npm / @pulumi/aws
@pulumi/aws
What changed in @pulumi/aws 6 to 7, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
22 breaking5 security32 new APIs and options15 behavior and defaults13 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@pulumi/aws 781 changes
Breaking changes 21
Token modules now use upstream AWS names, which may affect how developers reference them in code.
Upgraded the underlying Terraform AWS provider to v6.63.0, potentially changing available AWS resource schemas and behavior.
Upgraded the underlying AWS Terraform provider to v6.54.0, potentially changing supported AWS resource behavior.
Upgraded the underlying AWS Terraform provider to v6.45.0, which may affect available AWS resource and configuration behavior.
CallbackFunction now defaults to the Node 22 runtime.
The regexValues property is now required for load balancer listener rule host-header lookups.
The regexValues property is now required for load balancer listener rule HTTP-header lookups.
The regexValues property is now required for load balancer listener rule path-pattern lookups.
The joinedMethod property is now required.
The joinedTimestamp property is now required.
The state property is now required.
The joinedMethod property is now required.
The joinedTimestamp property is now required.
The state property is now required.
The joinedMethod property is now required.
The joinedTimestamp property is now required.
The state property is now required.
The joinedMethod property is now required.
The joinedTimestamp property is now required.
The state property is now required.
The revert patch for rds.db.Proxy was removed.
New APIs and options 32
Adds missing AWS regions to the Region enum, allowing developers to select those regions.
The ecr.getCredentials data source was added back from v6.
The ECS ContainerDefinition overlay type now includes restartPolicy to match the current ECS API.
The ECS ContainerDefinition overlay type now includes versionConsistency to match the current ECS API.
Added the r8 instance family to the provider's recognized instance types, enabling developers to configure r8 instances.
Adds support for the ap-east-2 region.
Adds the getImages ECR Public lookup function.
Adds the IdentityCenterConfiguration Lake Formation resource.
A new AgentcoreMemory resource is available in Bedrock.
A new AgentcoreMemoryStrategy resource is available in Bedrock.
A new AgentcoreOauth2CredentialProvider resource is available in Bedrock.
A new AgentcoreTokenVaultCmk resource is available in Bedrock.
A new AgentcoreWorkloadIdentity resource is available in Bedrock.
Adds the AMP ResourcePolicy resource for managing Amazon Managed Service for Prometheus resource policies.
Adds the Bedrock AgentCore agent runtime resource.
Adds the Bedrock AgentCore agent runtime endpoint resource.
Adds the Bedrock AgentCore API key credential provider resource.
Adds the Bedrock AgentCore browser resource.
Adds the Bedrock AgentCore code interpreter resource.
Adds the Bedrock AgentCore gateway resource.
Adds the Bedrock AgentCore gateway target resource.
Adds a function for retrieving an EC2 VPN connection.
Adds a function for retrieving Oracle Cloud Autonomous VM clusters.
Adds a function for retrieving Oracle Cloud Exadata infrastructures.
Adds a function for retrieving Oracle Cloud VM clusters.
Adds a function for retrieving Oracle Database network peering connections.
Adds a function for retrieving Oracle Database networks.
Adds a function for retrieving an RDS global cluster.
Adds the Transfer Family host key resource.
Adds the Transfer Family web app resource.
Adds the Transfer Family web app customization resource.
Adds a function for retrieving a VPN connection.
Behavior and default changes 15
Credential errors now explain how to sign in, making authentication failures easier to resolve.
Credential validation now reads aws:sharedConfigFiles, so configured shared AWS credential files are considered.
The provider opts into the pulumi new credentials preflight, changing credential checks during project creation.
The AWS Terraform provider was upgraded, potentially changing available provider-backed behavior.
The underlying AWS Terraform provider was upgraded, potentially affecting available AWS resource behavior and configuration.
Upgraded to v6.35.1, potentially changing the underlying AWS provider surface.
Upgraded the underlying AWS Terraform provider to v6.30.0, potentially changing available AWS provider functionality.
Upgraded the underlying Terraform AWS provider to v6.25.0, potentially affecting supported resources and provider behavior.
The values property is no longer required for ALB listener rule host-header conditions.
The values property is no longer required for load balancer listener rule host-header conditions.
The values property is no longer required for ALB listener rule HTTP-header conditions.
The values property is no longer required for load balancer listener rule HTTP-header conditions.
The values property is no longer required for ALB listener rule path-pattern conditions.
The values property is no longer required for load balancer listener rule path-pattern conditions.
Pulumi APN 1.1 marketplace id is appended to the User Agent request header.
Fixes and other changes 13
The EC2 InstanceType enum was synchronized with AWS, keeping supported instance type values aligned for developer configuration.
The underlying AWS Terraform provider was upgraded to v6.59.0.
Node.js-only overlays were added back, restoring Node.js-specific SDK behavior for developers.
RDS cluster storage type changes are now supported in place.
Creating a safety rule no longer panics when the API returns an error.
Fixes updates to aws_route when only timeouts change.
Fixed scope-down logical statements in WAFv2.
RDS instance identifiers now support autonaming, allowing identifiers to be generated automatically.
Patches the Cognito IdP provider details diff.
Fixes drift when importing EC2 key pairs with a public key.
Corrected source-typed ECR lifecycle policy enums so developers receive the intended enum values when configuring lifecycle policies.
Upgraded the underlying AWS Terraform provider to v6.33.0.
Write-only version support fields were re-introduced.
@pulumi/aws 66 changes
Breaking changes 1
The SDK's required Go version rises to 1.24 because go-git v5.16.5 requires Go 1.24.
Security 5
The CIRCL dependency was updated to resolve a P-384 CombinedMult security vulnerability.
The go-git dependency was updated to resolve a packfile integrity vulnerability.
The Go toolchain was updated to resolve multiple standard-library and command security vulnerabilities affecting TLS, HTTP, archive handling, and cgo tooling.
This is a backport/security release; the notes provide no further details about the affected behavior or API.
Security fix addressing vulnerability GO-2025-3956.