Skip to content

CHANGELOG.md

Latest commit

 

History

History
309 lines (216 loc) · 10.9 KB

CHANGELOG.md

File metadata and controls

309 lines (216 loc) · 10.9 KB

2.3.2 (24/04/2026)

FEATURES:

  • terraform.sh: added multi-group support. The -g/--group flag (also --groups) now accepts comma-delimited values, e.g. -g dev,live, loading each group's tfvars file in order. Closes #41.

2.3.1 (24/04/2026)

FEATURES:

  • Lambda module: replaced external data source + Node.js script with native aws_lambda_layer_version for CloudWatch Lambda Insights layer resolution.
  • Lambda module: added ADOT OpenTelemetry layer support via adot variable.
  • Lambda module: added SSM Parameters & Secrets extension layer support via ssm_extension variable.
  • Lambda module: added memory usage CloudWatch alarm via function_memory variable.
  • Lambda module: error alarm now supports percentage-based thresholds in addition to count-based via threshold_type option.
  • Lambda module: added destroy-time placeholder handling for S3 function source.
  • Cognito module: SMS IAM role and configuration now gated on sms_enabled variable.
  • Cognito module: added software_token_mfa_configuration support.
  • Cognito module: extracted ui_customisation as standalone variable.
  • Cognito module: added generate_secret variable for cognito user pool client.
  • Cognito module: added callback_urls variable with app_fqdn fallback.
  • Cognito module: added user_pool_domain_ready output.
  • terraform.sh: added edge lambda logging support.

BUG FIXES:

  • Lambda module: added length guards on S3 bucket/key/version references to prevent errors when data source is empty during destroy.
  • Cognito module: fixed recovery mechanism priority ordering (email first).
  • Cognito module: fixed trailing whitespace in multiple files.

CHORES:

  • S3bucket module: removed deprecated expected_bucket_owner from accelerate, CORS, and server-side encryption configurations.
  • S3bucket module: fixed lifecycle_configuration_id output to return rule[*].id.
  • S3bucket module: uncommented ownership_controls output.
  • Lambda module: removed external provider dependency.
  • Regenerated terraform-docs READMEs for lambda, s3bucket, and cognito.

2.3.0 (24/04/2026)

BREAKING CHANGES:

  • Shebang changed from #!/bin/bash to #!/usr/bin/env bash for portability.
  • set -uo pipefail now enforced across all scripts. Unbound variable access will now cause failures rather than silent empty expansion.
  • Bootstrap tag keys changed from capitalised (tfscaffold:Environment) to lowercase (tfscaffold:environment) for consistency with module conventions.

FEATURES:

  • error_and_die now accepts an optional second argument for custom exit codes.
  • TF_VAR_aws_account_id and TF_VAR_environment are now exported automatically, making them available to Terraform without explicit variable passthrough.
  • S3 backend configuration now always includes encrypt = true.
  • S3 backend configuration now injects profile when AWS_PROFILE is set, enabling named profile support for state access.
  • Remote dynamic tfvars now supports multiple files: all *.tfvars and *.tfvars.json files under the environment's S3 prefix are downloaded, replacing the previous single dynamic.tfvars pattern.
  • New output action for standalone terraform output retrieval, with optional JSON file output support.
  • IAM role module now supports sts:ExternalId conditions via optional external_id field on trusted principals.
  • SNS module now supports content_based_deduplication for FIFO topics.
  • Lambda module now supports reserved_concurrent_executions.

BUG FIXES:

  • Fixed unquoted variable expansions throughout terraform.sh (~20 instances), including two HIGH-severity rm commands inside trap statements.
  • Fixed set -u safety: all declare statements now initialised, empty array access guarded, and ${AWS_DEFAULT_REGION:-} defaulted.
  • Fixed cognito module access_token_validity default key typo: validity corrected to value.
  • Fixed KMS module alias variable default from string "null" to HCL null.
  • Fixed VPC module force_destroy from string "true" to boolean true.
  • Fixed missing semicolons throughout terraform.sh for style consistency.
  • Fixed lockfile variable quoting in conditional test.
  • Fixed -r/--region flag not being authoritative over tfvars files (#37). Region is now passed as -var region= (highest precedence) and exported as TF_VAR_region (lowest precedence fallback).

CHORES:

  • Removed dead code: data.aws_iam_policy_document.default_assumerole from bootstrap (never referenced).
  • Removed duplicate data.aws_iam_policy_document.xray from lambda module (functionality already in lambda_core.tf).
  • Removed committed state files from bootstrap directory.
  • Renamed module.s3bucket_other.tf to module.s3bucket_bestpractice.tf to match the module name it declares.
  • Replaced TODO comment on cognito SNS policy with explanation of why sns:Publish on * is required for Cognito MFA/SMS.
  • Regenerated all terraform-docs README files.
  • Added vim modelines to all shell scripts.

SECURITY:

  • Updated esbuild from 0.24.0 to ^0.25.0 (CVE: dev server request forgery, medium severity).
  • Updated undici from 6.21.0 to >=6.21.1 (CVE: insufficiently random values, medium severity).

2.0.1 (12/02/2025)

  • Updated included modules to follow new standard and include other generics

2.0.0 (02/12/2024)

BREAKING CHANGES:

  • It is now possible, with a validation check, to destroy the bootstrap.
  • Bootstrap and the example component have been completely rewritten.
  • .terraform and backend_tfscaffold.tf no longer removed during bootstrap cleanup
  • Bootstrap and examples now configured to use terraform >= 1.10.0.
  • Bootstrap and examples now require terraform > 1.0.0.
  • Bootstrap and examples now require AWS Provider ~> 5.79.0.
  • tfscaffold tagging default have changed to prefix tag keys with tfscaffold:

FEATURES:

  • Bootstraps can now be fully and cleanly destroyed, however only interactively, requiring a manual text input to confirm.
  • A DynamoDB lock table has been added to Bootstrap.
  • Bootstrap now uses AWS Provider v4+ S3 Bucket property resources instead of declaring all configuration in a single bucket resource.
  • The example component has been rewritten to reflect modern naming standards, and idempotency structures.
  • An example module has been added, which is called from the example component.
  • Example region changed to eu-west-2.
  • bin/docs.sh has been added to recursively apply terraform-docs (https://github.com/terraform-docs/terraform-docs) to all directories beneath the project root that contain a variables.tf file.
  • Remove unnecessary compatability log entry for auto-approve.
  • Remove unnecessary non-current version transitions from the bootstrap bucket.

BUG FIXES:

  • Do not write .terraform.output.json after a destroy.
  • -compact-warnings is no longer passed to terraform init

CHORES:

  • .gitignore updated

1.10.2 (02/12/2024)

BUG FIXES:

  • Correct terraform.output.json to .terraform.output.json

1.10.1 (02/12/2024)

BUG FIXES:

  • Add **/terraform.output.json to the default .gitignore

1.10.0 (02/12/2024)

FEATURES:

  • Apply/Refresh/Destroy actions now output a terraform.output.json file containing the contents of terraform output -json -no-color. On by default, can be disabled.
  • Ignore -w/--compact-warnings for commands that don't support it so the user can specify it all the time without worrying which commands support it.

BUG FIXES:

  • Fix plugin-cache base directory from $(pwd) to ${base_path} so it is correctly located if terraform.sh is invoked from somewhere other than the project root.

CHORES:

  • Fix inappropriate double-quoting of non-interpolated strings.

1.9.1 (06/09/2024)

BUG FIXES:

  • Correct selection of lockfile_or_upgrade, thanks to @edmundcraske-bjss

1.9.0 (06/09/2024)

FEATURES:

  • New options:
    • -l/--lockfile: Local lock file
    • -t/--lock-table: Lock with DynamoDB Table
  • Bootstrap:
    • New multi-resource approach to S3 Bucket
    • KMS Key Alias for S3 Bucket KMS Key, for easy data-sourcing elsewhere
    • New tfscaffold: prefix for tfscaffold tags
  • Updated the warning for duplicate input variables

BUG FIXES:

  • Some alignment and ordering

1.8.0 (Unreleased)

  • Merged into 1.9.0

1.7.1 (14/07/2023)

  • Explicitly declare and clear out, refresh and destroy in case someone exports them

1.7.0 (29/10/2021)

  • Added custom action shell: a bash login shell between component init and cleanup

1.6.1 (24/05/2021)

FEATURES:

  • Added -d/--detailed-exitcode to propagate terraform exit codes to shell
  • Added -n/--no-color appends -co-color to all tf calls
  • Added -w/--compact-warnings appends -compact-warnings to all terraform calls

BUG FIXES:

  • Getopt fixes
  • Various small fixes

NOTES:

  • Support for early versions of terraform has been dropped (<0.11)
  • Default backend bucket name has changed, pass in -b to overwrite
  • Scaffold bootstrap updated

1.4.3 (16/12/2019)

  • Remove extraneous eval from secret parsing
  • Remove deprecated/irrelevant module-depth parameter

1.4.2 (05/02/2018)

  • Add an init with -backend=false in bootstrap mode, otherwise providers are not downloaded
  • Fix bootstrap output that was using a now deprecated bucket resource attribute
  • Add an indicative .terraform-version file for tfenv support in bootstrap

1.4.1 (18/12/2017)

  • Remove -upgrade from init. Added prematurely. Can go back in when 0.9 support is dropped.

1.4.0 (18/12/2017)

  • Support terraform 0.10/0.11, bypassing new built-in approval mechanism.
  • Explicitly cache plugin downloads.
  • Set TF_IN_AUTOMATION.

1.3.1 (27/07/2017)

  • Change from error to warn on non-presence of requested group variables file

1.3.0 (26/07/2017)

  • Introduce the group variables file functionality

1.2.0 (09/06/2017)

  • Merge bootstrap functionality into the main script

1.1.4 (16/05/2017)

  • Global and Region scoped variables files

1.1.3 (12/04/2017)

  • Support the use of .terraform-version file in components when in the presence of tfenv

1.1.2 (06/04/2017)

  • Provide a case for import that requires the variable file parameters

1.1.1 (06/04/2017)

  • Fix 0.9.2+ support for bootstrap.sh

1.1.0 (28/03/2017)

  • Move from terraform-0.8 to terraform-0.9
    • Change remote state from manual config to temporary-file "backend"
    • Complain in the code comments about Hashicorp forcing my hand on this
    • Don't push state any more; there's no persisted local copy to push
  • Same change for bootstrap.sh (UNTESTED!)

1.0.1 (15/03/2017)

  • Bugfix: Duplicate variable warning conditional to presence of duplicates

1.0.0 (14/03/2017)

  • Add CHANGELOG.md
  • Add version and help parameters to bin/terraform.sh
  • Add optional unencrypted S3 parameters
  • Move secrets S3 key path to more appropriate place
  • Test and Warn on duplicate variables
  • Support arbitrary terraform actions
  • Additional comments