2.3.0 (2026-10-15)

Bug Fixes

• accessanalyzer: route GetAnalyzer through GET /analyzer/ (#5534) (9889910), closes #5353
• acm: reject empty SAN arrays in certificate requests (#5688) (e15c081)
• apigateway: match AWS integration responses by status (#5443) (7b8377f)
• apigateway: refuse EDGE REST APIs outside the commercial partition (#5397) (a1f9045)
• apigateway: require API keys for imported methods (#5450) (77113c7)
• apigateway: resolve component parameter references on REST import (#4855) (0f94d62)
• apigateway: select request models by content type and default (#5530) (e77710d)
• apigatewayv2: honor payload format 1.0 (#5338) (04621d8)
• apigatewayv2: include stage variables in Lambda events (#5416) (22c4c32)
• apigatewayv2: infer the 2.0 response body and answer function errors with a message (#5153) (ecdecf2)
• apigatewayv2: send cookies and comma-joined duplicates in the 2.0 event (#5152) (c6369b3)
• apigateway: validate and normalize imported integration types (#5543) (63e0302)
• appconfig: accept a quoted Ion type parameter in Accept (#5687) (190ed52), closes #5673
• appconfig: accept names in management APIs (#5417) (4ff2632)
• appconfig: serve legacy deployed configuration requests (#5658) (91c67c6)
• appconfig: support deleting environments (#5337) (2015d01)
• appsync: front custom domains with the partition's CloudFront zone (#5237) (9d49e61)
• appsync: name the one service principal in a data-source denial (#5593) (dbf6c30)
• auth: explain signature date and service mismatches (#5591) (d5c6a36)
• auth: verify query signatures and retain STS caller identity (#5584) (a017c94)
• autoscaling: balance scale-out across zones and subnets (#5525) (6442d75)
• autoscaling: pause suspended capacity adjustments (#5545) (41517f3)
• autoscaling: preserve launch configuration user data (#5600) (ddc0e02)
• autoscaling: preserve launch template user data (#5607) (b488d0c)
• autoscaling: preserve paused refresh ownership (#5668) (b395560)
• autoscaling: round-trip InstanceMaintenancePolicy, AvailabilityZoneDistribution, CapacityReservationSpecification, ServiceLinkedRoleARN, WeightedCapacity and EnabledMetrics (#5513) (991bf3a)
• bedrock-runtime: preserve images sent through the proxy (#4681) (3bdb07d)
• bedrock-runtime: preserve structured output and reasoning effort (#5512) (d0c7bd1)
• bedrock-runtime: stop abandoned calls and omit error-body logs (#5526) (ce3d826)
• cloudcontrol: bound the worker queue and reject overflow (#4479) (517409a)
• cloudformation: accept the stack ID in UpdateStack and CreateChangeSet (#4846) (efd9512), closes #4842
• cloudformation: apply an S3 bucket's NotificationConfiguration (#5493) (6695482)
• cloudformation: apply Tags, DNS attributes and InstanceTenancy on AWS::EC2::VPC (#5224) (2cade5c)
• cloudformation: apply TimeToLiveSpecification on DynamoDB tables (#4951) (a5228a0)
• cloudformation: default CreateChangeSet type to UPDATE (#5287) (f6e76bb)
• cloudformation: expand a SAM function's EventInvokeConfig (#5524) (aff6f0e)
• cloudformation: honour PermissionsBoundary on AWS::IAM::Role and AWS::IAM::User (#5266) (7d71df6), closes #5391 #5110 #5391
• cloudformation: honour the DescribeStackResources filters (#5455) (c5feab6), closes #5451
• cloudformation: reject resources that depend on each other in a cycle (#5208) (13738f8)
• cloudformation: replace Cognito user pool groups like CloudFormation (#4841) (e9f2463), closes #4836
• cloudformation: report CREATE events for a resource an update adds (#4932) (8c61aa4)
• cloudformation: roll back a changed custom resource (#4941) (e8a300f)
• cloudformation: send the stack's StackId to custom resources (#4861) (f248eb5), closes #4973
• cloudformation: wait for a stable ECS service (#4880) (0ec64ad)
• cloudfront: reject a function runtime that CloudFront does not support (#5445) (8deac0a), closes #5425
• cloudfront: release origin connections when viewers disconnect (#5564) (ee229af)
• cloudfront: serve viewer Range GETs (#5377) (ff20750)
• cloudfront: stream origin responses and viewer request bodies (#5278) (1f1d4f9)
• cloudwatch: route Query GET requests through CloudWatch (#5589) (984e818)
• codeartifact: capture an empty readme for npm versions published without one (#5683) (4be2b8b)
• codeartifact: escape the namespace/package boundary in storage keys (#5408) (7fa1a50)
• codeartifact: make npm republish of identical content idempotent (#5163) (2cf011f)
• codepipeline: link approval notifications to the partition's console host (#5595) (8bd88bf)
• cognito: include domains in user pool responses (#5448) (34c11b8)
• cognito: refuse user pool custom domains in GovCloud and EUSC (#5614) (9df4ffb)
• cognito: reject token validity outside AWS's limits (#5160) (17c40ce), closes #5610
• cognito: run missing post-confirmation triggers (#5207) (5dfb45d)
• cognito: run the PreSignUp trigger on AdminCreateUser (#5149) (69b4d17)
• cognito: send email from the pool's EmailConfiguration sender (#5150) (45f45e5)
• cognito: send the AdminCreateUser invitation with a temporary password (#5155) (641bf98), closes #5144
• cognito: surface sign-in denials with the exception classes Cognito uses (#5223) (bcfb9c7)
• core: fail a Docker call after 30 seconds when its connection pool is full (#5285) (985921c)
• core: give launched containers the port Floci listens on (#5577) (1883855), closes #4987
• core: make Docker read timeouts real on a Unix-socket host, except for long-lived streams (#5294) (ddc47a4)
• core: replay a Docker request after a lost response only when it is safe to repeat (#5171) (957d492)
• core: reuse pooled Docker connections and validate them after a second idle (#5333) (3b36a4d), closes #5294
• core: route a shared Query action name by the Version it declares (#5549) (8a87e06), closes #5032
• core: verify SigV4 header signatures for every service under validate-signatures (#5268) (9f224d9), closes #5195
• deps: bump botocore to 1.43.111 and regenerate the vendored AWS data (#5498) (94a801e)
• deps: bump botocore to 1.43.113 and regenerate the vendored AWS data (#5613) (d84a764)
• dns: forward queries without per-context ordering (#4643) (89f59de), closes #4606
• dns: validate forwarded DNS responses against the query and its target (#4671) (b6eeae9), closes #4670
• docker: do not retry a call when the Docker socket does not exist (#5424) (dd6bf4c), closes #5342
• docker: skip stale connection checks for named pipes (#5400) (66756f7), closes #5394
• dynamodb: authorize every requested item return mode (#5652) (4ea7e3d)
• dynamodb: keep expired items visible until TTL deletion (#5555) (e919560)
• dynamodb: mark time-to-live deletions on the stream as AWS does (#4930) (9a7ec1c)
• dynamodb: prefix the Select conflict errors of Query and Scan (#5562) (9c9e5a1)
• dynamodb: reject a too deep transact value before the transaction runs (#5483) (6e38c08)
• dynamodb: reject an unknown ReturnConsumedCapacity on Scan (#5669) (f3e1cb6)
• dynamodb: reject every mix of expression and non-expression parameters in Query and Scan (#5619) (804335d)
• dynamodb: reject UpdateTable GSI changes AWS refuses (#4714) (fdb21de), closes #4572
• dynamodb: treat a null ReturnConsumedCapacity as absent, as AWS does (#5686) (503899d)
• dynamodb: use the AWS wording when Query or Scan rejects AttributesToGet with a Select (#5599) (dd0f40f)
• dynamodb: use the current AWS wording for Scan validation errors (#5504) (c047da8)
• dynamodb: validate legacy Expected operands without rejecting Value (#5508) (255ad96)
• ec2: add t2.medium through t2.2xlarge to the instance type catalog (#5528) (24c1fdc)
• ec2: allocate endpoint IPv4 addresses within the subnet prefix (#5385) (a8374ee), closes #5384
• ec2: apply EBS encryption by default to new volumes and root volumes (#5371) (da063a8), closes #5370
• ec2: avoid Docker waits on the first CreateVpc (#5179) (dc41417)
• ec2: canonicalize VPC and subnet CIDR blocks on create (#5214) (4eae79d)
• ec2: derive flow log az-id the way subnets do (#5238) (7f5a332)
• ec2: enforce VPC IPv4 CIDR block association restrictions (#5510) (ac5f0bd)
• ec2: expose m6g.large through the shared instance catalog (#5583) (f4c8237)
• ec2: filter network interfaces by primary address association (#5531) (04dd78d)
• ec2: give availability-zone ids AWS's shape, shared by EC2, flow logs and EFS (#5486) (1aabc8b)
• ec2: honor ZoneName, ZoneId and filters in DescribeAvailabilityZones (#5475) (9cd97f1)
• ec2: list the request partition's regions in DescribeRegions (#5550) (b4758b0)
• ec2: preserve endpoint IP types across updates and templates (#5438) (80e8b74)
• ec2: preserve original Spot instance user data (#5468) (b86268e)
• ec2: preserve original user-data bytes in instance metadata (#5437) (f4bce30)
• ec2: preserve reserved tags during API and stack updates (#5611) (90b9d37)
• ec2: preserve VPC endpoint IP address types (#5427) (47d1e10)
• ec2: reject reserved IPv4 ranges for VPC CIDR blocks (#5559) (66b2ec0)
• ec2: reject subnet CIDRs outside the VPC address space (#5461) (20bc835)
• ec2: reject subnet IPv4 prefixes outside /16 to /28 (#5439) (b1bb016)
• ec2: reject VPC IPv4 prefixes outside /16 to /28 (#5495) (162ac6d)
• ec2: remove the volume helper container on shutdown (#5551) (ec5692d)
• ec2: resolve interface endpoint fallback address collisions (#5347) (84dbed1), closes #5345
• ec2: return real AWS error for unknown availability zone name (#5529) (06f0e06), closes eksctl-io/eksctl#8174
• ec2: serve IMDS instance identity credentials (#5289) (8502565), closes #5264
• ec2: validate subnet tags before creation (#5306) (aa94969)
• ecr: advertise the registry at the published address (#4863) (c1cd5af)
• ecr: retry occupied registry ports (#4857) (8b1ece9), closes floci-io/floci#4856
• ecs: accept a service ARN in ListTasks (#4859) (5a8694e)
• ecs: launch service tasks through capacity provider strategies (#5500) (431748f)
• ecs: look up a task definition without failing on a stored record with no ARN (#5296) (4927f71)
• ecs: mount and clean up ephemeral task volumes (#5511) (760c38e)
• ecs: preserve binary output in exec sessions (#5621) (9f224e5)
• ecs: use caller endpoint for exec stream URLs (#5666) (6e8a083)
• eks: accept a role ARN from another partition the way STS does (#5398) (fb202cc)
• eks: mirror the cluster's own region and account in the registry config (#5399) (8b83892)
• elasticache: restore groups and clusters of every account (#5244) (05e1beb)
• elasticache: return modeled wire error codes for replication group and user name faults (#5571) (86b1904)
• elasticache: use the AWS wire codes UserNotFound and UserAlreadyExists (#5452) (b318794)
• elbv2: honor SubnetMappings in CreateLoadBalancer and SetSubnets (#5533) (999ccde)
• elbv2: keep a refused ModifyListener from moving the listener (#5491) (ee274b9)
• elbv2: preserve default listener certificates (#5692) (a55352b)
• elbv2: preserve repeated target response headers (#5628) (15f50cb)
• elbv2: reject a listener certificate the account does not have (#5474) (2332533)
• emr: use the cluster's regional private DNS domain for instances and the master (#5169) (4115bec)
• eventbridge: reject malformed Detail JSON for PutEvents (#5465) (e3c2096)
• eventbridge: require EventPattern or ScheduleExpression in PutRule (#5172) (be668ac)
• eventbridge: stop a scheduled rule's timer when its rule is gone (#5462) (d6f93ab)
• eventbridge: stop schedule-only rules from matching put events (#5168) (bb24ee0)
• iam: answer AWS's own errors for a malformed service-credential id, and for DeleteUser (#5239) (3a8f974), closes #5084
• iam: authorize a Smithy RPC v2 call as the operation its route runs (#5620) (29ead62)
• iam: authorize an operation as the action AWS checks for it (#5604) (eba0582)
• iam: check DynamoDB transaction item permissions (#5576) (69bbd22)
• iam: enforce inline role policy quota (#5327) (d22b4f1)
• iam: enforce user and group inline policy quotas (#5590) (1d8f65d)
• iam: evaluate every IAM action against the resource it acts on (#5404) (d884d55), closes #4979
• iam: honor managed policy attachment conditions (#5578) (367ae0b)
• iam: make the server certificate reference check atomic with the write (#5368) (477e3ef), closes #5087
• iam: match absent context keys with ForAllValues (#5482) (ea8da22)
• iam: open every ValidationError with the count AWS puts on it (#5280) (88d429a), closes #5240 #5239 #5240
• iam: page ListRoles and ListPolicies through MaxItems and Marker (#5515) (72a4cc5)
• iam: preserve later policy writes during rollback (#5596) (9ab820d)
• iam: refuse inactive keys and unreadable credentials in enforcement (#5346) (46f9c23)
• iam: return UserName from GetAccessKeyLastUsed (#5579) (372d3d1)
• iam: route every dispatched IAM action, and require the parameters the model requires (#5227) (4495ade), closes #5032
• iam: separate a constraint failure from an invalid value in PutAccountProperties (#5240) (5fc8b04), closes #5177
• iam: take service-linked role names and suffix support from AWS evidence (#5293) (df4fa58), closes #5084
• iam: validate RoleName in CreateRole (#5374) (cb67380)
• iam: validate RoleName in every role action (#5391) (b2b083e)
• kms: return an empty body for operations without output (#5318) (63ef2d3)
• lambda: add cookies array to function URL events (#5288) (673c809), closes #5255
• lambda: check the RevisionId precondition in UpdateFunctionCode (#4641) (b9625bf), closes #4639
• lambda: default event source mapping BatchSize by source type (#5362) (29319fb), closes #4740
• lambda: end the invocation when a checkpoint closes a durable execution (#5299) (ebd364e)
• lambda: enforce function policies on cross-account calls (#5476) (6d7d85f)
• lambda: expose the executing version on cold launches (#5523) (8565ad8)
• lambda: keep every AddPermission condition and store account principals as root ARNs (#5123) (e28c58c), closes #4627
• lambda: keep watching for a runtime exit after the wait stream fails (#5284) (a3027c0), closes #3314
• lambda: list $LATEST first, then versions in numeric order (#5376) (47dae88), closes #5121
• lambda: list changed durable operations in creation order (#5328) (9c2db35)
• lambda: quote the model's FunctionName pattern in the validation error (#5487) (32cb4b7)
• lambda: refuse function URLs in GovCloud and China (#5615) (2551626)
• lambda: validate members the model bounds (ESM Topics, S3 code, alias, LicenseInfo) (#4989) (c3133f1), closes #4607 #4607
• logs: enforce stream resource permissions (#5694) (dbe7fdb)
• mq: return CreateBroker members from DescribeBroker (#5211) (73133b4), closes #1951
• mq: route DescribeSharedResources (#5356) (d1fe27c)
• partition: accept EFS access points in ISO-E and ISO-F and list the execution's regions in Step Functions (#5485) (7837792)
• partition: hold escaped host regexes to the DNS suffix gate (#5232) (1b61945)
• partition: read strict-mode service availability from endpoint rulesets too (#5231) (8a1d1dd)
• partition: serve a pseudo signing region as its partition's global region (#5233) (e1cd6fe)
• partitions: source the China CloudFront suffix and GovCloud API Gateway zones (#5618) (3afb5b4)
• rds-data: accept parameter names that start with a digit (#5119) (bdb37f0)
• rds-data: reject an ExecuteStatement response over 1 MiB (#5120) (a7e2447)
• rds-data: reject concurrent transaction requests (#5575) (2a04cd7)
• rds-data: reject result rows larger than 64 KB (#5290) (93cc2ff), closes #5113
• rds-data: reject SQL containing multiple statements (#5556) (f833ca9)
• rds-data: return typed array result fields (#5665) (bb06acd)
• rds,elasticache: decode IAM auth token parameters once (#5039) (3041d6b)
• rds: apply Aurora IAM changes to existing members (#5608) (966da1d)
• rds: apply PostgreSQL startup parameters to IAM sessions as the token's role (#5304) (91c15be)
• rds: bind IAM tokens to the published port (#5305) (3171b8a)
• rds: delete managed instance secrets (#5330) (c70e1b0)
• rds: forward PostgreSQL startup parameters through the proxy (#5151) (1199f3a)
• rds: honor restore IAM flags and reject malformed booleans (#5473) (03a0dfe)
• rds: inherit Aurora member master credentials (#5667) (92b2cf7)
• rds: inherit cluster IAM settings for new members (#5653) (12c8f96)
• rds: keep Aurora member passwords owned by their cluster (#5685) (430af5f)
• rds: list Aurora engines in DescribeOrderableDBInstanceOptions (#5585) (025af9d)
• rds: load the token role's ALTER ROLE defaults into IAM sessions (#5344) (e61b66f)
• rds: preserve credentials when managed-secret opt-out is refused (#5553) (2927a45)
• rds: preserve snapshot partitions in custom regions (#5428) (ad1fbbc)
• rds: reject malformed cluster snapshot copy flags (#5472) (1e92b7e)
• rds: reject malformed event subscription flags (#5481) (eb3c14d)
• rds: reject malformed instance boolean flags (#5332) (b28eac9)
• rds: reject malformed parameter reset flags (#5454) (4fd8df2)
• rds: reject malformed proxy boolean flags (#5453) (af3672e)
• rds: reject malformed upgrade flags (#5329) (c8f16d2)
• rds: reject tag ARNs from another partition (#5419) (6083795)
• rds: report the default managed secret key (#5420) (23e6fce)
• rds: restrict custom endpoint mutations to Aurora (#5206) (d8b170a)
• rds: use cluster IAM policies for Aurora members (#5605) (2aca536)
• redshift-serverless: return HTTP 400 for ResourceNotFoundException and ConflictException (#5409) (972ff03)
• rekognition: refuse the images Rekognition refuses (#5540) (c65b6e9)
• route53resolver: require at least two IP addresses for CreateResolverEndpoint (#5539) (4da5143), closes #4774
• route53: return the health check on a CreateHealthCheck retry (#5298) (0d4b8cd)
• s3: answer an expired session with ExpiredToken when verifying signatures (#5435) (013a921)
• s3: answer GetObject Range requests as S3 does (#5436) (09a2d5c)
• s3: compare conditional GET dates at second precision (#5598) (ca1d74c)
• s3: evaluate identity policies per key in DeleteObjects (#5471) (23c6666)
• s3: limit CORS credentials header to S3-routed requests (#5375) (9698c21)
• s3: refuse DeleteBucket while versions or delete markers remain (#5548) (e023ae9)
• s3: reject a PutObject or UploadPart over 5 GiB (#5469) (6d2aaba), closes aws/aws-cli#5420
• s3: reject aws-chunked S3 uploads whose trailing checksum mismatches (#5176) (37e66ee), closes #5136
• s3: reject unverified credentials and malformed auth in account routing (#4825) (#5059) (d39c7e1)
• s3: report EntityTooSmall for a presigned POST below the content-length-range minimum (#5154) (58bad47), closes #5469
• s3: report the default Block Public Access settings for a new bucket (#5434) (e52ce67)
• s3: run S3 Select over CSV and JSON a record at a time (#5178) (a0a2a5f)
• s3: url-encode event record keys and add sequencer (#5192) (d0fec13)
• s3: validate multipart upload object size (#5643) (4d6ecc1)
• s3: validate multipart upload part numbers (#5655) (4c3d9ca)
• scheduler: do not base64-decode BinaryValue in universal sqs target (#5314) (d0c2774)
• scheduler: invoke rate schedules at their first occurrence (#5610) (16293b6)
• serialize IAM and STS Query timestamps with millisecond precision (#5110) (3cdc9ef)
• servicequotas: implement GetRequestedServiceQuotaChange (#5561) (60d4d6b)
• ses: check a v2 raw From header only in place of a missing sender (#5490) (1230aec)
• ses: delete by id and filter by source in /_aws/ses (#5159) (7c4d1c9), closes #4949 #4834 #4949
• ses: match AWS tag ARN parsing and configuration set name errors (#5235) (86371d8)
• ses: publish to an SNS topic only when its policy allows SES (#5650) (46f4977)
• ses: reject malformed send addresses with AWS's messages (#5380) (6d76af0)
• ses: reject non-array v2 reply-to and bulk destination members (#5477) (a96cc04)
• ses: require a verified sender to send email (#5156) (0edb699), closes #5141
• ses: return Easy DKIM signing hosted zone (#5068) (58ac054)
• ses: take v2 Raw send recipients from the MIME headers (#5442) (3ad1a76)
• ses: word a v1 raw From header without @ as a missing user name (#5612) (3ec1466)
• signin: accept the cross-device redirect on each partition's sign-in host (#5557) (1b7c79f)
• signin: complete aws login --remote against an endpoint override (#5552) (bcda595)
• sns: carry Status on VerificationException (#5602) (c5a9642), closes #5570
• sqs: reject batch requests with more than 10 entries (#5331) (5d5e39a), closes #5319
• ssm: return KeyId, AllowedPattern, Tier and Policies from DescribeParameters (#5263) (80f2541)
• stepfunctions: authorize a Lambda task as the state machine's execution role (#5554) (c6c2c60), closes #5079 #5476
• sts: reject session-token requests from temporary callers (#5582) (43eacd5)
• sts: require long-term callers for federation tokens (#5586) (c907eec)
• ui: preserve bracketed IPv6 hosts in sidecar redirect URLs (#5538) (5a90be1)

Features

• apigateway: export deployed REST APIs as OpenAPI (#5131) (1acedaf)
• cloudformation: add optional-value and delete cleanup hooks (#5067) (07b529e)
• cloudformation: pass Lambda DurableConfig through (#5218) (ee2d1a6)
• cloudformation: provision Application Auto Scaling targets and policies (#5407) (bfa9c2f)
• cloudformation: provision AWS::ApiGatewayV2::DomainName and ApiMapping (#5038) (85e0061)
• cloudformation: provision AWS::BedrockAgentCore::Runtime, RuntimeEndpoint and Memory (#5226) (f50437e)
• cloudformation: provision CloudFront public keys, key groups and functions (#5390) (61fe304)
• cloudformation: provision Cognito resource servers (#4832) (ebae2ba)
• cloudformation: provision ElastiCache cache clusters and subnet groups (#5307) (475d230)
• cloudformation: provision ElastiCache serverless caches (#5423) (b8e6283)
• cloudformation: provision ElastiCache users and user groups (#5422) (86b3258)
• cloudformation: provision Scheduler schedules (#4834) (f6c8ebd)
• cloudformation: refuse updates after a failed rollback and add ContinueUpdateRollback (#4949) (c4a809f)
• codeartifact: add DeletePackage for all package formats (#5320) (ceab47e)
• codeartifact: add DescribePackage for all package formats (#5308) (e452ce8)
• codeartifact: add PutPackageOriginConfiguration (#5381) (3ff5529)
• codeartifact: compute DescribeDomain's assetSizeBytes for every format (#5484) (6b0d0bc)
• codeartifact: implement GetPackageVersionReadme (#5644) (8f90702)
• codepipeline: roll back a single stage from a successful target execution (#4618) (f661923)
• cognito: accept the refresh_token grant on the OAuth token endpoint (#4948) (2d7ebcb)
• cognito: serve the OAuth token revocation endpoint (#4936) (1a0afce)
• cognito: support passkeys (WebAuthn) registration and sign-in (#5102) (5092713)
• cognito: support TOTP MFA when MFA is optional (#5101) (a5db397)
• core: make the Docker call timeout configurable (#5431) (9810005)
• ec2: support transit gateway peering attachments (#5122) (e22bd2c)
• eks: join EC2 instances to a cluster as nodes (#5091) (6fc957a)
• elasticache: add serverless cache APIs (#5366) (bac2c7c), closes #5400
• elasticache: add user groups and associate them with replication groups (#4435) (0848fa6)
• guardduty: add Malware Protection plans and AWS::GuardDuty::MalwareProtectionPlan (#5373) (daef71c), closes #4657
• iam: change the calling user's console password (#5546) (5ea632c)
• iam: generate and read the Organizations access report (#5467) (4e76948)
• iam: model account properties and outbound web identity federation (#5177) (04a3b97)
• iam: populate aws:username, aws:userid and aws:PrincipalType (#5568) (287d683), closes #5576
• iam: resolve policy variables in Resource patterns and Condition values (#5639) (425cd31), closes #5568
• iot: enforce custom authorizer decisions on MQTT connections (#4835) (a33eea0), closes #4823
• iot: indexing configuration (#4896) (f413a66)
• iot: search the supported fleet index subset (#4913) (1082941)
• lambda: durable function chained invokes (#5164) (6e6ce61)
• opensearch: allow configuring a data volume for domain containers (#5581) (8145ffd)
• opensearch: serve the legacy Elasticsearch Service 2015-01-01 API (#5357) (4afa7d8)
• rds: engine versions, engine defaults and valid modifications (#5196) (890b8ec), closes #5186
• rds: IAM role associations for DB clusters and instances (#5367) (5e48cbb), closes #5343 #5196
• rds: refuse role feature names the engine does not support (#5637) (ff32bae), closes #5631 #5656
• redshift-data: add async execution and statement status events (#5383) (ae75a65)
• redshift-serverless: add UpdateSnapshot (#5537) (a95b010)
• redshift-serverless: add usage limit actions (#5378) (141fd74)
• redshift: add relational queries for Redshift Spectrum (#5095) (950b6fe)
• redshift: add snapshot copy and snapshot schedule operations (#5574) (63b4834)
• redshift: run Data API statements from Step Functions and Scheduler (#5312) (1a6f336)
• redshiftserverless: add snapshot and restore operations (#5184) (9934b39)
• redshift: support more COPY and UNLOAD options (#5204) (38ce99b)
• s3: read one part of an object with GetObject and HeadObject partNumber (#5569) (a88ef42)
• scheduler: substitute schedule context attributes in target Input (#5194) (07ebc33)
• ses: support Content.Simple.Attachments in SESv2 SendEmail (#5190) (74b3cec)
• sns: add topic permissions, the SMS sandbox and SMS opt-out (#5570) (b7a1bde), closes #5549
• sns: sign deliveries with a served RSA certificate like AWS (#5189) (c0b2b29)
• ssm: support UnlabelParameterVersion (#5339) (4f34a90)
• ui: add a light and dark theme toggle to the landing page (#5695) (d4d4f16)
• ui: turn the landing page into a dashboard with a built-in wait view (#5594) (73b034a)

Performance Improvements

• docker: cut healthy wait from 5 s to 0.1 s (#5447) (cc12900)