build(deps): bump the terraform-dependencies group in /infra with 2 updates

[dependabot]

Bumps the terraform-dependencies group in /infra with 2 updates: cloudflare/cloudflare and hashicorp/aws.

Updates cloudflare/cloudflare from 4.51.0 to 5.16.0

Release notes

Sourced from cloudflare/cloudflare's releases.

v5.16.0

5.16.0 (2026-01-20)

Full Changelog: v5.15.0...v5.16.0

Features

• custom_pages: add "waf_challenge" as new supported error page type identifier in both resource and data source schemas
• list: enhance CIDR validator to check for normalized CIDR notation requiring network address for IPv4 and IPv6
• magic_wan_gre_tunnel: add automatic_return_routing attribute for automatic routing control
• magic_wan_gre_tunnel: add BGP configuration support with new BGP model attribute
• magic_wan_gre_tunnel: add bgp_status computed attribute for BGP connection status information
• magic_wan_gre_tunnel: enhance schema with BGP-related attributes and validators
• magic_wan_ipsec_tunnel: add automatic_return_routing attribute for automatic routing control
• magic_wan_ipsec_tunnel: add BGP configuration support with new BGP model attribute
• magic_wan_ipsec_tunnel: add bgp_status computed attribute for BGP connection status information
• magic_wan_ipsec_tunnel: add custom_remote_identities attribute for custom identity configuration
• magic_wan_ipsec_tunnel: enhance schema with BGP and identity-related attributes
• ruleset: add request body buffering support
• ruleset: enhance ruleset data source with additional configuration options
• workers_script: add observability logs attributes to list data source model
• workers_script: enhance list data source schema with additional configuration options

Bug Fixes

• dns_record: remove unnecessary fmt.Sprintf wrapper around LoadTestCase call in test configuration helper function
• load_balancer: fix session_affinity_ttl type expectations to match Float64 in initial creation and Int64 after migration
• workers_kv: handle special characters correctly in URL encoding

Documentation

• account_subscription: update schema description for rate_plan.sets attribute to clarify it returns an array of strings
• api_shield: add resource-level description for API Shield management of auth ID characteristics
• api_shield: enhance auth_id_characteristics.name attribute description to include JWT token configuration format requirements
• api_shield: specify JSONPath expression format for JWT claim locations
• hyperdrive_config: add description attribute to name attribute explaining its purpose in dashboard and API identification
• hyperdrive_config: apply description improvements across resource, data source, and list data source schemas
• hyperdrive_config: improve schema descriptions for cache settings to clarify default values
• hyperdrive_config: update port description to clarify defaults for different database types

v5.15.0

5.15.0 (2025-12-19)

Full Changelog: v5.14.0...v5.15.0

Features

• ai_search: add AI Search endpoints (6f02adb)
• certificate_pack: add terraform config for CRUD support. This ensures proper Terraform resource ID handling for path parameters in API calls. (081f32a)
• leaked_credentials_check: Add GET endpoint for leaked_credentials_check/detections (feafd9c)

... (truncated)

Changelog

Sourced from cloudflare/cloudflare's changelog.

5.16.0 (2026-01-20)

Full Changelog: v5.15.0...v5.16.0

Features

• custom_pages: add "waf_challenge" as new supported error page type identifier in both resource and data source schemas
• list: enhance CIDR validator to check for normalized CIDR notation requiring network address for IPv4 and IPv6
• magic_wan_gre_tunnel: add automatic_return_routing attribute for automatic routing control
• magic_wan_gre_tunnel: add BGP configuration support with new BGP model attribute
• magic_wan_gre_tunnel: add bgp_status computed attribute for BGP connection status information
• magic_wan_gre_tunnel: enhance schema with BGP-related attributes and validators
• magic_wan_ipsec_tunnel: add automatic_return_routing attribute for automatic routing control
• magic_wan_ipsec_tunnel: add BGP configuration support with new BGP model attribute
• magic_wan_ipsec_tunnel: add bgp_status computed attribute for BGP connection status information
• magic_wan_ipsec_tunnel: add custom_remote_identities attribute for custom identity configuration
• magic_wan_ipsec_tunnel: enhance schema with BGP and identity-related attributes
• ruleset: add request body buffering support
• ruleset: enhance ruleset data source with additional configuration options
• workers_script: add observability logs attributes to list data source model
• workers_script: enhance list data source schema with additional configuration options

Bug Fixes

• dns_record: remove unnecessary fmt.Sprintf wrapper around LoadTestCase call in test configuration helper function
• load_balancer: fix session_affinity_ttl type expectations to match Float64 in initial creation and Int64 after migration
• workers_kv: handle special characters correctly in URL encoding

Documentation

• account_subscription: update schema description for rate_plan.sets attribute to clarify it returns an array of strings
• api_shield: add resource-level description for API Shield management of auth ID characteristics
• api_shield: enhance auth_id_characteristics.name attribute description to include JWT token configuration format requirements
• api_shield: specify JSONPath expression format for JWT claim locations
• hyperdrive_config: add description attribute to name attribute explaining its purpose in dashboard and API identification
• hyperdrive_config: apply description improvements across resource, data source, and list data source schemas
• hyperdrive_config: improve schema descriptions for cache settings to clarify default values
• hyperdrive_config: update port description to clarify defaults for different database types

5.15.0 (2025-12-19)

Full Changelog: v5.14.0...v5.15.0

Features

• ai_search: add AI Search endpoints (6f02adb)
• certificate_pack: add terraform config for CRUD support. This ensures proper Terraform resource ID handling for path parameters in API calls. (081f32a)
• leaked_credentials_check: Add GET endpoint for leaked_credentials_check/detections (feafd9c)
• worker_version: support startup_time_ms (286ab55)
• zero_trust_access_group: v4 to v5 migration acceptance tests (9c877c7)

... (truncated)

Commits

• 44fcbdd Merge pull request #6571 from cloudflare/release-please--branches--main--chan...
• 20c1528 release: 5.16.0
• f694dcd Merge pull request #6666 from cloudflare/generate-docs
• 00c1274 docs: generate docs from schemas
• 45d036b Merge pull request #6665 from cloudflare/fix-acct-member
• 2647f4e chore(ci): skip tests failing due to test account inconsistencies
• 415127f Merge pull request #6654 from cloudflare/ssicard/workers-for-platforms-dispat...
• 2b5b020 fix: add missing provider tests (#6642)
• 2b8a3ec Merge pull request #6664 from cloudflare/fix-acct-member
• f1ed99d feat(workers_for_platforms_dispatch_namespace): add migration tests
• Additional commits viewable in compare view

Updates hashicorp/aws from 6.26.0 to 6.28.0

Release notes

Sourced from hashicorp/aws's releases.

v6.28.0

6.28.0 (January 7, 2026)

NOTES:

• resource/aws_dynamodb_global_secondary_index: This resource type is experimental. The schema or behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#44999)

FEATURES:

• New Data Source: aws_cloudfront_connection_group (#44885)
• New Data Source: aws_cloudfront_distribution_tenant (#45088)
• New List Resource: aws_kms_alias (#45700)
• New List Resource: aws_sqs_queue (#45691)
• New Resource: aws_cloudfront_connection_function (#45664)
• New Resource: aws_cloudfront_connection_group (#44885)
• New Resource: aws_cloudfront_distribution_tenant (#45088)
• New Resource: aws_cloudfront_multitenant_distribution (#45535)
• New Resource: aws_dynamodb_global_secondary_index (#44999)
• New Resource: aws_ecr_pull_time_update_exclusion (#45765)
• New Resource: aws_organizations_tag (#45730)
• New Resource: aws_redshift_idc_application (#37345)
• New Resource: aws_secretsmanager_tag (#45825)
• New Resource: aws_sesv2_tenant (#45706)

ENHANCEMENTS:

• data-source/aws_apigateway_domain_name : Add endpoint_access_mode attribute (#45741)
• data-source/aws_db_proxy: Add endpoint_network_type and target_connection_network_type attributes (#45634)
• data-source/aws_dx_gateway: Add tags attribute (#45766)
• data-source/aws_ecr_lifecycle_policy_document: Add rule.action.target_storage_class and rule.selection.storage_class arguments, and new valid values for rule.action.type and rule.selection.count_type arguments (#45752)
• data-source/aws_iam_saml_provider: Add saml_provider_uuid attribute (#45707)
• data-source/aws_lambda_function: Add response_streaming_invoke_arn attribute (#45652)
• data-source/aws_lambda_function: Support code_signing_config_arn in AWS GovCloud (US) Regions (#45652)
• data-source/aws_route53_resolver_firewall_rules: Add dns_threat_protection, confidence_threshold, firewall_threat_protection_id, firewall_domain_redirection_action, and q_type attributes (#45711)
• data-source/aws_route53_resolver_rule: Add target_ips attribute (#45492)
• data-source/aws_vpc_endpoint: Add dns_options.private_dns_preference and dns_options.private_dns_specified_domains attributes (#45679)
• data-source/aws_vpc_endpoint: Promote service_region and vpc_endpoint_type from attributes to arguments for filtering (#45679)
• resource/aws_alb: Enforce tag policy compliance for the elasticloadbalancing:loadbalancer tag type (#45671)
• resource/aws_alb_listener: Enforce tag policy compliance for the elasticloadbalancing:listener tag type (#45671)
• resource/aws_alb_listener_rule: Enforce tag policy compliance for the elasticloadbalancing:listener-rule tag type (#45671)
• resource/aws_alb_target_group: Enforce tag policy compliance for the elasticloadbalancing:targetgroup tag type (#45671)
• resource/aws_apigateway_domain_name: Add endpoint_access_mode argument and configurable timeout for create and update (#45741)
• resource/aws_athena_workgroup: Add customer_content_encryption_configuration argument (#45744)
• resource/aws_athena_workgroup: Add enable_minimum_encryption_configuration argument (#45744)
• resource/aws_athena_workgroup: Add monitoring_configuration argument (#45744)
• resource/aws_cleanrooms_collaboration: Add resource identity support (#45548)
• resource/aws_cloudfront_distribution: Add connection_function_association and viewer_mtls_config arguments (#45847)
• resource/aws_cloudfront_distribution: Add owner_account_id argument to vpc_origin_config for cross-account VPC origin support (#45011)
• resource/aws_cloudwatch_log_subscription_filter: Add apply_on_transformed_logs argument (#45826)
• resource/aws_cloudwatch_log_subscription_filter: Add emit_system_fields argument (#45760)

... (truncated)

Changelog

Sourced from hashicorp/aws's changelog.

6.28.0 (January 7, 2026)

NOTES:

• resource/aws_dynamodb_global_secondary_index: This resource type is experimental. The schema or behavior may change without notice, and it is not subject to the backwards compatibility guarantee of the provider. (#44999)

FEATURES:

• New Data Source: aws_cloudfront_connection_group (#44885)
• New Data Source: aws_cloudfront_distribution_tenant (#45088)
• New List Resource: aws_kms_alias (#45700)
• New List Resource: aws_sqs_queue (#45691)
• New Resource: aws_cloudfront_connection_function (#45664)
• New Resource: aws_cloudfront_connection_group (#44885)
• New Resource: aws_cloudfront_distribution_tenant (#45088)
• New Resource: aws_cloudfront_multitenant_distribution (#45535)
• New Resource: aws_dynamodb_global_secondary_index (#44999)
• New Resource: aws_ecr_pull_time_update_exclusion (#45765)
• New Resource: aws_organizations_tag (#45730)
• New Resource: aws_redshift_idc_application (#37345)
• New Resource: aws_secretsmanager_tag (#45825)
• New Resource: aws_sesv2_tenant (#45706)

ENHANCEMENTS:

• data-source/aws_apigateway_domain_name : Add endpoint_access_mode attribute (#45741)
• data-source/aws_db_proxy: Add endpoint_network_type and target_connection_network_type attributes (#45634)
• data-source/aws_dx_gateway: Add tags attribute (#45766)
• data-source/aws_ecr_lifecycle_policy_document: Add rule.action.target_storage_class and rule.selection.storage_class arguments, and new valid values for rule.action.type and rule.selection.count_type arguments (#45752)
• data-source/aws_iam_saml_provider: Add saml_provider_uuid attribute (#45707)
• data-source/aws_lambda_function: Add response_streaming_invoke_arn attribute (#45652)
• data-source/aws_lambda_function: Support code_signing_config_arn in AWS GovCloud (US) Regions (#45652)
• data-source/aws_route53_resolver_firewall_rules: Add dns_threat_protection, confidence_threshold, firewall_threat_protection_id, firewall_domain_redirection_action, and q_type attributes (#45711)
• data-source/aws_route53_resolver_rule: Add target_ips attribute (#45492)
• data-source/aws_vpc_endpoint: Add dns_options.private_dns_preference and dns_options.private_dns_specified_domains attributes (#45679)
• data-source/aws_vpc_endpoint: Promote service_region and vpc_endpoint_type from attributes to arguments for filtering (#45679)
• resource/aws_alb: Enforce tag policy compliance for the elasticloadbalancing:loadbalancer tag type (#45671)
• resource/aws_alb_listener: Enforce tag policy compliance for the elasticloadbalancing:listener tag type (#45671)
• resource/aws_alb_listener_rule: Enforce tag policy compliance for the elasticloadbalancing:listener-rule tag type (#45671)
• resource/aws_alb_target_group: Enforce tag policy compliance for the elasticloadbalancing:targetgroup tag type (#45671)
• resource/aws_apigateway_domain_name: Add endpoint_access_mode argument and configurable timeout for create and update (#45741)
• resource/aws_athena_workgroup: Add customer_content_encryption_configuration argument (#45744)
• resource/aws_athena_workgroup: Add enable_minimum_encryption_configuration argument (#45744)
• resource/aws_athena_workgroup: Add monitoring_configuration argument (#45744)
• resource/aws_cleanrooms_collaboration: Add resource identity support (#45548)
• resource/aws_cloudfront_distribution: Add connection_function_association and viewer_mtls_config arguments (#45847)
• resource/aws_cloudfront_distribution: Add owner_account_id argument to vpc_origin_config for cross-account VPC origin support (#45011)
• resource/aws_cloudwatch_log_subscription_filter: Add apply_on_transformed_logs argument (#45826)
• resource/aws_cloudwatch_log_subscription_filter: Add emit_system_fields argument (#45760)
• resource/aws_db_proxy: Add endpoint_network_type and target_connection_network_type arguments (#45634)

... (truncated)

Commits

• 3f49f39 Merge pull request #45856 from hashicorp/t-update-changelog-6.28.0
• 908cfcb Bumps version to 6.28.0
• b370058 Updates CHANGELOG
• 385aef5 Update CHANGELOG.md (Manual Trigger)
• fc037e5 Merge pull request #44885 from gahykiamzn/f-cloudfront-connection-group
• 413594d Cleanup data source
• 05dd931 Merge pull request #45847 from madhavvishnubhatta/f-aws_cloudfront_distributi...
• 7fa17c3 Fix tags on update
• 584d910 Add timeouts to docs
• aaacb01 Add timeouts
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml