v1.4.10

What's Changed

New Contributors

• @Lukasdoe made their first contribution in #1256

[1.4.10] — 2026-08-03

Added

• CloudFront — cache, origin request, and response headers policies — full CRUD plus GetConfig and ListDistributionsBy...Id for CachePolicy (/2020-05-31/cache-policy), OriginRequestPolicy (/origin-request-policy), and ResponseHeadersPolicy (/response-headers-policy), so Terraform's aws_cloudfront_cache_policy, aws_cloudfront_origin_request_policy, and aws_cloudfront_response_headers_policy create, read, update, and delete end-to-end. Each config round-trips in full: CachePolicyConfig (MinTTL/DefaultTTL/MaxTTL and ParametersInCacheKeyAndForwardedToOrigin), OriginRequestPolicyConfig (header/cookie/query-string behaviors and name lists), and ResponseHeadersPolicyConfig (CORS, security headers, server-timing, custom and remove headers). ETag is returned on every read, If-Match is enforced on update/delete (InvalidIfMatchVersion / PreconditionFailed), and the ...AlreadyExists / NoSuch... / ...InUse error codes match AWS. Reported by @wparad.
• Cognito — state is now account- and region-scoped — user pools, pool domains, identity pools, and identity tags were account-scoped and leaked across regions. They now scope by account and region, and unsigned IDP / Identity data-plane requests infer the owning region from pool and identity IDs, tokens, sessions, or unambiguous client ownership. Persisted state carries the versioned regional schema (on-disk format v3) that an older binary refuses rather than misreads; legacy resources self-place from their region-bearing IDs. Contributed by @Areson.
• CloudFormation — state is now account- and region-scoped — stacks, stack events, exports, and change sets were account-scoped, so same-name stacks collided across regions and exports leaked into cross-region Fn::ImportValue lookups. They now scope by account and region; asynchronous stack work retains the owning region and nested stacks stay co-located with their parent. Contributed by @Areson.
• EKS — ListIdentityProviderConfigs — GET /clusters/{name}/identity-provider-configs was unimplemented and returned No route. It now returns the AWS-shaped identityProviderConfigs list ({name, type}) and a ResourceNotFoundException for an unknown cluster. Contributed by @b-rajesh.
• DynamoDB PartiQL — RETURNING, REMOVE, and richer WHERE predicates — ExecuteStatement now supports RETURNING ALL OLD * / ALL NEW * / MODIFIED OLD * / MODIFIED NEW * on UPDATE and RETURNING ALL OLD * on DELETE, the REMOVE clause, and begins_with / IN / IS MISSING / IS NOT MISSING predicates. An UPDATE whose WHERE matches no item now returns ConditionalCheckFailedException rather than a silent no-op, matching AWS.

Fixed

• IoT — binary topic-rule payloads are no longer corrupted — the rules engine built every rule event by decoding the payload as UTF-8 with errors="replace", so a payload that is not valid UTF-8 reached the action with each non-ASCII byte replaced by U+FFFD. encode(<expr>, 'base64') is now supported and encodes the payload as published, so SELECT encode(*, 'base64') AS data FROM 'telemetry' delivers {"data": "<base64>"} that decodes back to the published bytes — the documented way to reach a Lambda action, which does not accept binary input. No lossy decode remains on the publish → rule → invoke path; a payload that is not valid UTF-8 and whose SELECT projects no attributes dispatches no action rather than dispatching corrupted text. Contributed by @maximoosemine.
• IoT — topic-rule SQL is now evaluated — the rules engine routed a publish to its actions but ignored the rule's SELECT clause, so a rule declaring SELECT deviceId AS id FROM 'sensors/+/telemetry' delivered the whole message instead of the projection. The SELECT clause is now parsed and projected — *, attribute paths, AS aliases, topic() / topic(n), timestamp(), and literals, with unaliased items named as AWS names them and missing attributes omitted — for both delivery paths, Basic Ingest (where topic() reports the topic after the rule prefix) and a publish matching the FROM filter. A JSON payload under SELECT * still arrives as the parsed object. Contributed by @maximoosemine.
• ACM — wildcard SAN DNS validation record now matches its base domain — a certificate with a wildcard subject alternative name emitted a validation ResourceRecord named _acme-challenge.*.example.com, so Terraform's aws_acm_certificate_validation never found the record its aws_route53_record had created and failed with missing DNS validation record. Real ACM strips the leading *., so *.example.com and example.com share one _acme-challenge.example.com CNAME with an identical name and value. RequestCertificate now emits that collapsed record, so the wildcard and apex entries line up and the validation resource resolves. Reported by @wparad.
• API Gateway — HTTP API routes are selected by specificity, not creation order — the v2 router returned the first route whose method and path matched in insertion order, so a dedicated route (e.g. POST /items) could lose to a greedy ANY /{proxy+} catch-all depending on which was created first during terraform apply. Matching routes are now ranked so the most specific one wins, as real API Gateway always dispatches to the most specific match. Contributed by @Lukasdoe.
• EC2 — DescribeAvailabilityZones now returns real AZ IDs — every zone reported its ZoneId as a copy of its ZoneName (e.g. us-east-1a under both), but AWS deliberately differs: names are shuffled per account while IDs are region-coded and stable. ZoneId is now the region-coded form (use1-az1, euc1-az1, apse2-az1, …), matching AWS's coding across every region. Contributed by @bandle.
• DynamoDB — ProjectionExpression list-index results no longer carry null placeholders — projecting a list element (e.g. #i[2]) returned the element behind sparse null entries ([null, null, {…}]) instead of the single projected element, and a sibling attribute in the same projection left the placeholders in place. Projected list results are now compacted to only the referenced elements.
• Persistence — MediaConnect state now persists, and regionalized services carry downgrade protection — MediaConnect had restore logic but was never registered for saves, so its state was lost across restarts; it now persists. Kinesis, Firehose, KMS, EventBridge, ElastiCache, Pipes, Scheduler, SNS, and MediaConnect now advertise the on-disk format version (v3) that an older binary refuses rather than misreading their region-scoped state. Contributed by @Areson.
• CloudWatch — DescribeAlarms over CBOR broke the Terraform AWS provider ≥ 6.50 — alarm StateUpdatedTimestamp / AlarmConfigurationUpdatedTimestamp were serialized as bare unsigned integers in the smithy-rpc-v2-cbor response, so the provider's typed decoder (CloudWatch uses CBOR from provider 6.50) failed the read-back with unexpected value type cbor.Uint and aws_cloudwatch_metric_alarm could not be created. Timestamp members are now encoded as CBOR tag 1 (epoch date-time), which the decoder expects; integer members such as Period and EvaluationPeriods are unchanged. Reported by @sdreger.