chore(deps): update dependency amazon.aws to v12

[dreadnode-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
amazon.aws	galaxy-collection	major	11.5.0 → 12.0.0

---

Release Notes

ansible-collections/amazon.aws (amazon.aws)

v12.0.0: amazon.aws 12.0.0

Compare Source

Release Summary

This major release includes breaking changes to support requirements and the removal of overdue deprecations from the ec2_instance and cloudformation modules. The collection now requires ansible-core >= 2.18.0 which supports Python >= 3.11. Additionally, minimum boto3 and botocore versions have been increased to 1.38.0. Deprecated parameters placement_group and tenancy from ec2_instance, and template from cloudformation have been removed. This release also includes bugfixes for the route53_zone module and refactoring improvements to autoscaling, RDS, and ELB modules.

Minor Changes

• CI test matrices updated against ansible-core 2.21 in addition to 2.18, 2.19, and 2.20 (#​3142).
• Collection - Add aiobotocore version 2.23.0 as a dependency for the event source plugins (#​2952).
• autoscaling_group - Refactored module to reduce code complexity, improve error handling, and replace manual wait loops with waiter-based implementations (#​2938).
• autoscaling_group - Standardised return values with autoscaling_group_info by extracting shared transformation logic to module_utils (#​2938).
• autoscaling_group_info - Refactored module to reduce code complexity, improve error handling, and replace manual wait loops with waiter-based implementations (#​2938).
• autoscaling_group_info - Standardised return values with autoscaling_group by extracting shared transformation logic to module_utils (#​2938).
• aws_account_attribute - added on_denied parameter to control behaviour when access to account attributes is denied, supporting error (default), skip, and warn modes. (#​2914)
• aws_ec2 inventory plugin - Added availability_zone_id to the placement block in host variables (#​1550).
• aws_ec2 inventory plugin - Addressed SonarCloud code-smells by reducing cognitive complexity in hostname processing methods (#​2936).
• ec2_tag - added resource_tags as an alias for the tags parameter, matching the convention already used by the ec2_instance module (#​3085).
• elb_application_lb - Refactor module to reduce cognitive complexity and improve code maintainability (#​2946).
• elb_application_lb - add http_xff_header_processing_mode to set whether the load balancer appends, preserves, or removes the X-Forwarded-For header (#​3098).
• lookup plugins - created centralised LookupErrorHandler decorator pattern to reduce code duplication and cognitive complexity in lookup plugins. (#​2914)
• lookup plugins - updated deprecated text converter imports from ansible.module_utils._text to ansible.module_utils.common.text.converters to avoid deprecation warnings. (#​2914)
• module_utils/_rds/api - Added shared utility functions for DB parameter group operations with @RDSErrorHandler decorators for standardized error handling. (#​3065)
• module_utils/_rds/common - Added DBParameterGroupNotFoundFault to the list of not-found error codes handled by RDSErrorHandler. (#​3065)
• module_utils/rds - Added describe_db_clusters centralized wrapper with @RDSErrorHandler and @AWSRetry decorators, and added DBClusterNotFoundFault to the error handler (#​3041).
• module_utils/rds - Added describe_global_clusters centralized wrapper with @RDSErrorHandler and @AWSRetry decorators, and added GlobalClusterNotFoundFault to the error handler (#​3068).
• module_utils/rds - Added describe_option_groups centralized wrapper with @RDSErrorHandler and @AWSRetry decorators, and added OptionGroupNotFoundFault to the error handler (#​3065).
• module_utils/rds - describe_db_cluster_parameter_groups() and describe_db_cluster_parameters() now take a boto3 client and **params like the other describe_* helpers, dropping the unused module argument (#​3089).
• plugin_utils/inventory - Refactored error handling to use centralised InventoryErrorHandler following S3ErrorHandler pattern (#​2936).
• rds_cluster - Removed module-level globals, replaced eval() dispatch with format_rds_client_method_parameters(), and use shared describe_db_clusters from module_utils/rds for consistent error handling (#​3041).
• rds_cluster_info - Refactored module to use shared describe_db_clusters from module_utils/rds and AnsibleRDSError for consistent error handling (#​3041).
• rds_cluster_param_group - Refactored shared describe_db_cluster_parameter_groups and describe_db_cluster_parameters in module_utils/rds to use RDSErrorHandler decorator for consistent error handling following previous PRs. (#​3069)
• rds_cluster_param_group - refactored the module onto the shared module_utils/rds helpers, removing the redundant botocore import and connection try/except block (#​3089).
• rds_cluster_param_group - the current parameters are now indexed by name when comparing them against the requested ones, instead of the full list being scanned once per requested parameter (#​3089).
• rds_cluster_param_group - the parameter group returned by the create call is now reused, removing a redundant describe_db_cluster_parameter_groups() call (#​3089).
• rds_cluster_param_group_info - refactored the module onto the shared module_utils/rds helpers and removed the redundant botocore import and connection try/except block (#​3089).
• rds_cluster_snapshot - Added docstrings to the module's helper functions, aligning the module with the style used by the shared module_utils/rds utilities (#​3090).
• rds_engine_versions_info - Refactored module to use shared utility functions from module_utils/rds for API calls, error handling, and retry logic (#​3062).
• rds_global_cluster_info - Refactored module to use shared describe_global_clusters from module_utils/rds and AnsibleRDSError for consistent error handling (#​3068).
• rds_instance_param_group - Refactored to use shared utilities from module_utils/_rds/api.py including describe_db_instance_parameter_groups, describe_db_parameters, create_db_parameter_group, modify_db_parameter_group, and delete_db_parameter_group for consistent error handling and reduced code duplication. (#​3065)
• rds_instance_param_group_info - Updated module to use refactored describe_db_instance_parameter_groups function with new signature that retrieves tags separately. (#​3065)
• rds_instance_snapshot - Simplified the absent state logic to remove a redundant branch and added docstrings to the module's helper functions, aligning the module with the style used by the shared module_utils/rds utilities (#​3080).
• rds_option_group - Refactored module to use shared describe_option_groups and get_tags from module_utils/rds, and standardized error handling (#​3064).
• rds_option_group - Removed direct botocore.exceptions imports and inline try/except blocks; option group create, modify, delete, and tagging calls are now made through small helper functions decorated with RDSErrorHandler, standardizing error handling on AnsibleRDSError (#​3078).
• rds_option_group_info - Refactored module to use shared describe_option_groups from module_utils/rds and AnsibleRDSError for consistent error handling (#​3065).
• rds_subnet_group - Refactored module to use the shared describe_db_subnet_groups and call_method helpers from module_utils/rds and standardized error handling on AnsibleRDSError, removing the module-local backoff and duplicated try/except blocks (#​3072).
• secretsmanager_secret - refactored to use LookupErrorHandler decorator, reducing cognitive complexity from 36 to <15. (#​2914)
• ssm_parameter - refactored to use LookupErrorHandler decorator, reducing cognitive complexity from 28 to <15. (#​2914)

Breaking Changes / Porting Guide

• Collection - Minimum supported Python version is now 3.9 (#​2922).
• Collection - Minimum supported boto3 version is now 1.38.0 (#​2922).
• Collection - Minimum supported boto3 version is now 1.38.23 (#​2952).
• Collection - Minimum supported botocore version is now 1.38.0 (#​2922).
• Collection - Minimum supported botocore version is now 1.38.23 (#​2952).
• Support for ansible-core < 2.18 has been dropped. The collection now requires ansible-core >= 2.18.0 which supports Python >= 3.11 (#​3142).
• cloudformation - removed the deprecated template parameter. The parameter was deprecated in release 7.6.0 and the removal date of 2026-05-01 has passed. Use template_body with the ansible.builtin.file or ansible.builtin.template lookup plugin instead (#​3097).
• ec2_instance - removed the placement_group parameter. The parameter was deprecated in release 7.0.0. Use placement.group_name instead (#​2937).
• ec2_instance - removed the tenancy parameter. The parameter was deprecated in release 7.0.0. Use placement.tenancy instead (#​2937).
• s3_object - removed support for boolean values in the overwrite parameter. Only the string values always, never, different, or latest are now accepted (#​2924).
• s3_object - removed support for passing both dualstack and endpoint_url parameters at the same time. The parameters are now mutually exclusive. To use dualstack endpoints with a custom endpoint, specify the dualstack endpoint URL directly in endpoint_url (#​2924).

Deprecated Features

• Collection - Support for Python 3.9 is deprecated and will be removed in a release after 2027-04-01, following AWS SDK for Python's end of support for Python 3.9 in April 2026 (#​2922).

Bugfixes

• cloudformation - Fix SHA1 hashing for FIPS mode compatibility by adding usedforsecurity=False parameter to support Python running in FIPS-enabled environments (#​2921).
• module_utils/s3 - Fix MD5 hashing for FIPS mode compatibility by adding usedforsecurity=False parameter to support Python running in FIPS-enabled environments (#​2921).
• rds_cluster - Fixed KeyError when stopping or starting clusters because changing_cluster_options assumed ApplyImmediately was always present in the parameters (#​3041).
• rds_option_group - Fixed check_mode not being respected during option group creation when tags are provided (#​3064).
• rds_option_group - state=absent no longer fails when the option group is deleted by another process between the existence check and the delete call; changed is now derived from the delete call's actual result instead of being pre-set to True (#​3078).
• route53_zone - Remove the default value for dnssec parameter to avoid idempotency issues (#​2553).
• secretsmanager_secret - fixed bug where falsy values (0, empty string, False) were incorrectly filtered when on_missing/on_denied was set to skip or warn. Now only None values are filtered. (#​2914)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.