Announcing the LocalStack for AWS 2026.07.0 Release

LocalStack for AWS 2026.07.0 is now available. This release adds Step Functions HTTP Tasks, Aurora DSQL CloudFormation and SQL dialect support, and an ECS service scheduler that maintains the requested task count. It also extends the AWS Replicator and adds in-place update support for more than 50 CloudFormation resource types.

The release includes provider fixes for API Gateway, CloudFront, Cognito, DynamoDB, EKS, ELBv2, IoT, RDS, and other services. The bundled Node.js runtime has moved from Node.js 22 to Node.js 24 LTS.

Get your free LocalStack account to access the latest features and updates in LocalStack for AWS 2026.07.0.

How to upgrade?

To upgrade to LocalStack for AWS 2026.07.0 using the LocalStack CLI, run:

localstack update all

Alternatively, you can use the new LocalStack CLI, which authenticates the session and pulls the latest image when started with:

lstk

If using Docker CLI or Docker Compose, update the Docker image:

docker pull localstack/localstack-pro:2026.07.0

Both DockerHub images (localstack/localstack and localstack/localstack-pro) are supported and contain the same image. Refer to the 2026.03.0 release notes for details about the consolidated image and auth token requirement.

What’s new in LocalStack for AWS 2026.07.0?

• Step Functions HTTP Tasks
• Aurora DSQL CloudFormation and SQL dialect support
• ECS service scheduling and load balancer integration
• CloudFormation resource update coverage
• Expanded AWS Replicator coverage
• IAM and access control changes
• Service provider improvements
• Deprecations
• Conclusion

Step Functions HTTP Tasks

AWS Step Functions HTTP Tasks let a state machine call a third-party HTTPS API without a Lambda function or custom integration. LocalStack now supports the arn:aws:states:::http:invoke task resource and resolves its authentication settings from an EventBridge Connection.

The implementation supports API key and basic authentication, plus connection-level and task-level headers, query parameters, and request bodies. Request bodies can use JSON or URL encoding. When the connection and task set the same field, the connection value takes precedence, as it does on AWS.

The request-response and waitForTaskToken integration patterns are supported. Non-2xx responses use the States.Http.StatusCode.<code> error name, so state machines can handle status codes in Retry and Catch blocks. Connection lookup failures use the corresponding Events.ConnectionResource.* errors.

Aurora DSQL CloudFormation and SQL dialect support

The first Aurora DSQL control-plane support shipped in 2026.06.0. This release adds a CloudFormation resource provider and data-plane syntax used by DSQL applications.

The AWS::DSQL::Cluster resource type now supports create, read, update, delete, and list operations. Updates cover deletion protection, KMS settings, multi-Region properties, tags, and cluster policies. Create and delete operations wait for the asynchronous cluster state transition before completing.

The DSQL data plane now accepts CREATE INDEX ASYNC and CREATE UNIQUE INDEX ASYNC. Indexes complete immediately, return a job_id, and appear as completed INDEX_BUILD jobs in the sys.jobs view. The sys.wait_for_job helper is also available.

CreateStream now rejects unsupported ordering values and checks that the target IAM role exists and trusts dsql.amazonaws.com. Kinesis stream existence is not checked during CreateStream, matching AWS, which validates that target asynchronously.

ECS service scheduling and load balancer integration

The ECS provider now includes background reconciliation for replica services. It replaces stopped or failed tasks to maintain the configured desiredCount without over-provisioning. The reconciliation interval defaults to 10 seconds and can be configured with ECS_SERVICE_RECONCILE_INTERVAL.

The scheduler also detects tasks whose Docker container or Kubernetes pod has stopped while the task is still marked as RUNNING. These tasks are marked as STOPPED and replaced. Temporary runtime API errors do not trigger replacements.

Additional improvements include:

• Load-balanced awsvpc tasks are registered by private IP, allowing multiple tasks to coexist in the same target group.
• Stopping a task deregisters only that task from its target group.
• Target registrations are restored after Cloud Pod or persistence state recovery.
• UpdateService applies the provided networkConfiguration before redeploying awsvpc tasks.
• DescribeServices derives runningCount and pendingCount from current task states.
• ListTasks now defaults to desiredStatus=RUNNING, while stopped tasks remain available through desiredStatus=STOPPED.
• DescribeServices now returns availabilityZoneRebalancing, and deployments return serviceConnectConfiguration.

CloudFormation resource update coverage

The CloudFormation v2 engine now applies in-place updates to more than 50 resource types. The new update handlers cover:

• AppConfig: AWS::AppConfig::Application, AWS::AppConfig::Environment, and AWS::AppConfig::DeploymentStrategy.
• API Gateway: AWS::ApiGateway::ApiKey, AWS::ApiGateway::RestApi, and AWS::ApiGatewayV2::RouteResponse.
• CloudFront: AWS::CloudFront::CachePolicy, AWS::CloudFront::Function, AWS::CloudFront::OriginAccessControl, AWS::CloudFront::OriginRequestPolicy, and AWS::CloudFront::ResponseHeadersPolicy.
• Data services: AWS::Athena::WorkGroup, AWS::DynamoDB::GlobalTable, AWS::Glue::Classifier, AWS::Glue::Connection, AWS::Glue::Database, AWS::Glue::Registry, AWS::Glue::Workflow, AWS::Kinesis::Stream, and AWS::SecretsManager::Secret.
• Database parameter groups: AWS::DocDB::DBClusterParameterGroup, AWS::ElastiCache::ParameterGroup, AWS::Neptune::DBClusterParameterGroup, AWS::Neptune::DBParameterGroup, AWS::RDS::DBClusterParameterGroup, and AWS::RDS::DBParameterGroup.
• EC2 and networking: AWS::EC2::DHCPOptions, AWS::EC2::InternetGateway, AWS::EC2::LaunchTemplate, AWS::EC2::PrefixList, AWS::EC2::TransitGateway, AWS::EC2::VPC, AWS::EFS::FileSystem, AWS::Route53::HealthCheck, AWS::WAFv2::IPSet, and AWS::WAFv2::WebACL.
• IAM and application services: AWS::Amplify::App, AWS::AppSync::GraphQLApi, AWS::Backup::BackupPlan, AWS::CodeDeploy::Application, AWS::ECR::Repository, AWS::ECS::Cluster, AWS::ElasticBeanstalk::Application, AWS::Events::Connection, AWS::Events::EventBus, AWS::IAM::Group, AWS::IAM::ServerCertificate, AWS::IAM::ServiceLinkedRole, AWS::IAM::User, AWS::Lambda::CodeSigningConfig, AWS::Logs::SubscriptionFilter, AWS::Scheduler::ScheduleGroup, and AWS::VerifiedPermissions::PolicyStore.
• IoT: AWS::IoT::Certificate, AWS::IoT::RoleAlias, AWS::IoT::Thing, and AWS::IoT::TopicRule.
• CloudFormation itself: AWS::CloudFormation::Stack.

CloudFormation also preserves explicit empty-string parameters. An empty value referenced by Fn::Equals is no longer treated as a missing parameter. This prevents a valid two-operand comparison from being reduced to one operand.

Expanded AWS Replicator coverage

The AWS Replicator adds the following resource coverage:

• AWS::SNS::Subscription, including filter policies, filter policy scope, raw delivery, delivery policy, redrive policy, and ARN translation for SQS, Lambda, and Firehose endpoints. Replicated subscriptions keep their source UUID.
• AWS::RDS::DBInstance, including engine and storage settings, IAM database authentication, CloudWatch Logs exports, Performance Insights, parameter groups, tags, and an optional master password. Single-resource and batch replication are supported.

Cross-Region discovery can now use service_region_name when the source AWS profile points to a different Region from the resource. If no target Region is set, the target client follows the resolved source Region.

IAM and access control changes

Resource Access Manager now supplies the ram:RequestedAllowsExternalPrincipals condition key during CreateResourceShare and UpdateResourceShare. Policies can use this condition to prevent resource shares from allowing principals outside the organization.

The ECR PutRegistryPolicy operation now accepts valid cross-account registry policy principals.

Service provider improvements

API Gateway and load balancing

• API Gateway v2 accepts uppercase URI schemes in CORS origins, applies OpenAPI CORS settings on ReimportApi, and accepts NLB and Gateway Load Balancer listener ARNs in VPC link integrations.
• API Gateway v2 EventBridge PutEvents integrations no longer require the optional Time field.
• API Gateway REST API accepts all valid content types in CreateModel.
• REST API and HTTP API domain names, APIs, stages, and API keys return tags added after creation.
• ELBv2 accepts QUIC and TCP_QUIC target group protocols, uses the gwy/ ARN infix for Gateway Load Balancers, and populates ForwardConfig for simple forward listener actions.
• Classic Load Balancers return the default health check configuration.

Kubernetes runtime configuration

Kubernetes runtime settings now use cloud-neutral names so they apply consistently to LocalStack services that run workloads on Kubernetes:

• LOCALSTACK_K8S_NAMESPACE is now K8S_NAMESPACE.
• LOCALSTACK_K8S_LABELS is now K8S_LABELS.
• LAMBDA_K8S_LABELS is now K8S_LABELS.
• LOCALSTACK_K8S_ANNOTATIONS is now K8S_ANNOTATIONS.
• LOCALSTACK_K8S_POD_CONFIG is now K8S_POD_CONFIG.
• LAMBDA_K8S_SECURITY_CONTEXT is now K8S_CONTAINER_SECURITY_CONTEXT.

The old names remain available as deprecated fallbacks and log a warning at startup.

EKS

• EKS uses k3d 5.9.0, applies managed node group taints to Kubernetes nodes, and resolves EKS-optimized AMI release versions from SSM Parameter Store.
• EKS now uses Kubernetes 1.36 as the default version.
• The managed-cluster settings are named MANAGED_K8S_PROVIDER and MANAGED_K8S_STARTUP_TIMEOUT. The legacy EKS_K8S_PROVIDER and EKS_STARTUP_TIMEOUT aliases still work.
• The EKS_K3S_* and EKS_K3D_* settings now use the K3S_* and K3D_* prefixes.

IoT and Cognito

• IoT stores the correct principal value when attaching a principal to a thing and implements ListThingPrincipalsV2.
• ReplaceTopicRule now updates rules in the IoT provider store.
• Deleting a thing removes its thing-group memberships. ListThingGroupsForThing returns ResourceNotFoundException for a missing thing.
• Cognito accepts SSORedirectBindingURI when creating a SAML identity provider.
• Cognito user pool schema responses preserve custom string and number attribute constraints.

Data services

• Amazon RDS supports PostgreSQL 18.
• RDS reference data has been refreshed from AWS. The default versions are now PostgreSQL 18.3, MySQL 8.4.8, and Aurora PostgreSQL 17.7, with updated DB and cluster parameter families.
• RDS rejects Aurora Serverless v1 cluster creation and Data API configurations on unsupported engines and versions.
• The RDS Data API returns HttpEndpointNotEnabledException when a request targets a cluster whose HTTP endpoint is disabled.
• The RDS Data API returns AWS-compatible metadata and values for MySQL integer, string, decimal, floating-point, date and time, BLOB, and JSON columns.
• RDS returns complete parameter metadata for user-modified DB parameters.
• RDS Data reports Aurora PostgreSQL constraint violations as DatabaseErrorException.
• Redshift implements ModifyClusterParameterGroup, tracks user changes, and uses AWS defaults in DescribeClusters to avoid Terraform drift.
• Athena implements UpdateWorkGroup, applies CloudFormation updates to AWS::Athena::WorkGroup, and serializes SQL NULL as an empty CSV field.
• A Lambda event source mapping for a DynamoDB stream now enforces MaximumRecordAgeInSeconds and sends expired retried records to the configured failure destination.
• DynamoDB returns the AWS error text when an application tries to delete a replica that is not part of a global table.
• DocumentDB event source mappings no longer report valid mappings as duplicates.
• DMS uses the correct endpoint DatabaseName when using PostgreSQL as a source.

Miscellaneous

• The bundled Node.js runtime has moved from Node.js 22 to Node.js 24 LTS to address CVE-2026-33671.
• CodeBuild uploads build artifacts before it publishes the build as SUCCEEDED.
• CloudFront, ACM, S3 Control, EventBridge, Auto Scaling, EC2, API Gateway, and SSM include response, tag, and error-handling fixes for AWS and IaC parity.

Deprecations

The Libvirt VM manager for EC2 is deprecated and now logs a warning when selected. It is planned for removal in the next release. Use the Mock, Docker or Kubernetes VM manager for EC2 workloads.

Conclusion

LocalStack for AWS 2026.07.0 adds direct HTTPS calls from Step Functions and more complete DSQL and ECS behavior. CloudFormation can update a larger set of resources in place, while the AWS Replicator, API Gateway, EKS, IoT, and database changes address common Terraform and application workflows.

Upgrade to LocalStack for AWS 2026.07.0 and report problems or parity gaps through GitHub Discussions.