Gruntwork release 2026-07

Guides / Update Guides / Releases / 2026-07

This page lists all the updates to the Gruntwork Infrastructure as Code Library that were released in 2026-07. For instructions on how to use these updates in your code, check out the updating documentation.

Here are the repos that were updated:

• pipelines-actions
• pipelines-cli
• pipelines-workflows
• terraform-aws-architecture-catalog
• terraform-aws-asg
• terraform-aws-data-storage
• terraform-aws-eks
• terraform-aws-security
• terraform-aws-vpc

pipelines-actions

v4.11.2

Published: 7/20/2026 | Release notes

• fix(pipelines-code-auth): keep path separator in generic fallback insteadOf rewrites by @Tensho in https://github.com/gruntwork-io/pipelines-actions/pull/168

• @Tensho made their first contribution in https://github.com/gruntwork-io/pipelines-actions/pull/168

Full Changelog: https://github.com/gruntwork-io/pipelines-actions/compare/v4.11.1...v4.11.2

pipelines-cli

v0.58.0

Published: 7/23/2026 | Release notes

Details on user-facing changes will be documented in the release notes for:

• https://github.com/gruntwork-io/pipelines-workflows
• https://gitlab.com/gruntwork-io/pipelines-workflows

v0.57.0

Published: 7/20/2026 | Release notes

Details on user-facing changes will be documented in the release notes for:

• https://github.com/gruntwork-io/pipelines-workflows
• https://gitlab.com/gruntwork-io/pipelines-workflows

v0.56.0

Published: 7/14/2026 | Release notes

Details on user-facing changes will be documented in the release notes for:

• https://github.com/gruntwork-io/pipelines-workflows
• https://gitlab.com/gruntwork-io/pipelines-workflows

v0.55.5

Published: 7/8/2026 | Release notes

Details on user-facing changes will be documented in the release notes for:

• https://github.com/gruntwork-io/pipelines-workflows
• https://gitlab.com/gruntwork-io/pipelines-workflows

v0.55.4

Published: 7/3/2026 | Release notes

Details on user-facing changes will be documented in the release notes for:

• https://github.com/gruntwork-io/pipelines-workflows
• https://gitlab.com/gruntwork-io/pipelines-workflows

pipelines-workflows

v4.23.0

Published: 7/23/2026 | Release notes

Added an auto_expand option to hooks, when enabled hook outputs will be expanded by default in the PR comment.

Full Changelog: https://github.com/gruntwork-io/pipelines-workflows/compare/v4.22.1...v4.23.0

v4.22.1

Published: 7/20/2026 | Release notes

A bug in the logic for authenticating private GitHub repositories in Pipelines resulted in CAS downloads failing when using a version of Terragrunt >= 1.1. Due to the way that CAS error handling works, a fallback automatically kicked in for users experiencing this, allowing the download to succeed anyways without CAS de-duplication. This prevented users from getting the performance improvements they expect from usage of CAS.

This has been fixed. Special thanks to @Tensho for contributing this fix!

• chore: Bumping pipelines-actions to v4.11.2 by @yhakbar in https://github.com/gruntwork-io/pipelines-workflows/pull/238

Full Changelog: https://github.com/gruntwork-io/pipelines-workflows/compare/v4...v4.22.1

v4.22.0

Published: 7/20/2026 | Release notes

• Update to pipelines CLI v0.57.0 by @ZachGoldberg in https://github.com/gruntwork-io/pipelines-workflows/pull/237

Included in this CLI change is bugfixes and a code-refactor for pipelines hooks. There should be no visible customer-visible behavior change with this release.

Full Changelog: https://github.com/gruntwork-io/pipelines-workflows/compare/v4...v4.22.0

v4.21.0

Published: 7/14/2026 | Release notes

GitHub is rolling out a new format for the OIDC sub used by Pipelines to authenticate to the cloud. Repositories created after July 15, 2026 will use this new format. In order to use the correct format when Account Factory creates new delegated repositories, upgrade to this Pipelines release along with terraform-aws-architecture-catalog v6.1.2 and terraform-aws-security v1.5.1 or newer.

Hooks can now specify a filter attribute to scope hooks to specific units. Hooks can be filtered by environment, label, and path. Hooks with a filter will only run when their targeted units are planned/applied. Read more here.

Full Changelog: https://github.com/gruntwork-io/pipelines-workflows/compare/v4.20.0...v4.21.0

v4.20.0

Published: 7/9/2026 | Release notes

✨ Remote script sources for hooks

The default Pipelines CLI version is now v0.55.5, which lets an after_hook declare a source: a URL that Pipelines fetches before the hook runs, so execute can run scripts that live outside the repository.

See the documentation for setup instructions and additional details.

Full Changelog: https://github.com/gruntwork-io/pipelines-workflows/compare/v4.19.1...v4.20.0

v4.19.1

Published: 7/3/2026 | Release notes

🐛 Restored authless environment support

The default Pipelines CLI version is now v0.55.4, which restores support for authless environments: an environment declaring an empty authentication {} block once again resolves to empty credentials instead of failing with an unrecognized-provider error.

⚙ Maintenance

The CLI update also improves troubleshooting when preflight checks fail: the output of the failing command now appears in the workflow logs at the default log level, without needing to enable debug logging. And code authentication is now configured before preflight checks run, as groundwork for upcoming support for remote hook sources.

Full Changelog: https://github.com/gruntwork-io/pipelines-workflows/compare/v4.19.0...v4.19.1

terraform-aws-architecture-catalog

v6.1.2

Published: 7/14/2026 | Release notes

• Fix invalid tags.yml by @Resonance1584 in https://github.com/gruntwork-io/terraform-aws-architecture-catalog/pull/1215

Full Changelog: https://github.com/gruntwork-io/terraform-aws-architecture-catalog/compare/v6.1.1...v6.1.2

v6.1.1

Published: 7/14/2026 | Release notes

• Fix access control PR should append accounts by @Resonance1584 in https://github.com/gruntwork-io/terraform-aws-architecture-catalog/pull/1214

Full Changelog: https://github.com/gruntwork-io/terraform-aws-architecture-catalog/compare/v6.1.0...v6.1.1

v6.1.0

Published: 7/13/2026 | Release notes

• Reduce retry count on security hub subscriptions by @odgrim in https://github.com/gruntwork-io/terraform-aws-architecture-catalog/pull/1211

• DEV-1581 changes needed for GitHub Immutable ID subject-claim by @x-nightwing in https://github.com/gruntwork-io/terraform-aws-architecture-catalog/pull/1212

• @x-nightwing made their first contribution in https://github.com/gruntwork-io/terraform-aws-architecture-catalog/pull/1212

Full Changelog: https://github.com/gruntwork-io/terraform-aws-architecture-catalog/compare/v6.0.2...v6.1.0

v6.0.1

Published: 7/1/2026 | Release notes

• fix access control account name in .gruntwork account config by @odgrim in https://github.com/gruntwork-io/terraform-aws-architecture-catalog/pull/1209

Full Changelog: https://github.com/gruntwork-io/terraform-aws-architecture-catalog/compare/v6.0.0...v6.0.1

terraform-aws-asg

v.1.2.0

Published: 7/8/2026 | Modules affected: asg-rolling-deploy, server-group | Release notes

• feat: add gw: namespaced tagging and scheduled cloud-nuke cleanup
• chore: bump cloud-nuke to v0.49.0
• chore: run cloud-nuke cleanup across all regions
• fix: harden cloud-nuke cleanup CI and bump to v0.50.0
• boto3: add logic to verify boto3 packages were in-sync
• Scope cloud-nuke cleanup to repo resource types (v0.51.0)
• Bump cloud-nuke cleanup to v0.52.0 (parallel scan)
• Fix rolling-deploy failure on Python 3.13+ (bump bundled boto3 to 1.35.99, urllib3<2)

terraform-aws-data-storage

v1.3.1

Published: 7/30/2026 | Modules affected: - aurora | Release notes

• aurora

• fix(aurora): stop perpetual plan drift on Serverless v2 seconds_until_auto_pause (#601). For Aurora Serverless v2, seconds_until_auto_pause only applies when scaling_configuration_min_capacity_V2 is 0 (scale-to-zero). With a min capacity above 0 the AWS provider never sends the value, AWS reports it back as 0, and because the attribute is computed every plan showed a 0 -> 300 diff. The module now omits the argument unless min capacity is 0, so the value computed from AWS stands and the drift stops. No input or output changes, and no action needed on upgrade. On earlier versions the workaround is scaling_configuration_seconds_until_auto_pause_V2 = null.

• fix(examples): parameterize the aurora-serverless-v2 engine version (#602). The example hardcoded engine_version = "16.6", which AWS retired, so the example and upgrade tests failed at CreateDBCluster with InvalidParameterCombination. It now defaults to the major family 16 so it resolves to an available minor. Examples and tests only; no module changes.

• fix(test): make upgrade-test resilient to retired MySQL engine versions (#600). Tests only; no module changes.

• https://github.com/gruntwork-io/terraform-aws-data-storage/pull/600

• https://github.com/gruntwork-io/terraform-aws-data-storage/pull/601

• https://github.com/gruntwork-io/terraform-aws-data-storage/pull/602

v1.3.0

Published: 7/10/2026 | Modules affected: - dms | Release notes

• dms

• feat: add PostgreSQL and DMS Serverless support (#590). Adds DMS Serverless (task_compute_config) plus new optional inputs on the dms module (create_replication_instance, create_iam_roles, and others), all backward compatible with defaults.

• fix(examples): move off retired MySQL 8.0.40 to 8.0.43 (#599). AWS retired MySQL 8.0.40; the RDS/MySQL, DMS, and rds-proxy examples pinned it, so CreateDBInstance failed. Examples only; no module changes.

• chore(ci): scope cloud-nuke cleanup to repo resource types; bump to v0.51.0 (#596).

• chore(ci): bump cloud-nuke cleanup to v0.52.0 (parallel scan/nuke) (#597).

Special thanks to @FriedCircuits for the contribution!

• https://github.com/gruntwork-io/terraform-aws-data-storage/pull/590
• https://github.com/gruntwork-io/terraform-aws-data-storage/pull/596
• https://github.com/gruntwork-io/terraform-aws-data-storage/pull/597
• https://github.com/gruntwork-io/terraform-aws-data-storage/pull/599

terraform-aws-eks

v5.0.0

Published: 7/10/2026 | Modules affected: eks-alb-ingress-controller-iam-policy, eks-alb-ingress-controller, eks-aws-auth-merger, eks-cloudwatch-agent | Release notes

• Scope cloud-nuke cleanup to repo resource types (v0.51.0)
• require AWS provider v6 across all modules (LIB-5235)

v.5.1.0

Published: 7/22/2026 | Modules affected: eks-cluster-control-plane, eks-k8s-karpenter | Release notes

• aded support zonal_shift_config and Karpenter enableZonalShift (#819)

terraform-aws-security

v1.6.0

Published: 7/16/2026 | Modules affected: github-actions-iam-role, gitlab-pipelines-iam-role | Release notes

Updated github-actions-iam-role validation to allow wildcards (*) Added validation to github-actions-iam-role and gitlab-actions-iam-role to verify role is using StringLike when wildcards are present.

v1.5.1

Published: 7/8/2026 | Release notes

• chore: bump cloud-nuke to v0.49.0 by @james00012 in https://github.com/gruntwork-io/terraform-aws-security/pull/914

• chore: run cloud-nuke cleanup across all regions by @james00012 in https://github.com/gruntwork-io/terraform-aws-security/pull/915

• fix: harden cloud-nuke cleanup CI and bump to v0.50.0 by @james00012 in https://github.com/gruntwork-io/terraform-aws-security/pull/916

• fix: drop --exclude-region me-central-1 from cloud-nuke cleanup by @james00012 in https://github.com/gruntwork-io/terraform-aws-security/pull/917

• Scope cloud-nuke cleanup to repo resource types (v0.51.0) by @james00012 in https://github.com/gruntwork-io/terraform-aws-security/pull/918

• Bump cloud-nuke cleanup to v0.52.0 (parallel scan) by @james00012 in https://github.com/gruntwork-io/terraform-aws-security/pull/919

• GitHub Immutable IDs by @x-nightwing in https://github.com/gruntwork-io/terraform-aws-security/pull/921

• @x-nightwing made their first contribution in https://github.com/gruntwork-io/terraform-aws-security/pull/921

Full Changelog: https://github.com/gruntwork-io/terraform-aws-security/compare/v1.5.0...v1.5.1

terraform-aws-vpc

v0.29.0

Published: 7/15/2026 | Modules affected: vpc-interface-endpoint | Release notes

• feat(vpc-interface-endpoint): add Cognito User Pools and Identity Pools VPC endpoints

v0.28.16

Published: 7/2/2026 | Modules affected: transit-gateway | Release notes

• feat(transit-gateway): add encryption_support argument

v0.28.15

Published: 7/2/2026 | Modules affected: vpc-flow-logs | Release notes

• Scope cloud-nuke cleanup to repo resource types (v0.51.0)
• Bump cloud-nuke cleanup to v0.52.0 (parallel scan)
• Bump private-s3-bucket to v1.5.0 in vpc-flow-logs