ENHANCEMENTS:

• terraform plan and terraform apply will now warn when the -target option is used, to draw attention to the fact that the result of applying the plan is likely to be incomplete, and to remind to re-run terraform plan with no targets afterwards to ensure that the configuration has converged. (#22783)
• config: New function parseint for parsing strings containing digits as integers in various bases. (#22747)
• config: New function cidrsubnets, which is a companion to the existing function cidrsubnet which can allocate multiple consecutive subnet prefixes (possibly of different prefix lengths) in a single call. (#22858)
• backend/google: The GCS backend now supports OAuth2 token authentication. (#21772)
• provisioner/habitat: Multiple updates and fixes, see PR for details (#22705)

BUG FIXES:

• backend/manta: fix panic when insecure_skip_tls_verify was not set (#22918)

NOTES:

• core: ignore_changes is now processed (in addition to existing behaviors) before the provider plan is run. This means that users may see fewer planned changes when using ignore_changes, as before this change, changes to ignored attributes were still being sent to CustomizeDiff in providers (which could mean cascading changes for some resources). This should be indicative that providers are no longer getting changes that were marked as ignored, but if unexpected plans are seen while using ignore_changes, investigate the settings in the ignore_changes block to ensure the appropriate attributes are set. (#22520)

ENHANCEMENTS:

• provisioners/habitat: accept_license argument available to automate accepting the EULA, now required by this client (#22745)
• config: add source addressing to unknown value errors in for_each (#22760)

BUG FIXES:

• command/console: support -var and -var-file flags (#22145)
• command/show: Fixed bug with wrong errors being returned or swallowed. (#22772)
• config: The cidrhost, cidrsubnet, and cidrnetmask functions now behave correctly with IPv6 prefixes that are short enough for the host portion to be greater than 64-bit or 32-bit (depending on the target architecture). (#22505)
• config: Fixed bug on empty sets with for_each (#22281)

0.12.8 (September 04, 2019)

NEW FEATURES:

• lang/funcs: New fileset function, for finding static local files that match a glob pattern. (#22523)

ENHANCEMENTS:

• remote-state/pg: add option to skip schema creation (#21607)

BUG FIXES:

• command/console: use user-supplied -plugin-dir (#22616)
• config: ensure sets are appropriately known for for_each (#22597)

0.12.7 (August 22, 2019)

NEW FEATURES:

• New functions regex and regexall allow applying a regular expression pattern to a string and retrieving any matching substring(s) (#22353)

ENHANCEMENTS:

• lang/funcs: lookup() can work with maps of lists, maps and objects (#22269)
• SDK: helper/acctest: Add function to return random IP address (#22312)
• SDK: httpclient: Introduce composable UserAgent(version) (#22272)
• connection/ssh: Support certificate authentication (#22156)

BUG FIXES:

• config: reduce MinIems and MaxItems validation during decoding, to allow for use of dynamic blocks (#22530)
• config: don't validate MinItems and MaxItems in CoerceValue, allowing providers to set incomplete values (#22478)
• config: fix panic on tuples with for_each (#22279)
• config: fix references to each of for_each in provisioners (#22289)
• config: fix panic when using nested dynamic blocks (#22314)
• config: ensure consistent evaluation when moving between single resources and for_each in addressing (#22454)
• core: only start a single instance of each required provisioner (#22553)
• command: fix issue where commands occasionally exited before the error message printed (#22373)
• command/0.12upgrade: use user-supplied plugin-dir (#22306)
• command/hook_ui: Truncate the ID considering multibyte characters (#18823)
• command/fmt: Terraform fmt no longer inserts spaces after % (#22356)
• command/state: Allow moving resources to modules not yet in state (#22299)
• backend/google: Now using the OAuth2 token endpoint on googleapis.com instead of google.com. These endpoints are equivalent in functionality but googleapis.com hosts are resolvable from private Google Cloud Platform VPCs where other connectivity is restricted. (#22451)

NOTES:

• backend/s3: After this update, the AWS Go SDK will prefer credentials found via the AWS_PROFILE environment variable when both the AWS_PROFILE environment variable and the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables are statically defined. Previously the SDK would ignore the AWS_PROFILE environment variable, if static environment credentials were also specified. This is listed as a bug fix in the AWS Go SDK release notes. (#22253)

NEW FEATURES:

• backend/oss: added support for assume role config (#22186)
• config: Resources can now use a for_each meta-argument (#17179)

ENHANCEMENTS:

• backend/s3: Add support for assuming role via web identity token via the AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN environment variables (#22253)
• backend/s3: Support automatic region validation for me-south-1. For AWS operations to work in the new region, the region must be explicitly enabled as outlined in the AWS Documentation (#22253)
• connection/ssh: Improve connection debug messages (#22097)

BUG FIXES:

• backend/remote: remove misleading contents from error message (#22148)
• backend/s3: Load credentials via the AWS_PROFILE environment variable (if available) when AWS_PROFILE is defined along with AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (#22253)
• config: Improve conditionals to returns the correct type when dynamic values are present but unevaluated (#22137)
• config: Fix panic when mistakingly using dynamic on an attribute (#22169)
• cli: Fix crash with reset connection during init (#22146)
• cli: show all deposed instances and prevent crash in show command (#22149)
• configs/configupgrade: Fix crash with nil hilNode (#22181)
• command/fmt: now formats correctly in presence of here-docs (#21434)
• helper/schema: don't skip deprecation check during validation when attribute value is unknown (#22262)
• plugin/sdk: allow MinItems > 1 when dynamic blocks (#22221)
• plugin/sdk: fix reflect panics in helper/schema validation (#22236)

ENHANCEMENTS:

• command/format: No longer show no-ops in terraform show, since nothing will change (#21907)
• backend/s3: Support for assuming role using credential process from the shared AWS configuration file (support profile containing both credential_process and role_arn configurations) (#21908)
• connection/ssh: Abort ssh connections when the server is no longer responding (#22037)
• connection/ssh: Support ssh diffie-hellman-group-exchange-sha256 key exchange (#22037)

BUG FIXES:

• backend/remote: fix conflict with normalized config dir and vcs root working directory (#22096)
• backend/remote: be transparent about what filesystem prefix Terraform is uploading to the remote system, and why it's doing that (#22121)
• configs: Ensure diagnostics are properly recorded from nested modules (#22098)
• core: Prevent inconsistent final plan error when using dynamic in a set-type block (#22057)
• lang/funcs: Allow null values in compact function (#22044)

NEW FEATURES:

• lang/funcs: new abspath function returns the absolute path to a given file (#21409)
• backend/swift: support for user configured state object names in swift containers (#17465)

BUG FIXES:

• core: Prevent crash when a resource has no current valid instance (#21979)
• plugin/sdk: Prevent empty strings from being replaced with default values (#21806)
• plugin/sdk: Ensure resource timeouts are not lost when there is an empty plan (#21814)
• plugin/sdk: Don't add null elements to diagnostic paths when validating config (#21884)
• lang/funcs: Add missing map of bool support for lookup (#21863)
• config: Fix issue with downloading BitBucket modules from deprecated V1 API by updating go-getter dependency (#21948)
• config: Fix conditionals to evaluate to the correct type when using null (#21957)

ENHANCEMENTS:

• config: add GCS source support for modules (#21254)
• command/format: Reduce extra whitespaces & new lines (#21334)
• backend/s3: Support for chaining assume IAM role from AWS shared configuration files (#21815)

BUG FIXES:

• configs: Can now use references like tags["foo"] in ignore_changes to ignore in-place updates to specific keys in a map (#21788)
• configs: Fix panic on missing value for version attribute in provider blocks. (#21825)
• lang/funcs: Fix merge panic on null values. Now will give an error if null used (#21695)
• backend/remote: Fix "Conflict" error if the first state snapshot written after a Terraform CLI upgrade has the same content as the prior state. (#21811)
• backend/s3: Fix AWS shared configuration file credential source not assuming a role with environment and ECS credentials (#21815)

NEW FEATURES:

• provisioners: new provisioner: puppet (#18851)
• range function for generating a sequence of numbers as a list (#21461)
• yamldecode and experimental yamlencode functions for working with YAML-serialized data (#21459)
• uuidv5 function for generating name-based (as opposed to pseudorandom) UUIDs (#21244)
• backend/oss: Add support for Alibaba OSS remote state (#16927)

ENHANCEMENTS:

• config: consider build metadata when interpreting module versions (#21640)
• backend/http: implement retries for the http backend (#19702)
• backend/swift: authentication mechanisms now more consistent with other OpenStack-compatible tools (#18671)
• backend/swift: add application credential support (#20914)

BUG FIXES:

• command/show: use the state snapshot included in the planfile when rendering a plan to json (#21597)
• config: Fix issue with empty dynamic blocks failing when usign ConfigModeAttr (#21549)
• core: Re-validate resource config during final plan (#21555)
• core: Fix missing resource timeouts during destroy (#21611)
• core: Don't panic when encountering an invalid depends_on (#21590)
• backend: Fix panic when upgrading from a state with a hash value greater than MaxInt (#21484)

BUG FIXES:

• core: Always try to select a workspace after initialization (#21234)
• command/show: fix inconsistent json output causing a panic [#21541]
• config: distinct function no longer panics when given an empty list (#21538)
• config: Don't panic when a version constraint is added to a module that was previously initialized without one (#21542)
• config: matchkeys function argument type checking will no longer fail incorrectly during validation (#21576)
• backend/local: Don't panic if an instance in the state only has deposed instances, and no current instance (#21575)