# What changed in @pulumi/aws

> 87 changes in @pulumi/aws 6 to 7 from its official release notes, upgrade guides and advisories: 22 breaking, 5 security, 32 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/@pulumi/aws/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @pulumi/aws 7

### Breaking changes

- Token modules now use upstream AWS names, which may affect how developers reference them in code. (7.46.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.46.0)
- Upgraded the underlying Terraform AWS provider to v6.63.0, potentially changing available AWS resource schemas and behavior. (7.45.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.45.0)
- Upgraded the underlying AWS Terraform provider to v6.54.0, potentially changing supported AWS resource behavior. (7.37.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.37.0)
- Upgraded the underlying AWS Terraform provider to v6.45.0, which may affect available AWS resource and configuration behavior. (7.30.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.30.0)
- CallbackFunction now defaults to the Node 22 runtime. (7.28.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.28.0)
- The regexValues property is now required for load balancer listener rule host-header lookups. (7.11.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.11.0)
- The regexValues property is now required for load balancer listener rule HTTP-header lookups. (7.11.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.11.0)
- The regexValues property is now required for load balancer listener rule path-pattern lookups. (7.11.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.11.0)
- The joinedMethod property is now required. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- The joinedTimestamp property is now required. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- The state property is now required. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- The joinedMethod property is now required. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- The joinedTimestamp property is now required. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- The state property is now required. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- The joinedMethod property is now required. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- The joinedTimestamp property is now required. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- The state property is now required. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- The joinedMethod property is now required. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- The joinedTimestamp property is now required. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- The state property is now required. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- The revert patch for rds.db.Proxy was removed. (7.9.1) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.1)

### New APIs and options

- Adds missing AWS regions to the Region enum, allowing developers to select those regions. (7.43.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.43.0)
- The ecr.getCredentials data source was added back from v6. (7.41.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.41.0)
- The ECS ContainerDefinition overlay type now includes restartPolicy to match the current ECS API. (7.38.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.38.0)
- The ECS ContainerDefinition overlay type now includes versionConsistency to match the current ECS API. (7.38.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.38.0)
- Added the r8 instance family to the provider's recognized instance types, enabling developers to configure r8 instances. (7.25.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.25.0)
- Adds support for the ap-east-2 region. (7.14.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.14.0)
- Adds the getImages ECR Public lookup function. (7.11.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.11.0)
- Adds the IdentityCenterConfiguration Lake Formation resource. (7.11.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.11.0)
- A new AgentcoreMemory resource is available in Bedrock. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- A new AgentcoreMemoryStrategy resource is available in Bedrock. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- A new AgentcoreOauth2CredentialProvider resource is available in Bedrock. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- A new AgentcoreTokenVaultCmk resource is available in Bedrock. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- A new AgentcoreWorkloadIdentity resource is available in Bedrock. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)
- Adds the AMP ResourcePolicy resource for managing Amazon Managed Service for Prometheus resource policies. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds the Bedrock AgentCore agent runtime resource. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds the Bedrock AgentCore agent runtime endpoint resource. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds the Bedrock AgentCore API key credential provider resource. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds the Bedrock AgentCore browser resource. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds the Bedrock AgentCore code interpreter resource. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds the Bedrock AgentCore gateway resource. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds the Bedrock AgentCore gateway target resource. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds a function for retrieving an EC2 VPN connection. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds a function for retrieving Oracle Cloud Autonomous VM clusters. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds a function for retrieving Oracle Cloud Exadata infrastructures. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds a function for retrieving Oracle Cloud VM clusters. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds a function for retrieving Oracle Database network peering connections. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds a function for retrieving Oracle Database networks. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds a function for retrieving an RDS global cluster. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds the Transfer Family host key resource. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds the Transfer Family web app resource. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds the Transfer Family web app customization resource. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)
- Adds a function for retrieving a VPN connection. (7.9.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.0)

### Behavior and default changes

- Credential errors now explain how to sign in, making authentication failures easier to resolve. (7.51.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.51.0)
- Credential validation now reads aws:sharedConfigFiles, so configured shared AWS credential files are considered. (7.51.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.51.0)
- The provider opts into the pulumi new credentials preflight, changing credential checks during project creation. (7.48.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.48.0)
- The AWS Terraform provider was upgraded, potentially changing available provider-backed behavior. (7.46.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.46.0)
- The underlying AWS Terraform provider was upgraded, potentially affecting available AWS resource behavior and configuration. (7.27.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.27.0)
- Upgraded to v6.35.1, potentially changing the underlying AWS provider surface. (7.22.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.22.0)
- Upgraded the underlying AWS Terraform provider to v6.30.0, potentially changing available AWS provider functionality. (7.17.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.17.0)
- Upgraded the underlying Terraform AWS provider to v6.25.0, potentially affecting supported resources and provider behavior. (7.13.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.13.0)
- The values property is no longer required for ALB listener rule host-header conditions. (7.11.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.11.0)
- The values property is no longer required for load balancer listener rule host-header conditions. (7.11.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.11.0)
- The values property is no longer required for ALB listener rule HTTP-header conditions. (7.11.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.11.0)
- The values property is no longer required for load balancer listener rule HTTP-header conditions. (7.11.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.11.0)
- The values property is no longer required for ALB listener rule path-pattern conditions. (7.11.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.11.0)
- The values property is no longer required for load balancer listener rule path-pattern conditions. (7.11.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.11.0)
- Pulumi APN 1.1 marketplace id is appended to the User Agent request header. (7.9.1) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.9.1)

### Fixes and other changes

- The EC2 InstanceType enum was synchronized with AWS, keeping supported instance type values aligned for developer configuration. (7.48.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.48.0)
- The underlying AWS Terraform provider was upgraded to v6.59.0. (7.42.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.42.0)
- Node.js-only overlays were added back, restoring Node.js-specific SDK behavior for developers. (7.41.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.41.0)
- RDS cluster storage type changes are now supported in place. (7.40.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.40.0)
- Creating a safety rule no longer panics when the API returns an error. (7.40.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.40.0)
- Fixes updates to aws_route when only timeouts change. (7.39.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.39.0)
- Fixed scope-down logical statements in WAFv2. (7.38.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.38.0)
- RDS instance identifiers now support autonaming, allowing identifiers to be generated automatically. (7.34.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.34.0)
- Patches the Cognito IdP provider details diff. (7.33.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.33.0)
- Fixes drift when importing EC2 key pairs with a public key. (7.29.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.29.0)
- Corrected source-typed ECR lifecycle policy enums so developers receive the intended enum values when configuring lifecycle policies. (7.25.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.25.0)
- Upgraded the underlying AWS Terraform provider to v6.33.0. (7.20.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.20.0)
- Write-only version support fields were re-introduced. (7.10.0) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v7.10.0)

## @pulumi/aws 6

### Breaking changes

- The SDK's required Go version rises to 1.24 because go-git v5.16.5 requires Go 1.24. (6.83.4) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v6.83.4)

### Security

- The CIRCL dependency was updated to resolve a P-384 CombinedMult security vulnerability. (6.83.4) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v6.83.4)
- The go-git dependency was updated to resolve a packfile integrity vulnerability. (6.83.4) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v6.83.4)
- The Go toolchain was updated to resolve multiple standard-library and command security vulnerabilities affecting TLS, HTTP, archive handling, and cgo tooling. (6.83.4) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v6.83.4)
- This is a backport/security release; the notes provide no further details about the affected behavior or API. (6.83.3) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v6.83.3)
- Security fix addressing vulnerability GO-2025-3956. (6.83.1) — [release notes](https://github.com/pulumi/pulumi-aws/releases/tag/v6.83.1)