v1.4.19

What's Changed

New Contributors

• @JoseExposito made their first contribution in #1408
• @tema-mazy made their first contribution in #1407
• @nightcityblade made their first contribution in #1410

[1.4.19] — 2026-08-16

Added

• IoT Core — device shadows over MQTT — the classic and named device-shadow operations are now served over the broker at the AWS reserved topics. Publishing to $aws/things/<thing>/shadow[/name/<name>]/{get,update,delete} drives the same shadow store the HTTP data plane uses and replies on the matching accepted / rejected topics; an update also publishes delta (when desired and reported differ) and documents (with previous/current, delta stripped). Malformed JSON is rejected on the verb's rejected topic, and every response echoes the request's clientToken, as on AWS. Contributed by @iot-rocket.
• IoT Core — sqs topic-rule action — a rule carrying {"sqs": {"queueUrl", "roleArn", "useBase64"}} was stored and then dispatched nothing. The payload now goes through SQS's own SendMessage, so the queue's DelaySeconds and size limit apply; useBase64 Base64-encodes the body as on AWS; an unresolvable queue fails that action alone and reaches the rule's errorAction; FIFO destinations are refused, which AWS does not support for this action. Contributed by @iot-rocket.
• IoT Core — CA-certificate registry and just-in-time-registration events — GetRegistrationCode, DeleteRegistrationCode, RegisterCACertificate (setAsActive / allowAutoRegistration as query parameters), DescribeCACertificate, UpdateCACertificate, ListCACertificates and DeleteCACertificate are served. Deleting an ACTIVE CA is refused with CertificateStateException (406), a duplicate CA is ResourceAlreadyExistsException (409), and RegisterCertificate validates caCertificatePem against the registered, actually-signing CA before storing anything, answering CertificateValidationException (400) otherwise. Registering a device certificate under an ACTIVE auto-registration CA publishes the JITR lifecycle event to $aws/events/certificates/registered/{caCertificateId}. Deleting an ACTIVE device certificate now answers the modeled CertificateStateException (406) instead of a generic 409. Contributed by @iot-rocket.
• IoT Core — MQTT 5.0 negotiated per connection — the broker negotiates its wire format from the CONNECT packet's protocol level: a 5.0 client receives property blocks, subscription options and reason codes on CONNACK/SUBACK/PUBACK/UNSUBACK/DISCONNECT, a 3.1.1 client keeps getting the exact bytes it did before, and a message crosses between the two versions. The CONNACK advertises AWS's server capabilities — Maximum QoS 1 (no QoS 2), Maximum Packet Size 128 KB, Retain Available, wildcard subscriptions — and features the broker does not implement (topic aliases, shared subscriptions, subscription identifiers) are advertised as unavailable rather than left silent. Contributed by @iot-rocket.
• IoT Core — connectivity.* terms in the fleet index — with thingConnectivityIndexingMode: STATUS in the indexing configuration, SearchIndex answers connectivity.connected, connectivity.timestamp and connectivity.disconnectReason, every hit carries the connectivity group, and DescribeIndex's schema reports ..._AND_CONNECTIVITY_STATUS. connected is derived from the live session registry — a thing is connected while a session whose client id equals the thing name is live — so it cannot drift or survive a restart, and the disconnect reason is one of CLIENT_INITIATED_DISCONNECT, DUPLICATE_CLIENTID or CONNECTION_LOST (the reasons the broker can distinguish). Contributed by @iot-rocket.

Fixed

• EventBridge — event-pattern matching follows AWS — the matcher was rewritten to AWS's real semantics. A pattern whose only key is $or, or whose keys are all unrecognized envelope fields, no longer matches every event; $or is expanded with AWS's last-write-wins on a repeated field and its 1000-rule-combination cap; wildcard treats only * as special, with \ escaping and consecutive * refused; exists works on leaf nodes; resources is an OR; and cidr, equals-ignore-case, and case-insensitive prefix/suffix are evaluated. An unparseable pattern is rejected with InvalidEventPatternException at PutRule, TestEventPattern, CreateArchive and UpdateArchive. Contributed by @t-rech.
• Cognito — federation endpoints are built from the user pool's domain, and CustomDomainConfig is honored — CreateUserPoolDomain accepted CustomDomainConfig and discarded it, always expanding Domain to {Domain}.auth.{region}.amazoncognito.com, while the SAML ACS URL and the OIDC federation callback ignored the domain entirely and were built from MINISTACK_HOST/GATEWAY_PORT. Federated sign-in therefore handed external identity providers redirect_uri=http://localhost:4566/oauth2/idpresponse — an address the browser cannot reach and that Google and other public IdPs reject outright for the scheme alone — so the flow died at the hop to the IdP with no way to correct it. CustomDomainConfig now distinguishes a custom domain (a full FQDN, served as-is and reported as CustomDomain on DescribeUserPool, fronted by a CloudFront distribution) from a prefix domain (a bare label, still expanded to the regional host), and /saml2/idpresponse and /oauth2/idpresponse — including the AssertionConsumerServiceURL in the generated SAML AuthnRequest and the redirect_uri replayed on the back-channel token exchange — are derived from whichever the pool has, exactly as AWS derives them. Configuring a custom domain is the same create-user-pool-domain --custom-domain-config CertificateArn=... call you would make against AWS; the certificate is recorded, not served, since TLS for a custom domain is terminated by whatever fronts it (nginx, an ALB, CloudFront) and proxied to the gateway. A pool holds one domain of each kind independently, a CustomDomainConfig without a CertificateArn is a InvalidParameterException, and a pool with no domain still falls back to the local gateway, so existing setups are unchanged. Contributed by @tema-mazy.
• DynamoDB — enabling a stream through UpdateTable sets the stream ARN — UpdateTable with StreamSpecification.StreamEnabled=true stored the specification but left LatestStreamArn and LatestStreamLabel unset, so aws_dynamodb_table.stream_arn came back empty in Terraform. Enabling a stream on the disabled→enabled transition now mints the label and arn:aws:dynamodb:<region>:<account>:table/<name>/stream/<label>, exactly as CreateTable already does, and DescribeStream resolves the new ARN. Contributed by @nightcityblade. Reported by @wparad.
• Lambda — the 250 MB unzipped limit counts function code plus layers — the unzipped-size check was applied to the deployment package on its own, so a function whose code and attached layers exceeded 250 MB together (each under the limit individually) was accepted, unlike AWS. CreateFunction and UpdateFunctionCode now sum the function code and every attached layer, unzipped, and reject a total over 262144000 bytes with InvalidParameterValueException, matching AWS's quota — "the maximum size of the contents of a deployment package, including layers and custom runtimes". Publishing a single oversized layer is still refused on its own. Reported by @iot-rocket.