Skip to main content

Gruntwork release 2026-10

Guides / Update Guides / Releases / 2026-10

This page lists all the updates to the Gruntwork Infrastructure as Code Library that were released in 2026-10. For instructions on how to use these updates in your code, check out the updating documentation.

Here are the repos that were updated:

boilerplate​

v0.17.0​

Published: 10/14/2026 | Release notes

Full Changelog: https://github.com/gruntwork-io/boilerplate/compare/v0.16.0...v0.17.0

pipelines-actions​

v4.16.1​

Published: 10/23/2026 | Release notes

Full Changelog: https://github.com/gruntwork-io/pipelines-actions/compare/v4.16.0...v4.16.1

v4.16.0​

Published: 10/22/2026 | Release notes

v4.15.0​

Published: 10/7/2026 | Release notes

v4.14.0​

Published: 10/5/2026 | Release notes

Full Changelog: https://github.com/gruntwork-io/pipelines-actions/compare/v4.13.0...v4.14.0

v4.13.0​

Published: 10/5/2026 | Release notes

pipelines-cli​

v0.70.0​

Published: 10/22/2026 | Release notes

Details on user-facing changes will be documented in the release notes for:

v0.69.1​

Published: 10/8/2026 | Release notes

Details on user-facing changes will be documented in the release notes for:

v0.69.0​

Published: 10/7/2026 | Release notes

Details on user-facing changes will be documented in the release notes for:

v0.68.1​

Published: 10/5/2026 | Release notes

Details on user-facing changes will be documented in the release notes for:

pipelines-workflows​

v4.32.1​

Published: 10/23/2026 | Release notes

Pipelines now installs mise 2026.10.18, with jdx/mise-action v5.2.2. We recommend upgrading.

Starting in 2026.10.17, mise no longer trusts the eight eMudhra intermediate CA certificates whose private keys were compromised. Anyone holding those keys can issue certificates that older mise versions accept, so we recommend upgrading. See jdx/mise#14781.

Full Changelog: https://github.com/gruntwork-io/pipelines-workflows/compare/v4.32.0...v4.32.1

v4.32.0​

Published: 10/22/2026 | Release notes

What's Changed​

Status comment updates now patch only the current job's section instead of downloading every job's artifacts, which cuts API calls on large runs.

🐛 Retries on rate limits​

Git operations retry on transient failures, including HTTP 429 rate limits.

Full Changelog: https://github.com/gruntwork-io/pipelines-workflows/compare/v4.31.0...v4.32.0

v4.31.0​

Published: 10/15/2026 | Release notes

The default Pipelines CLI version is now v0.69.1, which adds error hooks: hooks that run when a plan or apply fails with an error that matches one of their on_errors patterns.

Each unit in PIPELINES_HOOK_IN_UNITS_JSON_FILE now includes the result, reason, and cause from the Terragrunt run report, and error hooks receive the failed Terragrunt output in PIPELINES_HOOK_IN_ERRORS_FILE. See the Hooks API.

When a Terragrunt run fails, the Pipelines logs and comment now show a short excerpt of the relevant error output.

Full Changelog: https://github.com/gruntwork-io/pipelines-workflows/compare/v4.30.0...v4.31.0

v4.30.0​

Published: 10/6/2026 | Release notes

The Pipelines Hook API now supports writing output to PIPELINES_HOOK_OUT_ERROR_SUMMARY_FILE and PIPELINES_HOOK_OUT_ERROR_COMMENT_FILE, which are read when a hook exits non-zero. If a hook exits non-zero without writing either file, the comment shows the first 500 characters of its stderr.

Added a new feature flag, PIPELINES_FEATURE_EXPERIMENT_COMMIT_AS_TOKEN_OWNER, which changes the commit author to match the owner of the token used to push commits, e.g., when creating drift detection commits.

Orchestrate will now create a warning when a unit matches multiple environment filters, and fail if a unit in multiple environments is being modified.

Cloud authentication has been rewritten to read only the configuration it needs, which speeds up repositories with large Pipelines configurations. This will have a negligible impact on small repositories, but for large repositories that cannot enable TG_NO_DISCOVERY_AUTH_PROVIDER_CMD this will have a significant impact on consolidated plans and applies. We highly recommend enabling TG_NO_DISCOVERY_AUTH_PROVIDER_CMD where possible.

Fixed a bug causing stale artifact caches to be read on persistent runners.

Full Changelog: https://github.com/gruntwork-io/pipelines-workflows/compare/v4.29.0...v4.30.0

terraform-aws-architecture-catalog​

v6.2.3​

Published: 10/22/2026 | Release notes

v6.2.2​

Published: 10/20/2026 | Release notes

Full Changelog: https://github.com/gruntwork-io/terraform-aws-architecture-catalog/compare/v6.2.1...v6.2.2

v6.2.1​

Published: 10/19/2026 | Release notes

v6.2.0​

Published: 10/2/2026 | Release notes

Full Changelog: https://github.com/gruntwork-io/terraform-aws-architecture-catalog/compare/v6.1.6...v6.2.0

terraform-aws-cache​

v2.0.0​

Published: 10/12/2026 | Modules affected: elastic-cache, memcached, redis, redis_copy_snapshot | Release notes

  • Update AWS provider version constraint to support v6
  • feat(elastic-cache): Add Event Notifications for ElastiCache cluster
  • fix(ci): disable mise legacy version file parsing
  • Fix elasticache_user_group engine case deprecation warning
  • feat: add gw: namespaced tagging and scheduled cloud-nuke cleanup
  • feat(ci): optimize CI to run only relevant tests based on PR changes
  • chore: bump cloud-nuke to v0.49.0
  • chore: run cloud-nuke cleanup across all regions
  • fix: harden cloud-nuke cleanup CI and bump to v0.50.0
  • Scope cloud-nuke cleanup to repo resource types (v0.51.0)
  • Bump cloud-nuke cleanup to v0.52.0 (parallel scan)
  • chore: migrate cache terratests to Terratest v2 beta
  • valkey: add auth_token_update_strategy passthrough
  • valkey: create one security group rule per CIDR block

terraform-aws-control-tower​

v2.1.4​

Published: 10/1/2026 | Modules affected: landingzone | Release notes

  • fix: Get organization region by partition
  • fix: Ensure that governed home regions go first

terraform-aws-lambda​

v1.5.0​

Published: 10/25/2026 | Modules affected: keep-warm, lambda-edge, lambda | Release notes

  • Lambda runtime updates (modules/keep-warm, modules/lambda-edge and modules/lambda updated to NodeJs 24)
  • Test stability improvements

terraform-aws-messaging​

v1.1.0​

Published: 10/6/2026 | Modules affected: sns-sqs-connection, amazon-mq, sns, sqs-lambda-connection | Release notes

  • feat: Make queue policy optional in sns-sqs-connection module
  • fix: Disable mise legacy version file parsing in CI
  • feat: Add Amazon MQ module supporting ActiveMQ and RabbitMQ
  • feat: Add configurable egress and data replication mode to Amazon MQ module
  • feat: Add missing AWS features to SNS and SQS modules
  • feat: Run only relevant tests based on changed modules/examples
  • feat: add gw: namespaced tagging and scheduled cloud-nuke cleanup
  • chore: bump cloud-nuke to v0.49.0
  • chore: run cloud-nuke cleanup across all regions
  • fix: harden cloud-nuke cleanup CI and bump to v0.50.0
  • Scope cloud-nuke cleanup to repo resource types (v0.51.0)
  • Bump cloud-nuke cleanup to v0.52.0 (parallel scan)
  • Migrate messaging terratests to Terratest v2 beta

terraform-aws-monitoring​

v1.4.1​

Published: 10/17/2026 | Modules affected: alarms | Release notes

  • Export CloudWatch alarm names and ARNs from alarm modules
  • Test updates

terraform-aws-security​

v1.9.0​

Published: 10/15/2026 | Modules affected: aws-config-bucket, aws-config-multi-region, aws-config, cloudtrail-bucket | Release notes

  • Exposed S3 lifecycle min object size; fix ssh-grunt apt and Ubuntu fail2ban CloudWatch

v1.8.0​

Published: 10/8/2026 | Modules affected: github-actions-iam-role, gitlab-pipelines-iam-role, saml-iam-roles, ssh-grunt | Release notes

  • Migrate security tests to Terratest v2 beta
  • permissions_boundary variable wiring to outer wrapper
  • GitHub actions iam role allow trusting tag pushes

terraform-aws-service-catalog​

v2.21.0​

Published: 10/15/2026 | Modules affected: mgmt | Release notes

  • fixed tailscale-subnet-router-v2: use --flag=value and add extra_routes

v2.20.0​

Published: 10/13/2026 | Modules affected: base, data-stores, landingzone, mgmt | Release notes

  • Upgrade all usage of terraform-aws-security to v1.8.0

v2.19.0​

Published: 10/12/2026 | Modules affected: - services | Release notes

  • services/public-static-website: adds use_cloudfront_standard_logging_v2 to send CloudFront access logs with standard logging (v2), so the access logs bucket trusts the delivery.logs.amazonaws.com service instead of the CloudFront log delivery AWS account, with ACLs disabled. Adds cloudfront_access_logs_output_format to set the log file format. Both default to the current behavior, so existing users see no change. To switch an existing deployment, see the s3-cloudfront README.
  • services/public-static-website: bumps terraform-aws-static-assets to v1.3.0.

v2.18.0​

Published: 10/9/2026 | Release notes

v2.17.0​

Published: 10/5/2026 | Modules affected: services, base, data-stores, mgmt | Release notes

  • fix(eks-workers): unpin terraform-aws-eks from the AL2023 Packer template
  • chore: migrate service-catalog terratests to Terratest v2 beta
  • fix(ci): resolve upgrade test base ref by field name and fail loudly when empty
  • Update terraform-aws-monitoring
  • feat(aurora): expose per-instance monitoring_interval
  • feat(aurora): expose storage_type so clusters can use I/O-Optimized (LIB-5560)
  • Bump aurora to data-storage v1.3.1 and expose Serverless v2 auto pause input
  • fix(vpc): let VPC peering plan on a first apply by sizing routes from subnet tiers
  • Expose database_insights_mode in modules/data-stores/rds

terraform-aws-static-assets​

v1.3.0​

Published: 10/12/2026 | Modules affected: - s3-cloudfront | Release notes

  • s3-cloudfront: add opt-in CloudFront standard logging (v2) with use_cloudfront_standard_logging_v2. The access logs bucket trusts the delivery.logs.amazonaws.com service instead of the CloudFront log delivery account, and ACLs are disabled. access_logs_output_format sets the log file format. Defaults are unchanged. To switch an existing deployment, see the module README.
  • Add the cloudfront-s3-private-standard-logging example.
  • Tag example resources with gw: namespaced tags and clean up test resources on a schedule with cloud-nuke.
  • Migrate tests to Terratest v2 beta.