chore(deps): update terraform aws to < 6.67.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aws (source)	required_provider	minor	< 6.66.0 → < 6.67.0

---

Release Notes

hashicorp/terraform-provider-aws (aws)

v6.66.0

Compare Source

NOTES:

• resource/aws_iam_openid_connect_provider: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing (#​50024)

FEATURES:

• New List Resource: aws_efs_mount_target (#​50057)
• New List Resource: aws_iam_openid_connect_provider (#​50024)
• New Resource: aws_msk_channel (#​49266)

ENHANCEMENTS:

• data-source/aws_ecs_service: Add target_type and timeout_configuration attributes to the lifecycle_hook block. (#​48128)
• resource/aws_bedrockagentcore_api_key_credential_provider: Add Resource Identity support (#​48629)
• resource/aws_bedrockagentcore_api_key_credential_provider: Add api_key_secret_source argument and api_key_secret_config configuration block to support customer-managed AWS Secrets Manager secrets (#​48629)
• resource/aws_ecs_service: Add target_type and timeout_configuration arguments to the lifecycle_hook configuration block to support ECS PAUSE deployment hooks. hook_target_arn and role_arn are now Optional (still required for AWS_LAMBDA hooks). (#​48128)
• resource/aws_efs_access_point: Add Resource Identity support (#​50026)
• resource/aws_efs_backup_policy: Add Resource Identity support (#​50026)
• resource/aws_efs_file_system: Add Resource Identity support (#​50026)
• resource/aws_efs_file_system_policy: Add Resource Identity support (#​50026)
• resource/aws_efs_mount_target: Add Resource Identity support (#​50026)
• resource/aws_efs_replication_configuration: Add Resource Identity support (#​50026)

BUG FIXES:

• list-resource/aws_rds_cluster_instance: Cache cluster using the DBClusterIdentifier as the key (#​50040)
• resource/aws_pipes_pipe: Fix source_parameters.self_managed_kafka_parameters.server_root_ca_certificate being sent to the API as an empty string instead of being omitted, which caused UpdatePipe to fail with a ValidationException when the attribute was unset (#​40116)
• resource/aws_redshiftserverless_workgroup: Filter server-only config_parameter entries from state and allow newly returned config parameter keys without a provider update (#​49939)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🔍 Rendered manifest diff — this PR vs main (desired state)

No changes to the rendered desired state. ✅