v1.4.12

What's Changed

New Contributors

• @roshie548 made their first contribution in #1282
• @ovsteenb made their first contribution in #1287

[1.4.12] — 2026-08-06

Added

• CloudWatch Logs — GetLogRecord, Insights @ptr rows, and StartLiveTail — StartQuery / GetQueryResults previously stubbed empty results, so there was no way to obtain an Insights @ptr or round-trip GetLogRecord. PutLogEvents now assigns an opaque pointer per event; Insights queries return matching rows in the AWS field/value shape (@ptr, @timestamp, @message, @logStream, @log); and GetLogRecord resolves those pointers to the full transformed field map (unmask accepted, masking not implemented). Insights evaluates a CWLI subset: fields, chained | filter (@field = '…', @field like /regex/[i] with AND semantics), | sort @timestamp asc|desc, and | limit applied after filter+sort as min(query limit, StartQuery limit). StartLiveTail holds a wire-valid application/vnd.amazon.eventstream open until client disconnect (initial-response, then sessionStart, then sessionUpdate frames fed by matching concurrent PutLogEvents); idle heartbeats are once per second and at most 10 updates are buffered (oldest dropped, sampled set). FilterLogEvents now returns the eventId real AWS assigns, while GetLogEvents keeps its {timestamp, message, ingestionTime} shape. DescribeLogGroups returns both arn (with trailing :*) and logGroupArn (StartLiveTail-safe, no star). Full CWLI (stats, parse, or, …) remains out of scope. Contributed by @ovsteenb.
• Lambda — PutFunctionRecursionConfig / GetFunctionRecursionConfig — the recursion-config sub-resource used by Terraform's aws_lambda_function_recursion_config was unrouted, so GET/PUT /2024-08-31/functions/{name}/recursion-config fell through to a ResourceNotFoundException. Both operations are now served: RecursiveLoop defaults to Terminate, accepts Allow / Terminate, round-trips per function, and returns ResourceNotFoundException for an unknown function. Reported by @mayankgupta57.
• API Gateway v2 — state is now account- and region-scoped — HTTP and WebSocket APIs, routes, integrations, stages, deployments, authorizers, responses, and tags were account-scoped, so control-plane resources and execute-api resolution bled across regions. They now scope by account and region, with execute-api dispatch pinning each request to its owning API's region. Contributed by @Areson.

Fixed

• S3 — lifecycle And filters no longer hang the Terraform waiter — a aws_s3_bucket_lifecycle_configuration rule using an And filter (prefix + tags) never converged, timing out the provider's 3-minute waiter. The AWS provider expands the And operator with ObjectSizeGreaterThan = 0 (and, for a prefixless And, Prefix = ""), which GetBucketLifecycleConfiguration omitted, so the provider's reflect.DeepEqual equality check never matched. The And operator now echoes ObjectSizeGreaterThan (0 when unset) and an empty Prefix when unset, and explicit object-size filters round-trip at both the filter and And level. Reported by @rogercost.
• DynamoDB — Scan / Query with ProjectionExpression and no Select — a scan or query supplying only ProjectionExpression was rejected with Select value ALL_ATTRIBUTES is not compatible with ProjectionExpression. Per the AWS API a ProjectionExpression without Select is equivalent to SPECIFIC_ATTRIBUTES; the effective default is now SPECIFIC_ATTRIBUTES whenever a projection is present, while an explicit incompatible Select (ALL_ATTRIBUTES, COUNT, …) with a ProjectionExpression is still rejected. Reported by @jin-gizmo.
• DynamoDB Streams — long-lived containers no longer accumulate stream backlog — shard records grew without bound and event-source-mapping poll state was never released, so memory and read latency degraded over a container's lifetime. Stream records now expire after 24 hours and per-mapping poll state is released, with reads resuming from the trim horizon after expiry. Contributed by @maximoosemine.
• RDS — DB subnet group and security-group fidelity — subnet groups did not resolve their VPC or availability zones and VpcSecurityGroupIds were dropped on cluster writes. Subnet groups now resolve VpcId and AZs from the referenced EC2 subnets and return InvalidSubnet for an unknown subnet, and VpcSecurityGroupIds on CreateDBCluster / ModifyDBCluster are preserved rather than mangled by the Query serializer. Contributed by @Areson.
• EC2 — DescribeVolumes now evaluates Filters — the operation ignored Filters and returned every volume; it now matches on volume-id, size, status, volume-type, availability-zone, snapshot-id, create-time, encrypted, multi-attach-enabled, attachment.*, and tag: / tag-key. Contributed by @bandle.
• EC2 — DescribeSubnets now evaluates the cidr-block filter — the cidr-block / cidr / cidrBlock aliases were ignored; they now match a subnet's CidrBlock exactly. Contributed by @bandle.
• EC2 — DescribeInternetGateways now evaluates Filters — the operation parsed only InternetGatewayId and ignored Filters, returning every gateway in the account; filters are now applied. Contributed by @bandle.
• Step Functions — Map Parameters applied per item only — a Map state applied Parameters to the state input and then reused it as the per-item selector. Parameters is the legacy spelling of ItemSelector, so it is now applied only per item. Contributed by @bandle.
• Step Functions — EC2 aws-sdk parameter names no longer over-expanded — acronym expansion (needed for RDS, e.g. DbClusterIdentifier → DBClusterIdentifier) was wrongly applied to EC2, mangling already-correct names such as VpcId and EnableDnsHostnames. EC2 aws-sdk parameter names now pass through unchanged. Contributed by @bandle.
• Lambda — SDK client stub lookup normalized — JSON-RPC SDK client stubs are now keyed by exact full module specifier (including the events and logs aliases), preserving bundled-module precedence and the actionable local-executor error for a missing stub. Contributed by @roshie548.
• Lambda — durable execution restore scoping — the durable-execution restore path rebuilt timers and callback indexes only for the ambient account, so executions in non-default accounts could stall and non-boot-region executions could re-arm under the wrong region after a restart. Restore now rebuilds across every persisted account scope and derives each execution's account and region from its DurableExecutionArn. Contributed by @Areson.