github floci-io/floci 2.1.0
on GitHub

6 hours ago

2.1.0 (2026-09-15)

Bug Fixes

  • acm: reflect the requested ValidationDomain in DescribeCertificate (#3264) (922eb0b)
  • acm: reject RequestCertificate key algorithms real ACM does not support (#3044) (db6c419), closes #3027
  • acm: report SUCCESS domain validation once a certificate is issued (#3112) (9b28388)
  • acm: stop hex-shaped names becoming bogus IP address SANs (#3335) (7a7531a)
  • amazonmq: add configuration for AMQP and console host port ranges (#3315) (2d5a8f7)
  • apigateway: add missing authorizer arg to two VtlContext test calls (38056a0), closes #3560
  • apigateway: allow idempotent custom-id tags (#3430) (eb62225)
  • apigateway: answer an unmatched REST request with 403, not 404/405 (#3547) (fb82fb2)
  • apigateway: decode the ~0 JSON Pointer escape in stage method-settings patch paths (#3526) (bc44fc9)
  • apigateway: enforce ApiKeyRequired on REST API methods (#3537) (3b31c5a), closes #3507 #3507
  • apigateway: enforce AWS_IAM authorization on the execute-api data plane (#2895) (06349c8), closes #2810
  • apigateway: expose VTL authorizer and parameter maps (#3538) (2290247)
  • apigateway: fall back to a parameterised sibling on method mismatch (#3399) (f03a716)
  • apigateway: implement MOCK integration response selection based on status code (#3327) (8d011cb)
  • apigateway: import x-amazon-apigateway-any-method on OpenAPI import (#2876) (b85dd2b)
  • apigateway: include apiKeyId in the REQUEST authorizer identity context (#3143) (dced3e7)
  • apigateway: only emit the greedy path parameter for greedy resources (#3397) (547090b)
  • apigateway: prefer path parameters in VTL lookups (#3560) (166b13a)
  • apigateway: report rootResourceId and the API key defaults (#3269) (c57b8ff)
  • apigateway: return the full integration configuration on read-back (#3432) (a91d7be)
  • apigateway: take the last value of a repeated query string parameter (#3548) (e8edc3d)
  • apigatewayv2: provision integration, route and stage on quick create (#2877) (2a637d3), closes #1902
  • appconfigdata: honor requested poll interval (#3092) (8686651)
  • appconfigdata: return empty payload on repeat polls (#3295) (47d96f6)
  • appsync: verify JWT signatures and SigV4 requests for GraphQL auth (#3541) (f38a384)
  • athena: project the column names the Glue table declares (#3414) (ebe9cf2)
  • athena: read a projecting table's partition paths, not its whole location (#3415) (6d6940b)
  • athena: register every Glue database as a DuckDB schema so . resolves (#2993) (0ab9979)
  • autoscaling: round-trip launch configuration InstanceMonitoring and BlockDeviceMappings (#3174) (4cc850e)
  • autoscaling: round-trip the dropped Auto Scaling group fields (#3494) (cebb011)
  • autoscaling: validate monitoring booleans (#3219) (84a7ce6)
  • bound CloudTrail delivery retries (#3298) (d44a3fe)
  • build: publish arm64 baseline release image (#3461) (e0d4318)
  • cdk: parse CDK endpoint URLs safely (#3352) (c5e1a7f)
  • cloudcontrol: reject ListResources for unsupported resource types instead of returning empty (#3141) (5cf10ec), closes #2043
  • cloudcontrol: scope resources by caller account (#3244) (b6080ea)
  • cloudformation: apply AWS::SQS::Queue tags from the template (#3532) (a5045d3), closes #2985
  • cloudformation: delete AWS::IAM::User on stack deletion (#3076) (7b5c6e2), closes #2490
  • cloudformation: expand AWS::Serverless::StateMachine, and reject every unresolvable DefinitionUri on both StateMachine and HttpApi (#2885) (f2b4c08)
  • cloudformation: expose the RDS resource-id GetAtt attributes (#3527) (b618fa9)
  • cloudformation: identify unsupported SAM Cognito authorizers (#3535) (809ce40)
  • cloudformation: keep a generated physical name across stack updates (#2788) (1528c65)
  • cloudformation: keep generated names across updates for Scheduler, SQS and MicrovmImage (#2985) (9162b99), closes #2788
  • cloudformation: keep unchanged VPCs and security groups on stack update (#3033) (dde11ae)
  • cloudformation: merge Fn::Transform AWS::Include before provisioning, and honour GetTemplate TemplateStage (#2886) (77b4881)
  • cloudformation: persist FunctionResponseTypes on Lambda::EventSourceMapping (#2964) (9e2c031), closes #2848
  • cloudformation: preserve list intrinsics and conditional tags (#2986) (9f44254)
  • cloudformation: preserve SAM implicit API auth (#3501) (8963c66)
  • cloudformation: provision AWS::Scheduler::ScheduleGroup (#2796) (961d82d)
  • cloudformation: provision CloudFront policies and origin access controls (#3228) (895adce), closes #2441
  • cloudformation: reconcile AWS::Pipes::Pipe on UpdateStack (#2970) (a31a959)
  • cloudformation: refuse UpdateStack on a ROLLBACK_COMPLETE stack (#3104) (d2d7eb4), closes #3097
  • cloudformation: replace AWS RDSDBCluster when EngineMode or StorageEncrypted changes (#3555) (589b1ab)
  • cloudformation: resolve dynamic references for all template values (#3301) (924e35c), closes ProvisionContext#resolveOptional #2213
  • cloudformation: resolve FunctionResponseTypes through whole-property intrinsics (#2996) (9eb4fc8), closes #2964 #2964 #2796 #2946
  • cloudformation: resolve list-valued intrinsics for DBSubnetGroup SubnetIds (#2946) (f214050), closes #2937 #2937 #2937 #2937 #2937 #2937 #2937
  • cloudformation: scope stack state by account (#3185) (0cff315)
  • cloudformation: set Fn::GetAtt attributes the schemas declare (#2761) (7095641)
  • cloudformation: skip re-invoking custom resource handlers when properties are unchanged (#2785) (71c7836)
  • cloudformation: validate WAFv2 WebACL and Config rule required properties (#3576) (36c8396), closes #2711
  • cloudformation: wire Route53 and Scheduler provisioners into the test fixture (#2922) (cf10d25), closes #2722 #2796
  • cloudfront: echo OriginSslProtocols and round-trip legacy cache behavior fields (#3182) (006f3c7)
  • cloudfront: echo TrustedSigners in cache behaviors so the AWS provider does not segfault (#3015) (75e93e5), closes #2767
  • cloudfront: emit origin timeout fields (#3299) (3523378), closes #3221
  • cloudfront: persist and echo LambdaFunctionAssociations and FunctionAssociations (#2915) (3d3ab00), closes #2835
  • cloudfront: report Logging on distribution reads (#3318) (d4e9dcb)
  • cloudfront: stop duplicating CachedMethods into AllowedMethods.Items (#3217) (9e9b0b6)
  • cloudhsmv2: tighten backup and tag fidelity (#3443) (daff15d)
  • cloudtrail: bound log flush memory (#3293) (d3530d9)
  • cloudtrail: implement CreateTrail with tagging support and add integration tests (#3206) (991470e)
  • cloudtrail: serialize trail mutations to prevent lost updates (#2911) (8c2619f), closes #2904
  • cloudtrail: stop CloudTrailLogWriterBoundedRetryIntegrationTest relying on S3 key order (#3363) (34be181), closes #3361
  • cloudwatch: fail Logs Insights queries with unsupported syntax instead of silently dropping it (#3139) (121a929)
  • cloudwatchlogs: bound stored events and enforce retention (#3611) (6ce3fbb)
  • cloudwatch: wrap TagResource and UntagResource in their declared Result element (#3211) (65db87d)
  • codebuild: persist build numbers across restarts (#3049) (51f5591)
  • codebuild: resolve project ARNs in batch lookup (#2999) (de92212)
  • codedeploy: default server hook timeout to one hour (#3606) (73ef15f)
  • codedeploy: fail closed on unreachable, erroring, or timed-out lifecycle hooks (#3563) (d167cc5)
  • codepipeline: cap QUEUED and PARALLEL pipelines at 50 active executions (#3503) (2104b33)
  • codepipeline: poll S3 source changes (#3525) (ffd2488)
  • codepipeline: populate stage execution status (#3478) (129ba0a)
  • cognito: clear stale pending admin updates (#2533) (a704f73)
  • cognito: delete a pool's users and resource servers on DeleteUserPool (#3419) (c48e81d), closes #2858
  • cognito: delete a user pool's records with the pool (#2949) (2a4ca61), closes #3419 #2864 #2936 #2864
  • cognito: fail listUsers/listUserPoolClients on an absent user pool (#2962) (4bf17a1), closes #2952
  • cognito: invoke the CustomMessage Lambda trigger before delivering verification emails (#3140) (148ec83)
  • cognito: name missing user pools in errors (#2936) (c30ca8f)
  • cognito: serialize attribute verification updates (#2535) (530717e)
  • cognito: verify self-service access tokens (#3184) (3c247eb)
  • compat: avoid CloudWatch statistics time race (#3320) (bf49390)
  • compat: require Kinesis stream details (#3321) (53a5164)
  • compat: retry RedshiftTest's SDK calls past a brief connection-refused hiccup (#3216) (974d357)
  • config: accept any Host header again after the Quarkus 3.39 upgrade (#3222) (1f4d43c), closes #3175
  • core: accept ARNs from every AWS partition (#3376) (1726c6a), closes #2485
  • core: accept only JSON objects as JSON protocol request bodies (#3509) (9f9a828)
  • core: prevent REST JSON requests falling through to S3 (#3498) (e62e99f)
  • core: quarantine unreadable hybrid storage (#2250) (cc8b8e9)
  • core: read ARN resource segments by structure, not by position (#3392) (7c08b35)
  • docdb: accept an existing security group on CreateDBCluster and ModifyDBCluster (#2991) (91d7ab8), closes #2990
  • docker: allow explicit root for restricted sockets (#3558) (d8e7382)
  • docker: PortAllocator also checks ports other containers already publish on the host (#2805) (afa5960)
  • docker: produce a working native image from Dockerfile.native (#3325) (a501eab)
  • docker: translate misleading disk-quota error for keyring exhaustion (#2797) (7828ab2), closes floci-io/floci#2243
  • dynamodb: add missing request validation (#3287) (4d199b1)
  • dynamodb: append list values for out-of-range indexes (#3088) (f8a1c31)
  • dynamodb: apply GSI throughput updates (#3032) (2d26f93), closes #3028
  • dynamodb: bind every PartiQL parameter type and reject unordered operands (#3288) (66ca9dc)
  • dynamodb: calculate consumed capacity correctly (#3071) (97915d3)
  • dynamodb: enforce primary key size limits (#3354) (8624ccc)
  • dynamodb: flush persistence once per affected table in batch and transact writes (#2998) (80725e6), closes #2995 #2995 #2995
  • dynamodb: honor customer-supplied KMS key for table SSE (#1923) (e313ab5), closes #1811
  • dynamodb: keep stream iterators stable after trimming (#3313) (b377134)
  • dynamodb: match AWS on UpdateItem results and request limits (#3447) (6d43e16)
  • dynamodb: match AWS wording and order for Select rejections (#3410) (dffe34e)
  • dynamodb: merge shared-prefix projection paths and compact list indices (#3072) (5c8cff6)
  • dynamodb: more request validations in Query and Scan (#3360) (fbe92aa), closes #3287
  • dynamodb: name the table in the ResourceNotFoundException message (#2929) (58b2e5f)
  • dynamodb: partition parallel scan by partition key hash (#3225) (#3429) (9c9aa67)
  • dynamodb: re-check TTL under item lock before sweeper deletes (#3562) (f1bbe12)
  • dynamodb: read every attribute through an ALL-projection index in PartiQL (#3309) (4cb9314)
  • dynamodb: reject a BETWEEN with reversed bounds at parse time (#3183) (df0bf82)
  • dynamodb: reject ConsistentRead on GSI Scan (#2931) (6dec214)
  • dynamodb: reject out-of-bound query cursors (#3389) (862e4a1)
  • dynamodb: reject QueryFilter with KeyConditionExpression (#2935) (7d693de)
  • dynamodb: reject unused ExpressionAttributeNames/Values on PutItem, DeleteItem, Scan, Query (#2923) (262495d), closes #2893 #2893 #st #2893
  • dynamodb: route Kinesis CDC to the table owner's account and retry failed forwards (#3063) (a9df872)
  • dynamodb: stage transact write mutations before commit (#3189) (8343583)
  • dynamodb: word BatchWriteItem key rejections the way AWS does (#3227) (f4954de)
  • ec2,ecr,eks,elasticache,msk,opensearch: degrade gracefully with no Docker daemon (#2975) (1aa981f), closes #2386 #3023
  • ec2,ssm: explain missing IMDS registration for SSM-only managed instances (#3283) (f77cf4d)
  • ec2: add network capacity to instance type responses (#3179) (f9686d5)
  • ec2: align catalog image owner filtering (#3463) (a6f1751)
  • ec2: answer DescribeTransitGatewayConnects with an empty list (#3274) (f30ba77)
  • ec2: bound launches and close userdata streams (#3135) (dd33308)
  • ec2: bound user data output capture (#3144) (653c139)
  • ec2: build the instance AWS_ENDPOINT_URL from the shared container endpoint (#3579) (1ae779a), closes #3578
  • ec2: carry DeliverLogsPermissionArn through CreateFlowLogs and DescribeFlowLogs (#3172) (acc0904)
  • ec2: describe launchable unknown AMI ids in DescribeImages (#3168) (de5dc0d)
  • ec2: generate real key material in CreateKeyPair and fingerprint imported keys (#3307) (2fbe2b7), closes PKCS#1 PKCS#8
  • ec2: guard null group entries in DescribeNetworkInterfaces group-id filter (#2887) (5c71713)
  • ec2: honor AMI architecture for containers (#3096) (43cdbe2)
  • ec2: include network metadata in instance type responses (#2943) (c54b237)
  • ec2: include supported usage classes in DescribeInstanceTypes (#3347) (19f410d)
  • ec2: let dnf swap curl-minimal for curl when installing the IMDS proxy (#3284) (5648be7), closes floci-io/floci#3281
  • ec2: match cidr-block-association filters on DescribeVpcs (#3257) (eb3a6b2), closes #3256
  • ec2: nest cidrBlockState in AssociateVpcCidrBlock response (#3243) (496b376), closes #3241
  • ec2: place a subnet in the zone its request names, not always az1 (#2890) (c32f8b5)
  • ec2: reclaim instance containers orphaned by a hard restart (#3031) (94b9665), closes #2029
  • ec2: register all guest network addresses with IMDS (#3546) (3c6568b)
  • ec2: reject a CreateSubnet whose CIDR overlaps an existing subnet (#3171) (614166f)
  • ec2: report a NAT gateway's addresses, not just its allocation id (#2892) (bed2704)
  • ec2: report NotFound for launch templates requested by name (#3246) (8bc4891), closes #3234
  • ec2: store and validate CreateVpcEndpoint SubnetConfiguration (#3491) (5d0b0b4)
  • ec2: store instance metadata options and add ModifyInstanceMetadataOptions (#3215) (5eacd01), closes lex00/floci#116
  • ec2: tolerate a null groupId in the network-interface group-id filter (#2921) (e44df51)
  • ecr: clean up registry storage (#2982) (732e009)
  • ecr: enforce immutable image tags (#3009) (9507996)
  • ecr: join the ECR API with the backing registry (#2466) (064f302)
  • ecr: recover backing registry containers (#3486) (8e3bd63)
  • ecs: enforce host-volume bind-mount safety fail-closed at register and run time (#3543) (126af73)
  • ecs: reconcile services in every account, not just the default one (#3297) (42bc0d9)
  • efs: implement UpdateFileSystemProtection and report protection on describe (#2842) (db182b3)
  • eks: validate IAM authentication tokens (#2912) (309043b)
  • elasticache: honor the requested Port on CreateReplicationGroup (#3276) (67198c7)
  • elasticache: implement parameter group reservation to prevent deletion during provisioning (#3023) (d398376)
  • elasticache: resolve order-dependent crossGroupAuthIsRejected test failure (#1991) (#3074) (173ff45)
  • elbv2: bound Lambda and target body sizes (#3149) (ec41b1e)
  • elbv2: do not let a listener bind a port Floci reserves for itself (#3034) (bf517ac)
  • elbv2: drop access logs from a Gateway Load Balancer's attributes (9bf93b9)
  • elbv2: report the attribute defaults, not only what was modified (910e64e)
  • eventbridge,scheduler: read cron day-of-week as AWS 1-7 SUN-SAT (#3147) (60a8a9d), closes 2#1
  • eventbridge: scope replay cancellation by ARN (#3058) (2e303e2)
  • firehose: isolate streams by account and region (#3267) (141b159)
  • firehose: keep buffered records when S3 delivery fails (#3471) (6507f32)
  • github-actions: continue Docker compatibility tests after failures (#3351) (051a2f0)
  • glue: bound DeleteSchemaVersions ranges before expanding them (#3508) (76c1907)
  • glue: populate CatalogId on GetDatabase and GetDatabases (#2814) (342f58b), closes #2793
  • guardduty: scope organization state across accounts (#3278) (ed116ae)
  • honor Kinesis ExplicitHashKey routing (#3069) (a006b27)
  • iam: distinguish cross-account resource grants (#3590) (2f76640)
  • iam: enforce temporary credential lifecycle (#3487) (ad1061c)
  • iam: report the real default version of AWS-managed policies (#3275) (abfa8e9)
  • iam: resolve DynamoDB table ARN from request body for IAM enforcement (#2928) (3db883d), closes #2925
  • iam: use AWS-managed policy documents (#3237) (379910b)
  • identitystore: self-heal the bootstrap identity store on hasIdentityStore (#3387) (b87ee5b), closes #3386
  • init-hooks: terminate hook process trees on timeout (#3372) (d99f162)
  • iot: isolate topic rule actions and run the error action (#3012) (7ec4c89)
  • kinesis: handle minimum partition key hash (#2950) (30b8f88)
  • kinesis: reject non-string tag members instead of coercing them (#3099) (fcb5bd0), closes #2512
  • kinesis: stop dropping shard records under concurrent producers and resharding (#3000) (73deb13)
  • kms: apply real RSAES-OAEP for RSA keys in Encrypt and Decrypt (#3038) (e5afe35), closes #3024
  • kms: give ECC_NIST_EDWARDS25519 an actual Ed25519 key (#2930) (146753b), closes #2924
  • kms: protect ciphertext blobs with an AES-GCM envelope (#3544) (494bab4)
  • kms: support ML-DSA keys (#3047) (b713c4b)
  • kms: support SM2 signing in China regions (#3046) (5198cf2)
  • kms: validate KeyUsage against KeySpec on CreateKey (#2787) (#3004) (69e8bf1)
  • lambda: apply Architectures on UpdateFunctionCode (#2907) (9b582b3)
  • lambda: bound ZIP extraction resources (#3127) (0fce2d2)
  • lambda: correct Function URL body encoding, cookies, and error status (#3196) (d049875), closes #3153
  • lambda: defer handler validation to invocation (#3332) (8b25e50), closes #3311
  • lambda: deliver extension INVOKE when the runtime receives the invocation (#3070) (43e2a48), closes #2573
  • lambda: do not publish a version when nothing has changed (#2941) (c48b6b0), closes #2822
  • lambda: enforce handler deadline at dispatch (#3177) (438ae61), closes #3154
  • lambda: fail the whole SQS batch on malformed batchItemFailures (#3169) (bcd422a), closes #3152
  • lambda: give each published version its own copy of the code (#3041) (4ee5a52), closes #2958
  • lambda: honor configured function architecture (#2994) (7fdd145)
  • lambda: honor DynamoDB stream partial batch failures (#3466) (c6316d1)
  • lambda: honor MaximumBatchingWindowInSeconds on SQS event source mappings (#3203) (ec2d678), closes #3155
  • lambda: honor MaximumRetryAttempts and DestinationConfig.OnFailure for DynamoDB Streams ESM (#3263) (#3428) (1af3b56)
  • lambda: honour Qualifier on GetFunction and GetFunctionConfiguration (#2932) (cf628ba), closes #1988 #2821
  • lambda: honour the CodeSha256 precondition on PublishVersion (#2939) (3d2b882), closes #2822
  • lambda: omit Environment when no variables are set (#2838) (2bf9b57)
  • lambda: persist, validate and enforce event source mapping FilterCriteria (#3060) (5512db0)
  • lambda: recover a DynamoDB Streams ESM from a trimmed checkpoint (#3412) (62abde8)
  • lambda: reject dotted and over-length function names (#3300) (49903ab), closes #3238
  • lambda: reject scalar structure members (#3051) (ec034a5)
  • lambda: replace the fabric8 kubernetes client with a plain REST client (#2919) (97ce09f), closes #2914 PKCS#8
  • lambda: report real runtime errors instead of Function.TimedOut (#3505) (34062f6), closes #3314
  • lambda: resolve layer version ARNs by account (#2948) (24a8c84), closes #2813 #2813 #2809
  • lambda: scope extracted function code by region (#3265) (290559c)
  • lambda: serialise the version snapshot against function updates (#3010) (ebd849a), closes #2939 #3041 #3051 #2939 #3007
  • lambda: stop rejecting a foreign-platform image the daemon cannot describe (#3357) (570f975)
  • lambda: warn before runtime api port exhaustion (#3496) (bea8f85)
  • lifecycle: clear storage before services clear on state reset (#3388) (22bae1f)
  • lifecycle: run every shutdown step even when one of them fails (#3472) (3bdb019)
  • memorydb: scope resources by account and region (#3261) (e02accf)
  • mq: match CreateBroker EngineType and DeploymentMode without regard to case (#3268) (c1e5cc2)
  • msk: isolate MSK resources by account and region (#3353) (970cd30)
  • mwaa: also detect a crashed sibling Postgres container, not just Airflow (#3454) (fe07621)
  • mwaa: apply AirflowConfigurationOptions to the Airflow container (#3457) (d429d10), closes #3436
  • mwaa: isolate environments by account and region (#3400) (c6e64a0)
  • mwaa: mark CREATE_FAILED when the Airflow container exits before becoming ready (#3446) (2a682a6), closes #3437
  • mwaa: match real MWAA's Airflow/Python pairing for the emulated image tag (#3445) (473a26a), closes #3438
  • mwaa: probe the metadata database over TCP before starting Airflow (#3406) (be578ac)
  • mwaa: reject a malformed configured AirflowVersion as ValidationException (#3453) (a7902b9)
  • neptune: isolate resources by account and region (#3401) (70176d6)
  • networkfirewall: model CreateFirewall* collisions and enforce UpdateToken (#3198) (215a802), closes #2600
  • opensearch: include CognitoOptions in domain status (#2860) (047db09), closes #2801
  • opensearch: keep publishing the domain's host port when floci runs in a container (#2798) (96c55ec)
  • opensearch: keep readiness polling after errors (#3373) (713a166)
  • organizations: return account state (#3053) (587d0b5)
  • parse S3 EventBridge notification XML (#3350) (ad9a88c)
  • pipes: replace kafka-clients with a Kafka REST Proxy client (#3160) (cd2847d)
  • pipes: restore a CloudFormation snapshot without re-validating it (#3218) (d95ed9f), closes #3192 #3209
  • ram: emulate organization sharing side effects (#3279) (d322d48)
  • ram: enforce resource share principal visibility (#3266) (8e10fd1)
  • rds: bound PostgreSQL handshake packet lengths (#3102) (148ea6f)
  • rds: bound RDS/Redshift auth proxy connections and handshakes (#3545) (1987bf0)
  • rds: enhance DB cluster handling by recording createOnly properties and updating rollback logic (#3636) (b2b43df)
  • rds: format unexpected query errors as XML error envelope (#3121) (daeea78), closes #3110
  • rds: keep the control plane working with no Docker daemon (#3170) (49dfd1b), closes lex00/floci#38
  • rds: map Aurora MySQL engine versions to the MySQL image tag (#3382) (d9cc2a0)
  • rds: persist PubliclyAccessible on Create/ModifyDBInstance and echo it on Describe (#2484) (d45a437), closes #2420
  • rds: populate MasterUserSecret for Aurora clusters with ManageMasterUserPassword (#3148) (6345c37), closes #3061
  • rds: preserve aurora engine identity in parameter group names and managed secrets (#1920) (5719e65), closes #1829
  • rds: register instances before starting auth proxy (#3467) (34efd89)
  • rds: report backing container failures (#3455) (68c783b)
  • rds: run IAM PostgreSQL sessions as the role named in the token (#3106) (c22ded9), closes #3087
  • rds: scope event reconciliation and prune history (#3533) (04f0c3b)
  • rds: support tagging DB proxy target groups (#3145) (e0bf589)
  • rds: use MySQL 8.4 auth options (#3001) (e26e9a6)
  • rds: wait for the final PostgreSQL server before reporting the instance ready (#3405) (14b0875), closes #3384
  • redshift: emit ClusterAvailabilityStatus and AvailabilityZoneRelocationStatus (#3109) (025ac71), closes #3098
  • resourceexplorer2: reject invalid pagination tokens (#3444) (f482a2d)
  • route53: require exact match for ChangeResourceRecordSets DELETE (#3565) (9da5895)
  • s3: authorize read on copyobject/uploadpartcopy source (#3450) (bb58176), closes #2333
  • s3: decode unsigned streaming checksum payloads (#3476) (d11fff3)
  • s3: enforce auth on bucket-level config writes when enforce-auth is enabled (#3536) (28105c0), closes #2326 #2335
  • s3: enforce source resource policies on object copies (#3539) (19917ed)
  • s3: evaluate IAM policy on presigned URL and presigned POST requests (#3504) (8a45211), closes #3195
  • s3: honor max-keys=0 and reject invalid max-keys values (#3510) (b994d58)
  • s3: honor per-object VersionId in batch DeleteObjects (#3232) (d9cddc5), closes #1045
  • s3: honor x-amz-bypass-governance-retention in batch DeleteObjects (#3366) (7d96799)
  • s3: honor x-amz-tagging query parameter on presigned PutObject and CreateMultipartUpload (#3615) (52bafb7), closes #3608
  • s3: make GetObject atomic against concurrent same-key overwrites (#2874) (b4aab99)
  • s3: preserve SSE-KMS key ID metadata (#2145) (d466ffe)
  • s3: return composite multipart checksums and match S3 on UploadPart, GetObjectAttributes and CopyObject responses (#3093) (724be0a), closes #877
  • s3: route signed multipart requests by virtual host (#3464) (01ec7af)
  • s3: shrink getObject's lock to a cheap seqlock check, not the I/O (#2901) (3a212d8)
  • s3: validate multipart completion parts (#3312) (31f8860)
  • s3: verify SigV4 signature on presigned POST uploads (#3081) (ffab3dc)
  • s3: verify the SigV4 header signature when enforce-auth is enabled (#3573) (bfe2b71), closes #1842 #3081 #2332
  • s3: verify virtual-hosted presigned URLs (#3048) (3dee17e)
  • scheduler: forward MessageAttributes in universal sqs target (#3435) (ffdd5b8)
  • secretsmanager: serialize secret version updates with the rotation lock (#3247) (172765a)
  • security: map EXTRA_CORS_* env variables to enable global CORS preflight (#1890) (18044d9)
  • serialize GetRecords ApproximateArrivalTimestamp as a plain decimal (#2359) (5b4d1af), closes #2099 #2358
  • ses: align v1 Query boolean parsing with probed xsd 1.1 behavior (#3075) (f677eda)
  • ses: create email identities atomically so failures leave nothing behind (#3146) (618ca58)
  • sfn: apply state input and output paths (#3289) (9fa36e9), closes #3258
  • sfn: enforce the alias and published version quotas per state machine (#3580) (4707d4d), closes #3575 #3614
  • sfn: fail States.Runtime on an unresolvable JSONPath in a payload template (#3199) (618f52e), closes #2521
  • sfn: merge ResultPath at a bracket-index reference path (#3483) (99c19d0), closes #3479
  • sfn: preserve Lambda function errors (#3456) (ae58097)
  • sfn: preserve mocked response indexes (#3391) (78cf107)
  • sfn: resolve context reference paths (#3390) (ce07393)
  • sfn: return empty objects for null state paths (#3371) (3090e33)
  • sfn: support advanced JSONPath expressions (#3398) (5bf8075)
  • sfn: treat null as falsy in JSONPath negation (#3497) (c18c80e)
  • sns: honor FifoThroughputScope=MessageGroup on FIFO topics (#3181) (a1d0597)
  • sqs: bound message move task history (#3292) (520568e)
  • sqs: honour ReceiveMessageWaitTimeSeconds when ReceiveMessage omits WaitTimeSeconds (#2989) (ad0f4a1)
  • sqs: keep DLQ messages when a move task cannot deliver them (#3470) (a9feb3c)
  • sqs: match AWS queue attribute defaults and MaximumMessageSize range (#3626) (1482d45)
  • ssm: apply every DescribeParameters filter and page the results (#3646) (ea88947), closes #3642
  • ssm: set the Arn attribute on AWS::SSM::Parameter (#3019) (3600038)
  • stepfunctions: abort executions abandoned by a restart (#2969) (504203f)
  • stepfunctions: fail an intrinsic argument that matches nothing (#2872) (fad54f3), closes #2870 #2927
  • stepfunctions: let Express executions reuse names and type the nested StartExecution refusal (#3059) (8a2161a)
  • stepfunctions: persist execution history across restarts (#3291) (35159c5)
  • stepfunctions: reject the QueryLanguage definitions AWS rejects (#2972) (e3230a7)
  • stepfunctions: resolve state machine alias ARNs (#3607) (e828363)
  • stepfunctions: resolve the States.Format template argument like every other argument (#2963) (fa265a4), closes #2927
  • storage: load each backend once and close WAL writers on shutdown (#3469) (1b83ef3)
  • storage: log effective storage mode at boot (#3495) (15eff7e), closes #2225
  • storage: migrate legacy entries by exact key (#3408) (d92211d)
  • sts: reject unverified web identity tokens (#3151) (1de6b80)
  • sts: return ExpiredTokenException for an expired web identity token (#3210) (90fa707), closes #3205
  • sts: validate SAML assertions before assuming roles (#3204) (1b12525)
  • support SSM PutParameter tags and ECS container healthCheck (#2567) (#3550) (7d6e958)
  • swf: improve polling mechanism with timeout and backoff strategy (#3207) (f765195)
  • test: disable the GuardDuty organization admin GuardDutyMembersIntegrationTest enables (#3348) (3669c8e)
  • test: isolate MQTT WebSocket concurrency from TLS (#3431) (9f36a87)
  • test: relax S3 concurrent write stress timeout (#3396) (901b83c)
  • test: sign the CopyObject source-permission requests for real (#3588) (62407e2), closes #3539 #3539 #3573 #3573
  • test: stop XmlParserTest matching a localized parser message (#3458) (c127794)
  • test: tear down the organization DetectiveIntegrationTest creates (#3229) (1a804ae), closes #3226
  • test: tear down the organizations the service-managed StackSets test creates (#3158) (6914530), closes #3055
  • test: wait for DeleteStack to actually complete in CloudFront policies test (#3473) (ec2ab07)
  • tls: fail startup when public listener cannot bind (#3362) (2fd55b5)
  • transcribe: isolate jobs and vocabularies by account and region (#3402) (c4ff42b)
  • transfer: allow DeleteServer regardless of server state (#2897) (e7256f5), closes #2802 #1834 #2802
  • transfer: isolate servers and users by account and region (#3403) (43eace4)
  • ui: verify Floci connectivity in readiness probe (#2753) (c0b5461)
  • wafv2: reject non-CIDR IPSet addresses (#3511) (a40409f), closes #3328
  • wafv2: validate resource names on operations (#3066) (0a57f0a)

    Features

    • accessanalyzer: add analyzer lifecycle (#3117) (aebed6e)
    • account: add alternate contact operations (#3118) (d80734e)
    • acm: enhance email validation to report approval mailboxes and omit DNS records (#3290) (8180d4b)
    • acm: map CertificateExport and CertificateTransparencyLoggingPreference onto the certificate options (#3111) (6150569)
    • acm: provision AWS::CertificateManager::Certificate (#3003) (38176b9)
    • agentcore: expand Bedrock AgentCore control-plane coverage (#3317) (483dfb4)
    • apigateway: provision AWS::ApiGateway::DomainName and BasePathMapping (#3040) (c3d977a)
    • apigateway: support HTTP and HTTP_PROXY integrations on REST APIs (#3433) (96707f6)
    • appintegrations: add data and event integrations (#3379) (137a39a)
    • aps: implement AMP rule groups namespaces (#3330) (6eca854), closes #3329
    • asl: add support for States.ArrayPartition, States.ArrayRange, States.ArrayUnique, and States.MathRandom intrinsics with comprehensive tests (#3224) (cf8466b)
    • athena: add UpdateWorkGroup support (#3468) (ea5925f)
    • athena: create, update and delete data catalogs (#3381) (cb6b4d8)
    • athena: support ListTagsForResource for workgroups (#3242) (b988dc5)
    • autoscaling: warm pools, scheduled actions, traffic sources, and process suspension (#2973) (0980114)
    • batch: add UpdateComputeEnvironment and DeleteComputeEnvironment (#2857) (3b7ba5c), closes #2293
    • batch: support array and multi-node parallel jobs (#3595) (74d4782)
    • bcm-pricing-calculator: emulate workload estimates (#3441) (a985773)
    • bedrock-agentcore: implement AgentCore Memory events (#3556) (3003f05)
    • bedrock-runtime: implement ConverseStream for stub and proxy backends (#2889) (4465575)
    • bedrock-runtime: stream ConverseStream incrementally (#3043) (0471d6f)
    • bedrock: add guardrail lifecycle and versions (#3380) (cae8f9a)
    • budgets: add full service emulation (#3165) (7a5ae96)
    • cloudformation: pass EngineMode and StorageEncrypted to RDS clusters (#3482) (4471e92)
    • cloudformation: provision AWS::ApiGateway::ApiKey (#3122) (cbde58f)
    • cloudformation: provision AWS::ApiGateway::UsagePlan and UsagePlanKey (#3123) (3a4982c)
    • cloudformation: provision AWS::AutoScaling::ScalingPolicy (#3124) (17af959)
    • cloudformation: provision AWS::Backup::BackupVault (#3125) (631df1d)
    • cloudformation: provision AWS::Lambda::Url (#3423) (10becc5)
    • cloudformation: provision AWS::SNS::TopicPolicy (#3126) (ba3dd65)
    • cloudformation: provision Route 53 hosted zones (#2722) (ab26a42)
    • cloudformation: provision the AppSync resource types (#3424) (55ada9b)
    • cloudformation: report a stubbed unsupported resource type instead of hiding it (#2971) (5dc0808), closes #2967
    • cloudformation: support service-managed stacksets (#3055) (41022d0)
    • cloudtrail: implement AddTags, RemoveTags and ListTags (#2934) (671628b), closes floci-io/floci#2297
    • cloudtrail: support AdvancedEventSelectors and CloudFormation Trail provisioning (#2720) (fd3c4d9), closes #1192 #1194
    • cloudwatch: implement the dashboard operations on both protocols (#2888) (e8eb4f2)
    • cloudwatchlogs: add cross-account policy operations (#3089) (6a728f1)
    • cloudwatch: provision AWS::CloudWatch::Dashboard (#3231) (460aa07)
    • cloudwatch: store and serve metric stream definitions (#3214) (5b7c2c4)
    • cognito: check the custom domain certificate in ACM and mark it in use (#3035) (d771783)
    • cognitoidentity: identity pool management plane (CRUD, roles, principal-tag maps, tags) (#2977) (dd9cdc1)
    • cognito: implement identity provider configuration CRUD (#2858) (0a3bc03)
    • cognito: implement log delivery configuration (#2867) (b8f1e22), closes #2855
    • cognito: implement managed login branding (#2869) (1e4e8b9), closes #2856
    • cognito: implement SetUserPoolMfaConfig (#2831) (906717a)
    • cognito: implement user MFA preferences (#2896) (82ee360)
    • cognito: implement VerifyUserAttribute (#2018) (36c3ee4)
    • cognito: provision AWS::Cognito::UserPoolDomain (#3005) (f3c251e)
    • cognito: route custom domains by Host (#3095) (b4d80a5)
    • cognito: support pending user attribute verification (#2531) (a03c4d6)
    • controlcatalog: add control lookup operations (#3130) (d99675a)
    • controltower: add enabled control operations (#3056) (b199894)
    • core: derive ARN partition from the region (#3334) (dc61c1a)
    • datasync: add the DataSync management plane (#3377) (128d3ef)
    • detective: add organization member operations (#3190) (5864b01)
    • docker: containers Floci launches trust the Floci CA (#3091) (024bfa0), closes #3079 #3086 #3086
    • dynamodb: import tables from S3 and report new exports as IN_PROGRESS (#3138) (cbec02d)
    • dynamodb: index-qualified PartiQL SELECT with ConsistentRead validation (#2953) (84ec8ae)
    • dynamodb: resource policies and GSI-level OnDemandThroughput (#2976) (17e02ed)
    • ec2: answer MonitorInstances and UnmonitorInstances (#3319) (8921ca1)
    • ec2: back each VPC with a real Docker network in RFC 1918 space (#3272) (cf1aabc)
    • ec2: Capacity Reservation CRUD (#2974) (0c33ef2)
    • ec2: capture the instance file system in CreateImage, and implement Deregister/CopyImage (#3306) (a228507)
    • ec2: carry the remaining launch template data fields (#3493) (0431677)
    • ec2: honour AmazonProvidedIpv6CidrBlock on a VPC (#2891) (0cf3144)
    • ec2: implement DescribeSpotPriceHistory (#3359) (ee23e26)
    • ec2: implement instant CreateFleet (#2956) (1f87f7c)
    • ec2: report instance credit specifications (#3492) (325bdfb)
    • ec2: support snapshot block public access (#3490) (fe40e06)
    • ec2: support standalone network interface create/attach/detach (#2843) (906af8c)
    • ec2: support VPC peering connections (#2654) (14f99a5)
    • ecr: prefer locally present images over the loopback registry rewrite (#3022) (23728e0)
    • ecs: honor UpdateService forceNewDeployment and emit EventBridge lifecycle events (#2938) (14ca62d), closes #2557 #2557 #2557 #2557 #2557 #2557
    • ecs: scope EFS volume mounts to rootDirectory and accessPointId (#3449) (543bde7), closes #2563
    • elasticache: add validation for cache parameter group existence in replication group operations (#2957) (6c9cc95)
    • eventbridge: run ECS tasks from classic rule targets (#3484) (cfe9f84), closes #2558
    • firehose: apply the Lambda transform to buffered records (#3393) (d96516d)
    • firehose: convert array, struct and map columns to Parquet (#3521) (6790024)
    • firehose: convert JSON records to Parquet via the floci-duck sidecar (#3333) (9a2a893)
    • firehose: validate and persist DataFormatConversionConfiguration (#3236) (8a122d2)
    • firehose: validate and persist ProcessingConfiguration (#3375) (debf9fb)
    • floci-core: resolve active Docker context when DOCKER_HOST is unset (#3197) (e31590b), closes #1990
    • globalaccelerator: add the Global Accelerator management plane (#3378) (2e79f5c)
    • glue: jobs and crawlers (#2591) (de6bf8f)
    • glue: support GetPartitionIndexes (#3416) (606e7b9)
    • guardduty: add member account operations (#3052) (b6489ac)
    • iam: resolve resource and request tag condition keys for EC2 and S3 (#3212) (64538f7)
    • iam: support DynamoDB fine-grained access control (#2926) (#3011) (6653b9a), closes #aliases
    • identity-center: complete IAM Identity Center emulation (#3331) (cbfa034)
    • identitystore: add full service emulation (#3159) (6264b09)
    • inspector2: add organization configuration operations (#3162) (4944764)
    • iot: configurable DescribeEndpoint address for published AWS IoT ports (#3202) (53a84c8)
    • iot: domain configurations (#3008) (9220c05)
    • iot: evaluate the SQL subset of topic rules (#3021) (d45c645)
    • iot: firehose and cloudwatchLogs rule actions (#3013) (ebdf092)
    • iot: MQTT over TLS listener on 8883 (#3142) (ee2f55b)
    • iot: MQTT over WebSocket at /mqtt (#3150) (c4027bb), closes #3142
    • iot: provision AWS::IoT::Thing, Policy and TopicRule (#3014) (dec348d)
    • iot: real device certificates issued by the local CA (#3079) (c67e598), closes PKCS#10 PKCS#10
    • iot: rule SQL message functions, isNull, isUndefined, IN and array literals (#3036) (b88034c)
    • iot: verify device certificates on the MQTT TLS listener (#3180) (19a8536)
    • kinesis: implement UpdateShardCount API (#3200) (e3766ea), closes #3064
    • kms: support ImportKeyMaterial for Origin=EXTERNAL keys (#3068) (37faaa8), closes #1916
    • lakeformation: add UpdateResource action (#2944) (ee24c77)
    • lambda: mint EKS bearer tokens natively for the kubernetes executor (#2981) (252bfe8), closes #2919
    • lambda: provision AWS::Lambda::EventInvokeConfig (#3230) (af42564)
    • lambda: support self-managed Apache Kafka event source mappings (#3062) (#3082) (ee5c87d)
    • macie2: add organization administration operations (#3105) (3927c66)
    • marketplace-agreement: emulate AWS Marketplace Agreement API (#3339) (c99ecea)
    • marketplace-catalog: emulate AWS Marketplace Catalog API (#3338) (50fa334)
    • marketplace-deployment: emulate AWS Marketplace Deployment API (#3341) (48d2928)
    • marketplace-discovery: emulate AWS Marketplace Discovery API (#3342) (07d6cab)
    • marketplace-entitlement: emulate AWS Marketplace Entitlement API (#3340) (87f2c2d)
    • marketplace-metering: emulate AWS Marketplace Metering API (#3344) (efcbc4d)
    • marketplace-reporting: emulate AWS Marketplace Reporting API (#3343) (3c080e1)
    • neptune: support the Terraform aws_neptune_cluster read-back contract (#3017) (a7be2dd)
    • oam: emulate observability access manager (#3440) (a0fd815)
    • pipes: validate ParallelizationFactor on Kinesis and DynamoDB sources (#3192) (5fd89e2)
    • ram: support resource-share invitation accept/reject (#3120) (81b8127)
    • rds: accept AWS IAM DB auth users on MySQL (#3395) (485b7c5)
    • rds: implement CreateDBSnapshot and RestoreDBInstanceFromDBSnap… (#1894) (2869502), closes #1817
    • rds: persist EngineMode and StorageEncrypted on DB clusters (#3448) (828b53c), closes #2559
    • redshift-data: emulate the Amazon Redshift Data API (#3186) (b9039fe)
    • redshift: emulate GetClusterCredentials and GetClusterCredentialsWithIAM (#3273) (6b17ef2)
    • redshift: emulate Redshift COPY FROM s3 over Simple Query protocol (#3100) (85180a4)
    • redshift: emulate Redshift UNLOAD TO s3 over Simple Query protocol (#3129) (4570bf6)
    • redshift: intercept Extended Query protocol (#3474) (e9454af)
    • redshift: provision AWS::Redshift::Cluster through CloudFormation (#3427) (e5bd8be)
    • redshift: rewrite Redshift table DDL keywords for a PostgreSQL backend (#2947) (17ea9a9)
    • redshift: wire the Simple Query DDL interceptor into the proxy (#3029) (4daba7e)
    • route53: support cross-account VPC associations (#3116) (162211d)
    • route53: update supported operations and add VPC association actions (#2959) (df0e7bc)
    • s3: add Intelligent-Tiering configuration CRUD (#2997) (96d16de)
    • s3: add object annotations support (#3324) (f9f90cf)
    • s3: support bucket analytics and inventory configurations (#3213) (703744c)
    • securityhub: add organization configuration operations (#3161) (9d4e71f)
    • serve custom domains over TLS as soon as they are created (#3086) (67bbd2c), closes PKCS#8 PKCS#8 PKCS#1 #3035 #3035 #3095 #3095
    • servicequotas: add quota request history lookup (#3054) (532e279)
    • ses: implement v1 receipt filters (CreateReceiptFilter, ListReceiptFilters, DeleteReceiptFilter) (#3163) (2c6a92c)
    • ses: implement v1 receipt rules with locally validated action targets (#3119) (fd665a0)
    • ses: implement v1 ReorderReceiptRuleSet and CloneReceiptRuleSet (#3176) (f485122)
    • ses: preserve raw message fidelity and envelope sender in the SMTP relay (#3522) (505b5d2)
    • ses: support tag operations on tenant ARNs (#2832) (812911f)
    • ses: support v2 dedicated IP (IP-level) and scaling/warmup APIs (#3420) (e219ea4)
    • sfn: publish history events for Parallel branches and Map iterations (#3167) (fd21ac9)
    • ssm: answer the public Amazon Linux AMI parameters (#3173) (8142457)
    • ssm: model documents and associations with full lifecycle operations (#3057) (f00fb4c)
    • ssoadmin: add permission sets and assignments (#3103) (1bf7494)
    • stepfunctions: add SNS Publish service integration (#3316) (283890d)
    • stepfunctions: close ASL gaps in intrinsics, Choice, StartExecution and ResultPath (#3002) (352d89f)
    • stepfunctions: resolve Fail state ErrorPath and CausePath dynamically (#3302) (650914f), closes #3255
    • tls: a local root CA that signs Floci's server certificate (#3078) (3c6c005)
    • translate: add Amazon Translate mock service (#2879) (10192f0)
    • ui: publish a console contract so any web console can be the sidecar (#3641) (a5ebda0)
    • verifiedpermissions: add full service emulation (#3128) (2d51259)

    Performance Improvements

    • apigateway: avoid repeated root resource scans (#3404) (0a45d2e)
    • build: drop KotlinPoet and ICU4J from the protobuf schema path (#2992) (21f165b)
    • build: keep only the snappy JNI libraries the image will use (#2940) (4ce53b5)
    • build: keep the managed policy catalog files out of the native image (#3489) (24e13f3)
    • build: replace BouncyCastle with JDK crypto API as much as possible (#2988) (ffe8a92)
    • build: replace quarkus-jdbc extensions with plain JDBC drivers (#3465) (569f9f5)
    • docker: drop the gosu layer and two no-op native-image inputs (#3037) (b0a8dff)
    • docker: shrink image by 28% using ubi9-micro (109 MB to 78 MB compressed) (#3085) (64f06e0), closes #3037
    • docker: trim the compat image's CLI extras and Python build leftovers (#3108) (a6bd055)
    • s3: drop unused hashes on S3Object creation (#3589) (a5ab167)
Check out latest releases or
releases around floci-io/floci 2.1.0

Don't miss a new floci release

NewReleases is sending notifications on new releases.

Get notifications