Upgrade the AWS provider to 6.x #195

When I enabled the DNSSEC DS record in #194, the AWS provider (we're pinned at 5.100.0) choked on aws_route53domains_delegation_signer_record. The registrar accepted the DS record just fine (ADD_DNSSEC came back SUCCESSFUL), but the provider failed on read-back with empty result and left the resource out of state. Importing it with the 5.x ID format (domain_name,dnssec_key_id) didn't fill in signing_attributes, so the next plan wanted to destroy and recreate the live DS record.

For now I worked around it with lifecycle { ignore_changes = [signing_attributes] } and imported the record. Plan is clean, and DNSSEC works.

The provider changelog for 6.70.0 changes this resource's import ID to domain_name,flags,algorithm,public_key, because AWS no longer returns the DNSKEY flags. I couldn't find an issue that matches our exact error, so I'm not 100% sure 6.x fixes it, but it lines up with both symptoms. Latest release as of today is 6.71.0.

What blocks the upgrade

terraform-aws-modules/autoscaling at ~> 8.0 (in terraform/asg.tf) pins aws >= 5.85, < 6.0. The comment there says v9+ has breaking changes in mixed_instances_policy, so the module bump is the real work here. terraform-aws-modules/ecs (~> 4.0) and terraform-aws-modules/security-group (~> 5.3) only set a lower bound, but should be checked against 6.x too.

Things to check in the 6.0 breaking changes

Full list is in the 6.0.0 section of the changelog. The ones that look relevant to us:

• aws_ami data source: most_recent = true without an owner or image ID filter is now an error (was a warning). This touches the ECS AMI lookup.
• aws_alb_target_group: preserve_client_ip only accepts "", true or false.
• aws_launch_template and the ECS task definition data sources lost the Elastic Inference and elastic_gpu_specifications attributes.
• The new per-resource region argument, which may let us drop the aws.us_east_1 provider alias later (optional).

I haven't gone through the SES, KMS, CloudWatch Logs or Route53 entries yet.

Done when

• terraform-aws-modules/autoscaling bumped to a version that allows aws >= 6, with the mixed_instances_policy changes handled
• Provider constraint in terraform/main.tf and the lock file moved to >= 6.70
• terraform plan locally shows no unexpected changes (plan, apply from the branch, clean plan, then merge)
• ignore_changes = [signing_attributes] removed from aws_route53domains_delegation_signer_record.operationcode in terraform/dns_operationcode_org_security.tf, and the plan stays clean (re-import with the new ID format if needed, don't let it replace the live DS record)

🤖 Generated with Claude Code