Who contributed to HashiCorp on July 17, 2026?

7 developers shipped this update, including Paras Gupta, gdavison, sbldevnet, DanyStinson, subham-ibmhc, Surabhi-1605, and pajay-rao.

What were the notable HashiCorp updates?

fix debug token leak. (#23731), fix debug token leak, and feat(bedrockagent): add Managed Knowledge Base support (type=MANAGED).

Jul 17, 2026

$ the-wire · showcase

CONSUL PLUGS TOKEN LEAK, AWS PROVIDER EXPANDS AI AND BEDROCK SUPPORT

By RepoJournal · Filed 06:57 UTC on July 17, 2026 · About HashiCorp · Composed from the cited sources · methodology

7 people shipped this

Paras Gupta @paras-gupta2 2 cited

gdavison @gdavison 2 cited

Surabhi-1605 @Surabhi-1605 2 cited

sbldevnet @sbldevnet 1 cited

DanyStinson @DanyStinson 1 cited

subham-ibmhc @subham-ibmhc 1 cited

pajay-rao @pajay-rao

Consul's debug logs were exposing ACL tokens in plaintext, a critical flaw now patched before it reaches production.

In brief

Consul patched a debug token leak that was leaking auth tokens in logs. If you're running this in prod, check your audit trail. This one's a must-update.
Terraform AWS provider adds Bedrock Agent support for Managed Knowledge Bases. RAG deployments just got a terraform-native path.
AWS provider now supports GuardDuty's AI_PROTECTION and AI_ANALYST features. Security tooling catching up to what AWS is actually shipping.
S3 bucket notifications can now list resources instead of querying one at a time. Sounds small, makes your terraform runs actually reasonable at scale.

The Consul team caught and fixed a token leak in debug logging where the full request URL, including plaintext ACL tokens in query parameters, was being logged [1] [2]. This is the kind of credential exposure that bypasses your security controls entirely, so patch immediately. On the AWS provider front, the team is shipping three meaningful expansions: Bedrock now supports managed knowledge bases [3], GuardDuty detectors can configure the new AI_PROTECTION and AI_ANALYST features [4], and S3 bucket notifications gain list operation support [5]. The secretsmanager_secret resource also underwent a refactor to remove the Read function from its List operation [6] [7], a subtle but important change for how the provider handles resource enumeration. Over in consul-k8s, the team implemented a deterministic patch-coverage merge gate that enforces 90% test coverage on new code in PRs [8] [9], removing the dependency on Codecov and making coverage decisions repeatable. This is the kind of CI hardening that prevents coverage regressions from slipping through.

Action items

→ Deploy Consul patch for token leak immediately - check your debug logs now hashicorp/consul [immediate]
→ Update terraform-provider-aws for Bedrock and GuardDuty AI feature support hashicorp/terraform-provider-aws [plan]
→ Review secretsmanager_secret resource behavior after refactor hashicorp/terraform-provider-aws [plan]
→ Monitor consul-k8s PR coverage enforcement for false positives hashicorp/consul-k8s [monitor]

References

[1] fix debug token leak. (#23731) ↗ hashicorp/consul
[2] fix debug token leak. ↗ hashicorp/consul
[3] feat(bedrockagent): add Managed Knowledge Base support (type=MANAGED) ↗ hashicorp/terraform-provider-aws
[4] guardduty: Add support for AI_PROTECTION and AI_ANALYST feature names ↗ hashicorp/terraform-provider-aws
[5] aws_s3_bucket_notification: Add list support ↗ hashicorp/terraform-provider-aws
[6] list resource/aws_secretsmanager_secret: Removes resource Read function from List ↗ hashicorp/terraform-provider-aws
[7] Merge pull request #48856 from hashicorp/td-no-read-in-list-secretsmanager-secret hashicorp/terraform-provider-aws ↗
[8] ci: gate PR merges on >=90% patch coverage ↗ hashicorp/consul-k8s
[9] ci: gate PR merges on >=90% patch coverage (#5424) ↗ hashicorp/consul-k8s