Skip to content

chore(deps): update dependency terraform-linters/tflint to v0.60.0 (terraform/aws/longhorn/aqua/imports) #6462

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 5 commits into
base: main
Choose a base branch
from
Open

chore(deps): update dependency terraform-linters/tflint to v0.60.0 (terraform/aws/longhorn/aqua/imports) #6462

renovate wants to merge 5 commits into from
+71 −14

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jan 31, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
terraform-linters/tflint minor v0.48.0 → v0.60.0

Release Notes

terraform-linters/tflint (terraform-linters/tflint)

v0.60.0

Compare Source

What's Changed

This release introduces a new configuration file format: .tflint.json. This is useful for workflows such as automatically generating configuration files.
Please note that in order to use the .tflint.json, enabled plugins must be built with SDK v0.23+.

From this release, Cosign signatures (checksums.txt.keyless.sig and checksums.txt.pem) are deprecated. They will not be included in future releases. If your installation scripts depend on them, please migrate to gh attestation verify.

Enhancements
Changes
Bug Fixes
Chores

New Contributors

Full Changelog: terraform-linters/tflint@v0.59.1...v0.60.0

v0.59.1

Compare Source

What's Changed

Enhancements
Bug Fixes
Chores

Full Changelog: terraform-linters/tflint@v0.58.1...v0.59.1

v0.58.1

Compare Source

What's Changed

Bug Fixes
Chores

Full Changelog: terraform-linters/tflint@v0.58.0...v0.58.1

v0.58.0

Compare Source

What's Changed

Enhancements
Bug Fixes
Chores

Full Changelog: terraform-linters/tflint@v0.57.0...v0.58.0

v0.57.0

Compare Source

What's Changed

Enhancements
  • build(deps): Bump github.com/terraform-linters/tflint-ruleset-terraform from 0.11.0 to 0.12.0 by @​dependabot in #​2278
Bug Fixes
  • plugin: Skip keyless verification for private third-party plugins by @​ricardo-kh in #​2292
    • This bug was supposed to have been fixed in v0.55.1, but was not fully fixed so has been fixed again.
Chores

New Contributors

Full Changelog: terraform-linters/tflint@v0.56.0...v0.57.0

v0.56.0

Compare Source

What's Changed

Enhancements
Bug Fixes
Chores

New Contributors

Full Changelog: terraform-linters/tflint@v0.55.1...v0.56.0

v0.55.1

Compare Source

What's Changed

Fixes
Chores

Full Changelog: terraform-linters/tflint@v0.55.0...v0.55.1

v0.55.0

Compare Source

What's Changed

Breaking Changes
  • plugin: Drop support for plugin SDK v0.14/v0.15 by @​wata727 in #​2203
    • Plugins built with SDKs v0.14/v0.15 are no longer supported. If you get "SDK version is incompatible" error, you need to update the plugin to use SDK v0.16+.
Enhancements
Chores

New Contributors

Full Changelog: terraform-linters/tflint@v0.54.0...v0.55.0

v0.54.0

Compare Source

What's Changed

Breaking Changes
Enhancements
Bug Fixes
Chores

New Contributors

Full Changelog: terraform-linters/tflint@v0.53.0...v0.54.0

v0.53.0

Compare Source

What's Changed

Enhancements
  • build(deps): Bump github.com/terraform-linters/tflint-ruleset-terraform from 0.8.0 to 0.9.1 by @​dependabot in #​2093
Bug Fixes
Chores

Full Changelog: terraform-linters/tflint@v0.52.0...v0.53.0

v0.52.0

Compare Source

What's Changed

Enhancements
Bug Fixes
Chores

Full Changelog: terraform-linters/tflint@v0.51.2...v0.52.0

v0.51.2

Compare Source

What's Changed

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot enabled auto-merge (squash) January 31, 2026 09:01
@boxp-tfaction

This comment has been minimized.

Sign in to view
@renovate
Copy link
Contributor Author

renovate bot commented Jan 31, 2026

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@boxp boxp mentioned this pull request Jan 31, 2026
Merged
2 tasks
@boxp @claude
Fix Trivy findings: IAM group-based policy and S3 bucket logging
83e3765 
- AVD-AWS-0143: Move IAM policy from inline user policy to managed policy
  attached via IAM group (aws_iam_group_policy_attachment)
- s3-bucket-logging: Add dedicated log bucket (boxp-longhorn-backup-logs)
  with SSE encryption and public access block, enable access logging on
  the main backup bucket

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@boxp-tfaction

This comment has been minimized.

Sign in to view
@boxp-tfaction

This comment has been minimized.

Sign in to view
@boxp-tfaction

This comment has been minimized.

Sign in to view
@boxp-tfaction

This comment has been minimized.

Sign in to view
@boxp @claude
Fix remaining Trivy findings: versioning on logs bucket, MFA ignore
8480327 
- AVD-AWS-0090: Add versioning to the logs bucket
- aws-iam-enforce-mfa: Add trivy:ignore for system user group (MFA
  is not applicable to programmatic-only access key users)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@boxp-tfaction
Copy link
Contributor

boxp-tfaction bot commented Jan 31, 2026

Plan Result (terraform/aws/longhorn)

CI link

⚠️ Resource Deletion will happen

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 9 to add, 0 to change, 1 to destroy.
  • Create
    • aws_iam_group.longhorn_backup
    • aws_iam_group_membership.longhorn_backup
    • aws_iam_group_policy_attachment.longhorn_backup
    • aws_iam_policy.longhorn_backup
    • aws_s3_bucket.longhorn_backup_logs
    • aws_s3_bucket_logging.longhorn_backup
    • aws_s3_bucket_public_access_block.longhorn_backup_logs
    • aws_s3_bucket_server_side_encryption_configuration.longhorn_backup_logs
    • aws_s3_bucket_versioning.longhorn_backup_logs
  • Delete
    • aws_iam_user_policy.longhorn_backup
Change Result (Click me) 
  # aws_iam_group.longhorn_backup will be created
  + resource "aws_iam_group" "longhorn_backup" {
      + arn       = (known after apply)
      + id        = (known after apply)
      + name      = "longhorn-backup-group"
      + path      = "/system/"
      + unique_id = (known after apply)
    }

  # aws_iam_group_membership.longhorn_backup will be created
  + resource "aws_iam_group_membership" "longhorn_backup" {
      + group = "longhorn-backup-group"
      + id    = (known after apply)
      + name  = "longhorn-backup-membership"
      + users = [
          + "longhorn-backup-user",
        ]
    }

  # aws_iam_group_policy_attachment.longhorn_backup will be created
  + resource "aws_iam_group_policy_attachment" "longhorn_backup" {
      + group      = "longhorn-backup-group"
      + id         = (known after apply)
      + policy_arn = (known after apply)
    }

  # aws_iam_policy.longhorn_backup will be created
  + resource "aws_iam_policy" "longhorn_backup" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + id               = (known after apply)
      + name             = "longhorn-backup-policy"
      + name_prefix      = (known after apply)
      + path             = "/"
      + policy           = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "s3:ListBucket",
                          + "s3:GetBucketLocation",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:s3:::boxp-longhorn-backup"
                    },
                  + {
                      + Action   = [
                          + "s3:GetObject",
                          + "s3:PutObject",
                          + "s3:DeleteObject",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:s3:::boxp-longhorn-backup/*"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id        = (known after apply)
      + tags_all         = (known after apply)
    }

  # aws_iam_user_policy.longhorn_backup will be destroyed
  # (because aws_iam_user_policy.longhorn_backup is not in configuration)
  - resource "aws_iam_user_policy" "longhorn_backup" {
      - id          = "longhorn-backup-user:longhorn-backup-policy" -> null
      - name        = "longhorn-backup-policy" -> null
      - policy      = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "s3:ListBucket",
                          - "s3:GetBucketLocation",
                        ]
                      - Effect   = "Allow"
                      - Resource = "arn:aws:s3:::boxp-longhorn-backup"
                    },
                  - {
                      - Action   = [
                          - "s3:GetObject",
                          - "s3:PutObject",
                          - "s3:DeleteObject",
                        ]
                      - Effect   = "Allow"
                      - Resource = "arn:aws:s3:::boxp-longhorn-backup/*"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - user        = "longhorn-backup-user" -> null
        # (1 unchanged attribute hidden)
    }

  # aws_s3_bucket.longhorn_backup_logs will be created
  + resource "aws_s3_bucket" "longhorn_backup_logs" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "boxp-longhorn-backup-logs"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_region               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = "ap-northeast-1"
      + request_payer               = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # aws_s3_bucket_logging.longhorn_backup will be created
  + resource "aws_s3_bucket_logging" "longhorn_backup" {
      + bucket        = "boxp-longhorn-backup"
      + id            = (known after apply)
      + region        = "ap-northeast-1"
      + target_bucket = (known after apply)
      + target_prefix = "access-logs/"
    }

  # aws_s3_bucket_public_access_block.longhorn_backup_logs will be created
  + resource "aws_s3_bucket_public_access_block" "longhorn_backup_logs" {
      + block_public_acls       = true
      + block_public_policy     = true
      + bucket                  = (known after apply)
      + id                      = (known after apply)
      + ignore_public_acls      = true
      + region                  = "ap-northeast-1"
      + restrict_public_buckets = true
    }

  # aws_s3_bucket_server_side_encryption_configuration.longhorn_backup_logs will be created
  + resource "aws_s3_bucket_server_side_encryption_configuration" "longhorn_backup_logs" {
      + bucket = (known after apply)
      + id     = (known after apply)
      + region = "ap-northeast-1"

      + rule {
          + blocked_encryption_types = []

          + apply_server_side_encryption_by_default {
              + sse_algorithm     = "AES256"
                # (1 unchanged attribute hidden)
            }
        }
    }

  # aws_s3_bucket_versioning.longhorn_backup_logs will be created
  + resource "aws_s3_bucket_versioning" "longhorn_backup_logs" {
      + bucket = (known after apply)
      + id     = (known after apply)
      + region = "ap-northeast-1"

      + versioning_configuration {
          + mfa_delete = (known after apply)
          + status     = "Enabled"
        }
    }

Plan: 9 to add, 0 to change, 1 to destroy.

@boxp-tfaction
Copy link
Contributor

boxp-tfaction bot commented Jan 31, 2026

❌ terraform/aws/longhorn: Renovate's PR must be No change

Build link

In the pull request created by Renovate, the result of terraform plan must be No change to enable automerge safely.
If you allow changes, please set the pull request label renovate-change and rerun CI.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

datasource:github-releases renovate:terraform-linters/tflint/v0.60.0 renovate:terraform-linters/tflint renovate-change terraform/aws/longhorn/destroy terraform/aws/longhorn

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@boxp