> ## Documentation Index
> Fetch the complete documentation index at: https://docs.formal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Terraform Provider

> Release notes for Formal Terraform Provider

<Update label="June 30, 2026" tags={["New Features"]}>
  ## 4.20.0

  ### New

  * Add a `formal_user` data source to look up an existing user by ID or identity (`idp:formal:human:<email>`)

  ## 4.19.0

  ### New

  * Create AWS and GCP resources with the new `aws` and `gcp` technology types
  * `formal_resource_tls_configuration`: present a client certificate to upstream resources with the new mutual TLS fields (`tls_client_cert`, `tls_client_key`)
  * `formal_inventory_object`: declare labeled JSON sub-columns so nested JSON fields can be masked by data label
</Update>

<Update label="June 18, 2026" tags={["New Features","Deprecations"]}>
  ## 4.18.0

  ### New

  * Support GCP KMS encryption keys, alongside AWS KMS
  * Reach resource upstreams through AWS Systems Manager with the new `aws_ssm` dial method

  ### Changed

  * Encryption keys now use asymmetric RSA by default. Symmetric and deterministic algorithms are no longer supported, and the `algorithm` field is deprecated.
  * The `aws` key provider is renamed to `aws-kms` (`aws` still works as a deprecated alias)
</Update>

<Update label="June 15, 2026" tags={["Improvements"]}>
  ## 4.17.2

  ### Changed

  * `formal_resource`: `port` can now be updated in place instead of forcing the resource to be recreated
</Update>

<Update label="June 5, 2026" tags={["Fixes"]}>
  ## 4.17.1

  ### Fixed

  * `formal_resource_dial_configuration`: `dial_target` can now reference an attribute from another resource (e.g. a Cloud SQL instance created in the same plan) without `terraform plan` failing
</Update>

<Update label="June 5, 2026" tags={["New Features"]}>
  ## 4.17.0

  ### New

  * Add `formal_resource_dial_configuration` resource to control how the connector dials a resource's upstream (`tcp` or `gcp_cloudsql`)
</Update>

<Update label="June 4, 2026" tags={["New Features"]}>
  ## 4.16.3

  ### New

  * Add `formal_network_rule` resource to define CEL-based network routing rules
</Update>

<Update label="May 22, 2026" tags={["New Features","Deprecations"]}>
  ## 4.16.2

  ### Removed

  * Remove `owner` and `notification` fields on the `formal_policy` resource.
</Update>

<Update label="May 14, 2026" tags={["New Features","Improvements"]}>
  ## 4.16.1

  ### New

  * Add `s3_bucket_prefix` to `formal_integration_log` AWS S3 configuration to write logs under a specific bucket prefix

  ### Changed

  * Update `formal_sidecar_resource_link` deprecation message to reference `formal_connector_listener` with `connector_id`
</Update>

<Update label="May 7, 2026" tags={["New Features","Deprecations"]}>
  ## 4.16.0

  ### New

  * Add `formal_inventory_object` resource to register inventory objects (database, schema, table, column) directly, instead of relying on discovery
  * Add `input_json` field on `formal_form` options source command for payloads with non-string JSON values

  ### Removed

  * Remove `formal_integration_data_catalog` resource (deprecated since 4.12.7)
</Update>

<Update label="April 9, 2026" tags={["New Features"]}>
  ## 4.15.2

  ### New

  * Add `autodiscovery_regions` to `formal_integration_cloud` AWS config to enable multi-region resource autodiscovery
</Update>

<Update label="March 18, 2026" tags={["Improvements"]}>
  ## 4.15.1

  ### Changed

  * Bump generated protobuf dependency
</Update>

<Update label="March 18, 2026" tags={["New Features","Deprecations"]}>
  ## 4.15.0

  ### New

  * Allow `llm` as a technology in `formal_connector_listener_rule`

  ### Removed

  * Remove `formal_data_domain` resource (data domains have been removed)
</Update>

<Update label="March 9, 2026" tags={["New Features"]}>
  ## 4.14.13

  ### New

  * Add `formal_connector_ai_provider` resource for managing hosted AI providers
  * Add hosted AI provider fields to `formal_connector_configuration`
</Update>

<Update label="March 6, 2026" tags={["New Features"]}>
  ## 4.14.12

  ### New

  * Support formal\_form resources
</Update>

<Update label="February 27, 2026" tags={["New Features"]}>
  ## 4.14.11

  ### New

  * Add support for resource aliases
</Update>

<Update label="February 20, 2026" tags={["Improvements"]}>
  ## 4.14.10

  ### Changed

  * Store the Formal IAM role ARN in the Terraform state for AWS cloud integration resources.
</Update>

<Update label="February 20, 2026" tags={["Improvements"]}>
  ## 4.14.9

  ### Changed

  * Add validation for write-only attribute version for native users
</Update>

<Update label="February 20, 2026" tags={["New Features"]}>
  ## 4.14.8

  ### New

  * Add support for `ai` satellite type to `formal_connector_satellite_link` resource
</Update>

<Update label="February 19, 2026" tags={["Improvements"]}>
  ## 4.14.7

  ### Changed

  * Support `status` on `formal_workflow` resources.
</Update>

<Update label="February 2, 2026" tags={["New Features"]}>
  ## 4.14.6

  ### New

  * Add the `formal_workflow` resource.
  * Add `resources_health_checks_frequency_seconds` to control resource health check frequency.
  * Introduce `connector` and `space` data sources.
</Update>

<Update label="January 15, 2026" tags={["New Features"]}>
  ## 4.14.1

  ### New

  * Add `otel_endpoint_hostname` and `otel_endpoint_port` fields to `formal_connector_configuration` resource to support custom OpenTelemetry collector endpoints
</Update>

<Update label="January 13, 2026" tags={["Improvements"]}>
  ## 4.14.0

  ### Changed

  * Deprecate `data_classifier` satellite type in favor of `ai` satellite type
</Update>

<Update label="January 10, 2026" tags={["New Features"]}>
  ## 4.13.2

  ### New

  * Add satellite link resource
</Update>

<Update label="January 9, 2026" tags={["New Features"]}>
  ## 4.13.1

  ### New

  * Add policy\_eval\_input\_retention attributes to log configuration resources
</Update>

<Update label="January 8, 2026" tags={["New Features"]}>
  ## 4.13.0

  ### New

  * Add write-only attributes (`native_user_secret_wo`, `native_user_secret_wo_version`) for native users to avoid storing secrets in Terraform state (requires Terraform 1.11+)
</Update>

<Update label="October 21, 2025" tags={["Improvements"]}>
  ## 4.12.8

  ### Changed

  * Require ai\_analysis\_timeout\_seconds to avoid stalled AI analyses and ensure predictable timeouts
</Update>

<Update label="October 20, 2025" tags={["New Features","Improvements"]}>
  ## 4.12.7

  ### New

  * Add S3 autodiscovery option for Cloud integration to discover buckets

  ### Changed

  * Deprecate Data Catalog integration resource to signal phase-out
  * Require specific fields in Sidecar, Sidecar Link, MFA, and TLS to prevent invalid configs
</Update>

<Update label="October 16, 2025" tags={["Bug Fixes"]}>
  ## 4.12.6

  ### Fixed

  * Fix formal\_integration\_mdm creation to prevent apply crashes and use the resource name
</Update>

<Update label="October 16, 2025" tags={["Improvements"]}>
  ## 4.12.5

  ### Changed

  * Make decryptor\_uri optional for encryption\_key to avoid unnecessary configuration
</Update>

<Update label="October 16, 2025" tags={["Bug Fixes"]}>
  ## 4.12.3

  ### Fixed
</Update>

<Update label="October 14, 2025" tags={["New Features"]}>
  ## 4.12.2

  ### New

  * Add S3 bucket autodiscovery to integration\_cloud to reduce manual setup
</Update>

<Update label="October 13, 2025" tags={["Improvements"]}>
  ### Changed

  * Update RPC library to latest version for improved stability and compatibility
  * Update documentation generator to latest version for clearer provider docs
</Update>

<Update label="October 6, 2025" tags={["New Features","Bug Fixes"]}>
  ## 4.11.3

  ### New

  * Add optional connector\_id to connector\_listener to link on create
</Update>

<Update label="September 10, 2025" tags={["New Features"]}>
  ## 4.11.2

  ### New

  * Add AI timeout and strict result count to resource\_classifier\_configuration
</Update>

<Update label="September 9, 2025" tags={["Improvements"]}>
  ## 4.11.1

  ### Changed

  * Require satellite\_type on satellite resource; use data\_discovery, data\_classifier, or policy\_data\_loader
</Update>

<Update label="September 8, 2025" tags={["New Features"]}>
  ## 4.11.0

  ### New

  * Add no-sync mode for Metabase integrations; create integrations without Metabase credentials
  * Add support for customer-managed TLS certificates
</Update>

<Update label="August 21, 2025" tags={["Improvements"]}>
  ## 4.10.4

  ### Changed

  * Revert self-supplied TLS on connector\_hostname; remove certificate/private\_key args to restore prior behavior
</Update>

<Update label="August 15, 2025" tags={["New Features","Bug Fixes","Improvements"]}>
  ## 4.10.3

  ### New

  * Add satellite\_hostname and connector\_satellite\_link resources to manage satellites

  ### Fixed

  * Set default log payload size limit to -1 for consistent log behavior

  ### Changed

  * Remove health check port from connector\_configuration
</Update>

<Update label="July 30, 2025" tags={["New Features","Bug Fixes"]}>
  ## 4.10.2

  ### New

  * Add option to set customer AWS role ARN in integration\_cloud to simplify setup without CloudFormation
</Update>

<Update label="July 10, 2025" tags={["Bug Fixes"]}>
  ## 4.10.1

  ### Fixed

  * Make technology\_provider optional unless using SSH with SSM, reducing config errors
</Update>

<Update label="July 2, 2025" tags={["Improvements"]}>
  ## 4.10.0

  ### Changed

  * Redesign log\_configuration with request/response/scope blocks for clearer control
  * Require name and encryption\_key\_id; remove legacy encryption and size settings for clarity
</Update>

<Update label="June 26, 2025" tags={["Bug Fixes","Improvements"]}>
  ## 4.9.1

  ### Changed

  * Require decryptor\_uri on encryption\_key resource for frontend decryption
</Update>

<Update label="June 24, 2025" tags={["New Features","Bug Fixes","Improvements"]}>
  ## 4.9.0

  ### New

  * Add formal\_group data source to reference existing groups by name

  ### Fixed

  * Block creating connector listeners on healthcheck port 8080 to avoid conflicts

  ### Changed

  * Update dependencies to improve stability and compatibility
</Update>

<Update label="June 13, 2025" tags={["New Features","Improvements"]}>
  ## 4.8.0

  ### New

  * Add per-resource classifier preference for fine-grained control
</Update>

<Update label="June 12, 2025" tags={["Bug Fixes"]}>
  ## 4.7.2

  ### Fixed

  * Prevent forced recreation when updating provider field, allowing in-place updates
</Update>

<Update label="June 11, 2025" tags={["New Features","Improvements"]}>
  ## 4.7.1

  ### Changed

  * Require provider for SSH resources using SSM (aws-ec2 or aws-ecs)
  * Switch KMS encryption key input to use key ARN instead of key ID
  * Update TLS validation options for clearer, safer configuration
</Update>

<Update label="June 2, 2025" tags={["New Features","Improvements"]}>
  ## 4.7.0

  ### New

  * Add formal\_resource data source to fetch a resource by name for easier lookups
</Update>

<Update label="May 6, 2025" tags={["Bug Fixes","Improvements"]}>
  ## 4.6.2

  ### Fixed

  * Improve permission update errors to reflect 'code' field name

  ### Changed

  * Update permission resource to use 'code' and remove timestamps to prevent plan drift
</Update>

<Update label="May 1, 2025" tags={["New Features","Improvements"]}>
  ## 4.6.1

  ### New

  * Add optional path to Data Discovery to limit scans to a specific subpath
</Update>

<Update label="April 29, 2025" tags={["New Features","Improvements"]}>
  ## 4.6.0

  ### New

  * Add resource formal\_inventory\_object\_data\_label\_link to link data labels to inventory objects
  * Add EC2 and ECS autodiscovery to cloud integration, with computed status fields
</Update>

<Update label="March 24, 2025" tags={["New Features","Improvements"]}>
  ## 4.5.3

  ### New

  * Add formal\_connector\_configuration to set connector log level and health check port for better monitoring
</Update>

<Update label="March 24, 2025" tags={["Improvements"]}>
  ## 4.5.2

  ### Changed

  * Allow in-place updates to primary hostname to reduce downtime
</Update>

<Update label="March 20, 2025" tags={["New Features","Bug Fixes"]}>
  ## 4.5.1

  ### New

  * Add plan-time validation for policy Rego code to catch errors before apply
</Update>

<Update label="March 11, 2025" tags={["New Features"]}>
  ## 4.5.0

  **New**

  * Added support for version 1.2.0 of CloudFormation template with new Cloud Integration fields in the `aws` configuration block of `formal_integration_cloud` resources:
    * `enable_eks_autodiscovery` toggles EKS clusters autodiscovery
    * `enable_rds_autodiscovery` toggles RDS instances (PostgreSQL, MySQL, MongoDB) autodiscovery
    * `enable_redshift_autodiscovery` toggles Redshift clusters autodiscovery
    * `allow_s3_access` allows Formal to send logs to S3 buckets in your AWS account through Log Integrations
  * Added read-only fields to the root level of `formal_integration_cloud` resources for CloudFormation stack parameters:
    * `aws_enable_eks_autodiscovery` provides the value for the `EnableEKSAutodiscovery` parameter
    * `aws_enable_rds_autodiscovery` provides the value for the `EnableRDSAutodiscovery` parameter
    * `aws_enable_redshift_autodiscovery` provides the value for the `EnableRedshiftAutodiscovery` parameter
    * `aws_allow_s3_access` provides the value for the `AllowS3Access` parameter
    * `aws_s3_bucket_arn` provides the value for the `S3BucketARN` parameter
</Update>

<Update label="February - March 2025" tags={["New Features", "Bug Fixes", "Deprecations"]}>
  ## 4.4.1

  **Changed**

  * Bumped Formal Go SDK from 2.8.1 to 2.8.2

  **Fixed**

  * Brought back the `type` field of `formal_integration_cloud` resources, which was mistakenly removed in version 4.4.0

  ## 4.4.0

  **New**

  * Added `aws` configuration block to `formal_integration_cloud` resources for AWS CloudFormation template version and S3 bucket ARN configuration

  **Changed**

  * Provider now uses version 2.8.1 of the Formal Go SDK and version 2025-02-24 of the API
  * The `type` field of `formal_integration_cloud` resources is now deprecated in favor of `aws`
</Update>

<Update label="January - February 2025" tags={["New Features", "Bug Fixes", "Deprecations"]}>
  ## 4.3.2

  **Changed**

  * Bumped to version 2.7.0 of the Formal SDK

  ## 4.3.1

  **New**

  * Added encryption keys and log configurations resources

  **Changed**

  * Added deprecated notification for `managed_tls` field in `formal_connector_hostname`
  * Deprecated `managed_tls` field in `formal_connector_hostname`

  **Fixed**

  * Fixed the list of update-able resource fields for formal resources

  ## 4.3.0

  **New**

  * Added `dns_record` to `formal_connector_hostname`

  **Changed**

  * Removed ForceNew for `formal_resource_hostname.hostname`
</Update>

<Update label="December 2024" tags={["New Features"]}>
  ## 4.2.2

  **New**

  * Added `resource_hostname` as supported identity type for `native_user_link`

  ## 4.2.1

  **New**

  * Added `formal_resource_hostname` resource

  ## 4.2.0

  **New**

  * Support for new form cloud integrations and log integrations
</Update>