bug: DynamoDB Expected ComparisonOperator + Value rejects writes accepted by AWS (Pro dev105)

[AndreKurait]

LocalStack rejects Expected conditions that combine ComparisonOperator with Value, while live AWS evaluates the operator and operand. Using a one-element AttributeValueList instead produces equivalent outcomes on live AWS and works on LocalStack.

Environment

• Unmodified localstack/localstack-pro:dev, version 2026.10.0.dev105, build 3a0ece14; Pro license activation verified.
• Exact linux/amd64 image: sha256:acec8be1241f45d56519b20746d0208041e331ad2913be1eb03fd8d582121a2d.
• Also reproduced on native linux/arm64: sha256:8f4da21eb967b43d53b3e2c66597979bc3bf58eaf6816295c3fa2b138f24b4e7.
• Both are from dev image index sha256:b38e4fcb56751f999637f3395fd9ef4a593a4b96b57887d9b62ce44c6f22b5aa, pulled 2026-10-12.
• Docker Desktop on an ARM Mac (AMD64 run under emulation), EC2_VM_MANAGER=mock, no DynamoDB provider overrides, extensions, or source patches.
• Region us-east-1, boto3 1.43.111. ARM comparison: 2026-10-12 16:44:05–16:44:09 UTC; exact AMD64 comparison: 16:47:07–16:47:12 UTC. Same outcomes on both architectures.

Observed versus expected

// Evaluated by live AWS, rejected by LocalStack
{"ComparisonOperator":"NE","Value":{"BOOL":true}}
// Evaluated by both
{"ComparisonOperator":"NE","AttributeValueList":[{"BOOL":true}]}

Old-form requests return HTTP 400 on LocalStack:

ValidationException: One or more parameter values were invalid: Invalid number of argument(s) for the EQ ComparisonOperator
ValidationException: One or more parameter values were invalid: Invalid number of argument(s) for the NE ComparisonOperator

The live AWS baseline ran in us-east-1 on 2026-10-12 at 16:24:24–16:26:04 UTC, using a temporary table and synthetic data. Forty old/new pairs (80 conditional writes) were separately seeded and followed by consistent GetItem readback:

Cases	Pairs
UpdateItem: EQ/NE × String/Number/Boolean × equal/unequal/missing/different-type attributes, including numeric zero	24
UpdateItem: combined string identities and Boolean/string NE guards; allowed, blocked, wrong-identity, absent-NE-field cases	6
UpdateItem: matching/stale numeric timestamp with identity equality	2
UpdateItem: identity equality with unchanged Exists=false guard	2
PutItem: the same combined-guard cases	6

On live AWS, 18 pairs succeeded and 22 pairs returned ConditionalCheckFailedException; all 40 pairs had identical stored items between representations. The old NE operator was enforced rather than ignored. Successful writes changed a marker from before to after; failed writes left the original item unchanged.

On both tested LocalStack architectures, 40/40 old-form requests returned ValidationException, while 40/40 new-form requests matched AWS's outcomes and stored items. This changes accepted writes and the exception type for refused writes.

AWS ExpectedAttributeValue documentation describes these parameter families as incompatible. The real service nevertheless accepted and evaluated the tested EQ/NE + Value forms. This report requests parity with those observed cases; it does not imply every mixed condition representation is valid.

Minimal reproducer

Start a disposable container with your own auth token set in the environment:

docker run --rm --name localstack-compat-repro \
  --platform linux/amd64 \
  -p 127.0.0.1:14566:4566 \
  -e LOCALSTACK_AUTH_TOKEN \
  -e EC2_VM_MANAGER=mock \
  localstack/localstack-pro@sha256:acec8be1241f45d56519b20746d0208041e331ad2913be1eb03fd8d582121a2d

After readiness, install boto3 and run the script below. This standalone reproducer was executed against the exact AMD64 image above. All AWS credentials are dummy values and the endpoint is loopback LocalStack. Fixtures are cleaned up.

The short reproducer covers successful and refused EQ/NE string conditions. The broader 40-pair comparison above additionally covered Boolean, numeric, missing/type-mismatched, compound, Exists=false, and PutItem cases.

"""LocalStack-only reproducer. Uses fake AWS credentials and creates no instances."""
import json
import uuid

import boto3
from botocore.config import Config
from botocore.exceptions import ClientError

options = dict(
    endpoint_url="http://127.0.0.1:14566",
    region_name="us-east-1",
    aws_access_key_id="test",
    aws_secret_access_key="test",
    config=Config(retries={"max_attempts": 0}, proxies={}),
)
ec2, asg, ddb = [boto3.client(name, **options) for name in ("ec2", "autoscaling", "dynamodb")]
name = "compat-repro-" + uuid.uuid4().hex[:8]


def record(label, call):
    try:
        value = call()
        print(json.dumps({"case": label, "result": value}, default=str))
        return True
    except ClientError as error:
        print(json.dumps({"case": label, "error": error.response["Error"]}))
        return False


ddb.create_table(
    TableName=name, AttributeDefinitions=[{"AttributeName": "pk", "AttributeType": "S"}],
    KeySchema=[{"AttributeName": "pk", "KeyType": "HASH"}], BillingMode="PAY_PER_REQUEST",
)
ddb.get_waiter("table_exists").wait(TableName=name, WaiterConfig={"Delay": 1, "MaxAttempts": 30})
try:
    item = {"pk": {"S": "row"}, "diNumber": {"S": "7"}, "tested": {"S": "PENDING"}}
    ddb.put_item(TableName=name, Item=item)
    # Re-seed before every call; successful writes must change marker, refusals must not.
    for operator, operand in [("EQ", "PENDING"), ("EQ", "READY"), ("NE", "READY"), ("NE", "PENDING")]:
        for version in ["old", "new"]:
            ddb.put_item(TableName=name, Item={**item, "marker": {"S": "before"}})
            condition = {"ComparisonOperator": operator}
            condition["Value" if version == "old" else "AttributeValueList"] = (
                {"S": operand} if version == "old" else [{"S": operand}]
            )
            record(f"expected-{operator}-{operand}-{version}", lambda: ddb.update_item(
                TableName=name, Key={"pk": {"S": "row"}}, Expected={"tested": condition},
                AttributeUpdates={"marker": {"Action": "PUT", "Value": {"S": "after"}}},
            ))
            record("marker", lambda: ddb.get_item(
                TableName=name, Key={"pk": {"S": "row"}}, ConsistentRead=True
            )["Item"]["marker"])
finally:
    ddb.delete_table(TableName=name)

On the affected image, every *-old condition returns ValidationException. The *-new controls succeed or return ConditionalCheckFailedException according to the predicate. Marker readbacks verify actual writes and unchanged data on refusal.

[ryan-berke]

Hi @AndreKurait, this is now fixed in the localstack/localstack:dev image. Please give this a try again and let us know if you have any further issues.