Announcing the LocalStack for AWS 2026.08.0 Release

Introduction

LocalStack for AWS 2026.08.0 is now available. This release adds Lambda Durable Functions, CloudFront Functions backed by CloudFront KeyValueStore, and a native ELBv2 provider that is now enabled by default. It also expands Verified Permissions, RDS, and OpenSearch coverage.

The release adds in-place CloudFormation updates for more resource types, returns the Docker base image to Debian trixie, and includes provider fixes for API Gateway, AppSync, CloudWatch Logs, Cognito, EventBridge, IAM, IoT, MSK, S3, SNS, Step Functions, and other services.

Get your free LocalStack account to access the latest features and updates in LocalStack for AWS 2026.08.0.

How to upgrade?

To upgrade to LocalStack for AWS 2026.08.0 using the LocalStack CLI, run:

localstack update all

Alternatively, use the new LocalStack CLI, which authenticates the session and pulls the latest image when started with:

lstk

If using Docker CLI or Docker Compose, update the Docker image:

docker pull localstack/localstack-pro:2026.08.0

Both DockerHub images (localstack/localstack and localstack/localstack-pro) are supported and contain the same image. Refer to the 2026.03.0 release notes for details about the consolidated image and auth token requirement.

What’s new in LocalStack for AWS 2026.08.0?

Lambda Durable Functions
CloudFront Functions and KeyValueStore
Native ELBv2 provider by default
Verified Permissions provider expansion
RDS and database provider enhancements
OpenSearch 3.7 and domain upgrades
CloudFormation resource update coverage
Container and runtime changes
Service provider improvements
Deprecations and removals
Conclusion

Lambda Durable Functions

AWS Lambda Durable Functions use checkpoints and replay to run multi-step work while preserving progress across waits and interruptions. LocalStack now emulates durable executions for Lambda functions configured with DurableConfig.

The implementation covers checkpointing, waits, step retries, callbacks, chained Lambda invokes, execution history, stopping and draining executions, and retention. The durable execution management and checkpoint protocol APIs are available for functions using Python, Node.js, Java, and .NET runtimes.

Lambda deployment artifacts must include the appropriate AWS Durable Execution SDK and its dependencies. LocalStack runtime images do not bundle the SDK. KMS encryption of execution data, CloudWatch and EventBridge monitoring emission, API rate limits, and the account-level running-execution quota are not emulated in this release.

Running durable executions requires a paid LocalStack plan and is not available on the free Hobby plan.

CloudFront Functions and KeyValueStore

CloudFront KeyValueStore stores data that a CloudFront Function can read without embedding it in the function code. LocalStack now supports KeyValueStore create, describe, list, update, and delete operations, plus data-plane access with ETag handling.

CloudFront Functions associated with the viewer-request event can use cf.kvs() to read KeyValueStore data. A function can use the returned values to rewrite a URI and select an origin. It can also return a response directly and write console output to the LocalStack logs. The TestFunction operation is also implemented.

The CloudFront provider also adds GetCloudFrontOriginAccessIdentityConfig and UpdateCloudFrontOriginAccessIdentity. CloudFormation can update AWS::CloudFront::CloudFrontOriginAccessIdentity resources in place.

Native ELBv2 provider by default

The native ELBv2 provider is now the default. Existing ELBv2 state saved through persistence or Cloud Pods is migrated when it is first loaded by the new provider.

The provider changes several observable behaviors:

Target health includes AWS-style states, reason codes, health-check ports, and availability zones.
Target groups and load balancers return a broader set of protocol-specific and target-specific attributes.
Application, Network, and Gateway Load Balancer listeners use separate attribute sets. HTTPS and TLS listeners return certificate, mutual TLS, and ALPN data according to their protocol.
Resource tag limits now match the AWS limit of 50 tags.
Load balancer, target group, listener, rule, health check, and certificate requests use stricter AWS-style validation.
DescribeSSLPolicies and DescribeAccountLimits return the supported policy and quota data.
ModifyCapacityReservation is implemented, and ELBv2 resources appear through the Resource Groups Tagging API.

Verified Permissions provider expansion

The Verified Permissions provider includes several API and Cedar updates:

OIDC identity sources are supported through CreateIdentitySource and CloudFormation. IsAuthorizedWithToken and BatchIsAuthorizedWithToken evaluate OIDC access and identity tokens and verify signatures against the issuer’s JWKS. Set VERIFIEDPERMISSIONS_DISABLE_JWT_VERIFICATION=1 when a local or offline issuer cannot provide verification keys.
CreatePolicyStore accepts encryption settings, and GetPolicyStore returns the resolved encryption state. KMS key IDs, aliases, and ARNs are validated and normalized against emulated KMS.
Policies and policy templates can have names. A name/ reference can replace an ID, names are unique within a policy store, and ListPolicies applies policy type, template, principal, and resource filters.
Authorization requests accept Cedar datetime and duration values, entity tags, and nested set and record attributes.
Policy stores report CEDAR_4. ListPolicyStores, ListPolicies, ListPolicyTemplates, and ListIdentitySources support nextToken and maxResults.
Policy-store aliases support create, get, list, soft delete, and hard delete operations. Alias values can be used in policyStoreId fields.
CloudFormation can update AWS::VerifiedPermissions::Policy and AWS::VerifiedPermissions::PolicyTemplate resources in place.

RDS and database provider enhancements

The RDS provider adds API coverage for Aurora and related database workflows:

Aurora Limitless DB shard groups support create, describe, modify, reboot, and delete operations.
EnableHttpEndpoint and DisableHttpEndpoint control Data API availability for Aurora Serverless v2 and provisioned clusters.
DescribeOrderableDBInstanceOptions is available for RDS, DocumentDB, and Neptune.
RDS resolves omitted and major-only engine versions to the corresponding AWS default. DescribeDBEngineVersions with DefaultOnly=true now covers MariaDB, custom SQL Server, and Db2 CE.
Engine-version, default parameter-group, and orderable-instance reference data has been refreshed so the two describe APIs return compatible results.
Global write forwarding accepts supported Aurora PostgreSQL versions specified by major version. Unrelated ModifyDBCluster calls no longer clear GlobalWriteForwardingRequested, and RebootDBInstance works for instances in secondary global clusters.
DescribeDBClusters returns configured Performance Insights settings, database-insights mode, CloudWatch Logs exports, and VPC security groups.
ResetDBParameterGroup is implemented, and ResetDBClusterParameterGroup removes the requested parameters. Retired families such as mysql5.6 and postgres9.4 are accepted, while CreateDBClusterParameterGroup validates family values and duplicate names.

OpenSearch 3.7 and domain upgrades

OpenSearch 3.7 is supported and is the default version for new domains. The compatible-version data includes upgrade paths from supported 2.19 and 3.x releases to 3.7.

The provider now implements UpgradeDomain. DescribeDomain and DescribeDomainConfig return the configuration stored for the domain instead of fixed or changing placeholder values. Off-peak-window and software-update options are included in both responses.

CloudFormation can update access policies, snapshot settings, off-peak windows, software-update options, and tags for AWS::OpenSearchService::Domain. It can also update access policies, snapshot options, advanced options, and tags for AWS::Elasticsearch::Domain.

CloudFormation resource update coverage

The CloudFormation provider can update more resources in place. The added resource coverage includes:

API Gateway: AWS::ApiGateway::VpcLink, AWS::ApiGateway::Model, AWS::ApiGateway::RequestValidator, AWS::ApiGateway::GatewayResponse, AWS::ApiGateway::BasePathMapping, and AWS::ApiGateway::UsagePlanKey.
API Gateway V2: AWS::ApiGatewayV2::Route, AWS::ApiGatewayV2::Authorizer, AWS::ApiGatewayV2::Integration, AWS::ApiGatewayV2::IntegrationResponse, AWS::ApiGatewayV2::Stage, AWS::ApiGatewayV2::Deployment, and AWS::ApiGatewayV2::ApiMapping.
Data and analytics: AWS::Timestream::Database, AWS::Timestream::Table, AWS::MSK::Cluster, AWS::Redshift::ClusterParameterGroup, AWS::Redshift::ClusterSubnetGroup, AWS::Glue::Schema, AWS::Glue::Trigger, AWS::Glue::Crawler, and AWS::Glue::Table.
Identity and application services: AWS::Cognito::UserPoolResourceServer, AWS::Cognito::UserPoolGroup, AWS::Cognito::UserPoolClient, AWS::Cognito::IdentityPool, AWS::Cognito::IdentityPoolRoleAttachment, AWS::Cognito::UserPoolIdentityProvider, AWS::AppSync::ApiKey, AWS::AppSync::FunctionConfiguration, and AWS::AppSync::DataSource.
Security and operations: AWS::ACMPCA::CertificateAuthority, AWS::ACMPCA::CertificateAuthorityActivation, AWS::SecretsManager::RotationSchedule, AWS::KMS::Alias, AWS::WAFv2::LoggingConfiguration, AWS::CloudWatch::Alarm, AWS::CloudWatch::CompositeAlarm, AWS::Logs::LogGroup, and AWS::CloudFormation::Macro.
Events and scheduling: AWS::Events::EventBusPolicy, AWS::Events::Rule, AWS::Scheduler::Schedule, AWS::StepFunctions::Activity, and AWS::ApplicationAutoScaling::ScalableTarget.
Networking and discovery: AWS::EFS::MountTarget, AWS::EFS::AccessPoint, AWS::Neptune::DBSubnetGroup, AWS::DocDB::DBSubnetGroup, AWS::ElastiCache::SubnetGroup, AWS::ServiceDiscovery::PrivateDnsNamespace, and AWS::ServiceDiscovery::Service.
Other services: AWS::ResourceGroups::Group, AWS::IoT::Policy, AWS::SSM::MaintenanceWindowTarget, AWS::SSM::MaintenanceWindowTask, AWS::CodeBuild::Project, AWS::SNS::TopicPolicy, and AWS::S3::BucketPolicy.

The related service APIs now apply the replacement and clearing behavior required by these updates. This includes IoT policy-version operations, Timestream UpdateDatabase and UpdateTable, Redshift ModifyClusterSubnetGroup, Scheduler schedule updates, CloudWatch Logs KMS and data-protection settings, SSM maintenance-window updates, and Service Discovery namespace and service updates.

CloudFormation stack behavior also includes these fixes:

Failed stack creation honors OnFailure=DELETE, ROLLBACK, and DO_NOTHING.
Fn::GetAtt resolves custom-resource response attributes whose names contain dots.
ListStackResources and DescribeStackResources return the AWS missing-stack error text used by CDK and Amplify Gen 2.
GetTemplateSummary returns Metadata as a JSON string, which allows Amplify Gen 2 to generate amplify_outputs.json.
AWS::Cognito::IdentityPool accepts IdentityPoolTags and supports updates used by Amplify Gen 2 authentication deployments.

Container and runtime changes

The LocalStack Docker image uses Debian trixie again instead of Debian sid. The stable base fixes runtime package installation failures that affected RDS PostgreSQL and MariaDB, plus Postgres-backed Redshift, Timestream, DSQL, and RDS Data workloads.

Every service that starts Docker containers now accepts a service-specific _DOCKER_FLAGS setting, such as RDS_DOCKER_FLAGS, ELASTICACHE_DOCKER_FLAGS, or KAFKA_DOCKER_FLAGS. These settings can pass Docker options such as custom CA certificate mounts to child containers.

Other runtime changes include:

Firehose delivery streams with a Kinesis source no longer download a Java runtime for their Kinesis consumer and reach ACTIVE faster.
EC2 IMDS and a gateway listener can share port 80, so exposing an ALB through GATEWAY_LISTEN no longer makes IMDS or the gateway listener unavailable.
EC2 user data is no longer truncated on Kubernetes when a script contains a nested heredoc.
Python Lambda functions using transparent endpoint injection no longer receive an invalid empty AWS_CA_BUNDLE outside DNS injection mode. For current botocore releases in DNS mode, DISABLE_TRANSPARENT_ENDPOINT_INJECTION=1 remains a workaround.
Cloud Pods can be saved to and loaded from real S3 while transparent endpoint injection is enabled. S3 credential, access, and missing-bucket errors are returned directly.
A virtual-memory leak across Lambda invocations, ECS task replacements, and Step Functions state evaluations is fixed. Long-running instances no longer reach can't start new thread because of this leak.

Service provider improvements

S3

GetBucketPolicyStatus reports whether a bucket policy makes a bucket public under the S3 Block Public Access rules.
ExpectedBucketOwner is enforced across bucket and object operations. A request returns 403 AccessDenied when the specified account does not own the bucket.
Set S3_VALIDATE_SIGNATURES=1 to validate SigV4 signatures and payload integrity for regular S3 requests. Validation accepts test/test, IAM user access keys, and temporary STS credentials. Pre-signed URL validation remains separately controlled by S3_SKIP_SIGNATURE_VALIDATION=0.

IAM and STS

IAM implements ChangePassword.
IAM implements GetOutboundWebIdentityFederationInfo, EnableOutboundWebIdentityFederation, and DisableOutboundWebIdentityFederation.
IAM MFA devices support ListMFADeviceTags, TagMFADevice, and UntagMFADevice.
STS implements GetWebIdentityToken. The generated token has a JWT-compatible shape but is not usable for outbound federation in this release.

EventBridge

JSONPath extraction for InputPath and InputTransformer preserves falsy values, distinguishes missing paths, and applies value conversion during template replacement.
PutTargets rejects Input, InputPath, and InputTransformer on event-bus targets. Kinesis target partition keys and Step Functions execution names use the original event ID when target input shaping is configured.
CreateEventBus and UpdateEventBus store and return KmsKeyIdentifier, DeadLetterConfig, and LogConfig. These settings are not validated and do not change event-bus behavior in this release.

MSK

MSK supports cluster updates for monitoring, broker count and type, storage, security, connectivity, configuration, and Kafka version. Updated values are returned by DescribeCluster.
A cluster created without an explicit security group uses the VPC default security group instead of attaching every group in the VPC.

API Gateway and AppSync

API Gateway REST API operations return apiStatus and the configured securityPolicy, including the fields expected by Terraform AWS Provider 6.58.0.
AppSync JavaScript resolvers can always read ctx.args. Argument-less queries receive an empty object, while the alias remains excluded when the context is serialized.
AppSync RDS query helpers handle empty inputs and add beginsWith, between, size, table aliases, and tagged-template where clauses. Resolver validation errors include the offending input and code position.

Setting an SNS subscription FilterPolicy to an empty object removes it. RedrivePolicy can also be removed and is validated more accurately. Null RawMessageDelivery values no longer cause 500 errors.
SNS SMS attributes accept integer MonthlySpendLimit values and handle empty values.
CloudWatch Logs subscription filters preserve distribution and return applyOnTransformedLogs.
Deleting a log group removes its metric filters.

Miscellaneous

Step Functions raises catchable States.QueryEvaluationError errors for JSONata failures in nested states and avoids duplicate EvaluationFailed events.
Cognito user-pool tags written through TagResource or UpdateUserPool are returned by user-pool and tag APIs.
IoT Thing Types can be created with resource tags.
Amplify implements UpdateBranch, including the operation used by Amplify Gen 2 branch deployments.
App Inspector records the dead-lettered SQS message on sqs.DeadLetter spans.
Pinpoint VerifyOTPMessage no longer returns 500 when ValidityPeriod or AllowedAttempts is set to 0.
Invalid AWS request identifiers now produce HTTP 403 responses.
Ubuntu 26.04 Resolute Raccoon is available as a preloaded EC2 Docker VM manager AMI.

Deprecations and removals

Docker image repository cleanup

On September 25, 2026, LocalStack will remove the 0.12.x LocalStack images and several legacy supporting images from its public Docker Hub repositories. LocalStack 0.12.x is no longer supported and does not receive security patches or bug fixes. Its images contain known critical vulnerabilities that will not be patched. See The Road Ahead for LocalStack for more information about the current image distribution model.

If a Dockerfile, Compose file, or CI pipeline is pinned to a 0.12.x image, upgrade it before September 25. Image pulls will fail after the tags are removed. Use localstack/localstack:latest to follow current releases, or pin the latest numbered release if your workflow requires a fixed version. Current images require an authenticated LocalStack account. Create a free account if needed and configure an auth token.

An upgrade from 0.12.x crosses several releases with breaking changes. Review the migration guides in order:

The following legacy supporting images will also be removed because they have been superseded or are no longer used: bigdata, presto, spark, lambda, lambda-js, java-maven-node-python, lambda-cve-mitigated-*, localstack-light, and localstack-full.

If you pull any of these images directly, switch to localstack/localstack:latest or a current numbered release. For the Kubernetes Lambda executor, use the current lambda-<runtime> images.

Other deprecations and removals

The EC2 Libvirt VM manager has been removed. Use the Mock, Docker, or Kubernetes VM manager for EC2 workloads.
The Amazon Linux 2 AMI is no longer preloaded by the EC2 Docker VM manager.
The Ubuntu 22.04 AMI in the EC2 Docker VM manager is deprecated and reaches end of life in 2027.
Amazon Pinpoint is deprecated and is planned for removal after October 30, 2026. See the AWS Pinpoint migration guide.
The legacy ELBv2 provider remains selectable with PROVIDER_OVERRIDE_ELBV2=legacy and is planned for removal in 2026.09.

Conclusion

LocalStack for AWS 2026.08.0 adds local execution for Lambda Durable Functions and CloudFront Functions backed by KeyValueStore data. The native ELBv2 provider is now the default. Verified Permissions, RDS, OpenSearch, and CloudFormation add the APIs and resource updates described above.

Upgrade to LocalStack for AWS 2026.08.0 and report problems or parity gaps through GitHub Discussions.