Summary

• Bumps TF AWS provider 6.55.0
• New managed resources across account, bedrock, bedrockagentcore, cloudwatchlogs, lambda and opensearchserverless API groups
• Bugfixes and enhancements and CVE remediations
• Bumps upjet v2.4.1-0.20260728103920-4f6e6e10dff2
• Bumps crossplane-runtime v2.3.3

⚠️ Breaking bugfix API changes

KeyPair.lightsail — status.atProvider.privateKey removed (#2136)

The upstream Terraform provider changed private_key on aws_lightsail_key_pair from a regular attribute to a Sensitive attribute. Consequently:

• status.atProvider.privateKey is removed from the CRD
• The private key is now written to the connection details secret after creation instead.

The private key is only available at creation time and cannot be re-read from AWS. Back up existing keys before upgrading, and make sure a writeConnectionSecretToRef is configured for new KeyPair resources.

Go module consumers: crossplane-runtime v2.3 changes (#2171)

All generated API types moved their common Crossplane types from github.com/crossplane/crossplane-runtime/v2/apis/common/v1 to github.com/crossplane/crossplane/apis/v2/core/v2. Every *Ref, *Selector, *SecretRef and SecretKeySelector field changed its Go type (v1.Reference → v2.Reference, v1.Selector → v2.Selector, v1.SecretKeySelector → xpv2.SecretKeySelector, …).

This is not a CRD/YAML-level change — the schema is identical, so existing manifests and stored objects are unaffected. It is a notification for anyone importing this provider's apis/... packages in Go (e.g. function or composition authors, custom controllers). Please update imports accordingly if needed.

⚠️ Field Deprecations (#2136)

Following fields still work but will be removed in the next major version as underlying TF versions deprecated them. Use the new replacements on external consumers where possible.

Cluster.elasticache — valkey removed from spec.forProvider.engine (#2136)

valkey was never a valid engine for the Cluster resource; it was accepted by the CRD enum but rejected by AWS. Aligned with the AWS SDK to avoid confusion (see hashicorp/terraform-provider-aws#41181). Valkey engines continue to be created via ReplicationGroup.elasticache or ServerlessCache.elasticache.

🆕 New managed resources

🔼 Terraform AWS provider version bump

• #2136 — 6.34.0 → 6.53.0. The single largest change in this release; the KeyPair.lightsail, Cluster.elasticache, required→optional and deprecation items above all originate here. Also backports new fields into cluster-scoped v1beta1 APIs, configures singleton-list conversions for newly added nested blocks, and fixes example manifests the new provider version rejected (Broker.mq, Cluster.elasticache, kafka).
• #2151 — 6.53.0 → 6.55.0. Additive at the API level (no removed CRD properties, no new required-field rules, no new deprecations). Carries three fixes not implied by the title:
  • Table.dynamodb — in-place GSI/attribute updates no longer fail validation.
  • Broker.mq — a spurious empty shared_resources diff is dropped, preventing a no-op update.
  • SecurityConfig.opensearchserverless — samlOptions now uses a regular singleton-list conversion after TF 6.x switched it to a list-nested block. No CRD API change.
• #2176 — VaultLockConfiguration.backup now supports updates. The retention arguments are no longer ForceNew, so changing retention on an unlocked vault applies in place instead of looping on upjet's assertNoForceNew refusal (EXT-338). Adds status.atProvider.locked / lockDate and the first example manifests for this kind.
• #2177 — InstanceState.rds stopped → available transitions (fixes #2100). spec.forProvider.state can now bring a stopped RDS instance back up. Also adds the missing password secrets to the instancestate.yaml examples; Go bumped to 1.26.5.

🐞 Bug fixes

• #2185 — Streaming configuration propagation to DynamoDB global-table replicas in MRSC mode When streaming is enabled via spec.forProvider.streamEnabled: true in Table.dynamodb in MRSC mode, the configuration is now properly propagated to all the replica tables.
• #2182 — Perpetual diff on DB parameter groups when only applyMethod differs (fixes #1286, #1444). Affects ParameterGroup / ClusterParameterGroup in the rds, docdb and neptune groups: AWS silently ignores apply-method-only changes, so applyMethod never round-tripped. A shared custom diff now suppresses the parameter diff when all parameter changes are ApplyMethod-only; value changes and additions/removals are untouched.
• #2140 — Perpetual reconcile loop on LBListenerRule.elbv2 with action.forward. target_group_arn was late-inited into spec but stripped from state on the next Observe, producing a diff on every cycle. Fixed with a forced per-action late-init (which also backfills order and forward.stickiness) plus a custom diff that suppresses the resulting spurious ARN add/remove. Real user-driven ARN changes still apply.
• #2137 — Stale tag keys in status.atProvider.tags / tagsAll. A tag key removed from or renamed in spec.forProvider.tags kept appearing in status indefinitely. The external AWS resource was always correct — only observed state was wrong.
• #2117 — External-name oscillation on VPC endpoint associations (fixes #2116). aws_vpc_endpoint_subnet_association and aws_vpc_endpoint_route_table_association flipped the crossplane.io/external-name annotation between the Terraform ID and the import ID on every reconciliation, causing perpetual updates, delete/recreate cycles and AWS 429 throttling. Both forms are now derived deterministically from the named fields.
• #2122 — Conversion webhooks not served by non-leader replicas. Webhook registration was gated behind leader election, so followers could not serve conversion requests. It now happens eagerly on all pods, with reconciler setup still deferred to the leader.
• #2156 — Missing performanceInsightsKmsKeyId reference on RDS Instance/Cluster (fixes #2155). Adds the cross-resource reference to aws_kms_key (all versions, both scopes) with the generated Ref/Selector fields, plus KMS example manifests.

🔧 Upjet & crossplane-runtime bumps and their transitive effects

Directly consumed by changes in this release

• #678 — conversion webhook registration decoupled from leader election. Consumed by #2122.
• #693 — custom setup-aggregator and terraformed templates, plus the new Terraform.ResourceSchema template variable (replacing Terraform.SchemaVersion). Consumed by #2137 (tags fix) and #2140 (forced late-init).
• #698 — Plugin Framework external client: fixes "Unexpected Identity Change" errors during Observe for Framework resources with Terraform resource identity, and makes external-name resolution error out when FrameworkResourceWithComputedIdentifier returns the placeholder stub instead of a real identifier. Relevant to the bedrockagentcore and opensearchserverless resources added here. Consumed by #2151.
• #664 — migrates common API imports to crossplane/apis/v2 for runtime 2.3.x. Consumed by #2171; this is the source of the Go-level v1.Reference → v2.Reference change described under Breaking changes.

Observable schema/behavior effects in the shipped CRDs

• #660 — SSA list-map markers are no longer emitted on observation (status.atProvider) fields. Visible in this release as LBListener.elbv2 status.atProvider.defaultAction losing x-kubernetes-list-type: map / x-kubernetes-list-map-keys: [index] and the injected index default. Removing those markers from a status field is schema-compatible; it stops server-side-apply from treating observed lists as associative maps.
• crossplane-runtime 2.3.x adds status.lastHandledReconcileAt to every MR CRD in the provider ("holds the value of the most recent reconcile-requested-at annotation token that the controller has processed"). This accounts for the bulk of the 2038 modified CRD files.
• #684 — XValidation rules are omitted for required fields that have references, so a field satisfied purely by a *Ref/*Selector no longer trips the "is a required parameter" CEL rule.
• #672 — configurable Description on SSA InjectedKey.

🔐 Security / CVE remediations

✨ Non-breaking Resource API changes

Non-breaking API relaxations (#2136)

The following fields were Required → Optional (the generated is a required parameter CEL validation rules were dropped). Existing manifests keep working; validation is simply looser now:

New Cross-resource references

New cross-resource references generated in this release:

New fields

New top-level spec.forProvider fields from the Terraform provider bumps (non-exhaustive — nested additions are not listed):

👥 Project

• #2163 — jonasz-lasut added as a maintainer

Full PR list