Gruntwork release 2025-07

Guides / Update Guides / Releases / 2025-07

This page is lists all the updates to the Gruntwork Infrastructure as Code Library that were released in 2025-07. For instructions on how to use these updates in your code, check out the updating documentation.

Here are the repos that were updated:

• boilerplate
• pipelines-actions
• pipelines-workflows
• repo-copier
• terraform-aws-architecture-catalog
• terraform-aws-cis-service-catalog
• terraform-aws-control-tower
• terraform-aws-load-balancer
• terraform-aws-messaging
• terraform-aws-security
• terraform-aws-server
• terraform-aws-service-catalog
• terraform-aws-static-assets
• terraform-aws-vpc

boilerplate

v0.8.1

Published: 7/24/2025 | Release notes

• fix: processing dependency variable and render for_each_reference value by @tiviuray in https://github.com/gruntwork-io/boilerplate/pull/230

• @tiviuray made their first contribution in https://github.com/gruntwork-io/boilerplate/pull/230

Full Changelog: https://github.com/gruntwork-io/boilerplate/compare/v0.8.0...v0.8.1

v0.8.0

Published: 7/23/2025 | Release notes

• State management helpers by @dee-kryvenko in https://github.com/gruntwork-io/boilerplate/pull/227

• @dee-kryvenko made their first contribution in https://github.com/gruntwork-io/boilerplate/pull/227

Full Changelog: https://github.com/gruntwork-io/boilerplate/compare/v0.6.4...v0.8.0

v0.7.0

Published: 7/23/2025 | Release notes

• Bump golang.org/x/oauth2 from 0.23.0 to 0.27.0 by @dependabot[bot] in https://github.com/gruntwork-io/boilerplate/pull/229

• feat: add fromYaml to template helpers. by @pseudomorph in https://github.com/gruntwork-io/boilerplate/pull/228

• @pseudomorph made their first contribution in https://github.com/gruntwork-io/boilerplate/pull/228

Full Changelog: https://github.com/gruntwork-io/boilerplate/compare/v0.6.3...v0.7.0

v0.6.4

Published: 7/23/2025 | Release notes

This release was replaced with v0.7.0 as it contained a change that is not backwards compatible

pipelines-actions

v3.6.5

Published: 7/7/2025 | Release notes

Full Changelog: https://github.com/gruntwork-io/pipelines-actions/compare/v3.6.4...v3.6.5

pipelines-workflows

v3.9.3

Published: 7/8/2025 | Release notes

• Pin-mise-version-in-unlock by @oredavids in https://github.com/gruntwork-io/pipelines-workflows/pull/142

Full Changelog: https://github.com/gruntwork-io/pipelines-workflows/compare/v3.9.2...v3.9.3

v3.9.2

Published: 7/7/2025 | Release notes

• Fix mise install by pinning mise version by @Resonance1584 in https://github.com/gruntwork-io/pipelines-workflows/pull/141

Full Changelog: https://github.com/gruntwork-io/pipelines-workflows/compare/v3.9.1...v3.9.2

repo-copier

v0.6.2

Published: 7/17/2025 | Release notes

A build failure during v0.6.0 and v0.6.1 broke the release binaries.

The build process has been repaired, resulting in this release fixing this release.

• fix: Fix missing generated rice-box.go by @Resonance1584 in https://github.com/gruntwork-io/repo-copier/pull/290

Full Changelog: https://github.com/gruntwork-io/repo-copier/compare/v0.6.1...v0.6.2

v0.6.1

Published: 7/9/2025 | Release notes

• Fix missing error message on bad requests by @Resonance1584 in https://github.com/gruntwork-io/repo-copier/pull/287

Full Changelog: https://github.com/gruntwork-io/repo-copier/compare/v0.6.0...v0.6.1

terraform-aws-architecture-catalog

v3.1.1

Published: 7/25/2025 | Release notes

• DEV-979 Update catalog tags implementation to use a local file cache by @ZachGoldberg in https://github.com/gruntwork-io/terraform-aws-architecture-catalog/pull/1149

Full Changelog: https://github.com/gruntwork-io/terraform-aws-architecture-catalog/compare/v3.1.0...v3.1.1

v3.1.0

Published: 7/23/2025 | Release notes

• Add additional boilerplate variables for infra-live-root to enable tests to pass in necessary overrides by @ZachGoldberg in https://github.com/gruntwork-io/terraform-aws-architecture-catalog/pull/1147
• Fix empty defaults should not be null by @Resonance1584 in https://github.com/gruntwork-io/terraform-aws-architecture-catalog/pull/1148
• Pass refs by @Resonance1584 in https://github.com/gruntwork-io/terraform-aws-architecture-catalog/pull/1150
• Fix find_in_parent_folders needs template arg by @Resonance1584 in https://github.com/gruntwork-io/terraform-aws-architecture-catalog/pull/1151
• Fix gitlab tg version and apply role by @Resonance1584 in https://github.com/gruntwork-io/terraform-aws-architecture-catalog/pull/1153

Full Changelog: https://github.com/gruntwork-io/terraform-aws-architecture-catalog/compare/v3.0.1...v3.1.0

terraform-aws-cis-service-catalog

v0.58.3

Published: 7/9/2025 | Modules affected: modules/security/cleanup-expired-certs | Release notes

• chore: Bump cleanup-expired-certs python version to python3.13

terraform-aws-control-tower

v0.8.7

Published: 7/16/2025 | Modules affected: landingzone/control-tower-app-account-baseline, landingzone/control-tower-security-account-baseline, landingzone/control-tower-landing-zone | Release notes

terraform-aws-load-balancer

v1.0.1

Published: 7/9/2025 | Modules affected: alb | Release notes

• modules/alb: support IPv6 ingress/egress security group rules

terraform-aws-messaging

v1.0.1

Published: 7/15/2025 | Modules affected: msk | Release notes

• add privatelink (multi vpc connection) support

terraform-aws-security

v1.0.1

Published: 7/3/2025 | Modules affected: fail2ban | Release notes

• modules/fail2ban: Changed AWS CLI installation for better support by Ubuntu 24.04+

terraform-aws-server

v1.0.1

Published: 7/3/2025 | Modules affected: persistent-ebs-volume | Release notes

• modules/persistent-ebs-volume: Updated to work with newer nvme utility (improved AL2023 compatitiblity)
• tests: Removed Ubuntu 18.04 and added Ubuntu 24.04 to automated compatibility tests

terraform-aws-service-catalog

v0.127.6

Published: 7/25/2025 | Modules affected: services/eks-cluster | Release notes

> [!IMPORTANT]
> EKS Users: A bug was introduced into the service catalog with the v0.121.0 release. This was due to a variable not being exposed in the service catalog that was added into the terraform-aws-eks library module with version v0.74.0. The new variable must be set to the existing EKS Cluster Security Group Name to avoid a destructive recreation of the Security Group which will fail during an update requiring state manipulation to recover. When updating to this version, you must set the new variable eks_cluster_security_group_name to the existing EKS Cluster Security Group Name to avoid this issue. This change is being back-ported as a patch to every minor version release since v0.121.0 to ensure an upgrade path is available since the bug was introduced.

• Expose new variable eks_cluster_security_group_name to allow the EKS Control Plane Security Group name to be overridden.

v0.126.3

Published: 7/11/2025 | Modules affected: data-stores/ecr-repos | Release notes

• Add support for IAM Roles for the users_or_roles_to_allow_deny_all_else input

v0.126.2

Published: 7/9/2025 | Modules affected: base, data-stores, landingzone, mgmt | Release notes

Updated the following modules to use terraform-aws-security v1.0.1 and terraform-aws-server v1.0.1 which provides better support for AL2023 and Ubuntu 24.04+:

• modules/base/ec2-baseline
• modules/data-stores/rds-replica
• modules/data-stores/rds
• modules/data-stores/s3-bucket
• modules/landingzone/account-baseline-app
• modules/landingzone/account-baseline-root
• modules/landingzone/account-baseline-security
• modules/langinzone/iam-users-and-groups
• modules/mgmt/bastion-host
• modules/mgmt/ecs-deploy-runner
• modules/mgmt/jenkins
• modules/mgmt/openvpn-server
• modules/services/ec2-instance
• modules/services/ec2-instance

v0.126.1

Published: 7/4/2025 | Modules affected: services/eks-cluster | Release notes

> This is a backport patch release.
> This release backports a bug fix to ensure users on older minor versions can safely upgrade without encountering the previously introduced issue. This release is part of a coordinated set of backport patches, each targeting a specific minor version since the bug was introduced. The goal is to provide a safe, direct upgrade path for users on any affected minor version, without requiring an immediate jump to the latest release. No other changes are included in this patch beyond the critical fix described below. > If you are upgrading from any version since v0.121.0, please read the instructions below carefully.

• services/eks-cluster

> [!IMPORTANT]
> EKS Users: A bug was introduced in the service catalog with the v0.121.0 release. This was due to a variable not being exposed in the service catalog that was added into the terraform-aws-eks library module with version v0.74.0.
>
> Impact: The new variable must be set to the existing EKS Cluster Security Group Name to avoid a destructive recreation of the Security Group, which will fail during an update and require state manipulation to recover. >
> Action Required: When updating to this version, you must set the new variable eks_cluster_security_group_name to the existing EKS Cluster Security Group Name to avoid this issue.

• Exposed new variable eks_cluster_security_group_name to allow the EKS Control Plane Security Group name to be overridden.

• Pull Request #2256

If you have questions or need help with the upgrade, please open an issue or a support ticket.

v0.125.6

Published: 7/4/2025 | Modules affected: services/eks-cluster | Release notes

> This is a backport patch release.
> This release backports a bug fix to ensure users on older minor versions can safely upgrade without encountering the previously introduced issue. This release is part of a coordinated set of backport patches, each targeting a specific minor version since the bug was introduced. The goal is to provide a safe, direct upgrade path for users on any affected minor version, without requiring an immediate jump to the latest release. No other changes are included in this patch beyond the critical fix described below. > If you are upgrading from any version since v0.121.0, please read the instructions below carefully.

• services/eks-cluster

> [!IMPORTANT]
> EKS Users: A bug was introduced in the service catalog with the v0.121.0 release. This was due to a variable not being exposed in the service catalog that was added into the terraform-aws-eks library module with version v0.74.0.
>
> Impact: The new variable must be set to the existing EKS Cluster Security Group Name to avoid a destructive recreation of the Security Group, which will fail during an update and require state manipulation to recover. >
> Action Required: When updating to this version, you must set the new variable eks_cluster_security_group_name to the existing EKS Cluster Security Group Name to avoid this issue.

• Exposed new variable eks_cluster_security_group_name to allow the EKS Control Plane Security Group name to be overridden.

• Pull Request #2256

If you have questions or need help with the upgrade, please open an issue or a support ticket.

v0.124.1

Published: 7/4/2025 | Modules affected: services/eks-cluster | Release notes

> This is a backport patch release.
> This release backports a bug fix to ensure users on older minor versions can safely upgrade without encountering the previously introduced issue. This release is part of a coordinated set of backport patches, each targeting a specific minor version since the bug was introduced. The goal is to provide a safe, direct upgrade path for users on any affected minor version, without requiring an immediate jump to the latest release. No other changes are included in this patch beyond the critical fix described below. > If you are upgrading from any version since v0.121.0, please read the instructions below carefully.

• services/eks-cluster

> [!IMPORTANT]
> EKS Users: A bug was introduced in the service catalog with the v0.121.0 release. This was due to a variable not being exposed in the service catalog that was added into the terraform-aws-eks library module with version v0.74.0.
>
> Impact: The new variable must be set to the existing EKS Cluster Security Group Name to avoid a destructive recreation of the Security Group, which will fail during an update and require state manipulation to recover. >
> Action Required: When updating to this version, you must set the new variable eks_cluster_security_group_name to the existing EKS Cluster Security Group Name to avoid this issue.

• Exposed new variable eks_cluster_security_group_name to allow the EKS Control Plane Security Group name to be overridden.

• Pull Request #2256

If you have questions or need help with the upgrade, please open an issue or a support ticket.

v0.123.1

Published: 7/4/2025 | Modules affected: services/eks-cluster | Release notes

> This is a backport patch release.
> This release backports a bug fix to ensure users on older minor versions can safely upgrade without encountering the previously introduced issue. This release is part of a coordinated set of backport patches, each targeting a specific minor version since the bug was introduced. The goal is to provide a safe, direct upgrade path for users on any affected minor version, without requiring an immediate jump to the latest release. No other changes are included in this patch beyond the critical fix described below. > If you are upgrading from any version since v0.121.0, please read the instructions below carefully.

• services/eks-cluster

> [!IMPORTANT]
> EKS Users: A bug was introduced in the service catalog with the v0.121.0 release. This was due to a variable not being exposed in the service catalog that was added into the terraform-aws-eks library module with version v0.74.0.
>
> Impact: The new variable must be set to the existing EKS Cluster Security Group Name to avoid a destructive recreation of the Security Group, which will fail during an update and require state manipulation to recover. >
> Action Required: When updating to this version, you must set the new variable eks_cluster_security_group_name to the existing EKS Cluster Security Group Name to avoid this issue.

• Exposed new variable eks_cluster_security_group_name to allow the EKS Control Plane Security Group name to be overridden.

• Pull Request #2256

If you have questions or need help with the upgrade, please open an issue or a support ticket.

v0.122.1

Published: 7/4/2025 | Modules affected: services/eks-cluster | Release notes

> This is a backport patch release.
> This release backports a bug fix to ensure users on older minor versions can safely upgrade without encountering the previously introduced issue. This release is part of a coordinated set of backport patches, each targeting a specific minor version since the bug was introduced. The goal is to provide a safe, direct upgrade path for users on any affected minor version, without requiring an immediate jump to the latest release. No other changes are included in this patch beyond the critical fix described below. > If you are upgrading from any version since v0.121.0, please read the instructions below carefully.

• services/eks-cluster

> [!IMPORTANT]
> EKS Users: A bug was introduced in the service catalog with the v0.121.0 release. This was due to a variable not being exposed in the service catalog that was added into the terraform-aws-eks library module with version v0.74.0.
>
> Impact: The new variable must be set to the existing EKS Cluster Security Group Name to avoid a destructive recreation of the Security Group, which will fail during an update and require state manipulation to recover. >
> Action Required: When updating to this version, you must set the new variable eks_cluster_security_group_name to the existing EKS Cluster Security Group Name to avoid this issue.

• Exposed new variable eks_cluster_security_group_name to allow the EKS Control Plane Security Group name to be overridden.

• Pull Request #2256

If you have questions or need help with the upgrade, please open an issue or a support ticket.

v0.127.5

Published: 7/3/2025 | Modules affected: services/eks-cluster | Release notes

> [!IMPORTANT]
> EKS Users: A bug was introduced into the service catalog with the v0.121.0 release. This was due to a variable not being exposed in the service catalog that was added into the terraform-aws-eks library module with version v0.74.0. The new variable must be set to the existing EKS Cluster Security Group Name to avoid a destructive recreation of the Security Group which will fail during an update requiring state manipulation to recover. When updating to this version, you must set the new variable eks_cluster_security_group_name to the existing EKS Cluster Security Group Name to avoid this issue. This change is being back-ported as a patch to every minor version release since v0.121.0 to ensure an upgrade path is available since the bug was introduced.

• Expose new variable eks_cluster_security_group_name to allow the EKS Control Plane Security Group name to be overridden.

v0.121.4

Published: 7/3/2025 | Modules affected: services/eks-cluster | Release notes

> This is a backport patch release.
> This release backports a bug fix to ensure users on older minor versions can safely upgrade without encountering the previously introduced issue. This release is part of a coordinated set of backport patches, each targeting a specific minor version since the bug was introduced. The goal is to provide a safe, direct upgrade path for users on any affected minor version, without requiring an immediate jump to the latest release. No other changes are included in this patch beyond the critical fix described below. > If you are upgrading from any version since v0.121.0, please read the instructions below carefully.

• services/eks-cluster

> [!IMPORTANT]
> EKS Users: A bug was introduced in the service catalog with the v0.121.0 release. This was due to a variable not being exposed in the service catalog that was added into the terraform-aws-eks library module with version v0.74.0.
>
> Impact: The new variable must be set to the existing EKS Cluster Security Group Name to avoid a destructive recreation of the Security Group, which will fail during an update and require state manipulation to recover. >
> Action Required: When updating to this version, you must set the new variable eks_cluster_security_group_name to the existing EKS Cluster Security Group Name to avoid this issue.

• Exposed new variable eks_cluster_security_group_name to allow the EKS Control Plane Security Group name to be overridden.

• Pull Request #2256

If you have questions or need help with the upgrade, please open an issue or a support ticket.

v0.127.4

Published: 7/1/2025 | Modules affected: services | Release notes

• services/asg-service: Updated to use latest modules and specifically pulls in new functionality that allows desired_capacity to be set to null

terraform-aws-static-assets

v1.1.1

Published: 7/17/2025 | Modules affected: cloudfront | Release notes

• fix: use correct attribute for realtime_log_config_arn
• fix: correct strict_transport_security variable reference

v1.1.0

Published: 7/14/2025 | Modules affected: cloudfront | Release notes

• Bump golang.org/x/net from 0.36.0 to 0.38.0 in /test
• Update default_cache_behavior.preload type from string to bool

terraform-aws-vpc

v0.28.6

Published: 7/3/2025 | Modules affected: transit-gateway | Release notes

• SME-3222: Added Security Group Referencing Support