New Amazon Verified Permissions (AVP) Provider
LocalStack adds a provider for Amazon Verified Permissions, letting you define and test fine-grained authorization for custom applications locally.
- Define access rules with the Cedar policy language and test them outside the application.
- Integrate with Cognito as an
IdentitySource; external OIDC providers are not yet supported. - Current gaps: no schema validation on
PutSchema and incomplete JWT checks (issuer, signature, expiration, jwks.json).
Step Functions Mocked Service Integrations
LocalStack can now replace AWS Step Functions Local for testing state machines with mocked service integrations.
- Point
SFN_MOCK_CONFIG at a mounted mock config file to define mocked task states. - Works with existing Step Functions Local setups and supports both mocked and emulated integrations.
- Compatible with JSONata and Variables; adds
ListStateMachineAliases pagination via --next-token and --max-results.
LocalStack-native RDS Provider
A new native RDS provider replaces the previous Moto-based CRUD operations and is now the default.
- Adds Parameter Groups, instance lifecycle operations (create, modify, start, stop, reboot), subnet and security group support, event subscriptions, option groups, snapshots, IAM authentication, and proxy support.
- Includes persistent storage, Neptune instance compatibility, and global tagging across resources.
- RDS state from 4.3 or earlier (Cloud Pods or standard persistence) is not compatible; recreate the RDS state.
Container-based Glue Job Executor
Glue jobs can now run inside Docker containers using the aws-glue-libs image instead of a pre-packaged Spark binary.
- Set
GLUE_JOB_EXECUTOR=docker and GLUE_JOB_EXECUTOR_PROVIDER=v2 to enable it. - Runs each job in an isolated environment, supports parallel jobs, and uses correct versions of Spark, Hadoop, Python, and Java.
- Deprecates older Glue versions
0.9, 1.0, and 2.0.
IAM Enforcement Enhancements
IAM gains service-specific credential APIs and additional condition keys for policy testing.
- New CRUD APIs:
CreateServiceSpecificCredential, ListServiceSpecificCredentials, UpdateServiceSpecificCredential, ResetServiceSpecificCredential, and DeleteServiceSpecificCredential. - New condition keys including
iam:PermissionBoundary, aws:RequestTag, aws:TagKeys, sts:ExternalId, iam:AWSServiceName, aws:PrincipalIsAWSService, aws:PrincipalServiceName, and aws:username. - Transitive session tags now propagate correctly and apply to IAM policy enforcement.
Service Enhancements
- KMS: supports
custom_key_material for ECC keys, preserves key material history across RotateKeyOnDemand, aligns PSS salt length with RFC 4055, and adds dry_run to GenerateDataKeyPair and GenerateDataKeyPairWithoutPlaintext. - EMR Serverless: jobs accept program arguments, and logs are sent to CloudWatch.
- CloudFront Lambda@Edge: adds the
IncludeBody parameter and runtime validation for Python and Node.js. - Application Auto Scaling: adds
TagResource, UntagResource, and ListTagsForResource. - Managed Service for Apache Flink: cluster deployment now uses separate JobManager and TaskManager containers.
- Other: Ruby 3.4 Lambda runtime, ECS task registration with AWS Cloud Map, Cognito
USER_AUTH flow, and EventBridge X-Ray trace ID propagation to Lambda and API Gateway.