chore(deps): update terraform minio to v3.43.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
minio (source)	required_provider	minor	3.38.5 → 3.43.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

aminueza/terraform-provider-minio (minio)

v3.43.0

Compare Source

Added

• minio_access_keys data source, which lists the access keys a server holds
  grouped by identity provider, with an optional users filter. It reports
  identifiers and metadata only; the MinIO APIs behind it never return secret
  material. The OpenID group covers both the credential a login mints and the
  service accounts created under it, told apart by kind, and it asks for every
  configured OpenID provider rather than the default one alone.
  identity_providers defaults to builtin, because MinIO answers a listing
  request for an identity provider it does not run with an error rather than an
  empty list
  (#​1144).
• minio_kms_keys data source, which lists the keys the configured KMS holds
  and takes an optional pattern glob. Community MinIO serves key listing
  whenever a KMS is configured, so this is not limited to AIStor
  (#​1145).

Changed

• Bumped golang.org/x/sync from 0.22.0 to 0.23.0
  (#​1165).
• Bumped the Go toolchain to go1.26.8
  (#​1167).

Fixed

• minio_accesskey no longer loses its attached policy when the secret is
  rotated. MinIO's UpdateServiceAccount reads a request that omits the policy
  field as "no session policy" and detaches whatever is attached, and the
  provider sent status, secret and description changes as separate calls, none
  of which carried the policy. Rotating a secret through
  secret_key_wo_version, or changing only the status or the description, threw
  away a policy the configuration never asked to remove. Clearing a policy on
  purpose still works
  (#​1176).

v3.42.0

Compare Source

Added

• minio_sts_credentials ephemeral resource: mints temporary credentials
  through STS AssumeRole without writing them to Terraform state. Use it to
  configure another provider instance or to feed a write-only attribute.
  duration_seconds accepts 3600 or more, since the MinIO client library
  replaces lower values with 3600. The resource requires a provider configured
  with static credentials: it refuses to run when the provider uses
  assume_role, assume_role_with_web_identity or a session token, because it
  would otherwise issue credentials outside the scope those establish, and
  MinIO rejects AssumeRole made with temporary credentials. Every Terraform
  operation opens the resource and mints a new server-side session that lives
  until it expires. Requires Terraform 1.10 or later
  (#​1146).

Changed

• The provider is now served through terraform-plugin-mux, combining the
  existing SDKv2 resources and data sources with a plugin-framework half that
  serves ephemeral resources. Every existing resource and data source is
  unchanged; the provider now speaks protocol 6, which Terraform 1.0 and later
  already negotiate.

Fixed

• minio_sts_credentials now uses the provider TLS settings. The request went
  out on the default HTTP client, so minio_insecure, minio_cacert_file,
  minio_cert_file, minio_key_file and request_timeout_seconds were all
  ignored. Against a server with a private certificate authority the resource
  failed with x509: certificate signed by unknown authority while every other
  resource worked. The request now also stops when Terraform is interrupted
  (#​1151).
• MINIO_REQUEST_TIMEOUT_SECONDS, MINIO_MAX_RETRIES and MINIO_RETRY_DELAY_MS
  now set request_timeout_seconds, max_retries and retry_delay_ms. The
  three attributes declared a static default beside the environment lookup, and
  the static default won, so the variables never took effect. A deployment that
  already sets one of them gets the value it asked for after this upgrade, where
  before it got 30, 6 and 1000
  (#​1149).
• A value that is not a whole number now stops every command that loads the
  provider, destroy included, instead of being ignored. The error names the
  variable: MINIO_MAX_RETRIES must be a whole number, got "abc".
• request_timeout_seconds of 0 or less falls back to 30. It used to reach the
  HTTP transport, where every call then failed with a misleading i/o timeout.
  minio_health_status fell back to 10 seconds in that case and now uses 30 too.
• retry_delay_ms is not the base delay between retries, as its description
  said. It caps the wait at 20 times its value in milliseconds, and the wait
  itself is random and doubles with each attempt. The description and the
  documentation now say so. The retry behaviour is unchanged.

v3.41.1

Compare Source

Changed

• Bumped github.com/minio/madmin-go/v4 from 4.10.3 to 4.10.5
  (#​1130).
• Bumped golang.org/x/crypto from 0.55.0 to 0.56.0
  (#​1137).
• Bumped google.golang.org/grpc from 1.82.1 to 1.83.1
  (#​1136).

Fixed

• Made TestAccMinioIAMUser_import trailing plans deterministic
  (#​1129).

v3.41.0

Compare Source

Changed

• minio_iam_group: changing name now recreates the group (ForceNew).
  MinIO has no rename operation; before this change a rename was silently
  ignored and Terraform state diverged from the server
  (#​1127).

Fixed

• minio_iam_group: force_destroy now actually deletes a group that still has
  members, and no longer fires during ordinary updates (previously an apply that
  changed any other attribute on a group carrying the flag deleted the group and
  failed with Provider produced inconsistent result after apply) (#​1113).
• minio_iam_group: deleting a group that still has members now waits for the
  membership to clear and then fails with a clear error pointing at
  force_destroy, instead of silently leaving the group behind on the server
  (#​1109).
• Error messages no longer contain literal printf verbs such as
  error updating IAM Group %s: %s; twenty-one messages across IAM group,
  IAM user, service account and bucket policy resources now state the
  operation plainly (#​1121).
• minio_config_history and minio_license_info reads against servers that
  do not serve those admin APIs (community MinIO) now return within seconds
  instead of retrying for minutes before reporting the graceful fallback
  (#​1126).

v3.40.1

Compare Source

Terraform Provider MinIO v3.40.1

To install this provider, copy and paste this code into your Terraform configuration:

terraform {
  required_providers {
    minio = {
      source  = "aminueza/minio"
      version = "3.40.1"
    }
  }
}

What's Changed

🐛 Bug Fixes

• fix(s3): make canned anonymous access policies match what mc writes by @​felladrin in #​1094

📖 Documentation

• docs(security): remove the public issue form that claimed to be private by @​felladrin in #​1090
• docs(security): drop the reporting fallback now that private reporting is enabled by @​felladrin in #​1091
• docs: use absolute URLs for the PR template checklist links by @​felladrin in #​1096

🧪 Tests

• test: stop building expectations from the code under test by @​felladrin in #​1093
• test(s3): pin the anonymous public policy to data-access-only actions by @​felladrin in #​1092
• test: stop sharing one provider instance across acceptance tests by @​felladrin in #​1095

Full Changelog: aminueza/terraform-provider-minio@v3.40.0...v3.40.1

v3.40.0

Compare Source

Terraform Provider MinIO v3.40.0

To install this provider, copy and paste this code into your Terraform configuration:

terraform {
  required_providers {
    minio = {
      source  = "aminueza/minio"
      version = "3.40.0"
    }
  }
}

What's Changed

Security

• fix(s3): stop granting bucket administration to anonymous callers by @​felladrin in #​1085
  • minio_s3_bucket_anonymous_access with access_type = "public" no longer grants anonymous clients s3:PutBucketPolicy, s3:DeleteBucketPolicy, s3:DeleteBucket, s3:CreateBucket, s3:GetBucketPolicy or the bucket notification actions. Before this fix, any unauthenticated client could rewrite the bucket policy or delete the bucket. Re-apply your configuration to replace the old policy; anonymous object read/write access is unchanged.

Other Changes

• Update info on Readme by @​felladrin in #​1084

Full Changelog: aminueza/terraform-provider-minio@v3.39.0...v3.40.0

v3.39.0

Compare Source

Terraform Provider MinIO v3.39.0

To install this provider, copy and paste this code into your Terraform configuration:

terraform {
  required_providers {
    minio = {
      source  = "aminueza/minio"
      version = "3.39.0"
    }
  }
}

What's Changed

🐛 Bug Fixes

• Migrate to madmin-go/v4 for MinIO admin API v4 support by @​aminueza in #​1074

Full Changelog: aminueza/terraform-provider-minio@v3.38.6...v3.39.0

v3.38.6

Compare Source

Terraform Provider MinIO v3.38.6

To install this provider, copy and paste this code into your Terraform configuration:

terraform {
  required_providers {
    minio = {
      source  = "aminueza/minio"
      version = "3.38.6"
    }
  }
}

What's Changed

🐛 Bug Fixes

• fix(data-source): use deterministic bucket id for notification config by @​dennismdejong in #​1048
• fix(s3-bucket-notification): support multiple notifications per bucket by @​felladrin in #​1066
• fix(deps): bump google.golang.org/grpc to v1.82.1 by @​felladrin in #​1073

📖 Documentation

• docs: clarify which env vars are required vs optional for tests by @​dennismdejong in #​1050

🔧 Maintenance

• chore: remove stale golangci exclusions and inert CodeQL config by @​dennismdejong in #​1051
• refactor: migrate remaining diag.FromErr to NewResourceError by @​dennismdejong in #​1052
• ci: add docker-compose ecosystem to dependabot and sync golang image with toolchain by @​dennismdejong in #​1053
• ci: add weekly workflow testing against latest MinIO release by @​dennismdejong in #​1054
• ci: enable OIDC acceptance test suite in CI by @​dennismdejong in #​1055
• ci: run the notify_redis acceptance test in CI by @​felladrin in #​1065
• refactor(bucket): extract create, read, and force-destroy helpers by @​felladrin in #​1070
• refactor(ilm): split the schema, CustomizeDiff, and Read into focused functions by @​felladrin in #​1069
• refactor(replication): split schema, Read, and converters into focused functions by @​felladrin in #​1067
• refactor(lifecycle): split the rule schema into focused per-block functions by @​felladrin in #​1068

🧪 Tests

• test: remove redundant TF_ACC guard in testAccPreCheck by @​dennismdejong in #​1049
• test(iam-policy): re-issue delete in CheckDestroy to tolerate IAM cache resurrection by @​felladrin in #​1072

Other Changes

• docs: auto-generate provider documentation by @​github-actions[bot] in #​1064

Full Changelog: aminueza/terraform-provider-minio@v3.38.5...v3.38.6

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.