Skip to content

v4.4.0

Latest
Latest
Compare
Choose a tag to compare
@localstack-bot localstack-bot released this 08 May 08:26
· 45 commits to master since this release
v4.4.0
21f6e5f

Summary

LocalStack 4.4 introduces the Amazon Verified Permissions provider, a native RDS provider for better AWS parity, and a container-based Glue job executor. The release also includes Step Functions service integration mocking, expanded IAM features with service-specific credential APIs and condition keys, and updates to KMS, EMR Serverless, CloudFront Lambda@Edge, and Application Auto Scaling services.

AWS Features

  • LocalStack now supports Amazon Verified Permissions (AVP) for managing fine-grained access using Cedar policies. You can test authorization logic locally and integrate with services like Cognito. Refer to our documentation to learn more. (🌟 enterprise)
  • LocalStack now supports AWS Step Functions Local with mocked and emulated service integrations. It works with existing setups and includes support for JSONata, Variables, and mocked task states. Refer to our documentation to learn more.
  • LocalStack now uses a new native RDS provider by default for better AWS parity. It adds support for advanced features like parameter groups, snapshots, IAM auth, proxies, and Neptune compatibility. (🌟 pro)
  • LocalStack now runs Glue jobs in Docker using the aws-glue-libs image for better parity, faster startup, and isolated execution. Set GLUE_JOB_EXECUTOR=docker and GLUE_JOB_EXECUTOR_PROVIDER=v2 to enable it. (🌟 pro)
  • Ruby 3.4 Lambda runtime is now supported in LocalStack.

Enhancements

  • LocalStack now supports IAM service-specific credential APIs with full CRUD operations. Supported APIs include create, list, update, reset, and delete for service-specific credentials.
  • LocalStack now supports additional IAM condition keys for fine-grained access control in policies. New keys include iam:PermissionBoundary, aws:RequestTag, sts:ExternalId, aws:username, and others.
  • KMS provider now includes the following enhancements:
    • Enables custom_key_material usage for Elliptic Curve Cryptography (ECC) keys in the KMS service.
    • Adds ability to decrypt data encrypted before a key rotation event by preserving the history of key material during RotateKeyOnDemand, maintaining access to all rotated KMS keys.
    • Improves KMS PSS signature generation by aligning salt length with RFC 4055, increasing compatibility with external cryptographic libraries.
    • Adds support for the dry_run parameter in the GenerateDataKeyPair and GenerateDataKeyPairWithoutPlaintext APIs.
  • EMR Serverless provider now includes the following enhancements: (🌟 pro)
    • EMR Serverless jobs now accept program arguments when running scripts, allowing reuse of functionality and parameterized execution.
    • Logs from EMR Serverless jobs are now sent to CloudWatch for better visibility into job execution and easier debugging of failures.
  • Cloudfront Lambda@Edge feature now includes the following enhancements: (🌟 pro)
    • Added support for the IncludeBody parameter.
    • Added validations for supported Python and Node.js runtimes.
  • LocalStack now supports tagging for Application Auto Scaling resources. Supported APIs include TagResource, UntagResource, and ListTagsForResource. (🌟 pro)
  • LocalStack now runs Apache Flink's JobManager and TaskManager in separate containers to better emulate AWS behavior. Previously, both ran in a single container with a shared filesystem. (🌟 pro)
  • Support for IAM transitive session tagging is now available. Tags marked as transitive on IAM sessions now propagate correctly and can be used for IAM policy enforcement.
  • Improvements to AppSync VTL template $utils helpers now include better support for $util.error and added support for $util.appendError. (🌟 pro)
  • Support for record filtering for MSK & Self-Managed Kafka Event Source Mappings. (🌟 pro)
  • Support for ListStateMachineAliases pagination is now available in Step Functions. This includes handling of the --next-token and --max-results parameters to paginate results when listing aliases for a state machine.
  • Implemented automatic registration of ECS tasks with AWS Cloud Map service discovery. Container IP addresses are now correctly registered in the service registry, enabling accurate service discovery and proper task-to-task communication. (🌟 pro)
  • Support for SES email confirmation from user pools is now available. User pools can now send confirmation emails to new users via SES automatically upon user creation. (🌟 pro)
  • Enhanced DeleteRepository operation in ECR to correctly honor the --force flag. When --force is specified, repositories containing images can now be deleted without requiring individual image deletion. (🌟 pro)
  • Enhanced CreateComputeEnvironment API in AWS Batch to automatically create an AWSBatchServiceRole if none is provided. This improves parity with AWS by matching the default behavior where the role is auto-created if not explicitly specified. (🌟 pro)
  • Enhanced domain name handling to properly normalize escaped character sequences in DNS names. This improves AWS parity by ensuring that all Route 53 encoded domain names are correctly processed before being passed to the DNS server.
  • Enhanced the OAuth2 authorization flow to generate unique state and code values for each login attempt. This improves CSRF protection for existing users and ensures compliance with OAuth2 specifications. (🌟 pro)
  • Deleting a FIFO message with an expired receipt handle now raises an error to achieve better parity with AWS.
  • Added X-Ray trace ID propagation from EventBridge to target services (Lambda and API Gateway), enabling end-to-end request tracing. This also ensures compatibility with existing trace header encoding.
  • Implemented support for USER_AUTH authentication flow type in Cognito, enabling SMS_OTP, PASSWORD, and PASSWORD_SRP challenge handling to match AWS behavior. (🌟 pro)

LocalStack Features

  • Replication support for AWS::Route53::HostedZone is now available for the AWS Replicator tool. (🌟 teams)
  • The --profile flag can now be used anywhere in the CLI command, not just at the top level, improving compatibility with custom tooling.

Deprecations

  • Older Glue versions (0.9, 1.0, 2.0) are now deprecated.
  • RDS state created in version 4.3 or earlier using Cloud Pods or standard persistence will not be compatible with the new RDS provider introduced in version 4.4. Recreating the RDS state is recommended for compatibility. (🌟 pro)

What's Changed

Exciting New Features 🎉

  • CloudFormation: [POC] Support Update Graph Modeling of Mappings and FindInMap by @MEPalma in #12432
  • CloudFormation: POC Support for Modeling of Outputs Blocks in the Update Graph, Improved Handling of Intrinsic Function Types by @MEPalma in #12443
  • Lambda: Added Ruby 3.4 Runtime by @anisaoshafi in #12458
  • Fix(#12318): Fixes a bug in evaluation of JSONPath for wildcard and s… by @marcodallasanta in #12366
  • CFn: WIP POC v2 executor by @simonrw in #12396
  • Step Functions: Migrate v2 Test Suite to no_retry aws_client Fixture by @MEPalma in #12461
  • Reapply reduce requests necessary for log publishing from lambda to cloudwatch logs by @dfangl in #12470
  • KMS: fix RSA PSS signing issue for salt length by @sannya-singal in #12467
  • [ESM] Re-initialize shards when NextShardIterator value is empty by @gregfurman in #12483
  • KMS: add ability to decrypt data with all rotated keys by @sannya-singal in #12482
  • CloudFormation: Update Graph Preprocessor by @MEPalma in #12447
  • Step Functions: remove config variables for legacy provided removed in v4.0 by @MEPalma in #12492
  • Step Functions Mocking: Add Support for Mounting Mocked Service Responses via MockConfigFile.json by @MEPalma in #12493
  • KMS: enable _custom_key_material_ for ECC keys by @sannya-singal in #12504
  • transcribe: add model path to vosk Model by @sannya-singal in #12479
  • Step Functions: Increase Retry Attempts on Service Integrations for Resilience Against Transient Network Errors by @MEPalma in #12512
  • Support IAM transitive session tagging by @dfangl in #12508
  • feat: propagate x-ray trace id to event bridge targets by @maxhoheiser in #12481
  • CloudFormation Engine v2: Base Mappings and Conditions tests for Update Graph and PreProc by @MEPalma in #12527
  • CloudFormation Engine V2: Improve delta computation of properties, conditional resolution, and physical resources ref by @MEPalma in #12533
  • Step Functions: Surface Support for Mocked Responses by @MEPalma in #12525
  • fix links for issue & PR messages by @HarshCasper in #12541
  • Lambda: fix transient connection errors on first container invoke with retry logic by @MEPalma in #12522
  • [ESM] Support discarding events exceeding MaxRecordAgeInSeconds by @gregfurman in #12531
  • Cloud Formation Engine v2: Improve Computation of Ref Functions and PhysicalResourceIDs Listing by @MEPalma in #12535
  • Clarify coverage error messages to distinguish license and emulation limits by @MEPalma in #12547
  • Step Functions: Decrease LocalStack Sampling Delays to Speed Up Tests Suite by @MEPalma in #12550
  • Cloud Formation v2 Engine: Support for Default fields in Parameters by @MEPalma in #12537
  • feat: add current region and account as input to _proxy_capture_input_event by @maxhoheiser in #12554
  • Step Functions: Improve Mocked Response Integration by @MEPalma in #12553
  • Step Functions: Fix Mock Test for Multi-Region by @MEPalma in #12562
  • Step Functions: Mock Mode Improvements by @MEPalma in #12560
  • Bump moto-ext to 5.1.4.post1 by @viren-nadkarni in #12563
  • Step Functions: Add Telemetry for SFN_MOCK_CONFIG Usage by @MEPalma in #12584

Other Changes

New Contributors

Full Changelog: v4.3.0...v4.4.0

Contributors

simonrw, tiurin, and 28 other contributors
Assets 2
Loading