v1.5.3

What's Changed

New Contributors

• @jbschooley made their first contribution in #1549

[1.5.3] — 2026-08-28

Added

• Step Functions — the JSONata query language — a state machine declaring QueryLanguage: JSONata now evaluates its {% ... %} expressions through a full JSONata engine: $states and workflow variables bind as documented, the six Step Functions functions ($partition, $range, $hash, $random, $uuid, $parse) are registered, failures surface as States.QueryEvaluationError with the JSONata error code leading the cause (T2010: ...), a malformed expression is refused at CreateStateMachine/UpdateStateMachine with InvalidDefinition (INVALID_JSONATA_EXPRESSION naming the field's path) as AWS refuses it, a non-ISO $toMillis argument and a zero-length-matching $replace regex draw AWS's D3110/D1004, and evaluation carries AWS's 1-second timeout. $eval is absent, as on AWS. Reported by @facuparedes.
• IoT Core — jobs delivered over MQTT — the reserved $aws/things/<t>/jobs/# request topics (get, start-next, <jobId>/get including $next, <jobId>/update) answer on their accepted/rejected topics from the same store the HTTP plane uses, with jobDocument as a JSON object over MQTT (a string over HTTP, as on AWS) and rejections carrying the string ErrorCode values plus the execution's state on version and state-transition conflicts; notify fires when the pending set changes and notify-next only when the queue front changes. stepTimeoutInMinutes and executionNumber are accepted but ignored. Contributed by @iot-rocket.
• IoT Core — provisioning templates, and AWS::IoT::ProvisioningTemplate — CreateProvisioningTemplate and the four other template operations answered Unsupported IoT path and the CloudFormation type rolled back as unsupported; both now work with the wire shapes of the real service (ResourceAlreadyExistsException on duplicates, absent-not-empty description, 1-36 char names, a templateBody without an AWS::IoT::Certificate resource refused). Storage + CRUD only: the fleet-provisioning MQTT workflow is not implemented and versions are not modeled. Contributed by @iot-rocket.
• API Gateway — registered custom domains route the data plane — a request addressed by a registered domain fell through host-pattern service guessing (typically into S3, or into IoT when the name contained iot.); it now resolves through the domain's base-path mappings before any guessing — longest base path wins, "(none)" is the root mapping, a mapping's stage is authoritative — matching the BASE_PATH_MAPPING_ONLY routing mode the records default to. Unregistered hosts are unchanged. Contributed by @iot-rocket.
• CloudFormation — in-place update handlers — a stack update fell through to a destructive re-create for 106 of 132 registered types, wiping published Lambda versions, DynamoDB items, SQS messages and IAM attachments; AWS::Lambda::Function, AWS::DynamoDB::Table, the four API Gateway types, AWS::IoT::TopicRule, AWS::SNS::Topic, AWS::SQS::Queue, AWS::Logs::LogGroup, AWS::S3::BucketPolicy, AWS::IAM::Role and AWS::IAM::ManagedPolicy now update in place through their service's own APIs, replacing only for genuinely create-only properties, as CloudFormation documents per property. Contributed by @iot-rocket.
• S3 — replication delivers, with x-amz-replication-status — a bucket's replication configuration was stored and echoed but never acted on: no object ever reached the destination and HeadObject showed no replication metadata. A write (put, POST upload, copy, or multipart complete) matching an Enabled rule's prefix now lands a copy in the destination bucket with its own version, the source's metadata, storage class override, and tags; the source object answers ReplicationStatus: COMPLETED (or FAILED when the destination is gone or no longer versioned) and the replica answers REPLICA, on current and version-addressed reads alike. The copy is synchronous so tests see a deterministic status. Delete-marker replication and replica re-replication are not modeled. Reported by @cringdahl.

Fixed

• CloudFormation — a resource that cannot be deleted fails the operation — a missing delete handler was a log warning and DeleteStack reported DELETE_COMPLETE while resources lived on; the stack now lands DELETE_FAILED (failed resources retained for a retry, exports kept, deleted siblings gone) and a failed rollback lands ROLLBACK_FAILED/UPDATE_ROLLBACK_FAILED, per the documented lifecycle. AWS::Lambda::Version gained a real delete handler (its Ref now returns the qualified version ARN, as on AWS) and AWS::AppSync::GraphQLSchema one that removes the stored schema. Contributed by @iot-rocket.
• IoT Core — an HTTP shadow write publishes the reserved-topic notifications — UpdateThingShadow over the REST data plane stored state and emitted nothing, so a topic rule on .../shadow/update/accepted fired for MQTT updates only; an accepted HTTP update now publishes update/accepted/delta/documents (and a delete its delete/accepted) through the same emission code as the MQTT bridge, which also fixed the documents envelope on both transports: it now echoes the request's clientToken and carries state + metadata + version only. Contributed by @iot-rocket.
• IoT Core — device-plane job timestamps were milliseconds, 1000x off — iot-jobs-data responses served epoch milliseconds where the API reference words every stamp "in seconds since the epoch"; every device-plane stamp, HTTP and MQTT alike, is now whole epoch seconds. Contributed by @iot-rocket.
• Step Functions — execution status changes are published to EventBridge — real Step Functions automatically emits source: aws.states / detail-type: "Step Functions Execution Status Change" to the default bus whenever a standard execution changes status; MiniStack ran the execution and published nothing, so a rule matching those events never fired and applications waiting on them hung with no error anywhere. Every StartExecution now emits RUNNING and its completion SUCCEEDED, FAILED (with error/cause and REDRIVABLE) or ABORTED on StopExecution, carrying the documented detail fields with epoch-millisecond dates; payloads over 248 KiB are excluded and flagged via inputDetails/outputDetails, and StartSyncExecution (the express-flavored path) emits nothing, as on AWS. Reported by @moonyseven.
• ECS — a service's tasks register in its target groups — a loadBalancers block was stored and never acted on, so DescribeTargetHealth stayed empty and every request through the load balancer fell to the listener's default action; a service now reconciles its target groups from its running tasks' addresses (awsvpc tasks carry their address as attachments[].details[privateIPv4Address], where real ECS reports it), withdrawing only its own registrations so manually registered targets and a second service sharing the group survive, as on AWS. Contributed by @jbschooley.
• ECS — an awsvpc task no longer publishes host ports — each awsvpc task has its own network namespace on AWS, so container ports never bind on the host; publishing them made two tasks sharing a container port collide with a Docker bind error that cannot happen on Fargate. Only bridge and host modes publish. Contributed by @jbschooley.
• ELBv2 — a rule condition sent as a typed config is read — only the flat legacy Values list was parsed, so a rule created by Terraform (which sends PathPatternConfig/HostHeaderConfig/HttpRequestMethodConfig/SourceIpConfig) stored an empty condition and never fired; both shapes now parse, DescribeRules echoes the typed config alongside Values as AWS does, and the data-plane matcher recognizes AWS's http-request-method field name. Contributed by @jbschooley.