chore(deps): update terraform cloudposse/dynamic-subnets/aws to v3

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/dynamic-subnets/aws (source)	module	major	2.4.1 -> 3.0.1

---

Release Notes

cloudposse/terraform-aws-dynamic-subnets (cloudposse/dynamic-subnets/aws)

v3.0.1

Compare Source

🚀 Enhancements

Fix NAT routing when max_nats limits NATs to fewer AZs @​aknysh (#​227)

what

• Fixed critical bug in NAT Gateway routing when max_nats is set to fewer than the number of Availability Zones
• Added modulo operation to route table mapping formulas to clamp NAT indices to available NATs
• Created new example limited-nat-gateways demonstrating the max_nats feature
• Added 3 new test functions providing 100% test coverage for max_nats feature
• Added comprehensive documentation including PRD with diagrams and decision tree

why

Critical Bug: When max_nats < num_azs, Terraform failed with "Invalid index" error because route tables in AZs without NATs attempted to reference non-existent NAT Gateway indices.

Example Failure:

Configuration: 3 AZs, max_nats=1 (only 1 NAT in AZ-a)
Error: aws_nat_gateway.default[1] - Invalid index
Route tables in AZ-b and AZ-c tried to access NAT[1] and NAT[2] which don't exist

Root Cause: The route table mapping formula calculated:

az_index * nats_per_az + subnet_offset

This produced indices [0, 1, 2] but only NAT[0] existed.

Fix: Added modulo operation to wrap indices to available NATs:

(az_index * nats_per_az + subnet_offset) % total_nats

Now produces [0, 0, 0] - all route to the single NAT.

Test Coverage Gap: The max_nats feature had ZERO test coverage. None of the 6 existing examples tested this scenario. The bug was discovered by the aws-vpc component test suite, not by this module's own tests.

Changes Include:

1. Bug Fix (main.tf):

   • Fixed private_route_table_to_nat_map calculation
   • Fixed public_route_table_to_nat_map calculation
   • Added explanatory comments and example scenarios

2. New Test Example (examples/limited-nat-gateways):

   • Tests 3 AZs with max_nats=1 (the failing scenario)
   • Tests 3 AZs with max_nats=2 (between scenario)
   • Includes comprehensive README with cost analysis
   • Documents use case: Dev/test cost optimization

3. Test Coverage (test/src/examples_limited_nat_gateways_test.go):

   • TestExamplesLimitedNatGateways - Tests max_nats=1
   • TestExamplesLimitedNatGatewaysTwoNats - Tests max_nats=2
   • TestExamplesLimitedNatGatewaysDisabled - Tests enabled=false
   • Brings max_nats test coverage from 0% to 100%

4. Documentation:

   • Test Coverage Analysis: Comprehensive audit of all tests, identifies gaps
   • PRD: Detailed problem statement, solution, cost analysis
   • NAT Placement Diagrams: 4 strategy diagrams with ASCII art
   • Decision Tree: Guides users to optimal configuration
   • Best Practices: Recommendations by environment type

Cost Implications:
The max_nats feature enables significant cost savings in non-production environments:

• Standard (3 NATs): $97.20/month
• Limited (1 NAT): $32.40/month
• Savings: $64.80/month per environment (67% reduction)
• 10 dev environments: $7,776/year savings

This bug blocked users from utilizing this cost optimization feature.

references

• Related to #​226 (Separate Public/Private Subnet Configuration)
• Discovered by: cloudposse-terraform-components/aws-vpc test suite
• Affects: All users attempting to use max_nats < num_azs for cost optimization
• Test Coverage Analysis: /docs/test-coverage-analysis.md
• Detailed PRD: /docs/prd/fix-max-nats-routing.md

v3.0.0

Compare Source

Separate Public/Private Subnet Configuration and Enhance NAT Gateway Placement @​aknysh (#​226)

what

• Add ability to configure different numbers of public and private subnets per Availability Zone independently
• Add controlled NAT Gateway placement by subnet index to reduce costs
• Add intuitive NAT Gateway placement by subnet name for better usability
• Fix critical NAT Gateway placement bug causing wrong AZ distribution
• Fix cross-AZ routing issue where private subnets routed to NATs in different AZs
• Add comprehensive examples demonstrating cost-optimized and high-availability configurations
• Add full test coverage with Terratest for all new features
• Maintain 100% backward compatibility with existing configurations

why

User Pain Points:

• Users were forced to create equal numbers of public and private subnets, even when workloads didn't require it
• NAT Gateways were created in every public subnet, resulting in unnecessarily high AWS costs (~$32/month per NAT)
• No control over which public subnets received NAT Gateways
• Index-based configuration was not intuitive for users who assigned names to subnets
• Critical bugs caused NAT Gateways to be placed in wrong AZs and private subnets to route across AZ boundaries

Business Impact:

• Cost Optimization: Reducing from 6 NATs to 3 NATs saves $96/month (50% reduction)
• Flexibility: Users can now match subnet configuration to their actual workload requirements
• Reliability: Fixes ensure NAT Gateways are correctly distributed across AZs and routing stays within same AZ
• Usability: Name-based placement is more intuitive and maintainable than index-based placement

Key Features:

1. Separate Public/Private Subnet Counts: New variables public_subnets_per_az_count, public_subnets_per_az_names, private_subnets_per_az_count, private_subnets_per_az_names allow independent control while falling back to original variables for backward compatibility

2. Controlled NAT Placement by Index: Variable nat_gateway_public_subnet_indices (default [0]) specifies which subnet position(s) in each AZ receive NAT Gateways, enabling cost optimization

3. Named NAT Placement: Variable nat_gateway_public_subnet_names allows intuitive placement like ["loadbalancer"] instead of remembering indices

4. Bug Fixes: Corrected NAT Gateway global index calculation and route table mapping to ensure proper AZ distribution and same-AZ routing

Examples Included:

• examples/separate-public-private-subnets/: Cost-optimized with 1 NAT per AZ (~$110/month)
• examples/redundant-nat-gateways/: High-availability with 2 NATs per AZ (~$140/month)

Test Coverage:

• Full Terratest coverage for both examples
• Tests for name-based and index-based NAT placement
• Tests for disabled state (no resources created)
• Verification of all outputs, subnet counts, NAT counts, and route table mappings

references

• Comprehensive PRD: docs/prd/separate-public-private-subnets-and-nat-placement.md

🤖 Automatic Updates

Fix go version in tests @​osterman (#​222)

what

• Update go 1.24

why

• Error loading shared library libresolv.so.2 in Go 1.20

References

• https://sweetops.slack.com/archives/G014YEKDH4K/p1746672149263629
• https://github.com/golang/go/issues/59305#issuecomment-1488478737
• https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/pull/294/#issuecomment-2859195553

Replace Makefile with atmos.yaml @​osterman (#​221)

what

• Remove Makefile
• Add atmos.yaml

why

• Replace build-harness with atmos for readme genration

References

• DEV-3229 Migrate from build-harness to atmos

Migrate new test account @​osterman (#​215)

what

• Update .github/settings.yml
• Update .github/chatops.yml files

why

• Re-apply .github/settings.yml from org level to get terratest environment
• Migrate to new test account

References

• DEV-388 Automate clean up of test account in new organization
• DEV-387 Update terratest to work on a shared workflow instead of a dispatch action
• DEV-386 Update terratest to use new testing account with GitHub OIDC

Update .github/settings.yml @​osterman (#​214)

what

• Update .github/settings.yml
• Drop .github/auto-release.yml files

why

• Re-apply .github/settings.yml from org level
• Use organization level auto-release settings

references

• DEV-1242 Add protected tags with Repository Rulesets on GitHub

Update release workflow to allow pull-requests: write @​osterman (#​211)

what

• Update workflow (.github/workflows/release.yaml) to have permission to comment on PR

why

• So we can support commenting on PRs with a link to the release

Update GitHub Workflows to use shared workflows from '.github' repo @​osterman (#​210)

what

• Update workflows (.github/workflows) to use shared workflows from .github repo

why

• Reduce nested levels of reusable workflows

Update GitHub Workflows to Fix ReviewDog TFLint Action @​osterman (#​209)

what

• Update workflows (.github/workflows) to add issue: write permission needed by ReviewDog tflint action

why

• The ReviewDog action will comment with line-level suggestions based on linting failures

Update GitHub workflows @​osterman (#​208)

what

• Update workflows (.github/workflows/settings.yaml)

why

• Support new readme generation workflow.
• Generate banners

Use GitHub Action Workflows from `cloudposse/.github` Repo @​osterman (#​202)

what

• Install latest GitHub Action Workflows

why

• Use shared workflows from cldouposse/.github repository
• Simplify management of workflows from centralized hub of configuration

Bump google.golang.org/grpc from 1.51.0 to 1.56.3 in /test/src @​[dependabot[bot]](https://redirect.github.com/apps/dependabot) (#​200)

Bumps [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) from 1.51.0 to 1.56.3.

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.56.3

Security

• server: prohibit more than MaxConcurrentStreams handlers from running at once (CVE-2023-44487)

  In addition to this change, applications should ensure they do not leave running tasks behind related to the RPC before returning from method handlers, or should enforce appropriate limits on any such work.

Release 1.56.2

• status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#​6374)

Release 1.56.1

• client: handle empty address lists correctly in addrConn.updateAddrs

Release 1.56.0

New Features

• client: support channel idleness using WithIdleTimeout dial option (#​6263)
  • This feature is currently disabled by default, but will be enabled with a 30 minute default in the future.
• client: when using pickfirst, keep channel state in TRANSIENT_FAILURE until it becomes READY (gRFC A62) (#​6306)
• xds: Add support for Custom LB Policies (gRFC A52) (#​6224)
• xds: support pick_first Custom LB policy (gRFC A62) (#​6314) (#​6317)
• client: add support for pickfirst address shuffling (gRFC A62) (#​6311)
• xds: Add support for String Matcher Header Matcher in RDS (#​6313)
• xds/outlierdetection: Add Channelz Logger to Outlier Detection LB (#​6145)
  • Special Thanks: @​​s-matyukevich
• xds: enable RLS in xDS by default (#​6343)
• orca: add support for application_utilization field and missing range checks on several metrics setters
• balancer/weightedroundrobin: add new LB policy for balancing between backends based on their load reports (gRFC A58) (#​6241)
• authz: add conversion of json to RBAC Audit Logging config (#​6192)
• authz: add support for stdout logger (#​6230 and #​6298)
• authz: support customizable audit functionality for authorization policy (#​6192 #​6230 #​6298 #​6158 #​6304 and #​6225)

Bug Fixes

• orca: fix a race at startup of out-of-band metric subscriptions that would cause the report interval to request 0 (#​6245)
• xds/xdsresource: Fix Outlier Detection Config Handling and correctly set xDS Defaults (#​6361)
• xds/outlierdetection: Fix Outlier Detection Config Handling by setting defaults in ParseConfig() (#​6361)

API Changes

• orca: allow a ServerMetricsProvider to be passed to the ORCA service and ServerOption (#​6223)

Release 1.55.1

• status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#​6374)

Release 1.55.0

Behavior Changes

• xds: enable federation support by default (#​6151)
• status: status.Code and status.FromError handle wrapped errors (#​6031 and #​6150)

... (truncated)

Commits

• 1055b48 Update version.go to 1.56.3 (#​6713)
• 5efd7bd server: prohibit more than MaxConcurrentStreams handlers from running at once...
• bd1f038 Upgrade version.go to 1.56.3-dev (#​6434)
• faab873 Update version.go to v1.56.2 (#​6432)
• 6b0b291 status: fix panic when servers return a wrapped error with status OK (#​6374) ...
• ed56401 [PSM interop] Don't fail target if sub-target already failed (#​6390) (#​6405)
• cd6a794 Update version.go to v1.56.2-dev (#​6387)
• 5b67e5e Update version.go to v1.56.1 (#​6386)
• d0f5150 client: handle empty address lists correctly in addrConn.updateAddrs (#​6354) ...
• 997c1ea Change version to 1.56.1-dev (#​6345)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Add GitHub Settings @​osterman (#​196)

what

• Install a repository config (.github/settings.yaml)

why

• Programmatically manage GitHub repo settings

Update README.md and docs @​cloudpossebot (#​194)

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

Update Scaffolding @​osterman (#​195)

what

• Reran make readme to rebuild README.md from README.yaml
• Migrate to square badges
• Add scaffolding for repo settings and Mergify

why

• Upstream template changed in the .github repo
• Work better with repository rulesets
• Modernize look & feel

v2.4.2

Compare Source

🚀 Enhancements

chore(deps): update terraform cloudposse/utils/aws to v1.4.0 (main) @​renovate (#​191)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/utils/aws (source)	module	minor	1.3.0 -> 1.4.0

---

Release Notes

cloudposse/terraform-aws-utils (cloudposse/utils/aws)

v1.4.0

Compare Source

Add il-central-1 region @​&#​8203;jasonmk (#&#​8203;31)

what

Add new Tel Aviv (il-central-1) region

why

Provide full coverage

references

Sync github @​&#​8203;max-lobur (#&#​8203;27)

Rebuild github dir from the template

---

🤖 Automatic Updates

chore(deps): update terraform cloudposse/utils/aws to v1.4.0 (main) @​renovate (#​191)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/utils/aws (source)	module	minor	1.3.0 -> 1.4.0

---

Release Notes

cloudposse/terraform-aws-utils (cloudposse/utils/aws)

v1.4.0

Compare Source

Add il-central-1 region @​&#​8203;jasonmk (#&#​8203;31)

what

Add new Tel Aviv (il-central-1) region

why

Provide full coverage

references

Sync github @​&#​8203;max-lobur (#&#​8203;27)

Rebuild github dir from the template

---

Update README.md and docs @​cloudpossebot (#​189)

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[mergify]

/terratest