floci-io/floci 1.5.34 on GitHub

🎉 Highlights

This release adds in-process CloudTrail with S3 data event emission, brings Step Functions HTTP invoke and the States.JsonMerge intrinsic, ships SES identity policies for authorization, and lands provenance and SBOM attestations on published container images. Cognito hostname handling, CloudFormation IAM inline policies, and DynamoDB expression parsing all see meaningful conformance work. Welcome to the 7 first-time contributors.

🔍 CloudTrail: in-process with S3 data event emission

In-process CloudTrail with S3 data event emission lands (#1460). CloudTrail moves from lifecycle-only support to actually capturing and emitting events, so audit-log workflows that depend on CloudTrail data events can now be exercised end to end locally.

🧩 Step Functions: HTTP invoke + `JsonMerge`

Two coordinated Step Functions capabilities:

HTTP invoke step (#1503) — external HTTP endpoints callable directly from state machines
States.JsonMerge intrinsic (#1662) — the JSONata merge operation now works in payload templates

Combined with the JSONata Assign support in 1.5.33, Step Functions expression coverage keeps expanding.

🔐 SES: identity (sending authorization) policies

Identity sending authorization policies for both v1 and v2 SES (#1750). Cross-account sending patterns and policy-controlled email delivery that couldn't previously be exercised locally now work.

🔒 CI: provenance + SBOM attestations

Published container images now include provenance and SBOM attestations (#2032). This is a meaningful supply-chain-security move: users can now cryptographically verify the images they pull match what was built from source, and enumerate the software bill of materials without external tooling. Enterprise procurement and compliance teams care about this specifically.

🧱 CloudFormation: `AWS::IAM::Policy` as inline

AWS::IAM::Policy is now correctly modeled as an inline policy (#1800, fixes #1531), matching real CloudFormation behavior. IAM patterns that use inline policies attached to roles or users now provision correctly.

🐛 Error handling improvements

Two coordinated error-handling fixes:

4xx client errors returned instead of 500 for malformed JSON-protocol input (#1926)
Firehose ResourceInUseException and ResourceNotFoundException properly returned instead of generic errors (#1738)

Meaningful for SDK client libraries that switch behavior based on error class (retry on 5xx, fail-fast on 4xx).

🌐 Core routing improvements

Unknown-service REST requests no longer fall through to S3 (#1967). Previously, requests for unrecognized services could be silently routed to S3, producing confusing errors. Now they fail correctly, which makes debugging routing issues much easier.

☸️ EKS: option to disable bundled CNI

EKS gains an option to disable k3s's bundled CNI (#1793), useful for testing setups that provide their own network plugin or want to exercise CNI-less patterns.

✨ New Features

CloudTrail / Step Functions / SES

feat(cloudtrail): in-process CloudTrail with S3 data event emission by @guilhermejsonar in #1460
feat(stepfunctions): implement States.JsonMerge intrinsic by @abanna in #1662
feat(sfn): support HTTP invoke step by @Mulgish in #1503
feat(ses): implement identity (sending authorization) policies for v1 and v2 by @okinaka in #1750

Firehose / EKS

feat(firehose): proper ResourceInUseException and ResourceNotFoundException error handling by @iam-ssrivastav in #1738
feat(eks): add option to disable k3s's bundled CNI by @attaradev in #1793

🐛 Bug Fixes

DynamoDB / S3

fix(dynamodb): throw ValidationException when list_append operand is not a list type by @PrabuDzak in #1702
fix(dynamodb): tokenize UpdateExpression whitespace-insensitively by @ravi-arnan in #1862
fix(s3): PutObjectRetention returns 400 instead of 500 on malformed RetainUntilDate by @mvanhorn in #1631
fix(s3): preserve literal question marks in copy source keys by @hectorvent in #1924

Cognito

fix(cognito): build OIDC URLs from effectiveBaseUrl so FLOCI_HOSTNAME is honored by @billjh in #1929
fix(cognito): prefer phone delivery for signup verification by @codingkiddo in #1839

CloudFormation / EC2 / ELBv2 / Neptune

fix(cloudformation): model AWS::IAM::Policy as an inline policy (fixes #1531) by @abanna in #1800
fix(ec2): apply cidr-block filter in DescribeSubnets by @Leandro-ft in #1864
fix(elbv2): move persisted-listener restore out of @PostConstruct by @hectorvent in #2015
fix(neptune): throw a mappable capacity fault when the proxy-port range is exhausted by @ahmedk20 in #1879

Core / Storage

fix(core): return 4xx client errors instead of 500 for malformed JSON-protocol input by @hectorvent in #1926
fix(core): stop unknown-service REST requests falling through to S3 by @hectorvent in #1967
fix(storage): dedupe backends by resolved file path by @bdemoss-runwise in #1931

Step Functions

fix(stepfunctions): update AslExecutorJsonMergeTest for new AslExecutor constructor by @hectorvent in #1925

🧪 Tests

test(s3): cover shared edge host routing by @CoreOxide in #1957
test(sfn): add input-context preservation test by @CoreOxide in #1851

🧰 CI

ci: attach provenance and SBOM attestations to the published images by @kobihikri in #2032
ci: use the snake_case input names first-interaction v3 expects by @hectorvent in #1981
chore: welcome first-time contributors and surface the Slack invite by @hectorvent in #1968

👋 New Contributors

A warm welcome to everyone making their first contribution to Floci:

Full Changelog: 1.5.33...1.5.34