github floci-io/floci 1.7.0
on GitHub

4 hours ago

🎉 Highlights

This release is one of the largest in Floci's history: nine new services including Bedrock AgentCore, Lambda MicroVMs, CloudHSM v2, GuardDuty, SWF, S3 Tables, Managed Service for Apache Flink, Application Auto Scaling, and transit gateways. AppSync Phase 6 closes the six-release build-out. CloudFront serves real content from S3 and custom origins. EKS gains IRSA with real OIDC. Massive CloudFormation resource push (11 new resource types plus new intrinsics). IAM seeds the full AWS managed policy catalog. Following 1.6.0's platform-additions bump, 1.7.0 is a maturity-and-breadth release.

🆕 Nine new services

  • Bedrock AgentCore — AgentCore control plane and InvokeAgentRuntime stub, extending the Bedrock story from 1.6.0 (#2316)
  • Lambda MicroVMs — service module and CloudFormation types for the new Lambda MicroVMs compute model (#2079)
  • CloudHSM v2 — hardware security module emulation (#1776)
  • GuardDuty — detector and organization configuration emulation (#2346)
  • SWF — Simple Workflow Service emulation (#2257)
  • S3 Tables — metadata service emulation (#2322)
  • Managed Service for Apache Flink (Kinesis Analytics V2) — real-time stream processing (#1914)
  • Application Auto Scaling — control plane for scalable resource targets (#2159)
  • EC2 Transit Gateways — cross-VPC networking (#2329)

🧩 AppSync Phase 6: Query Execution + HTTP Endpoint

The AppSync journey completes across six phases with Phase 6 (#1884): Query Execution and HTTP Endpoint support. From Phase 1 in 1.5.22 through Phase 6 here, AppSync went from a management-API stub to a working GraphQL service that executes queries against real data sources. Genuine end-to-end GraphQL emulation is now available.

☁️ CloudFront: real content serving

CloudFront moves from configuration-only support to actually serving distribution requests from S3 and custom origins (#1820), with signed private content enforcement (#1831). Real CDN patterns — origin routing, cache behaviors, signed URLs — now work end to end.

☸️ EKS: IRSA with real OIDC issuer

IAM Roles for Service Accounts (IRSA) now works with a real OIDC issuer and JWT validation (#2108). This is the specific EKS pattern that most production Kubernetes workloads use for AWS credential access, and previously required real EKS. Combined with managed node groups (1.5.24), Fargate profiles (1.5.33), and host-reachable clusters (1.5.22), EKS on Floci is now genuinely production-shaped.

🧱 CloudFormation: massive resource-provisioning push

Eleven new resource types plus significant behavior improvements:

  • AWS::EC2::VPCEndpoint (#1995)
  • AWS::EC2::FlowLog, AWS::ApiGateway::Account, AWS::AutoScaling::LifecycleHook (#2003)
  • AWS::ECS::CapacityProvider and ClusterCapacityProviderAssociations (#1999)
  • AWS::Events::EventBus as a real custom bus (#1807)
  • AWS::Lambda::Permission with Version and Alias update fixes (#1997)
  • Network ACL family (#2001)

Plus:

  • AWS::Serverless::HttpApi expanded via SAM transform (#2146)
  • SAM AutoPublishAlias expanded into Version + Alias (#1961)
  • Resource-level DeletionPolicy honored (#2167)
  • Resource-level conditions honored (#2255)
  • GetTemplateSummary implemented (#2148)
  • Dynamic references in RDS credentials resolved (#1809)
  • Nested stacks and removed resources physically deleted on update (#2345)

🔐 IAM: full managed policy catalog

IAM now seeds the full AWS managed policy catalog (#2194). Every AWS-managed policy that real workloads reference is now present, closing the last major "why doesn't this CDK/Terraform stack work" gap around managed-policy attachments. Also lands: service-linked roles (#2179), account aliases (#2103), OIDC identity providers (#2106), account summary (#1986), long-term access keys routed to owning accounts (#2319).

🔐 Cognito: refresh token hardening

Three coordinated security fixes for Cognito refresh tokens:

  • Refresh tokens expire and are scoped to their pool in REFRESH_TOKEN_AUTH (#2135)
  • Refresh tokens HMAC-signed to prevent forgery (#2139)
  • Invalid refresh tokens rejected in InitiateAuth (#2132)

These close real security gaps where forged or reused tokens could have been accepted. Also lands: AdminLinkProviderForUser (#2166), GetUserAttributeVerificationCode (#1898), contact attribute verification on ConfirmSignUp (#1881).

🔒 Multi-account isolation

Three coordinated isolation improvements:

  • DynamoDB: item storage and locks isolated between accounts (#2240)
  • S3: object byte storage isolated between accounts (#2241)
  • Core: shared pagination helper, maxResults=0 rejected (#2343)

Combined with the cross-account IAM assumed-role routing from 1.5.29 and STS session policies from 1.5.30, multi-account testing on Floci is now genuinely correct rather than approximate.

🚌 EventBridge to event-bus targets

EventBridge can now deliver events to event-bus targets (#1814). Cross-bus event routing patterns work locally.

🌊 Firehose: BufferingHints

Firehose now honors BufferingHints with both time and size based flushing (#2314). Real-world Firehose patterns that depend on batching behavior now match production semantics.

🎯 API Gateway: execute-api hostnames + WebSocket

  • execute-api hostnames routed for HTTP APIs (#2054)
  • execute-api hosts route to WebSocket $connect and @connections (#2188)
  • JWT authorizer claims verified and propagated for HTTP API v2 (#2353)

✨ New Features

New services

  • feat(bedrockagentcore): emulate the AgentCore control plane and InvokeAgentRuntime stub (#2316)
  • feat(lambdamicrovms): AWS Lambda MicroVMs service module and CloudFormation types (#2079)
  • feat(cloudhsmv2): implement CloudHSM v2 service (#1776)
  • feat(guardduty): add GuardDuty detector and organization configuration emulation (#2346)
  • feat(swf): add Simple Workflow Service emulation (#2257)
  • feat(s3tables): emulate metadata service (#2322)
  • feat(kinesisanalytics): add Managed Service for Apache Flink (Kinesis Analytics V2) (#1914)
  • feat(applicationautoscaling): add Application Auto Scaling control plane (#2159)
  • feat(ec2): support transit gateways (#2329)

AppSync / CloudFront / EKS

  • feat(appsync): Phase 6 — Query Execution + HTTP Endpoint (#1884)
  • feat(cloudfront): serve distribution requests from S3 and custom origins (#1820)
  • feat(cloudfront): enforce signed private content (#1831)
  • feat(eks): support IRSA with a real OIDC issuer and JWT validation (#2108)

CloudFormation

  • feat(cloudformation): provision AWS::EC2::VPCEndpoint (#1995)
  • feat(cloudformation): provision ApiGateway::Account, AutoScaling::LifecycleHook, EC2::FlowLog (#2003)
  • feat(cloudformation): provision AWS::ECS::CapacityProvider and ClusterCapacityProviderAssociations (#1999)
  • feat(cloudformation): provision AWS::Events::EventBus as a real custom bus (#1807)
  • feat(cloudformation): provision AWS::Lambda::Permission and fix Version and Alias updates (#1997)
  • feat(cloudformation): provision the network ACL family (#2001)
  • feat(cloudformation): honor resource-level DeletionPolicy (#2167)
  • feat(cloudformation): implement GetTemplateSummary (#2148)
  • feat(cloudformation): resolve dynamic references in RDS credentials (#1809)

IAM

  • feat(iam): seed the full AWS managed policy catalog (#2194)
  • feat(iam): add service-linked role create, delete, and deletion status (#2179)
  • feat(iam): support account aliases (#2103)
  • feat(iam): support OIDC identity providers (#2106)
  • feat(iam): add GetAccountSummary support (#1986)

EC2

  • feat(ec2): add ReplaceRoute (#2178)
  • feat(ec2): allow security group rules to take a prefix list as source (#2271)
  • feat(ec2): config toggle to report the AWS-faithful private IP (#2024)
  • feat(ec2): DescribeImages synthesizes an AMI for wildcard lookups (#2009)
  • feat(ec2): DescribeVpcEndpointServices returns common interface services with AZs (#2007)
  • feat(ec2): support CreateImage (create AMI from instance) (#1979)
  • feat(ec2): support managed prefix lists (#2105)

API Gateway

  • feat(apigateway): API key management — UpdateApiKey, DeleteApiKey, UsagePlan custom-id, generateDistinctId (#1883)
  • feat(apigateway): derive SQS QueueUrl from path-style integration URI when absent from template (#1903)
  • feat(apigateway): route execute-api hostnames for HTTP APIs (#2054)
  • feat(apigatewayv2): route execute-api hosts to WebSocket $connect and @connections (#2188)

Cognito / SES

  • feat(cognito): add AdminLinkProviderForUser (#2166)
  • feat(cognito): add GetUserAttributeVerificationCode support (#1898)
  • feat(ses): add DKIM actions with domain-inherited email DKIM (#1904)
  • feat(ses): honor ConfigurationSetName on CreateEmailIdentity (v2) (#1812)
  • feat(ses): implement custom verification email templates for v1 and v2 (#1840)
  • feat(ses): implement PutAccountVdmAttributes and return VdmAttributes from GetAccount (v2) (#2265)
  • feat(ses): implement SendCustomVerificationEmail for v1 and v2 (#2191)
  • feat(ses): implement SendEmail ListManagementOptions suppression and unsubscribe (v2) (#1875)
  • feat(ses): implement v1 receipt rule set actions (stored-but-inert) (#2128)

Step Functions

  • feat(stepfunctions): add UpdateStateMachine and update in place on stack updates (#1867)
  • feat(stepfunctions): emulate distributed Map ResultWriter (S3 export + manifest) (#1823)
  • feat(stepfunctions): run Map iterations concurrently honoring MaxConcurrency (#1810)

Other features

  • feat(cloudcontrol): implement CreateResource / DeleteResource / GetResource (#2037)
  • feat(dynamodb): global-table v2 replicas (UpdateTable ReplicaUpdates + Custom::DynamoDBReplica) (#1811)
  • feat(elbv2): honor preserve_host_header parameter (#2109)
  • feat(eventbridge): deliver events to event-bus targets (#1814)
  • feat(firehose): honor BufferingHints with time and size based flush (#2314)
  • feat(kinesis): add local inspection endpoints for UI (#1880)
  • feat(kms): implement UpdateAlias (#2324)
  • feat(lambda): support EFS file system configs (#2053)
  • feat(logs): support log group deletion protection (#2256)
  • feat(msk): add configuration CRUD (Create/List/Describe/Delete) (#2336)
  • feat(opensearch): parse, store, and return AccessPolicies (#2327)
  • feat(rds-data): preparedStatement() support (#1887)
  • feat(rds): model DB proxies and their target groups (#1813)
  • feat(s3): resolve index documents for static-website directory requests (#1815)

🐛 Bug Fixes

Note: this section is condensed by area given the size of the release.

CloudFormation

Idempotent resource cleanup, resource-level conditions and status filters, ASG launch template resolution, log group in-place reconciliation, SAM HttpApi expansion, IAM role adoption on update, physical deletion of nested stacks. See PRs #1802, #1969, #1977, #2005, #2019, #2031, #2143, #2146, #2152, #2177, #2244, #2255, #2325, #2345, #2056.

API Gateway

MOCK integration response headers, CreateDeployment stage creation, REST/HTTP API region fallback, case-insensitive Content-Type matching, trailing-slash preservation in proxy events, binary Lambda body encoding, JWT authorizer claims, execute-api hostname routing. See PRs #1822, #1863, #2130, #2149, #2150, #2203, #2286, #2353.

CloudWatch

GetLogEvents paging within list bounds, FilterLogEvents forward paging, invalid token rejection, logStreamName on filter results, warnings on unsupported Logs Insights operators. See PRs #2170, #2249, #2259, #2354, #2355.

Cognito

Refresh token expiration and pool scoping, HMAC signing, invalid token rejection, contact attribute verification on ConfirmSignUp, SecureRandom import restoration. See PRs #1881, #2132, #2135, #2139, #2337.

DynamoDB

Legacy Expected Value comparison, per-account isolation, composite sort key ordering. See PRs #2114, #2125, #2240.

EC2

Public IP assignment via MapPublicIpOnLaunch, key pair deletion, security group rule sources, prefix list name reservation, sshd path handling, security group rule tag typing. See PRs #2023, #2187, #2245, #2266, #2272, #2274, #2351.

S3 / S3 Vectors

Bucket configuration tags, EventBridgeConfiguration in notifications, HTTP/2 virtual-hosted-style routing, percent-encoded copy source separators, empty DeleteObjects key lists, multipart tag persistence, per-account byte storage isolation, literal + in keys, accelerate subresource routing, FULL_OBJECT checksum validation on multipart complete, auth enforcement on write paths, presigned URL SigV4 verification. See PRs #1736, #1842, #1843, #1954, #1980, #2072, #2115, #2151, #2175, #2201, #2241, #2285, #2326, #2330.

Lambda

Runtime API HTTP/2 disable, extension draining on server close, image inspection failure propagation, container log line reassembly, code volume reconciliation, qualifier-scoped resource policies, SIGTERM before socket close, layer ARN eager validation, execution role SDK assumption, published version code location. See PRs #1909, #1953, #2012, #2098, #2129, #2156, #2181, #2208, #2268, #2282.

RDS / MSK / MemoryDB / ElastiCache

Reachable endpoints, NotFound fault codes, configured image preservation, managed default parameter groups, Terraform compatibility, engine user preservation, container cleanup on readiness timeout. See PRs #1740, #1805, #1951, #2035, #2074, #2090, #2092, #2331.

Other

Firehose Kinesis source and S3 object key building (#1858, #2025), EventBridge boolean/numeric pattern matching (#1889), IoT topic rule region matching (#2169), Kinesis record size and shard iterator resolution (#1896, #1901), KMS key mismatch rejection (#1893), Step Functions execution status publishing and lambda:invoke envelope (#2165, #2234), SQS delayed FIFO message group blocking (#2112), IAM/Lambda resource tags in Get/Create (#2262), IAM policy descriptions (#2155), IAM long-term access key routing (#2319), IAM AmazonAPIGatewayPushToCloudWatchLogs seeding (#2147), EKS subnet validation (#1943), ECS service deployment reporting (#2176), AppConfig tag ARN parsing and CRUD additions (#2279, #2280), Docker Windows named pipe fallback (#2030), Docker container/volume labeling (#2341), docker-java compatibility (#2096), core pagination and executor thread cleanup (#2343, #2363), compat image AWS CLI v2 installation (#2315), SES store passing in test (#2182).

🚀 Performance

  • perf(lambda): reuse a populated code volume across restarts via a completion marker (#1827)

Full Changelog: 1.6.0...1.7.0

Check out latest releases or
releases around floci-io/floci 1.7.0

Don't miss a new floci release

NewReleases is sending notifications on new releases.

Get notifications