Terraform AWS Provider v6.69.0: New List Resources, CloudWatch Alarm Evaluation Windows, and RDS Public Access Control

Introduction

HashiCorp shipped terraform-provider-aws v6.69.0 on October 14, 2026. The release is feature-heavy: six new list resources, five brand-new managed resources (CloudWatchOmni, DevOps Agent Space, Pricing Plan Manager), and a batch of enhancements and bug fixes that affect CloudWatch alarms, RDS clusters, OpenSearch domains, and WAFv2 rule groups. No breaking changes or deprecations are called out in the changelog for this release. This article walks through the changes that matter for day-to-day HCL authoring and for running Terraform in production.

What Is New

New list resources

Six resources now support Terraform's list-resource query workflow (used with .tfquery.hcl files and terraform query):

• aws_cloudwatchomni_domain (#50329)
• aws_cloudwatchomni_space (#50385)
• aws_devopsagent_agent_space (#47795)
• aws_pricingplanmanager_subscription (#49235)
• aws_ram_principal_association (#50427)
• aws_ssm_service_setting (#50359)

Example query file to list existing RAM principal associations before importing them:

# list.tfquery.hcl
list "aws_ram_principal_association" "existing" {
  provider = aws
 
  config {
    region = "us-east-1"
  }
}

terraform query -config=list.tfquery.hcl

New managed resources

• aws_cloudwatch_resource_metrics_configuration (#50254)
• aws_cloudwatchomni_domain / aws_cloudwatchomni_space (#50329, #50385)
• aws_devopsagent_agent_space (#47795)
• aws_pricingplanmanager_subscription (#49235)

CloudWatch metric alarm: wall-clock evaluation windows

aws_cloudwatch_metric_alarm gains evaluation_window for wall-clock based evaluation periods (#50373):

resource "aws_cloudwatch_metric_alarm" "high_cpu" {
  alarm_name          = "high-cpu-wall-clock"
  comparison_operator = "GreaterThanThreshold"
  evaluation_window   = "ROLLING"
  metric_name         = "CPUUtilization"
  namespace           = "AWS/EC2"
  period              = 300
  statistic           = "Average"
  threshold           = 80
}

RDS cluster: control public accessibility

aws_rds_cluster now exposes publicly_accessible directly (#50354):

resource "aws_rds_cluster" "this" {
  cluster_identifier   = "app-cluster"
  engine               = "aurora-postgresql"
  publicly_accessible  = false
}

WAFv2: monetize action and monetization config

Both aws_wafv2_rule_group and aws_wafv2_web_acl add a monetize rule action plus a monetization_config block (#48419):

resource "aws_wafv2_web_acl" "api" {
  name  = "api-acl"
  scope = "REGIONAL"
 
  default_action {
    allow {}
  }
 
  rule {
    name     = "monetize-bots"
    priority = 1
 
    action {
      monetize {}
    }
 
    monetization_config {
      # see provider docs for required sub-arguments
    }
 
    statement {
      # match statement omitted for brevity
    }
 
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "monetize-bots"
      sampled_requests_enabled   = true
    }
  }
 
  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "api-acl"
    sampled_requests_enabled   = true
  }
}

Resource identity support

aws_ram_principal_association and aws_ssm_service_setting now support Terraform resource identity (#50427, #50359), improving import and drift-detection reliability for these resources.

Notable bug fixes

• aws_opensearch_domain: default timeouts.delete raised to 120m, and the hardcoded enum validation on cluster_config.warm_type is removed so newer instance types such as oi2.large.search are accepted (#46969).
• aws_ec2_transit_gateway_peering_attachment: no longer forces replacement when the DescribeTransitGatewayPeeringAttachments API returns a present-but-empty Options object (#50405).
• aws_ecs_cluster_capacity_providers: fixed delete handling for inactive clusters (#50374).
• aws_api_gateway_method: fixed a deserialization failed, expected string, got null error on Read (#50444).
• aws_observabilityadmin_telemetry_rule: fixed updates when all_regions is enabled (#50150).
• aws_agentregistry_registry: fixed validation of custom_claim-only custom JWT authorizers (#50298).

Upgrade Steps

Pin the provider in required_providers and refresh the lock file:

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.69.0"
    }
  }
}

terraform init -upgrade

If the Opensearch timeouts.delete default change or any evaluation_window/publicly_accessible additions could affect existing resources, run a plan before applying:

terraform plan

Verify

Confirm the provider version and that the plan is clean (or shows only the intended changes):

terraform version
terraform providers
terraform plan -no-color | grep "aws"

For new list resources, confirm the query workflow runs against your AWS account:

terraform query -config=list.tfquery.hcl

Conclusion

v6.69.0 is a routine but substantial update: six new list resources extend Terraform's query-based discovery to RAM, SSM, CloudWatchOmni, Pricing Plan Manager, and DevOps Agent services, while CloudWatch, RDS, OpenSearch, and WAFv2 users get targeted new arguments and bug fixes. The release notes do not flag any breaking changes or deprecations, so upgrading with terraform init -upgrade and a standard terraform plan review should be low-risk for most configurations. Full details are on the release page.