v1.4.4

What's Changed

New Contributors

• @yl made their first contribution in #1107
• @robert-pitt-foodhub made their first contribution in #1125
• @jasondcamp made their first contribution in #1115

[1.4.4] — 2026-07-22

Added

• RDS — DisableHttpEndpoint — the Aurora Data API HTTP endpoint could be enabled via EnableHttpEndpoint but never disabled: DisableHttpEndpoint returned InvalidAction. It now mirrors enable, setting HttpEndpointEnabled to false on the cluster matching ResourceArn. Contributed by @jayjanssen.
• ALB — data-plane forwarding to instance/ip targets — the ALB data plane routed live traffic to Lambda targets only; instance/ip target groups returned 502 Target type not supported. Requests are now proxied over HTTP to the registered target with hop-by-hop headers stripped, X-Forwarded-* and X-Amzn-Trace-Id injected, and connection failures surfaced as 502. Contributed by @jasondcamp.
• ElastiCache — Valkey engine — Engine=valkey fell into the memcached branch, requesting a nonexistent image and falling back to memcached's port 11211. CreateCacheCluster/CreateReplicationGroup now spawn a real valkey/valkey:<major.minor>-alpine container on port 6379 (AWS versions 7.2, 8.0, 8.1), and DescribeCacheEngineVersions lists them. Contributed by @jasondcamp.
• KMS — GenerateDataKeyPair and GenerateDataKeyPairWithoutPlaintext — the emulator had GenerateDataKey but no data-key-pair operation, so both returned InvalidAction. They now generate an asymmetric data key pair wrapped under a symmetric CMK (the WithoutPlaintext variant omits PrivateKeyPlaintext) across the AWS KeyPairSpec enum, SM2 excluded. Contributed by @yl.
• API Gateway v1 — AWS::ApiGateway::GatewayResponse (CloudFormation) — CDK/CloudFormation stacks customizing REST API errors rolled back with Unsupported resource type. The v1 control plane now serves PutGatewayResponse/GetGatewayResponse(s)/DeleteGatewayResponse, and the resource provisions with in-place updates and generated-default restore on delete. Contributed by @robert-pitt-foodhub.
• Cognito — NEW_PASSWORD_REQUIRED in the Hosted UI — a first-login FORCE_CHANGE_PASSWORD user was let straight through the managed-login endpoint, issuing an OAuth code without ever changing the temporary password. The Hosted UI now shows a change-password form, enforces the pool policy, and completes to the code once the password is set. Contributed by @kjdev.
• s3tables — CloudFormation and Iceberg REST — AWS::S3Tables::TableBucket/Namespace/Table now provision through CloudFormation, and the Iceberg REST catalog surface (config, namespaces, tables, load-table, commit) is served for table buckets, backed by DuckDB. Contributed by @squirmy.
• RDS — Aurora shared-storage model — cluster members previously provisioned diverging per-instance databases. They now share one cluster-owned container, so tables, users, and grants created through one member are visible through the writer and reader endpoints and the RDS Data API. Contributed by @Areson.
• Region scoping — EventBridge Scheduler, CodeBuild, and Resource Groups — state is now isolated by account and region, so same-named resources in different regions no longer collide. Persisted state carries a versioned regional schema that an older binary refuses rather than misreads. Contributed by @Areson.

Fixed

• Batch — UpdateComputeEnvironment — Terraform aws_batch_compute_environment with an update_policy block failed with InvalidAction. UpdateComputeEnvironment now resolves the compute environment by name or ARN and applies state, serviceRole, computeResources, updatePolicy, unmanagedvCpus, and context. Reported by @smoores-dev.
• S3 — empty object tag value — a bare x-amz-tagging key with no =value was dropped instead of stored. Empty tag values are now preserved as a tag with an empty value, matching real S3. Contributed by @murlock.
• EC2 — DescribeSecurityGroupRules by rule id — the operation ignored SecurityGroupRuleIds (a group filter was required) and rule ids shifted when another rule on the group was revoked. Rule ids are now stable and content-derived and SecurityGroupRuleIds is honored, fixing Terraform aws_vpc_security_group_ingress_rule refresh. Reported by @staranto.
• Lambda — docker worker respawn on config change — with LAMBDA_EXECUTOR=docker, UpdateFunctionConfiguration left the old container running with stale config because the reaper matched the pre-region-scoping key shape. It now reaps the function's containers so the next invocation uses the new configuration. Reported by @ykharko.