6.28.0 (January 7, 2026)

NOTES:

• resource/aws_dynamodb_global_secondary_index: This resource type is experimental. The schema or behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#44999)

FEATURES:

• New Data Source: aws_cloudfront_connection_group (#44885)
• New Data Source: aws_cloudfront_distribution_tenant (#45088)
• New List Resource: aws_kms_alias (#45700)
• New List Resource: aws_sqs_queue (#45691)
• New Resource: aws_cloudfront_connection_function (#45664)
• New Resource: aws_cloudfront_connection_group (#44885)
• New Resource: aws_cloudfront_distribution_tenant (#45088)
• New Resource: aws_cloudfront_multitenant_distribution (#45535)
• New Resource: aws_dynamodb_global_secondary_index (#44999)
• New Resource: aws_ecr_pull_time_update_exclusion (#45765)
• New Resource: aws_organizations_tag (#45730)
• New Resource: aws_redshift_idc_application (#37345)
• New Resource: aws_secretsmanager_tag (#45825)
• New Resource: aws_sesv2_tenant (#45706)

ENHANCEMENTS:

• data-source/aws_apigateway_domain_name : Add endpoint_access_mode attribute (#45741)
• data-source/aws_db_proxy: Add endpoint_network_type and target_connection_network_type attributes (#45634)
• data-source/aws_dx_gateway: Add tags attribute (#45766)
• data-source/aws_ecr_lifecycle_policy_document: Add rule.action.target_storage_class and rule.selection.storage_class arguments, and new valid values for rule.action.type and rule.selection.count_type arguments (#45752)
• data-source/aws_iam_saml_provider: Add saml_provider_uuid attribute (#45707)
• data-source/aws_lambda_function: Add response_streaming_invoke_arn attribute (#45652)
• data-source/aws_lambda_function: Support code_signing_config_arn in AWS GovCloud (US) Regions ()

BUG FIXES:

• data-source/aws_ecr_authorization_token: Fix value of proxy_endpoint when registry_id is specified (#45754)
• data-source/aws_networkmanager_core_network_policy_document: Support account-id, not account, as a valid value for attachment_policies.conditions.type. This fixes a regression introduced in v6.27.0 (#45788)
• data-source/aws_vpc_endpoint: Add missing implementation for service_region attribute (#45679)
• provider: Fix handling of user_agent values where the product name contains a forward slash (#45715)
• resource/aws_batch_job_definition: Fix crash during update when node_properties has NodeRangeProperties.ecsProperties set (#45676)
• resource/aws_batch_job_definition: Fix handling of logically deleted results in List ()