App Inspector
LocalStack for AWS 2026.04.0 launches App Inspector, an observability layer that monitors your locally emulated AWS environment to surface misconfigurations, runtime errors, and missing permissions.
- Trace service-to-service calls to see where a request stopped and why.
- Inspect the data payloads exchanged between services at every hop, such as a Lambda payload to SNS or an SQS message body.
- Catch IAM misconfigurations like missing or overly restrictive permissions while still local.
- Available as a core feature with no extra setup. The Event Studio extension is deprecated in favor of App Inspector.
Athena and S3 Tables Federation via Glue Catalogs
Athena, Glue, and S3 Tables are wired together so S3 Tables data can be queried from Athena via Glue federated catalogs, matching the AWS s3tablescatalog pattern.
- Glue adds federated catalog CRUD APIs (
CreateCatalog, GetCatalog, GetCatalogs, DeleteCatalog) and an Iceberg REST endpoint at /iceberg/v1/catalogs/.... - Glue
GetDatabase, GetTable, CreateDatabase, and CreateTable act on S3 Tables when the catalog ID matches s3tablescatalog. - Athena queries S3 Tables by referencing catalogs of the form
s3tablescatalog/<bucket>. - The Trino engine powering Athena's
bigdata container is upgraded from 440 to 480 (Java 25).
CloudFormation Registry Custom Resource Type Execution
Custom resource types uploaded via RegisterType are now executed end-to-end instead of only supporting CRUD and mock operations.
- When a stack references a registered type, LocalStack resolves it against the registry first, falling back to built-in providers, then invokes the extension's Lambda with the original CloudFormation handler payload.
- Python and Java-based extensions are supported. Only the
RESOURCE extension type is executable in this release.
RDS PostgreSQL SSL and AWS Organizations Coverage
- The RDS provider accepts SSL/TLS connections to emulated PostgreSQL instances, including
sslmode=require. Note pg_stat_ssl reports ssl=false even though the connection is encrypted. - The AWS Replicator can replicate organizations from a real AWS account, with deterministic IDs for organizations and policies, policy and attachment replication, and full hierarchy coverage.
- Added the
AWS::Organizations::OrganizationalUnit CloudFormation resource provider with full CRUDL support, including via Cloud Control.
S3 Checksum Algorithms and Service Parity
- S3 supports the five new checksum algorithms (MD5, XXHash3, XXHash64, XXHash128, SHA-512) for uploads, downloads, and multipart uploads, with end-to-end validation against client-supplied values.
- CloudFormation propagates stack-level tags to taggable resources and adds
Update support for AWS::ECS::Service and AWS::KMS::Key. - Athena adds
UpdateDataCatalog, GetTableMetadata, and ListTableMetadata, and bumps the default workgroup engine from v2 to v3. - Lambda redirects Java 17+ AWS SDK V1 functions via Transparent Endpoint Injection and keeps
$LOCALSTACK_HOST in no_proxy for Lambda runtimes.
Deprecations and Removals
- Removed the legacy v1 EventBridge provider; remove any
PROVIDER_OVERRIDE_EVENTS reference from your configuration. - The legacy CloudFormation engine (
engine-legacy) and the CloudWatch v1 provider now log a boot-time deprecation warning and are planned for removal in 2026.05. - EKS now supports Kubernetes 1.30 through 1.35; support for 1.29 has been removed.