v1.5.7

What's Changed

New Contributors

• @mm-salesqueze made their first contribution in #1613

[1.5.7] — 2026-09-04

Added

• Cognito — identity pool principal tag attribute maps — SetPrincipalTagAttributeMap and GetPrincipalTagAttributeMap were missing, so a CDK or CloudFormation deployment declaring AWS::Cognito::IdentityPoolPrincipalTag rolled the stack back. The operations round-trip a per-provider mapping on the identity pool, per botocore cognito-identity-2014-06-30: both members optional and stored as sent, an unconfigured provider answers ResourceNotFoundException with No Principal Tags configured for Provider {name}, and each provider keeps its own map. UseDefaults is not expanded into a tag map — AWS applies the default claim mapping when vending credentials — and is accepted alongside PrincipalTags, as terraform-provider-aws sends on destroy. The CloudFormation resource keys its physical id on the pool/provider pair, applies a changed PrincipalTags in place, and clears the mapping on delete or replacement. State is account- and region-scoped and persisted. Contributed by @ppettitau.
• EC2 — cross-account AMI sharing — a registered image was invisible to other accounts, with no way to grant access, so a Terraform aws_ami lookup across simulated accounts found nothing. ModifyImageAttribute applies launchPermission add/remove in both wire forms (structured LaunchPermission.Add/Remove and legacy Attribute+OperationType+UserId/UserGroup), DescribeImageAttribute and ResetImageAttribute round-trip and revoke it, and DescribeImages shows another account's image when the caller holds a permission or all is granted — keeping the owner's OwnerId, flipping Public on Group=all, honouring ExecutableUsers and Owners, shapes per botocore ec2-2016-11-15. A shared AMI launches through the same permission check. A non-owner modifying an image answers AuthFailure "Not authorized for image:{id}", as real EC2 does; an unknown id keeps InvalidAMIID.NotFound. Reported by @edersonbrilhante.
• API Gateway — IAM-authorized methods report the caller's identity — a REST method with authorizationType: AWS_IAM handed its Lambda only sourceIp and userAgent; the resolved caller now fills the payload-1.0 fields (accessKey, accountId, caller, user, userArn, principalOrgId from the account's Organization when one exists) and, for identity-pool credentials, the four cognito* fields — cognitoAuthenticationProvider in the documented <provider>,<provider>:CognitoSignIn:<sub> format. HTTP API AWS_IAM routes reject a request with no Authorization header (403 Forbidden) and fill requestContext.authorizer.iam (accessKey, accountId, callerId, userArn, userId, cognitoIdentity with amr/identityId/identityPoolId). Signatures are not verified — key resolution only, per the documented no-SigV4 stance. GetCredentialsForIdentity also registers its credentials as an STS session — GetCallerIdentity reports arn:aws:sts::<account>:assumed-role/<PoolRole>/CognitoIdentityCredentials, as on AWS — so identity-pool credentials work under AUTH=true instead of being rejected as an invalid token. Reported by @iot-rocket.

Changed

• RDS — Aurora MySQL global writer switchover foundations — deadline-bounded helpers for writer fencing, GTID convergence, replication-channel management and verified write enablement, plus lifecycle guards reserving clusters mid-switchover. No user-visible behavior changes; dormant until an orchestrator calls them. Contributed by @Areson.

Fixed

• Lambda — a Docker-executed function sees its real ARN in context.invoked_function_arn — the RIE inside the official images hardcodes arn:aws:lambda:us-east-1:012345678912:function:{name}, account and region, so a handler self-registering its own ARN (the standard pattern for wiring a Cognito trigger) stored a scope where nothing exists and the trigger never fired. Python and Node.js zip functions run through a shim handing user code the control-plane ARN; for provided and Image-type functions, where MiniStack owns no code path, an ARN carrying exactly the RIE's hardcoded scope resolves as the caller's own function, so a stored trigger still fires. Reported by @TomaszKupka.
• Cognito — TOTP codes verify — VerifySoftwareToken answered SUCCESS for any six digits and the SOFTWARE_TOKEN_MFA challenge issued tokens for any code. The AssociateSoftwareToken secret is now stored and verified with RFC 6238 (HMAC-SHA1, 30-second step, ±1 step): a wrong code answers EnableSoftwareTokenMFAException on verify and CodeMismatchException on the challenge, both in the operations' botocore error models, and success promotes the secret and enrolls the user. The CloudFormation provisioner maps EnabledMfas: [SOFTWARE_TOKEN_MFA] (what CDK emits) onto GetUserPoolMfaConfig. Tests sending a fixed code must derive one from the SecretCode they receive; users enrolled before this release keep the old behavior until re-enrolment. Reported by @iot-rocket.
• RDS — the Aurora reader endpoint is a name that resolves — CreateDBCluster handed out an AWS-shaped cluster-ro- name that nothing registered, so a consumer that stored it (Terraform reads reader_endpoint during the creating apply) held an unresolvable endpoint, hanging until client timeout. The reader name is registered as a Docker network alias alongside the writer name, and DescribeDBClusters reports it whenever the writer reports its stable name — per the Aurora documentation, a cluster with no replicas resolves its reader endpoint to the primary. With PG streaming replication on, the name stays off the writer so a standby can carry it. Outside alias mode everything behaves as before. Reported by @jbschooley.
• CloudWatch — Timestamp members over JSON are epoch numbers — the awsJson1_0 branches returned the XML path's ISO strings, which AWS SDK timestamp parsers reject (Expected real number, got implicit NaN), failing GetMetricStatistics, GetMetricData and DescribeAlarmHistory reads. Timestamps convert to integer epoch seconds at the JSON serialization boundary. Contributed by @mm-salesqueze.
• CloudFront — GetDistribution returns a config every SDK can read — re-serialising the client's namespaced config_xml made ElementTree invent an ns0: prefix on every child, which REST-XML SDK parsers read as absent, so Origins, DefaultCacheBehavior and CallerReference were invisible on read-back. The re-parsed config has its namespaces stripped, on all four response paths. Contributed by @mm-salesqueze.
• STS — cross-account AssumeRole works, and an assumed session runs in the right account — the role was resolved in the caller's account, so a cross-account role was never found and refused under AUTH=true; and a session's non-12-digit key fell back to the default account, so every assumed session saw the wrong tenant while AssumeRole reported success. The role resolves in the account its ARN names — the ARN's account is authoritative, a miss stays the AccessDenied real STS returns without disclosing role existence — and a session key resolves to the account of the role it assumed. Contributed by @mm-salesqueze.
• CloudFormation — a stack addressed by its unique stack ID deletes and updates — every StackName parameter accepts the name or the stack ID per the API reference, and the CDK CLI addresses stacks by ARN; DeleteStack resolved the name only, so cdk destroy returned OK and deleted nothing, and an update by ID hung in UPDATE_IN_PROGRESS. Both — plus DescribeStackResource(s), DescribeStackEvents, ListStackResources and GetTemplate — resolve either form through one helper. Contributed by @mm-salesqueze.
• CodeBuild — a build the agent never ran no longer reports SUCCEEDED — the local agent exits 0 after failing to start anything (denied the Docker socket under SELinux), and the outcome was read off the exit code alone. A zero exit with no completed phase lands the build FAULT. The agent container also takes extra docker run flags through CODEBUILD_DOCKER_FLAGS — same syntax and parser as LAMBDA_DOCKER_FLAGS, both gaining --security-opt — the only lever that makes the agent work under SELinux. Contributed by @mm-salesqueze.
• SNS — a Lambda subscription delivers for every account — the delivery thread resolved the subscriber with an empty request context, reading back the default account, so a tenant under a 12-digit key had every SNS→Lambda notification silently dropped. The publisher's context travels into the delivery thread. The CloudWatch Logs subscription-filter delivery had the sibling defect and now invokes through the function's own account and region.
• Pagination tokens are omitted when empty — MSK, Organizations, WAF Classic, Bedrock agent/runtime, AppSync item listings and the Lambda durable/microVM surfaces emitted NextToken: null or NextMarker: "" on every list; a present-but-empty token reads as real to non-boto clients and as drift to Terraform. All now omit the member, matching the models.
• ElastiCache — DescribeCacheClusters reports CacheClusterCreateTime — the cluster-level creation time was stored but never serialized; it is emitted as ISO8601 alongside the node-level times.
• DynamoDB — ContributorInsights timestamps are integer epoch — LastUpdateDateTime was a float on the wire, against the JSON timestamp convention.
• EC2 — the seeded public AMIs carry their real owners — the stub images reported no owner, so Owners=["amazon"] (Terraform's aws_ami data source) selected nothing. They carry the real publishing accounts — 137112412989 for Amazon Linux, 801119661308 for Windows, 099720109477 for Canonical — with ImageOwnerAlias: amazon on the Amazon-published pair, as DescribeImages reports on AWS.