feat: Cloud WAN VPC attachment options (v4.9.0) - #187
Merged
Conversation
… SG referencing support) Exposes three new optional keys on core_network subnets, wired to the aws_networkmanager_vpc_attachment resource: - routing_policy_label (top-level attachment argument) - dns_support and security_group_referencing_support (options block) Defaults are null so AWS keeps its own defaults and existing attachments see no diff on upgrade. Provider requirement bumped to >= 6.27.0 (routing_policy_label is not present in the 5.x provider schema). cloud_wan example updated to demonstrate the new options. Offline regression tests added (option propagation + null defaults). Supersedes the remaining scope of aws-ia#176. Co-authored-by: Pablo Sanchez Carmona <pablo19sc@users.noreply.github.com>
clopca
marked this pull request as ready for review
August 18, 2026 21:48
clopca
pushed a commit
to clopca/terraform-aws-vpc
that referenced
this pull request
Aug 18, 2026
Adds routing_policy_label, dns_support and security_group_referencing to core_network_options, wired to aws_networkmanager_vpc_attachment. Defaults are null so the AWS service defaults apply and existing attachments see no diff on upgrade. Ports the remaining v4.9.0 scope (PR aws-ia#187) to v5; enable_dns64 and the NAT64 route were already present. Co-authored-by: Pablo Sanchez Carmona <pablo19sc@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Completes the remaining scope of #176: exposes the newer Cloud WAN VPC attachment arguments through the
core_networksubnet type.Changes
core_networksubnet keys, wired toaws_networkmanager_vpc_attachment:routing_policy_label(top-level attachment argument)dns_support(options block)security_group_referencing_support(options block)null— the provider defers to the AWS service defaults, so existing attachments see no diff on upgrade. (The options areOptional + Computedin the provider schema; passing an explicitfalsefordns_supportwould have flipped existing attachments, which AWS creates withtrue.)>= 6.27.0—routing_policy_labeldoes not exist in the 5.x provider schema. This is the reason these options ship in a minor release (v4.9.0) rather than a patch: consumers pinned to provider 5.x need to upgrade their provider to adopt this module version.cloud_wanexample updated to demonstrate the new options (from Fixing IPv6 configuration in private subnets + Cloud WAN VPC attachment update #176).Testing
tests/cloudwan_attachment_options.tftest.hcl(mock provider): option propagation to the attachment, androuting_policy_labeldefaulting tonullwhen unset.enable_dns64suite still green (5/5 total runs).terraform fmt/terraform validateclean.cloud_wanexample CI test covers the apply path.Supersedes the remaining scope of #176 — co-authored with @pablo19sc.