chore: bump hashicorp/aws from 6.63.0 to 6.66.0 in /terraform/modules/aws-control-plane

[dependabot]

Bumps hashicorp/aws from 6.63.0 to 6.66.0.

Release notes

Sourced from hashicorp/aws's releases.

v6.66.0

6.66.0 (September 21, 2026)

NOTES:

• resource/aws_iam_openid_connect_provider: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#50024)

FEATURES:

• New List Resource: aws_efs_mount_target (#50057)
• New List Resource: aws_iam_openid_connect_provider (#50024)
• New Resource: aws_msk_channel (#49266)

ENHANCEMENTS:

• data-source/aws_ecs_service: Add target_type and timeout_configuration attributes to the lifecycle_hook block. (#48128)
• resource/aws_bedrockagentcore_api_key_credential_provider: Add Resource Identity support (#48629)
• resource/aws_bedrockagentcore_api_key_credential_provider: Add api_key_secret_source argument and api_key_secret_config configuration block to support customer-managed AWS Secrets Manager secrets (#48629)
• resource/aws_ecs_service: Add target_type and timeout_configuration arguments to the lifecycle_hook configuration block to support ECS PAUSE deployment hooks. hook_target_arn and role_arn are now Optional (still required for AWS_LAMBDA hooks). (#48128)
• resource/aws_efs_access_point: Add Resource Identity support (#50026)
• resource/aws_efs_backup_policy: Add Resource Identity support (#50026)
• resource/aws_efs_file_system: Add Resource Identity support (#50026)
• resource/aws_efs_file_system_policy: Add Resource Identity support (#50026)
• resource/aws_efs_mount_target: Add Resource Identity support (#50026)
• resource/aws_efs_replication_configuration: Add Resource Identity support (#50026)

BUG FIXES:

• list-resource/aws_rds_cluster_instance: Cache cluster using the DBClusterIdentifier as the key (#50040)
• resource/aws_pipes_pipe: Fix source_parameters.self_managed_kafka_parameters.server_root_ca_certificate being sent to the API as an empty string instead of being omitted, which caused UpdatePipe to fail with a ValidationException when the attribute was unset (#40116)
• resource/aws_redshiftserverless_workgroup: Filter server-only config_parameter entries from state and allow newly returned config parameter keys without a provider update (#49939)

v6.65.0

6.65.0 (September 16, 2026)

NOTES:

• resource/aws_dx_bgp_peer: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#49590)
• resource/aws_dx_hosted_private_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#49591)
• resource/aws_dx_hosted_public_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#49591)
• resource/aws_dx_hosted_transit_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#49591)
• resource/aws_dx_public_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#49589)

FEATURES:

• New List Resource: aws_api_gateway_deployment (#49820)
• New List Resource: aws_apigatewayv2_integration (#48425)
• New List Resource: aws_dms_migration_project (#49936)
• New List Resource: aws_ec2_transit_gateway_policy_table_entry (#49256)
• New List Resource: aws_glue_catalog_table (#49953)

... (truncated)

Changelog

Sourced from hashicorp/aws's changelog.

6.66.0 (September 21, 2026)

NOTES:

• resource/aws_iam_openid_connect_provider: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#50024)

FEATURES:

• New List Resource: aws_efs_mount_target (#50057)
• New List Resource: aws_iam_openid_connect_provider (#50024)
• New Resource: aws_msk_channel (#49266)

ENHANCEMENTS:

• data-source/aws_ecs_service: Add target_type and timeout_configuration attributes to the lifecycle_hook block. (#48128)
• resource/aws_bedrockagentcore_api_key_credential_provider: Add Resource Identity support (#48629)
• resource/aws_bedrockagentcore_api_key_credential_provider: Add api_key_secret_source argument and api_key_secret_config configuration block to support customer-managed AWS Secrets Manager secrets (#48629)
• resource/aws_ecs_service: Add target_type and timeout_configuration arguments to the lifecycle_hook configuration block to support ECS PAUSE deployment hooks. hook_target_arn and role_arn are now Optional (still required for AWS_LAMBDA hooks). (#48128)
• resource/aws_efs_access_point: Add Resource Identity support (#50026)
• resource/aws_efs_backup_policy: Add Resource Identity support (#50026)
• resource/aws_efs_file_system: Add Resource Identity support (#50026)
• resource/aws_efs_file_system_policy: Add Resource Identity support (#50026)
• resource/aws_efs_mount_target: Add Resource Identity support (#50026)
• resource/aws_efs_replication_configuration: Add Resource Identity support (#50026)

BUG FIXES:

• list-resource/aws_rds_cluster_instance: Cache cluster using the DBClusterIdentifier as the key (#50040)
• resource/aws_pipes_pipe: Fix source_parameters.self_managed_kafka_parameters.server_root_ca_certificate being sent to the API as an empty string instead of being omitted, which caused UpdatePipe to fail with a ValidationException when the attribute was unset (#40116)
• resource/aws_redshiftserverless_workgroup: Filter server-only config_parameter entries from state and allow newly returned config parameter keys without a provider update (#49939)

6.65.0 (September 16, 2026)

NOTES:

• resource/aws_dx_bgp_peer: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#49590)
• resource/aws_dx_hosted_private_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#49591)
• resource/aws_dx_hosted_public_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#49591)
• resource/aws_dx_hosted_transit_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#49591)
• resource/aws_dx_public_virtual_interface: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#49589)

FEATURES:

• New List Resource: aws_api_gateway_deployment (#49820)
• New List Resource: aws_apigatewayv2_integration (#48425)
• New List Resource: aws_dms_migration_project (#49936)
• New List Resource: aws_ec2_transit_gateway_policy_table_entry (#49256)
• New List Resource: aws_glue_catalog_table (#49953)
• New List Resource: aws_iam_group (#49994)
• New List Resource: aws_iam_user_policy (#49993)

... (truncated)

Commits

• 351a07f Update CHANGELOG.md for #50092
• edae85c Merge pull request #50092 from hashicorp/t-update-changelog-version
• 295d1ec release: version
• bd7724b release: changelog
• 3f43e0f Merge pull request #49986 from harini237/fix/redshiftserverless-config-parame...
• c1dacda r/aws_redshiftserverless_workgroup: semgrep findings
• a74c36c Corrects attribute to check for import
• 9412206 Merge pull request #50047 from hashicorp/td-generate-service-package-formatting
• 37184e5 Merge pull request #50029 from hashicorp/b-generate-tagtests-opt-in
• 2572793 Adds tests for partially populating config_parameter and using invalid key
• Additional commits viewable in compare view

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅
Tests	✅
Modal module tests	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @dependabot[bot], Action: pull_request

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 7144efea-a2bb-4061-8b46-0a0dc3c0cf29

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅
Tests	✅
Modal module tests	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @dependabot[bot], Action: pull_request