Amazon Web Services breaking changes, updated weekly

Every verified Amazon Web Services trap in Footgun: changes and behaviors that break code or give wrong results, newest first. Each one has the error you see, the fix, and the date it was last checked. The list updates when the weekly check adds or retires a trap. For the full cause and sources, open the trap, or see all Amazon Web Services traps.

1. fg-0561· added 2026-10-27· last checked 2026-10-27

   An S3 bucket with Block Public Access off and a public bucket policy serves your files to anyone

   Symptom

   Objects open in a browser with no signed URL or credentials

   Fix

   Turn on all four Block Public Access settings on the bucket, and on the account so current and future buckets are covered. If something must be public, such as a static website, keep it in its own bucket and keep user uploads in a private one.

2. fg-0171· added 2026-10-15· last checked 2026-10-15

   API Gateway returns 504 Endpoint request timed out after about 29 seconds while the Lambda keeps running

   Symptom

   {"message": "Endpoint request timed out"} with HTTP 504

   Fix

   Move long work to an async pattern (return 202 and poll, or use a queue), or for a Regional or private REST API request a higher integration timeout quota. Edge-optimized REST APIs and HTTP APIs cannot go higher.

3. fg-0174· added 2026-10-15· last checked 2026-10-15

   DynamoDB DocumentClient throws Unsupported type passed when an item contains a Date or class instance

   Symptom

   Error: Unsupported type passed: Tue Oct 14 2026 ... Pass options.convertClassInstanceToMap=true to marshall typeof object as map attribute.

   Fix

   Convert dates to ISO strings or epoch numbers before writing. Use convertClassInstanceToMap only for your own classes, since it would turn a Date into an empty map.

4. fg-0176· added 2026-10-15· last checked 2026-10-15

   Lambda cannot connect to RDS over TLS after upgrading from Node.js 18 to Node.js 20 or later

   Symptom

   Error: self-signed certificate in certificate chain

   Fix

   Bundle the RDS certificate bundle for your Region and point NODE_EXTRA_CA_CERTS at it, or point it at the Amazon CA file the runtime ships. Pass certificate contents, not a path, when you hand a CA to the driver yourself.

5. fg-0177· added 2026-10-15· last checked 2026-10-15

   Lambda fails with Cannot find module 'aws-sdk' after moving to a newer Node.js runtime

   Symptom

   Runtime.ImportModuleError: Error: Cannot find module 'aws-sdk'

   Fix

   Port the calls to the modular v3 clients and bundle the clients you use in the deployment package rather than relying on the runtime copy.

6. fg-0178· added 2026-10-15· last checked 2026-10-15

   Lambda function fails with Runtime.CallbackHandlerDeprecated after switching to the Node.js 24 runtime

   Symptom

   errorType Runtime.CallbackHandlerDeprecated in CloudWatch, invocation returns FunctionError Unhandled

   Fix

   Make the handler async and return the result or throw the error. If the callback parameter is declared but never used, just remove it from the signature.

7. fg-0180· added 2026-10-15· last checked 2026-10-15

   S3 GetObject Body.toString() returns [object Object] or a stream instead of the file contents in AWS SDK v3

   Symptom

   response.Body.toString() prints [object Object] or IncomingMessage

   Fix

   Await Body.transformToString() or transformToByteArray(). Read it once, because the stream is consumed by the first read.

8. fg-0182· added 2026-10-15· last checked 2026-10-15

   S3 uploads to Cloudflare R2, MinIO, or other S3-compatible storage fail after upgrading the AWS SDK in January 2025

   Symptom

   501 NotImplemented: Header 'x-amz-checksum-crc32' with value (...) not implemented

   Fix

   For non-AWS endpoints, set request and response checksum behavior to WHEN_REQUIRED in the client config, or through the shared config file or environment variables. Keep the default for real Amazon S3.

9. fg-0173· added 2026-10-15· last checked 2026-10-15

   DynamoDB DocumentClient put throws Pass options.removeUndefinedValues=true to remove undefined values

   Symptom

   Error: Pass options.removeUndefinedValues=true to remove undefined values from map/array/set.

   Fix

   Create the document client with removeUndefinedValues true, or strip undefined fields before the write.

10. fg-0172· added 2026-10-15· last checked 2026-10-15

    cdk deploy fails with Cloud assembly schema version mismatch when the CDK CLI version matches aws-cdk-lib

    Symptom

    Cloud assembly schema version mismatch: Maximum schema version supported is 39.x.x, but found 40.0.0

    Fix

    Upgrade the CLI to the latest 2.1xxx release, which reads every older schema. Use npx with the project-local CLI in CI so a stale global install is not picked up.

11. fg-0170· added 2026-10-15· last checked 2026-10-15

    API Gateway REST API returns 502 Bad Gateway with Malformed Lambda proxy response though the Lambda succeeded

    Symptom

    {"message": "Internal server error"} with HTTP 502

    Fix

    Return statusCode and a JSON string body from the handler, and add CORS headers there because proxy integrations do not add them.

12. fg-0175· added 2026-10-15· last checked 2026-10-15

    event.httpMethod and event.path are undefined in a Lambda behind an API Gateway HTTP API

    Symptom

    event.httpMethod is undefined

    Fix

    Read the 2.0 fields, or set the integration payloadFormatVersion to 1.0 if the handler expects the REST API shape. The CLI, CloudFormation and SDKs require you to choose it explicitly.

13. fg-0181· added 2026-10-15· last checked 2026-10-15

    S3 presigned URL expires after an hour or a few hours even though you set expiresIn to 7 days

    Symptom

    ExpiredToken: The provided token has expired

    Fix

    Sign long-lived URLs with credentials that live as long as the URL, or keep URLs short and mint a fresh one on demand from your backend. For AssumeRole, raise the session duration if a few hours is enough.

14. fg-0179· added 2026-10-15· last checked 2026-10-15

    PutObject with ACL public-read fails with AccessControlListNotSupported on a new S3 bucket

    Symptom

    AccessControlListNotSupported: The bucket does not allow ACLs

    Fix

    Drop the ACL parameter and grant read access with a bucket policy or CloudFront instead. Only switch Object Ownership back to an ACL mode if you truly need per-object ACLs.

15. fg-0183· added 2026-10-15· last checked 2026-10-15

    Setting reserved concurrency fails with decreases account's UnreservedConcurrentExecution below its minimum value on a new AWS account

    Symptom

    InvalidParameterValueException: Specified ReservedConcurrentExecutions for function decreases account's UnreservedConcurrentExecution below its minimum value

    Fix

    Remove or lower reserved concurrency until the quota is raised, and request a Concurrent executions increase in Service Quotas.