chore(infrastructure): bump hashicorp/aws from 6.36.0 to 6.53.0 by Nachiket-Roy · Pull Request #5129 · OWASP/Nest

Nachiket-Roy · 2026-07-03T11:35:18Z

Proposed change

Resolves #5128

Bumps the hashicorp/aws Terraform provider constraint from ~> 6.36.0 to ~> 6.53.0 across all infrastructure modules and updates all .terraform.lock.hcl lockfiles to match.

Checklist

Required: I followed the contributing workflow
Required: I verified that my code works as intended and resolves the issue as described
Required: I ran all required checks and tests locally; all warnings addressed and failures resolved
I used AI for code, documentation, tests, or communication related to this PR

…dd Dependabot tracking - Bump AWS provider constraint from ~> 6.36.0 to ~> 6.53.0 across all infrastructure modules and regenerate .terraform.lock.hcl files with correct provider hashes - Fixes MalformedXML errors on S3 operations against LocalStack and other S3-compatible backends (fixed upstream in v6.43.0, hashicorp/terraform-provider-aws#47530) - Add terraform package-ecosystem to Dependabot covering all existing infrastructure module directories with 21-day cooldown and daily schedule, consistent with other ecosystems in the project - Update auto-generated terraform-docs READMEs to reflect new constraint ~> 6.53.0 Signed-off-by: Nachiket Roy <nachiket.roy.2@gmail.com>

coderabbitai · 2026-07-03T11:35:39Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

The Terraform AWS provider is bumped from ~> 6.36.0 to ~> 6.53.0 across infrastructure modules. Lockfiles and documentation are updated, Dependabot adds Terraform coverage, and a pre-commit hook is added for Terraform provider lock regeneration. The KMS module also changes its CloudWatch Logs policy interpolation to use the AWS region name.

Changes

AWS Provider Version Bump

Layer / File(s)	Summary
Update automation `.github/dependabot.yml`, `.pre-commit-config.yaml`	Adds Terraform Dependabot tracking for `infrastructure/*/` and a pre-commit hook for `terraform_providers_lock` on `.terraform.lock.hcl` files.
Root module provider updates `infrastructure/bootstrap/...`, `infrastructure/live/...`, `infrastructure/state/...`	Updates AWS provider constraints, lock files, and README version references for the root infrastructure modules.
Core module provider updates `infrastructure/modules/alb/...`, `infrastructure/modules/cache/...`, `infrastructure/modules/database/...`, `infrastructure/modules/ecr-cache/...`, `infrastructure/modules/kms/main.tf`	Updates AWS provider constraints, lock files, and README version references for the core modules.
KMS log policy interpolation `infrastructure/modules/kms/main.tf`	Changes the KMS CloudWatch Logs condition and principal interpolation to use `data.aws_region.current.region`.
Networking, parameters, security, and service updates `infrastructure/modules/networking/...`, `infrastructure/modules/networking/modules/nacl/...`, `infrastructure/modules/networking/modules/vpc-endpoint/...`, `infrastructure/modules/parameters/...`, `infrastructure/modules/security/...`, `infrastructure/modules/service/...`	Updates AWS provider constraints, lock files, and README version references for networking-related and adjacent modules.
Storage and tasks module updates `infrastructure/modules/storage/...`, `infrastructure/modules/storage/modules/s3-bucket/...`, `infrastructure/modules/storage/modules/shared-data-bucket/...`, `infrastructure/modules/tasks/...`, `infrastructure/modules/tasks/modules/task/...`	Updates AWS provider constraints, lock files, and README version references for storage and tasks modules, including random-provider hash refreshes where present.

Estimated code review effort: 4 (Complex) | ~60 minutes

Suggested reviewers: arkid15r, kasya, rudransh-shrivastava

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The KMS module also changes CloudWatch Logs policy interpolation from region id to region name, which is unrelated to the provider bump.	Remove the KMS policy change or split it into a separate PR unless it is required by the linked issue.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the AWS provider bump from 6.36.0 to 6.53.0, which matches the main change.
Description check	✅ Passed	The description matches the PR by describing the provider bump and lockfile updates across infrastructure modules.
Linked Issues check	✅ Passed	The provider bump, lockfile refresh, and Dependabot config satisfy the linked issue's acceptance criteria.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

cubic-dev-ai

No issues found across 58 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/dependabot.yml:
- Around line 124-128: The new terraform Dependabot group is missing the same
dependency-level grouping used by the pre-commit block, so update the
version-updates group definition to include group-by: dependency-name alongside
applies-to and patterns. Keep the change within the terraform grouping section
in dependabot.yml and use the existing group blocks as the reference point for
consistency.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: be030504-d1b5-4846-a057-0d28f726f47b

📥 Commits

Reviewing files that changed from the base of the PR and between 2de24d1 and 63cbaa6.

📒 Files selected for processing (58)

.github/dependabot.yml
infrastructure/bootstrap/.terraform.lock.hcl
infrastructure/bootstrap/README.md
infrastructure/bootstrap/main.tf
infrastructure/live/.terraform.lock.hcl
infrastructure/live/README.md
infrastructure/live/main.tf
infrastructure/modules/alb/.terraform.lock.hcl
infrastructure/modules/alb/README.md
infrastructure/modules/alb/main.tf
infrastructure/modules/cache/.terraform.lock.hcl
infrastructure/modules/cache/README.md
infrastructure/modules/cache/main.tf
infrastructure/modules/database/.terraform.lock.hcl
infrastructure/modules/database/README.md
infrastructure/modules/database/main.tf
infrastructure/modules/ecr-cache/.terraform.lock.hcl
infrastructure/modules/ecr-cache/README.md
infrastructure/modules/ecr-cache/main.tf
infrastructure/modules/kms/.terraform.lock.hcl
infrastructure/modules/kms/README.md
infrastructure/modules/kms/main.tf
infrastructure/modules/networking/.terraform.lock.hcl
infrastructure/modules/networking/README.md
infrastructure/modules/networking/main.tf
infrastructure/modules/networking/modules/nacl/.terraform.lock.hcl
infrastructure/modules/networking/modules/nacl/README.md
infrastructure/modules/networking/modules/nacl/main.tf
infrastructure/modules/networking/modules/vpc-endpoint/.terraform.lock.hcl
infrastructure/modules/networking/modules/vpc-endpoint/README.md
infrastructure/modules/networking/modules/vpc-endpoint/main.tf
infrastructure/modules/parameters/.terraform.lock.hcl
infrastructure/modules/parameters/README.md
infrastructure/modules/parameters/main.tf
infrastructure/modules/security/.terraform.lock.hcl
infrastructure/modules/security/README.md
infrastructure/modules/security/main.tf
infrastructure/modules/service/.terraform.lock.hcl
infrastructure/modules/service/README.md
infrastructure/modules/service/main.tf
infrastructure/modules/storage/.terraform.lock.hcl
infrastructure/modules/storage/README.md
infrastructure/modules/storage/main.tf
infrastructure/modules/storage/modules/s3-bucket/.terraform.lock.hcl
infrastructure/modules/storage/modules/s3-bucket/README.md
infrastructure/modules/storage/modules/s3-bucket/main.tf
infrastructure/modules/storage/modules/shared-data-bucket/.terraform.lock.hcl
infrastructure/modules/storage/modules/shared-data-bucket/README.md
infrastructure/modules/storage/modules/shared-data-bucket/main.tf
infrastructure/modules/tasks/.terraform.lock.hcl
infrastructure/modules/tasks/README.md
infrastructure/modules/tasks/main.tf
infrastructure/modules/tasks/modules/task/.terraform.lock.hcl
infrastructure/modules/tasks/modules/task/README.md
infrastructure/modules/tasks/modules/task/main.tf
infrastructure/state/.terraform.lock.hcl
infrastructure/state/README.md
infrastructure/state/main.tf

Consistent with npm and pip ecosystem groups in the same file. Signed-off-by: Nachiket Roy <nachiket.roy.2@gmail.com>

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

_{Re-trigger cubic}

codecov · 2026-07-04T05:56:54Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.73%. Comparing base (88f5bf0) to head (10adf86).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5129   +/-   ##
=======================================
  Coverage   98.73%   98.73%           
=======================================
  Files         536      536           
  Lines       16980    16980           
  Branches     2418     2418           
=======================================
  Hits        16765    16765           
  Misses        123      123           
  Partials       92       92

Flag	Coverage Δ
backend	`99.44% <ø> (ø)`
frontend	`96.71% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 88f5bf0...10adf86. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: Rudransh Shrivastava <rudransh.shrivastava@owasp.org>

add darwin_arm64 and linux_arm64 hashes to the lockfiles. Signed-off-by: Rudransh Shrivastava <rudransh.shrivastava@owasp.org>

cubic-dev-ai

0 issues found across 21 files (changes from recent commits).

_{Re-trigger cubic}

rudransh-shrivastava

Hi, there are some deprecation warnings:

https://github.com/OWASP/Nest/actions/runs/28710387263/job/85143014122?pr=5129#step:6:771

I think you already fixed them in your original PR? Can you please add them here as well? Thank you!

Signed-off-by: Rudransh Shrivastava <rudransh.shrivastava@owasp.org>

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

_{Re-trigger cubic}

Nachiket-Roy · 2026-07-04T15:37:08Z

Hello @rudransh-shrivastava,
I've kept the scope limited to just the Terraform provider version bump. Fixing them would mean adding additional file to the PR. To avoid scope creep in this PR, I've left that out for now. Let me know if you want me to fix them in this PR.

rudransh-shrivastava · 2026-07-04T15:41:54Z

@Nachiket-Roy Hello!

I think it's fine to add them here. We can update the PR title/description to reflect the changes.

The alternative is to keep those changes in the other PR -- which makes less sense.

…on id Signed-off-by: Nachiket Roy <nachiket.roy.2@gmail.com>

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@infrastructure/modules/kms/main.tf`:
- Around line 43-48: The KMS test for AllowCloudWatchLogs is too loose and can
miss regressions in the region-specific interpolation. Update the test that
covers the KMS policy rendering to explicitly assert the rendered
kms:EncryptionContext:aws:logs:arn value and the logs.<region>.amazonaws.com
service principal, using the same data sources or expected interpolation as in
the KMS policy module. Focus on the policy assertions around the
AllowCloudWatchLogs statement so the test verifies both the ARN and principal
values, not just the statement existence.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6507328a-534e-42f9-b859-870037552579

📥 Commits

Reviewing files that changed from the base of the PR and between bce29d2 and cb34c8d.

📒 Files selected for processing (1)

infrastructure/modules/kms/main.tf

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

_{Re-trigger cubic}

…atch logs configuration Signed-off-by: Nachiket Roy <nachiket.roy.2@gmail.com>

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

_{Re-trigger cubic}

github-actions · 2026-07-06T22:58:13Z

Contribution validation failed:

commit_sign_off: One or more commits are missing or have an invalid Signed-off-by trailer.
- 2417e74

github-actions · 2026-07-06T22:58:15Z

Contribution validation failed:

commit_sign_off: One or more commits are missing or have an invalid Signed-off-by trailer.
- 2417e74

github-actions · 2026-07-06T22:59:42Z

Contribution validation failed:

commit_sign_off: One or more commits are missing or have an invalid Signed-off-by trailer.
- 2417e74
- 10adf86

x

sonarqubecloud · 2026-07-06T23:00:44Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

_{Re-trigger cubic}

Nachiket-Roy requested review from arkid15r, kasya and rudransh-shrivastava as code owners July 3, 2026 11:35

github-actions Bot added docs Improvements or additions to documentation infrastructure labels Jul 3, 2026

Nachiket-Roy changed the title ~~chore(infrastructure): bump hashicorp/aws from 6.36.0 to 6.53.0 and a…~~ chore(infrastructure): bump hashicorp/aws from 6.36.0 to 6.53.0 Jul 3, 2026

Nachiket-Roy marked this pull request as draft July 3, 2026 11:35

cubic-dev-ai Bot previously approved these changes Jul 3, 2026

View reviewed changes

coderabbitai Bot requested changes Jul 3, 2026

View reviewed changes

Comment thread .github/dependabot.yml

ci: add group-by dependency-name to Terraform Dependabot group

c969e8a

Consistent with npm and pip ecosystem groups in the same file. Signed-off-by: Nachiket Roy <nachiket.roy.2@gmail.com>

Nachiket-Roy marked this pull request as ready for review July 3, 2026 11:46

Nachiket-Roy dismissed cubic-dev-ai[bot]’s stale review via c969e8a July 3, 2026 11:46

coderabbitai Bot previously approved these changes Jul 3, 2026

View reviewed changes

cubic-dev-ai Bot previously approved these changes Jul 3, 2026

View reviewed changes

rudransh-shrivastava added 2 commits July 4, 2026 20:14

replace hardcoded directories with glob pattern matching

f4a7555

Signed-off-by: Rudransh Shrivastava <rudransh.shrivastava@owasp.org>

add terraform_providers_lock pre-commit hook and update lockfiles

b6e6cbf

add darwin_arm64 and linux_arm64 hashes to the lockfiles. Signed-off-by: Rudransh Shrivastava <rudransh.shrivastava@owasp.org>

rudransh-shrivastava dismissed stale reviews from cubic-dev-ai[bot] and coderabbitai[bot] via b6e6cbf July 4, 2026 15:11

coderabbitai Bot previously approved these changes Jul 4, 2026

View reviewed changes

cubic-dev-ai Bot previously approved these changes Jul 4, 2026

View reviewed changes

rudransh-shrivastava previously requested changes Jul 4, 2026

View reviewed changes

sort alphabetically

bce29d2

Signed-off-by: Rudransh Shrivastava <rudransh.shrivastava@owasp.org>

rudransh-shrivastava dismissed stale reviews from cubic-dev-ai[bot] and coderabbitai[bot] via bce29d2 July 4, 2026 15:22

coderabbitai Bot previously approved these changes Jul 4, 2026

View reviewed changes

cubic-dev-ai Bot previously approved these changes Jul 4, 2026

View reviewed changes

fix: update kms policy identifiers to use region name instead of regi…

cb34c8d

…on id Signed-off-by: Nachiket Roy <nachiket.roy.2@gmail.com>

Nachiket-Roy dismissed stale reviews from cubic-dev-ai[bot] and coderabbitai[bot] via cb34c8d July 4, 2026 15:43

coderabbitai Bot requested changes Jul 4, 2026

View reviewed changes

Comment thread infrastructure/modules/kms/main.tf

cubic-dev-ai Bot previously approved these changes Jul 4, 2026

View reviewed changes

test: update kms policy mock and add validation assertions for cloudw…

0909f87

…atch logs configuration Signed-off-by: Nachiket Roy <nachiket.roy.2@gmail.com>

Nachiket-Roy dismissed cubic-dev-ai[bot]’s stale review via 0909f87 July 4, 2026 16:00

coderabbitai Bot previously approved these changes Jul 4, 2026

View reviewed changes

cubic-dev-ai Bot previously approved these changes Jul 4, 2026

View reviewed changes

Update code

2417e74

arkid15r dismissed stale reviews from cubic-dev-ai[bot] and coderabbitai[bot] via 2417e74 July 6, 2026 22:57

Merge branch 'main' into fix/bump-aws-provider-6.53.0

10adf86

arkid15r enabled auto-merge July 6, 2026 23:00

arkid15r approved these changes Jul 6, 2026

View reviewed changes

cubic-dev-ai Bot approved these changes Jul 6, 2026

View reviewed changes

arkid15r added this pull request to the merge queue Jul 6, 2026

Merged via the queue into OWASP:main with commit 46a69ff Jul 6, 2026
30 of 31 checks passed

Nachiket-Roy deleted the fix/bump-aws-provider-6.53.0 branch July 7, 2026 05:49

Uh oh!

Uh oh!

Conversation

Nachiket-Roy commented Jul 3, 2026

Proposed change

Checklist

Uh oh!

coderabbitai Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

rudransh-shrivastava left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Nachiket-Roy commented Jul 4, 2026

Uh oh!

rudransh-shrivastava commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 6, 2026

Uh oh!

github-actions Bot commented Jul 6, 2026

Uh oh!

github-actions Bot commented Jul 6, 2026

Uh oh!

sonarqubecloud Bot commented Jul 6, 2026

Quality Gate passed

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading

codecov Bot commented Jul 4, 2026 •

edited

Loading

rudransh-shrivastava commented Jul 4, 2026 •

edited

Loading