[dependabot]

Bumps hashicorp/aws from 5.100.0 to 6.70.0.

Release notes

Sourced from hashicorp/aws's releases.

v6.70.0

6.70.0 (October 21, 2026)

BREAKING CHANGES:

• resource/aws_route53domains_delegation_signer_record: Change the format of the import ID from domain_name,dnssec_key_id to domain_name,flags,algorithm,public_key. This is acceptable in a minor version because AWS no longer return DNSKEY flags and delegation signer records can no longer reliably be found by domain name and key ID (#50522)

NOTES:

• provider: The provider is now built with Go 1.26.10, which no longer trusts certificates issued through a set of compromised eMudhra intermediate CAs (CVE-2026-111943) (#50555)
• resource/aws_dx_macsec_key_association: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#50559)

FEATURES:

• New List Resource: aws_cloudwatchomni_access_grant (#50483)
• New List Resource: aws_cloudwatchomni_access_profile (#50471)
• New List Resource: aws_cloudwatchomni_view (#50428)
• New List Resource: aws_directory_service_directory_setting (#50145)
• New List Resource: aws_directoryservicedata_group (#50221)
• New Resource: aws_bedrock_enforced_guardrail_configuration (#47408)
• New Resource: aws_cloudwatchomni_access_grant (#50483)
• New Resource: aws_cloudwatchomni_access_profile (#50471)
• New Resource: aws_cloudwatchomni_view (#50428)
• New Resource: aws_directory_service_directory_setting (#50145)
• New Resource: aws_directoryservicedata_group (#50221)

ENHANCEMENTS:

• resource/aws_arcregionswitch_plan: Add step.rds_switchover_read_replica_config argument (#49675)
• resource/aws_dx_macsec_key_association: Add cak_wo, cak_wo_version, ckn_wo, and ckn_wo_version arguments (#50559)
• resource/aws_elasticache_global_replication_group: Enable Global Replication Group Failover. Changing primary_replication_group_id no longer replaces resource. (#47913)
• resource/aws_guardduty_detector_feature: Add RDS_DATA_RISK as a valid value for additional_configuration.name (#50445)
• resource/aws_guardduty_member_detector_feature: Add RDS_DATA_RISK as a valid value for additional_configuration.name (#50445)
• resource/aws_guardduty_organization_configuration_feature: Add RDS_DATA_RISK as a valid value for additional_configuration.name (#50445)
• resource/aws_neptune_cluster: Add network_type argument (#50331)

BUG FIXES:

• resource/aws_guardduty_detector_feature: Fix perpetual diff when additional_configuration is omitted and AWS returns default entries such as RDS_DATA_RISK (#50445)
• resource/aws_guardduty_member_detector_feature: Fix perpetual diff when additional_configuration is omitted and AWS returns default entries such as RDS_DATA_RISK (#50445)
• resource/aws_guardduty_organization_configuration_feature: Fix forced replacement when additional_configuration is omitted and AWS returns default entries such as RDS_DATA_RISK (#50445)
• resource/aws_prometheus_scraper: Fix update failure on scrapers with a CloudWatch destination by omitting unchanged destination from update requests (#50463)
• resource/aws_route53domains_delegation_signer_record: Fix handling of null Flags and PublicKey fields for .uk/.co.uk domain registries which caused resources to be removed from state when they existed at AWS (#50522)
• resource/aws_secretsmanager_secret_version: Fix read and delete errors when the version is no longer current and its KMS key has been disabled or deleted, such as after the secret moved to a new key. Terraform keeps the value from state and shows a warning (#50369)

v6.69.1

6.69.1 (October 15, 2026)

BUG FIXES:

... (truncated)

Changelog

Sourced from hashicorp/aws's changelog.

6.70.0 (October 21, 2026)

BREAKING CHANGES:

• resource/aws_route53domains_delegation_signer_record: Change the format of the import ID from domain_name,dnssec_key_id to domain_name,flags,algorithm,public_key. This is acceptable in a minor version because AWS no longer return DNSKEY flags and delegation signer records can no longer reliably be found by domain name and key ID (#50522)

NOTES:

• provider: The provider is now built with Go 1.26.10, which no longer trusts certificates issued through a set of compromised eMudhra intermediate CAs (CVE-2026-111943) (#50555)
• resource/aws_dx_macsec_key_association: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#50559)

FEATURES:

• New List Resource: aws_cloudwatchomni_access_grant (#50483)
• New List Resource: aws_cloudwatchomni_access_profile (#50471)
• New List Resource: aws_cloudwatchomni_view (#50428)
• New List Resource: aws_directory_service_directory_setting (#50145)
• New List Resource: aws_directoryservicedata_group (#50221)
• New Resource: aws_bedrock_enforced_guardrail_configuration (#47408)
• New Resource: aws_cloudwatchomni_access_grant (#50483)
• New Resource: aws_cloudwatchomni_access_profile (#50471)
• New Resource: aws_cloudwatchomni_view (#50428)
• New Resource: aws_directory_service_directory_setting (#50145)
• New Resource: aws_directoryservicedata_group (#50221)

ENHANCEMENTS:

• resource/aws_arcregionswitch_plan: Add step.rds_switchover_read_replica_config argument (#49675)
• resource/aws_dx_macsec_key_association: Add cak_wo, cak_wo_version, ckn_wo, and ckn_wo_version arguments (#50559)
• resource/aws_elasticache_global_replication_group: Enable Global Replication Group Failover. Changing primary_replication_group_id no longer replaces resource. (#47913)
• resource/aws_guardduty_detector_feature: Add RDS_DATA_RISK as a valid value for additional_configuration.name (#50445)
• resource/aws_guardduty_member_detector_feature: Add RDS_DATA_RISK as a valid value for additional_configuration.name (#50445)
• resource/aws_guardduty_organization_configuration_feature: Add RDS_DATA_RISK as a valid value for additional_configuration.name (#50445)
• resource/aws_neptune_cluster: Add network_type argument (#50331)

BUG FIXES:

• resource/aws_guardduty_detector_feature: Fix perpetual diff when additional_configuration is omitted and AWS returns default entries such as RDS_DATA_RISK (#50445)
• resource/aws_guardduty_member_detector_feature: Fix perpetual diff when additional_configuration is omitted and AWS returns default entries such as RDS_DATA_RISK (#50445)
• resource/aws_guardduty_organization_configuration_feature: Fix forced replacement when additional_configuration is omitted and AWS returns default entries such as RDS_DATA_RISK (#50445)
• resource/aws_prometheus_scraper: Fix update failure on scrapers with a CloudWatch destination by omitting unchanged destination from update requests (#50463)
• resource/aws_route53domains_delegation_signer_record: Fix handling of null Flags and PublicKey fields for .uk/.co.uk domain registries which caused resources to be removed from state when they existed at AWS (#50522)
• resource/aws_secretsmanager_secret_version: Fix read and delete errors when the version is no longer current and its KMS key has been disabled or deleted, such as after the secret moved to a new key. Terraform keeps the value from state and shows a warning (#50369)

6.69.1 (October 15, 2026)

BUG FIXES:

• provider: Fixes bufio.Scanner: token too long when logging requests or responses with long lines (#50501)

... (truncated)

Commits

• 5e13eed Merge pull request #50587 from hashicorp/t-update-changelog-version
• 9cb7a57 Updates VERSION
• c48e10d Updates CHANGELOG
• 3a6de32 Merge pull request #48894 from jiaxiforwork/f-sagemaker-inference-component
• 76ed066 Update CHANGELOG.md for #50578
• 886491e chore: add changelog entry for Go 1.26.10 upgrade (#50578)
• c4dc4bb r/aws_sagemaker_inference_component: Scope accelerator import verification
• 62fba4b Merge pull request #50570 from hashicorp/resource-counts
• d271861 Merge pull request #50567 from hashicorp/dependabot/go_modules/dot-ci/tools/g...
• e2ebd5f docs: update resource counts
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)