v1.4.6

What's Changed

[1.4.6] — 2026-07-24

Added

• EC2 — AWS::EC2::VPCEndpoint CloudFormation support — VPC endpoints now provision through CloudFormation into the shared EC2 state, so DescribeVpcEndpoints returns them; Ref returns the vpce- id and Fn::GetAtt exposes Id. Endpoint type, VPC/route/subnet/security-group associations, tags, and in-place updates are supported. Contributed by @robert-pitt-foodhub.
• API Gateway v1 — AWS::ApiGateway::DocumentationVersion CloudFormation support — documentation versions now create, update, and replace through CloudFormation; Ref returns the {RestApiId}/{DocumentationVersion} identity, and a version change triggers replacement. Contributed by @robert-pitt-foodhub.
• API Gateway v1 — AWS::ApiGateway::RequestValidator CloudFormation support — request validators now provision through CloudFormation; both Ref and Fn::GetAtt RequestValidatorId return the validator id. A Name or RestApiId change triggers replacement while the validation flags update in place. Contributed by @robert-pitt-foodhub.
• AppSync — AWS::AppSync::FunctionConfiguration CloudFormation support — pipeline functions now provision through CloudFormation; Ref returns the function ARN and Fn::GetAtt exposes FunctionArn, FunctionId, Name, and DataSourceName. An ApiId change triggers replacement. Contributed by @robert-pitt-foodhub.
• Lambda — AWS::Lambda::Url CloudFormation support — function URLs now provision through CloudFormation and share the Function URL API state; Fn::GetAtt exposes FunctionArn and FunctionUrl, AuthType/InvokeMode/Cors update in place, and a TargetFunctionArn or Qualifier change triggers replacement. UpdateFunctionUrlConfig now also applies InvokeMode. Contributed by @robert-pitt-foodhub.
• CloudWatch Logs — AWS::Logs::ResourcePolicy CloudFormation support — resource policies now provision through CloudFormation; Ref returns the PolicyName, a policy-document change updates in place, and a PolicyName change triggers replacement. Contributed by @robert-pitt-foodhub.
• CloudFront — AWS::CloudFront::CloudFrontOriginAccessIdentity CloudFormation support — origin access identities now provision through CloudFormation; Ref returns the identity id (E…) and Fn::GetAtt exposes Id and S3CanonicalUserId, both retained across comment updates. Contributed by @robert-pitt-foodhub.
• API Gateway v1 — GetExport — a REST API stage can now be exported as OpenAPI 3 (oas30) or Swagger 2 (swagger), in JSON or YAML, with the optional integrations extension included on request. Contributed by @robert-pitt-foodhub.
• RDS — Aurora MySQL global replication — Aurora MySQL 8 global clusters now replicate from the global writer to secondary-region readers over GTID-based binary log replication, with binlog retention bounded on the source and fail-closed handling for volumes initialized by an older version. Contributed by @Areson.
• Region scoping — Athena, Auto Scaling, Cloud Map, EFS, EMR, Inspector2, Amazon MQ, AppSync, and S3 Files — state is now isolated by account and region, so same-named resources in different regions no longer collide. Persisted state carries a versioned regional schema (on-disk format v3) that an older binary refuses rather than misreads, and legacy state migrates by recovering each record's region from its stored ARNs. Contributed by @Areson.

Fixed

• API Gateway v2 — queryStringParameters/body sent as null instead of omitted — the HTTP API v2 Lambda proxy event included queryStringParameters/body with a null value when a request had no query string or no payload, rather than omitting the key entirely as real AWS does. Strict event-shape validators (e.g. AWS Lambda Powertools' isAPIGatewayProxyEventV2) accept undefined or a proper value but reject null, so every bodyless or querystring-less request against such a validator failed with an unhandled InvalidEventError, even though the invocation itself succeeded and the Lambda's own business logic never ran. Contributed by @ryan-bennett.
• Cognito — Hosted UI bound the authorization code to the raw email alias instead of the resolved Username — in pools with UsernameAttributes or AliasAttributes, the email entered on the Hosted UI login page was bound to the authorization code verbatim, so the code exchange keyed off the alias rather than the user's real Username. The login and new-password submit paths now bind the code to the Username resolved by the alias lookup. Contributed by @kjdev.
• CloudFormation/Lambda — Docker-executed custom resources hung because the ResponseURL used localhost — with LAMBDA_EXECUTOR=docker, a Lambda-backed custom resource completed its work but could not post its completion callback: the ResponseURL pointed at localhost, which inside the Lambda container resolves to the container itself rather than the host running MiniStack, so the PUT failed with connection refused and the stack sat in CREATE_IN_PROGRESS until the one-hour service timeout. The ResponseURL handed to a container-executed custom resource now rewrites localhost/127.0.0.1 to host.docker.internal, the same host already used for AWS_ENDPOINT_URL; explicitly configured hostnames are left untouched. Reported by @robert-pitt-foodhub.