AWS Provider v6.0: What's Breaking and How to Prepare

# These are dead in v6.0
resource "aws_opsworks_stack" "legacy" {
  name = "my-stack"  # RIP
}
 
resource "aws_opsworks_instance" "web" {
  stack_id = aws_opsworks_stack.legacy.id  # Won't work
}

# Old way (v5.x) - worked but was sloppy
resource "aws_launch_template" "old_habits" {
  block_device_mappings {
    ebs {
      delete_on_termination = "1"  # Nope
      encrypted = "0"              # Also nope
    }
  }
}
 
# New way (v6.0) - what you should've done anyway
resource "aws_launch_template" "clean_code" {
  block_device_mappings {
    ebs {
      delete_on_termination = true
      encrypted = false
    }
  }
}

# Before
resource "aws_eip" "old" {
  vpc = true  # Dead parameter
}
 
# After
resource "aws_eip" "new" {
  domain = "vpc"
}

# Find the zombies (deprecated resources)
grep -r "aws_opsworks_\|aws_simpledb_\|aws_worklink_" . --include="*.tf"
 
# Hunt down lazy boolean usage
grep -r '"[01]"' . --include="*.tf" | \
  grep -E "delete_on_termination|encrypted|ebs_optimized"
 
# Check your provider constraints
grep -r "version.*=" . --include="*.tf" | grep aws

# .tflint.hcl
plugin "aws" {
  enabled = true
  version = "0.39.0"
  source = "github.com/terraform-linters/tflint-ruleset-aws"
}
 
rule "terraform_deprecated_lookup" {
  enabled = true
}

DATE=$(date +%Y%m%d_%H%M%S)
mkdir -p state-backups/${DATE}
terraform state pull > state-backups/${DATE}/terraform.tfstate.backup
cp .terraform.lock.hcl state-backups/${DATE}/

func TestV6Compatibility(t *testing.T) {
    terraformOptions := terraform.WithDefaultRetryableErrors(t, &terraform.Options{
        TerraformDir: "../infrastructure",
        Vars: map[string]interface{}{
            "test_mode": true,
        },
    })
 
    defer terraform.Destroy(t, terraformOptions)
    
    // Apply with current provider
    terraform.InitAndApply(t, terraformOptions)
    
    // Verify plan shows no changes
    planOutput := terraform.Plan(t, terraformOptions)
    assert.Contains(t, planOutput, "No changes")
}

name: Provider v6 Compatibility
on: 
  pull_request:
    paths:
      - '**.tf'
      - '.terraform.lock.hcl'
 
jobs:
  validate-v6:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.9.0
      
      - name: Test v6 compatibility
        run: |
          terraform init -upgrade
          terraform validate
          tflint --recursive --format=compact

# modules/networking/versions.tf
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0.0-beta2"  # Start with beta
    }
  }
}

# environments/production/versions.tf
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "= 6.0.0"  # Exact pin for prod
    }
  }
}

provider "aws" {
  region = "us-east-1"
}
 
# Default region resource
resource "aws_s3_bucket" "main" {
  bucket = "my-main-bucket"
}
 
# Override region inline
resource "aws_s3_bucket" "backup" {
  bucket = "my-backup-bucket"
  region = "eu-west-1"  # Just works now
}
 
# Cross-region replication without aliases
resource "aws_s3_bucket_replication_configuration" "cross_region" {
  bucket = aws_s3_bucket.main.id
  role   = aws_iam_role.replication.arn # Required: IAM role S3 assumes to replicate
 
  rule {
    id     = "backup"
    status = "Enabled"
    
    destination {
      bucket = aws_s3_bucket.backup.arn
      # No provider alias needed!
    }
  }
}

# 1. Revert provider version in versions.tf
# 2. Clean the provider cache
rm -rf .terraform/
rm .terraform.lock.hcl
 
# 3. Reinitialize
terraform init
 
# 4. If state is corrupted
terraform state push state-backups/[timestamp]/terraform.tfstate.backup

# Remove problematic resource
terraform state rm aws_instance.borked
 
# Re-import with old provider
terraform import aws_instance.borked i-1234567890abcdef0