v1.5.5

[1.5.5] — 2026-09-01

Added

• Bedrock — Knowledge Base ingestion reads the bucket, and Retrieve retrieves — StartIngestionJob answered COMPLETE with an all-zero statistics block without touching the data source, and Retrieve answered [] forever, so a green ingestion run was indistinguishable from a working one. The job now reads the S3 data source (honouring inclusionPrefixes) and reports real statistics — scanned, new versus modified, and non-UTF-8 documents as failed with a reason each; a source it cannot read at all (missing bucket, non-S3 type) lands FAILED with failureReasons instead of a fabricated success. Retrieve searches the ingested documents lexically and returns content, the s3Location of each hit and a score, ResourceNotFoundException for an unknown knowledge base. Reported by @bradleyhet.
• KMS — multi-Region keys and ReplicateKey — CreateKey with MultiRegion mints an mrk- key carrying MultiRegionConfiguration, and ReplicateKey creates a same-id replica in another region sharing the key material, so a ciphertext from the primary decrypts against the replica. Invalid sources and occupied regions are refused as on AWS, and deleting a primary with live replicas lands PendingReplicaDeletion. Reported by @cringdahl.

Changed

• RDS — the Aurora MySQL replication channel operations are role-independent — No user-visible behavior changes. Contributed by @Areson.

Fixed

• RDS — a cluster endpoint is a stable name, not the container's current address — the endpoint reported for a cluster changed as it came up (an AWS-shaped hostname, then localhost, then the container's IP), so anything that stored it — Terraform reads once, at create — held a value that went stale whenever the container was replaced. The AWS-shaped endpoint the cluster already advertises is now registered as a Docker network alias on its container and reported unchanged, so the stored value keeps resolving after a replacement. Skipped where Docker refuses aliases (the default bridge), which behaves exactly as before; localhost and MINISTACK_HOST never qualify as aliases. Contributed by @jbschooley.
• Gateway — a gzip-compressed request body is inflated before the service reads it — smithy's @requestCompression trait makes an AWS SDK gzip a request body once it passes REQUEST_MIN_COMPRESSION_SIZE_BYTES (default 10240) and send Content-Encoding: gzip; CloudWatch PutMetricData carries the trait, so boto3 compresses it with no client configuration. The handler parsed the compressed bytes, so a PutMetricData call of more than 10 KB answered 200 and stored nothing, losing every datapoint in the batch without an error. The body is now inflated once the target service is known and the gzip token dropped from Content-Encoding. S3 is excluded: there Content-Encoding is object metadata, so a gzip upload keeps the exact bytes it was sent and returns the header on GetObject. Contributed by @Lukasdoe.
• Bedrock — guardrails guard — ApplyGuardrail evaluated nothing: every input answered action: NONE with an empty assessment, a nonexistent guardrail id answered HTTP 200, and Converse ignored guardrailConfig entirely, so a guardrail test suite went green while letting everything through. The deterministic policies are now enforced — word policy, the sensitive-information regexes, and the pattern-matchable PII types (EMAIL, PHONE, IP/MAC address, URL, SSN, card numbers, AWS keys) with BLOCK and ANONYMIZE honoured per input/output stage — with the documented response anatomy: GUARDRAIL_INTERVENED, the blocked messaging as output, and the per-policy assessment. Converse and ConverseStream apply the same evaluation to both stages (stopReason: guardrail_intervened, guardrail trace on request), and an unknown id answers ResourceNotFoundException everywhere. The model-graded policies (topic, content, contextual grounding, PROFANITY) still need a classifier and are not evaluated. Reported by @bradleyhet.
• Bedrock — InvokeAgent no longer fabricates an ORCHESTRATE trace — with enableTrace the canned reply was preceded by an orchestrationTrace describing reasoning that never ran, which made the absence of orchestration harder to detect from the one artifact a developer would check. No trace events are emitted. Reported by @bradleyhet.
• Cognito — PreventUserExistenceErrors=ENABLED hides an unknown user — USER_PASSWORD_AUTH, USER_SRP_AUTH and ADMIN_USER_PASSWORD_AUTH answer NotAuthorizedException (at RespondToAuthChallenge too, which is what closes SRP), ForgotPassword and ResendConfirmationCode answer a simulated CodeDeliveryDetails with the masked Destination (j****@e****), and ConfirmForgotPassword answers CodeMismatchException. Admin directory operations keep UserNotFoundException, and CUSTOM_AUTH is untouched. Contributed by @fhfournier.
• Lambda — SQS event source mapping records carry AWSTraceHeader and the FIFO attributes — the trace header and MessageGroupId/MessageDeduplicationId/SequenceNumber were dropped from the event's attributes map; each now rides the record when set, per the documented event shape. Reported by @future-h-takeda-g3.
• Request bodies assemble in linear time — the ASGI body reader, the aws-chunked decoder, S3 CompleteMultipartUpload and the DSQL proxy's row serialization each rebuilt an immutable bytes per chunk; all four now collect and join once, taking a 95 MB PutObject from ~23 s to ~0.3 s. Reported by @vernonhaughton.