v1.4.20

What's Changed

New Contributors

• @MGSousa made their first contribution in #1405
• @vivedo made their first contribution in #1442

[1.4.20] — 2026-08-19

Added

• RDS — FailoverDBCluster — forcing an Aurora failover was InvalidAction; it now promotes a reader to writer (explicit TargetDBInstanceIdentifier or the lowest PromotionTier), reporting the transitional failing-over status and flipped IsClusterWriter flags. Metadata-only until per-instance replication lands. Contributed by @Kiran01bm.
• RDS — opt-in Aurora PostgreSQL reader replication — with MINISTACK_RDS_PG_CLUSTER_REPLICATION=1, extra cluster members run their own PostgreSQL containers, cloned with pg_basebackup and streaming WAL as hot standbys (read-only, ReaderEndpoint resolves to a reader). Off by default; Aurora MySQL and the no-flag path keep aliasing the writer's shared container. Contributed by @Kiran01bm.
• CloudFormation — API Gateway (v1) API keys and usage plans — AWS::ApiGateway::ApiKey, UsagePlan and UsagePlanKey failed with Unsupported resource type; they now provision through the runtime stores with Ref and Fn::GetAtt wired, unblocking CDK RestApi/ApiKey and Terraform aws_api_gateway_api_key. Contributed by @ryan-bennett.
• AWS IoT Jobs — control plane and device data plane — CreateJob fell through to Unsupported IoT path and iot-jobs-data did not exist; the iot service now serves the nine job operations and a new iot-jobs-data service the device ones, sharing one store and the AWS execution state machine. Contributed by @iot-rocket.

Fixed

• S3 — server-side encryption is stated, validated, and enforced — SSE-S3, SSE-KMS and SSE-C headers were accepted and forgotten. SSE is now contract state: validated on write, echoed on HEAD/GET, and enforced for SSE-C (keyless/plain read 400 InvalidRequest, wrong-key read 403 AccessDenied), following versions, copies and multipart completes. Contributed by @gaul.
• DynamoDB — key attribute types are enforced on PutItem, Query, and UpdateTable — a key declared S accepted an N value on write and in a key condition, and an attribute-definitions-only UpdateTable changed a key's type in place; all three now return ValidationException, so no API changes a key's type. Reported by @iot-rocket.
• CloudWatch — extended-statistic percentiles are computed instead of aliased to Average — GetMetricData and alarm evaluation now interpolate pNN from the period's samples on both paths, and a percentile alarm's StateReason reports the actual statistic (e.g. p95). Contributed by @MGSousa.
• S3 — presigned SigV4 URLs verify for virtual-hosted addressing and temporary credentials — a virtual-hosted URL was rewritten to path-style before its signature was recomputed, and an STS-signed URL was checked against the static secret; verification now runs against the original signed URI and the secret STS issued. Reported by @mayankgupta57.
• Step Functions — arn:aws:states:::events:putEvents actually publishes the event — the optimized EventBridge integration fell through to the task passthrough, so the state reported SUCCEEDED while nothing reached any target; it now calls EventBridge PutEvents and returns its response. Reported by @iwasakar.
• S3 — SSE-C is enforced and echoed on UploadPartCopy and CompleteMultipartUpload — UploadPartCopy accepted a part for an SSE-C upload without the upload's key and read an SSE-C copy source without the source key, and neither echoed the stored encryption; UploadPartCopy now requires both keys (including a ?versionId=-qualified source) and echoes SSECustomerAlgorithm/SSECustomerKeyMD5, and CompleteMultipartUpload echoes ServerSideEncryption. Contributed by @iot-rocket.
• Aurora DSQL — SELECT ... FOR UPDATE is gated on lock strength, not the predicate — strict mode rejected a locking read unless it was a single table with an equality on every key column (0A000), failing quoted identifiers from every mainstream ORM. Measured against a live cluster, FOR UPDATE now locks whatever the query selects, while FOR NO KEY UPDATE/FOR SHARE/FOR KEY SHARE are refused with 0A000. Contributed by @vivedo.
• Aurora DSQL — quoted identifiers are normalized the way the server stores them — DROP COLUMN "ID" and mixed-case or schema-qualified table names were mis-resolved; identifiers are now folded as PostgreSQL folds them (bare lower-cased, quoted verbatim) and the relation requoted part by part before lookup. Contributed by @vivedo.
• CloudFormation — AWS::IoT::Policy updates apply instead of rolling the stack back — the type had no update handler, so an edit hit ResourceAlreadyExistsException and rolled back. A changed PolicyDocument is now a no-interruption update stored as a new default version (pruned to IoT's five-version cap), and a changed PolicyName is a replacement. Contributed by @maximoosemine.
• EC2 — instance public IP and DNS reach the SDKs — DescribeInstances/RunInstances emitted the address under publicIpAddress/publicDnsName rather than the wire tags ipAddress/dnsName, so every SDK dropped both; they now ride the real tags, and generated addresses complete to four octets. Contributed by @iot-rocket.
• S3 — versioning edge cases: the null version, delete markers, and versioned copies — suspended-bucket PUT/DELETE store under the literal null version, pre-versioning objects stay addressable as VersionId=null, DeleteObjects mints markers (x-amz-delete-marker: true on the hidden 404), and UploadPartCopy/CopyObject honor the source ?versionId=. Contributed by @gaul.
• S3 — CompleteMultipartUpload honors If-Match / If-None-Match — conditional writes landed on PutObject but were ignored on the multipart path, so a create-once or compare-and-swap upload could silently overwrite; the complete now evaluates the same preconditions (412 on violation, 404 NoSuchKey for If-Match on a missing object). Contributed by @gaul.
• S3 — canned ACLs are stored, and object ACLs bind to versions — PutBucketAcl/CreateBucket dropped the x-amz-acl header SDKs send, so buckets read back owner-only; both now validate and store the canned grants (InvalidArgument/MalformedACLError/MissingSecurityHeader as on AWS), and object ACLs are per-version like tags. Contributed by @gaul.
• S3 — CRC64NVME checksums are computed instead of refused — the default SDK/CLI checksum algorithm returned InvalidRequest, so a stock aws s3 cp failed; it is now computed from a stdlib table (no new dependency), validated on upload (BadDigest on mismatch) and returned on GET/HEAD. CRC32C still needs its native library. Contributed by @gaul.
• CloudFormation — auto-generated physical names keep their uniqueness suffix when truncated — a deeply-nested stack whose generated name exceeded a resource's name cap truncated every resource to the same string and collapsed them onto one; the hash suffix that guarantees uniqueness is now always preserved. Contributed by @ryan-bennett.
• IAM — role Description charset is validated — CreateRole, UpdateRole and UpdateRoleDescription now reject a description outside IAM's allowed character set or longer than 1000 characters with 400 ValidationError. Reported by @iot-rocket.
• CloudFormation — AWS::SSM::Parameter goes through the SSM API — instead of writing the store directly, so a create over an existing name fails (ParameterAlreadyExists), updates increment Version, a Name change replaces, SecureString is rejected, and Fn::GetAtt exposes Arn/Type/Value. Reported by @iot-rocket.
• CloudFormation — AWS::SSM::Parameter::Value<...> is re-resolved on UpdateStack — the parameter name is kept and re-resolved on every operation, so an update with UsePreviousValue=true picks up a value changed in Parameter Store since the last deploy. Reported by @iot-rocket.