to ENABLED for new resources compatible with AvailabilityZoneRebalancing and maintain an existing service's availability_zone_rebalancing value during update when not configured. If an existing service never had an availability_zone_rebalancing value configured and is updated, ECS will treat this as DISABLED (#​43241)
• resource/aws_efs_mount_target: Add ip_address_type and ipv6_address arguments to support IPv6 connectivity (#​44079)
• resource/aws_fsx_openzfs_file_system: Remove maximum items limit on the user_and_group_quotas argument (#​44120)
• resource/aws_fsx_openzfs_volume: Remove maximum items limit on the user_and_group_quotas argument (#​44118)
• resource/aws_instance: Add placement_group_id argument (#​38527)
• resource/aws_instance: Add resource identity support (#​44068)
• resource/aws_lambda_function: Add source_kms_key_arn argument (#​44080)
• resource/aws_launch_template: Add placement.group_id argument (#​44097)
• resource/aws_ssm_association: Add resource identity support (#​44075)
• resource/aws_ssm_document: Add ...