github floci-io/floci 2.4.0
on GitHub

3 hours ago

2.4.0 (2026-10-31)

Features

  • apigatewayv2: route VPC link integrations to Cloud Map service instances (#6753) (4fffb5a)
  • autoscaling: describe suspended process reasons (#5941) (7ce4b6b)
  • autoscaling: implement DescribeTags (#5750) (05153b3)
  • autoscaling: support EnterStandby and ExitStandby (#6955) (ead5d4a)
  • backup: add CreateLogicallyAirGappedBackupVault (#6015) (65e35ad), closes #4986
  • cloudformation: apply AssociatedRoles on RDS clusters and instances (#5656) (ad1b225), closes #5638
  • cloudformation: expose RegionalEndpoints of a web function endpoint to Fn::GetAtt (#6907) (c4ae11c)
  • cloudformation: provision AWS::EC2::PrefixList (#6481) (6acd906), closes aws/aws-cdk#35360
  • cloudformation: provision AWS::WAFv2::IPSet (#5950) (a57c209)
  • cloudformation: provision Redshift event subscriptions (#6664) (d3c4732)
  • cloudformation: provision SES email identities (#4812) (7f8383d)
  • cloudformation: provision SES receipt rules (#7040) (f48c3a9)
  • cloudformation: support AWS::Route53::RecordSetGroup (#6676) (f3f8b42)
  • cloudformation: support four AWS::AppConfig resource types (#6791) (fee688b)
  • cloudformation: support Redshift snapshot restores (#6395) (4c70d6b)
  • cloudformation: support S3 Vectors resources (#5853) (5774e7d)
  • cloudformation: support SAM's optional AutoPublishAlias version properties (#5823) (f22c2a4)
  • cloudformation: support WAFv2 logging configuration (#6194) (a8e49fb)
  • cloudfront: model AWS managed cache policies (#6698) (c538fb5), closes #6691
  • cloudfront: serve execute-api custom origins of this Floci in-process (#6754) (5487888)
  • cloudfront: sign requests to a Lambda Web Function origin under OAC (#6037) (8bff1ba)
  • cloudwatch: record alarm history and serve DescribeAlarmHistory (#6670) (989f714)
  • cloudwatch: support composite alarm lifecycle (#6408) (922e36a)
  • codeartifact: add CopyPackageVersions for the generic format (#5854) (faf344a)
  • codeartifact: add DeletePackageVersions for every format (#6559) (5c7c843)
  • codeartifact: add ListPackages for every format (#6622) (454d7b6), closes RepositorySidecarManager#listPackages
  • codeartifact: add ListPackageVersionAssets for every format (#5962) (6027872)
  • codeartifact: add ListPackageVersions for every format (#6204) (9e66185)
  • codeartifact: add NuGet/BaGetter sidecar for the nuget format (#5790) (3db18d5)
  • codeartifact: add UpdatePackageVersionsStatus and DisposePackageVersions (#6435) (3053b35)
  • codeartifact: bridge CopyPackageVersions to every sidecar format (#5888) (5dcddc9)
  • codeartifact: bridge DescribePackageVersion to Maven/npm/pypi sidecars (#5715) (1ba977a)
  • codeartifact: resolve Maven version ranges and dynamic versions through an external connection (#6961) (00ab75b)
  • codeartifact: retain Maven packages from a public external connection (#6889) (a03e88b)
  • cognito: hand email codes to the CustomEmailSender trigger (#6031) (47f570a)
  • cognito: support Google identity provider federation (#5868) (e38dba5)
  • cognito: support SMS and email MFA challenges (#5104) (d0e0af5), closes #5182
  • core: have the JVMs in Lambda, ECS, Batch and Flink containers trust Floci's CA (#6945) (743bede)
  • core: keep a host native binary's state in the user data directory (#5769) (0a5809a), closes #5767
  • core: make the image pull timeout configurable (#6521) (b66ee9e)
  • core: make the init hook directory configurable (#5801) (050f93e), closes #5767
  • core: namespace a host native binary's child containers by port (#5800) (cb378af), closes #5767
  • core: relay container callbacks to a loopback Floci on a Linux host (#5774) (a2d02ef), closes #5767
  • core: report at startup which services an unreachable Docker affects (#5773) (4c32fae), closes #5767
  • core: translate LocalStack variables in Java instead of the entrypoint (#5851) (9dcb1b6), closes #5767
  • deliver Redshift audit logs to CloudWatch Logs (#6432) (b15bc70)
  • dsql: add Aurora DSQL's control plane and AWS::DSQL::Cluster (#6048) (95bf6df), closes #6014
  • dsql: map IAM roles to database roles with AWS IAM GRANT (#6143) (6e5b3c6)
  • dsql: serve each cluster's database on the DSQL endpoint (#6102) (f2b62fb)
  • dsql: speak DSQL's dialect and keep its transaction limits (#6185) (42fd858), closes #6102
  • dynamodb: add on-demand backups (#6052) (9b59b89)
  • dynamodb: add point-in-time recovery restores (#6110) (1dce18e)
  • dynamodb: export tables in the ION format (#6429) (ed21e67)
  • dynamodb: export the changes of a period as an incremental export (#6480) (3dc5d35)
  • dynamodb: journal per-table items one record per item in wal mode (#6310) (4c49f23), closes #6293
  • dynamodb: opt-in per-table item files, split into shards (#6303) (7635345), closes #6293
  • dynamodb: read PartiQL's FROM-first form of UPDATE (#6648) (d42b83c)
  • dynamodb: restore backups across regions (#6349) (05d4786)
  • dynamodb: support IS with a PartiQL type name (#6930) (e37a415)
  • dynamodb: write export files and descriptions as AWS does (#6400) (023cb83)
  • ec2: associate instances with capacity reservations (#6336) (d05399f)
  • ec2: configure additional AWS-managed prefix lists (#6401) (3073807)
  • ec2: list SUSE and Red Hat family images in the image catalog (#6193) (8d73535)
  • ec2: page and filter DescribeTags as AWS does (#6109) (e5591dd)
  • ec2: support DHCP options lifecycle (#6428) (4a95c1b)
  • ec2: support egress-only internet gateways (#5822) (708dc32)
  • ecr: PutImage and the layer API (#5784) (c6551a4), closes #5735
  • ecr: registry policy, replication and scanning configuration (#5817) (1f96bf4), closes #5803
  • ecr: repository creation templates (#5955) (d10db3c), closes #5804
  • ecr: support account settings (#6855) (e24bc36)
  • ecr: support pull time update exclusions (#6856) (8270cc7)
  • ecs: publish Container Insights task counts (#6054) (1b15299)
  • ecs: stop service tasks off the reconciler thread so slow graceful stops don't serialize unrelated services (#6619) (#6972) (d3543ac)
  • eks: advertise a configurable endpoint host (#6331) (1476b0e)
  • eks: associate access policies with access entries (#6427) (7453011)
  • eks: vendor AWS's add-on version catalog for every supported Kubernetes version (#6735) (07f2d62)
  • elbv2: terminate HTTPS with ACM and IAM certificates (#5959) (0da0c80)
  • emr-serverless: retry a failed job run as its retry policy allows (#6894) (66a5c05)
  • emr-serverless: run a job run in its application's custom image (#6975) (931b2d2)
  • emr-serverless: run Spark job runs in a container (#6469) (edbcac3), closes #6046
  • emr-serverless: send Spark driver output to CloudWatch Logs (#6703) (5c9eb3e)
  • emr-serverless: start, get, list and cancel job runs (#6202) (1f1e5db), closes #6046
  • emr-serverless: tag job runs and report their attempts (#6297) (63d577a), closes #6202 #6046
  • emr,emr-serverless: write Spark driver logs to S3 (#6620) (0a47ddd)
  • emr: add an optional timed lifecycle for clusters and steps (#6441) (55b060b), closes #6046
  • emr: have the JVMs in EMR containers trust Floci's CA (#6926) (c9bc1e7)
  • emr: ListReleaseLabels, DescribeReleaseLabel and ListSupportedInstanceTypes (#5748) (7dc514b), closes #5734
  • emr: publish aws.emr cluster and step events to EventBridge (#6403) (1174922), closes #6046
  • emr: run a cluster's bootstrap actions in the docker runner mode (#6878) (591d5f5), closes hashicorp/terraform-provider-aws#4378
  • emr: run command-runner.jar commands and script-runner.jar scripts (#6747) (897667f)
  • emr: run Spark steps in containers in a docker runner mode (#6578) (4b33002)
  • firehose: accept a Redshift destination on create, update and describe (#6004) (4842558)
  • firehose: deliver staged Redshift batches with single-attempt COPY (#6006) (fd37e10)
  • firehose: retry failed Redshift COPY loads every five minutes (#6111) (99ef369)
  • glue: data quality rulesets (#7035) (6db78b8), closes #6830
  • guardduty: support publishing destinations (#6016) (fb39096), closes #4983
  • iam: answer GetHumanReadableSummary for a delegation request (#6298) (27338a6)
  • iam: authorize the account password policy's self-service flag (#5717) (b58d181), closes #5639
  • iam: check lambda:PassNetworkConnector from a table generated from the Service Reference (#6699) (b0cd704)
  • iam: dispatch GetMFADevice, AcquireRole and GetRoleTemplateVersion (#6453) (32663a2), closes #6402
  • iam: dispatch UpdateRoleDescription, the description half of UpdateRole (#6029) (94b09ff)
  • iam: generate, claim and answer delegation requests (#5797) (66fce77), closes #5879
  • iam: publish delegation request notifications to the partner's topic (#6199) (8427c0b)
  • iam: read a Query list's constraints from the model (#6625) (0ec28ae), closes #6478 #6402
  • iam: read every modelled operation's constraints from the model (#6965) (98a3d2a)
  • iam: read the managed-policy family's constraints from the model (#6580) (bb48983), closes #6402 #6402 #6402
  • iam: release and exchange the delegation token (#5914) (494a672), closes #5879
  • iot: add RegisterCertificateWithoutCA and the V2 principal lists (#5772) (e3e06a1)
  • iot: publish connection lifecycle events (#5277) (87aa6f3), closes #5275
  • iot: route shadow events through topic rules (#5260) (534571b), closes floci-io/floci#5256
  • iot: search fleet things by connectivity status (#6025) (34d904f), closes #4912
  • kms: add GenerateDataKeyPair and GenerateDataKeyPairWithoutPlaintext (#6359) (5116b3c)
  • lambda: add init-timeout-seconds so a cold runtime gets its own init budget (#6442) (4d35617)
  • lambda: add provisioned concurrency configuration APIs (#6317) (6bc598f)
  • lambda: initialize provisioned concurrency environments (#6320) (238d16e)
  • lambda: list provisioned concurrency configurations (#6758) (b6d9e4c)
  • lambda: make reactive S3 sync toggleable and optionally async (#6548) (89be5c1)
  • lambda: retarget provisioned alias allocations (#6335) (7c8daff)
  • lambda: version network connectors as AWS does (#6595) (3438a00)
  • lambdaweb: accept code up to 512 MiB and refuse more as AWS does (#6218) (2720f84)
  • lambdaweb: check the code bucket versioning and policy as AWS does (#6479) (cd2dac7)
  • lambdaweb: check the egress network connector as AWS does (#6647) (ec13eda)
  • lambdaweb: check the execution role as AWS does (#6347) (7e6439c)
  • lambdaweb: CloudFormation types for Lambda Web Functions (#5722) (0492fc9), closes #5699
  • lambdaweb: delete the oldest unused revisions past 50 as AWS does (#6518) (29eae43)
  • lambdaweb: enforce IamAuth on Web Function endpoints (#5855) (5eb4eec)
  • lambdaweb: fail a revision whose code is not a zip (#6141) (62972c9)
  • lambdaweb: keep the code a revision was created from (#6113) (bf82846)
  • lambdaweb: Lambda Web Functions control plane (#5706) (6f78083), closes #5699
  • lambdaweb: publish the Web Function metrics (#5976) (6e5b156)
  • lambdaweb: refuse a long request head as AWS does (#6083) (5aaa372)
  • lambdaweb: reject resource policies whose principal does not exist (#6769) (701b04c)
  • lambdaweb: scale environments per endpoint and apply maxEnvironments and rateLimit (#5785) (832f100), closes #5699
  • lambdaweb: send what a Web Function writes to its log groups as AWS does (#5919) (8067ecf)
  • lambdaweb: serve each region of a PerRegion endpoint in that region (#6423) (72bbc80)
  • lambdaweb: serve endpoint domains from a Node.js environment per revision (#5760) (6e01216), closes #5699
  • lambdaweb: serve the Lambda metadata endpoint (#6391) (54b3db7)
  • lambdaweb: serve the MultiRegion global domain in the default region (#6460) (acb9fd2)
  • lambdaweb: set the WebFunctionAuthType condition keys on endpoint routes (#6893) (385ffcf)
  • lambdaweb: verify SigV4a on IamAuth endpoints (#6956) (433989b)
  • lambdaweb: write the platform events of Web Function environments (#5936) (301ac79)
  • msk: apply SCRAM credentials in redpanda cluster (#6353) (6914401)
  • msk: scheduled reconcile for SCRAM secret changes (#6384) (bc18cbb)
  • msk: support SCRAM secret associations (#6221) (756e722), closes #6229
  • ram: support GetResourceShareAssociations (#6558) (6b21aeb)
  • rds-data: opt into retryable database resume errors (#5703) (fb6adc0)
  • rds: add the snapshot export task API (#5787) (772ec8d)
  • rds: automated backups, kept after a delete and restored from (#6996) (e29b1d8), closes #6828
  • rds: DB proxy endpoints (#6062) (1108bc7), closes #5805
  • rds: DescribeCertificates, ModifyCertificates and an instance's CA certificate (#6106) (ec21cf3), closes #5806
  • rds: DescribeDBLogFiles and DownloadDBLogFilePortion (#5741) (4353e42), closes #5733
  • rds: EnableHttpEndpoint, DisableHttpEndpoint and HttpEndpointEnabled (#5736) (9cd9002), closes #5732
  • redshift-data: implement ListSessions (#6892) (da8e227)
  • redshift-data: support client token idempotency (#6343) (38c641e)
  • redshift-data: support session reuse (#6396) (3488747)
  • redshift-serverless: accept customDomainName in GetCredentials (#5856) (1cb8b0f)
  • redshift-serverless: add custom domain association actions (#5766) (7cab804)
  • redshift-serverless: add endpoint access actions (#5742) (c67a5af)
  • redshift-serverless: add release track, managed workgroup and reservation reads (#5691) (d3fce14)
  • redshift-serverless: add resource policy actions for snapshots (#5730) (a68e6bc)
  • redshift-serverless: add scheduled action actions (#5852) (fa2a49e)
  • redshift-serverless: add snapshot copy configuration actions (#5798) (2a012cf)
  • redshift-serverless: copy snapshots into the configured destination region (#7024) (9b69b3d)
  • redshift-serverless: execute scheduled actions on cron and at schedules (#6851) (e820414)
  • redshift-serverless: expire snapshots after their retention period (#6966) (80edd85)
  • redshift-serverless: manage namespace admin credentials (#6491) (0a13e42)
  • redshift-serverless: validate requests against the AWS model constraints (#5641) (77384dc)
  • redshift: add event history and DescribeEvents (#6663) (e9e2b38)
  • redshift: add event subscriptions with SNS delivery (#6705) (3d30bbc)
  • redshift: add ResetClusterParameterGroup (#6230) (d2f2625)
  • redshift: complete Glue external table lifecycle (#5866) (c33823b)
  • redshift: create final snapshots before deleting clusters (#6346) (1b8548a)
  • redshift: execute automated snapshot schedules (#6536) (f184cce)
  • redshift: publish CloudWatch cluster metrics (#6740) (5bd4bd4)
  • redshift: rotate managed master passwords (#6505) (ce0933b)
  • redshift: send zero-ETL integration events to EventBridge (#6822) (c0d1767)
  • redshift: support default IAM roles for COPY and UNLOAD (#6304) (7e51e69)
  • redshift: support pausing and resuming provisioned clusters (#6911) (1a87139)
  • resourcegroups: support EC2 capacity reservation pools (#6011) (be2cb67)
  • route53resolver: add TagResource, UntagResource and ListTagsForResource (#6035) (2f6f3a8)
  • route53resolver: implement ListResolverEndpointIpAddresses (#5731) (a37c275)
  • s3: apply lifecycle expiration rules (#5158) (cbd2f61), closes #5137
  • s3: verify SigV4A (AWS4-ECDSA-P256-SHA256) request signatures (#6092) (6355474), closes #5210
  • secretsmanager: publish secret write events through CloudTrail (#6623) (57c4a20)
  • securityhub: standards subscriptions (#6979) (0a3efd6)
  • servicequotas: configure applied EC2 vCPU quota (#5926) (1a80884)
  • ses: add SES v2 GetEmailAddressInsights (#6573) (7f5f1b5)
  • ses: add SES v2 ListRecommendations (#6817) (4dbe373)
  • ses: add the v2 reputation entity operations (#6407) (5a9f9cb)
  • ses: validate v2 tracking configuration overrides (#5871) (043daa5)
  • sfn: encode HTTP Task object bodies as form data (#6010) (f8ab55f)
  • sqs: opt-in AWS QueueUrl form via endpoint strategy (#5517) (691499d)
  • sqs: publish AWS/SQS queue metrics to CloudWatch (#6280) (ba35302), closes #6275
  • ssm: add PutResourcePolicy, GetResourcePolicies and DeleteResourcePolicy for parameters (#6833) (045c65e)
  • ssm: expose ECS AL2023 AMI subparameters (#6591) (220d814)
  • ssm: expose ECS optimized AL2023 AMI parameters (#6583) (51ce672)
  • ssm: match parameter path label filters (#6560) (bcae24f)
  • ssm: publish parameter change events (#5262) (8931783)
  • stepfunctions: add the elasticmapreduce optimized integrations (#6261) (94c4572), closes raster-foundry/raster-foundry#352 hashicorp/terraform-provider-aws#1355 hashicorp/terraform-provider-aws#9400 hashicorp/terraform-provider-aws#31375 #6046
  • stepfunctions: add the emr-serverless optimized integrations (#6386) (15de90c), closes #6046
  • stepfunctions: emit execution status change events to EventBridge (#5567) (fc5e1ae)
  • stepfunctions: invoke regional API Gateway tasks with IAM (#6043) (a899318)
  • sts: dispatch AssumeRoot and authorize centralized root access (#6251) (c094ce3)
  • sts: dispatch GetAccessKeyInfo, the account an access key id belongs to (#6121) (4eea017)
  • sts: read a Query request's declared constraints from the model (#6891) (c9c1c09), closes #6402 #6580 #6625
  • sts: read every modelled operation's constraints from the model (#6925) (3426965), closes #6811
  • sts: vend a signed web identity token for the calling identity (#6517) (4c55ec6), closes #6402 #6478
  • support managed credentials in Redshift restore (#6515) (2a5f734)
  • support parameters in Redshift Data API batches (#6475) (36e244f)
  • ui: serve the Console Contract v2 manifest and pass its URL to the console (#6711) (258994c)

Performance Improvements

  • codeartifact: parallelize per-version metadata fetches in ListPackageVersions (#6262) (581cd62)
  • docker: decode completed log frames with JDK fast paths (#6525) (57889bb)
  • dynamodb: query only the requested partition (#6668) (86d9115), closes #6667
  • dynamodb: retain the live item map in memory mode instead of copying the table (#6915) (5f89a70), closes #1292
  • dynamodb: stop copying the change history on each write to a table with point-in-time recovery (#6824) (8ad8901)
  • keep long polls, Invoke and function URL calls off the shared workers (#6576) (4ab43ee)
  • lambda: avoid code-copy helper shutdown delay (#5646) (f08a443)
  • lambda: stream S3 code to disk instead of holding it in memory (#6126) (83647aa)
  • logs: evict past the ceiling and retention without scanning the store (#5167) (c229311)
  • stepfunctions: wake nested waits on execution status changes (#6513) (fe928d6)

Bug Fixes

  • account: implement DeleteAlternateContact (#5560) (9174147)
  • acm: reject mismatched certificate private keys (#5987) (84dfb77)
  • allow Cognito custom authentication without CreateAuthChallenge (#6410) (6256805), closes #6345
  • apigateway: answer 401 when a Cognito authorizer refuses the scopes (#6636) (e9c3766)
  • apigateway: answer an HTTP API proxy result without a Content-Type as text/plain (#6201) (34f592f)
  • apigateway: authorize management calls against the path ARN they name (#6825) (981b885)
  • apigateway: default a REST custom domain to EDGE when no endpoint type is given (#6885) (0436644)
  • apigateway: forward the request body on DELETE (#6868) (b3d9f2f)
  • apigateway: map Cognito list claims in REST integrations (#6348) (2cda011)
  • apigateway: map Lambda context in HTTP proxy requests (#6818) (9eabfaf)
  • apigateway: patch a usage plan's throttle, quota and stage throttles (#6418) (74cab79)
  • apigateway: preserve API ownership across integration invocations (#6001) (4b3681e)
  • apigateway: refuse a long-term access key sent with a session token (#5875) (4f4db89), closes #5858
  • apigateway: retain V2 integration and authorizer credentials (#6795) (02852f0)
  • apigateway: return a usage plan's API stages, throttle and quota (#6360) (bab7af3)
  • apigateway: route greedy resources below a path parameter (#6690) (7ca109b), closes #6686
  • apigateway: send x-amzn-ErrorType on REST gateway responses (#6687) (3f294c3)
  • apigateway: support integration connection patches (#6645) (4d0dfe9)
  • apigateway: tag REST API VPC links (#6165) (110f58a)
  • apigateway: take the usage plan lock on delete (#6546) (3389621)
  • apigatewayv2: answer an HTTP API's Lambda proxy body it cannot read with 500 (#6012) (28799ed)
  • apigatewayv2: answer the Lambda proxy results an HTTP API cannot read with 500 (#5985) (49d2d74), closes #5153 #5935
  • apigatewayv2: apply an HTTP API's CORS configuration to its actual responses (#5935) (dd832b4)
  • apigatewayv2: include authorizer identity sources (#6694) (825564a)
  • apigatewayv2: select the most specific HTTP API route (#6999) (4aaa5cc)
  • apigatewayv2: trust Floci's own CA when fetching a JWT issuer's keys (#5933) (a90482f)
  • apigateway: validate imported models in their deployment context (#5645) (5a72b4f)
  • appconfig: keep environment monitors and report deployment sources (#6665) (b280a77)
  • appconfig: list deployments with the settings they started with (#6759) (c2482e2)
  • appconfig: reject ambiguous configuration names (#6783) (5c20d54)
  • appconfig: return no content for cached configurations (#6777) (f4ace9e)
  • appconfig: serialize tag writes with deletes and write copies (#6912) (23d815f)
  • application-autoscaling: paginate describe operations (#6398) (2a1d3f3)
  • appsync: answer a failed AWS_IAM request with AppSync's errors (#5901) (0dd4434)
  • appsync: refuse a long-term access key sent with a session token (#5880) (ffb3d84)
  • aps: honor workspace idempotency tokens (#6552) (2bab3b5)
  • athena: paginate data catalog summaries (#6679) (13289b0)
  • athena: paginate ListWorkGroups (#6519) (57257e1)
  • athena: paginate query execution listings (#6816) (119b7e9)
  • autoscaling: apply group capacity reservation preferences (#6378) (ceaad92)
  • autoscaling: honor launch configuration metadata options (#5964) (e75b158), closes #5671
  • autoscaling: match DescribeTags input validation (#5894) (4e47507)
  • autoscaling: name the group and capitalize health in DescribeAutoScalingInstances (#6940) (b73f643)
  • autoscaling: skip groups deleted mid-iteration and lock instance updates (#5751) (f045d7d)
  • autoscaling: tag member instances with aws:autoscaling:groupName (#6471) (c517e4e)
  • backup: paginate backup plan listings (#6714) (ecb39dd)
  • backup: paginate ListBackupVaults (#6541) (13d0452)
  • backup: persist and manage backup plan tags (#6796) (a636de2)
  • backup: publish BACKUP_JOB_COMPLETED to the vault's SNS topic (#5623) (c236414)
  • backup: resume unfinished jobs after restart (#5721) (6d96849)
  • backup: return HTTP 400 for ResourceNotFoundException (#5794) (a7df271)
  • batch: paginate multi-node job listings (#6512) (ddb94d6)
  • bcm-data-exports: paginate exports and executions (#6604) (9359229)
  • bedrock-agentcore: check tag ARNs against the request account (#6802) (ad2089e), closes #6008
  • bedrock-agentcore: delete a memory's events when the memory is deleted (#6554) (a79cc4d)
  • bedrock-runtime: return errors when upstream error bodies stall (#5527) (4204ee2)
  • bedrock: list guardrails in the tagging api and route its writes (#6646) (c4ad788)
  • bedrock: resolve the KMS key before updating a guardrail (#5710) (ac83817), closes #2501 #5654
  • bedrock: validate guardrail ARNs for tag actions (#6342) (589a6a9)
  • build: build the amd64 native binary on Ubuntu 24.04 so it runs on x86-64-v2 CPUs (#6644) (84442d8)
  • build: keep build-time Jackson cache locks out of the native image heap (#5065) (a522c5a), closes #5062
  • build: let the Windows native build keep its JNI libraries (#5843) (a70b9b8), closes #5767
  • ci: retain Docker fixture sockets and bound result uploads (#5877) (720f95b)
  • cloudformation: append AutoPublishCodeSha256 to a SAM function's Description (#6364) (9c6d6a0)
  • cloudformation: carry EC2 MetadataOptions from templates and instances (#6050) (d09b321)
  • cloudformation: check S3 ownership rules against the resource schema (#5834) (9099cec), closes #5712 #5712
  • cloudformation: clean up, roll back and delete AWS::EC2::VPC like the other EC2 types (#5503) (fa682b2)
  • cloudformation: copy a SAM function's VersionDescription to its version (#6770) (a6cf29e)
  • cloudformation: create inline SNS subscriptions (#6443) (7d4caf2)
  • cloudformation: delete dependents first on update rollback (#5943) (d273d4f)
  • cloudformation: delete the HTTP API whose Body import fails on create (#6982) (ec3bd31)
  • cloudformation: delete the REST API whose Body import fails on create (#6472) (93f1904)
  • cloudformation: drop undeclared OpenAPI authorizer schemes (#6632) (f32db4f)
  • cloudformation: enforce SAM REST authorization defaults (#6021) (0517a7a)
  • cloudformation: evaluate conditions with intrinsics, require parameter values (#5737) (ad8fba7)
  • cloudformation: forward Firehose processing and logging configuration (#6277) (deeb3b3)
  • cloudformation: keep a rule target's dead-letter queue, retry policy, role and ECS parameters (#5958) (d60c973), closes #5923
  • cloudformation: keep Route 53 routing policies and provision health checks (#6191) (5beb8d4)
  • cloudformation: move a kept load balancer onto the template's subnets (#5881) (94288da)
  • cloudformation: order leftover deletes by what their attributes reference (#5998) (b955aa0)
  • cloudformation: pass a function's LoggingConfig to Lambda (#5902) (63af5cd)
  • cloudformation: pass IntegrationMethod and RequestParameters for AWS::ApiGatewayV2::Integration (#6415) (d5fc643), closes #6135
  • cloudformation: preserve nested dynamic reference opt-out (#6574) (b553202)
  • cloudformation: preserve numeric GetAtt attributes (#6564) (d903074)
  • cloudformation: provision a usage plan's throttle, quota and stage throttles (#6419) (e09c0b6)
  • cloudformation: publish content-hashed versions for SAM AutoPublishAlias (#5744) (3cb1643), closes #1987
  • cloudformation: read an ECS task definition's properties as the ECS handler does (#6018) (fcb4196)
  • cloudformation: read ECS awsvpc subnets and security groups as lists (#6180) (0934391)
  • cloudformation: read network ACL entry PortRange and RuleNumber with resolveOptionalInt (#6724) (0c44312)
  • cloudformation: refuse a Lambda function property that is not an object (#5912) (30d2bf0), closes #5902
  • cloudformation: refuse a list property that a parameter or an intrinsic makes a string (#5949) (1f4a468)
  • cloudformation: refuse a template body that does not parse (#6179) (a6433d5)
  • cloudformation: refuse a template that holds a null value (#6071) (5fa6762)
  • cloudformation: refuse an update that has nothing to change (#5849) (197ccb5)
  • cloudformation: refuse every Lambda property of the wrong type (#5923) (8db1597)
  • cloudformation: register an ECS task definition's containers with their LinuxParameters (#6027) (e38ec02), closes #6018
  • cloudformation: relocate SAM schemes without auth defaults (#6656) (0759759)
  • cloudformation: replace AWS::S3::Bucket when BucketName changes (#5762) (8298779), closes #5678
  • cloudformation: replace SAM OpenAPI security schemes (#6638) (9b36aa6)
  • cloudformation: report a failed resource in the stack's rollback reason the way AWS does (#5904) (c68cc76)
  • cloudformation: report and continue a failed REST API update rollback (#6568) (e1726e8)
  • cloudformation: resolve Fn::GetStackOutput as CloudFormation does (#5848) (e12b878)
  • cloudformation: resolve SAM AutoPublishAlias references (#7048) (5f327da)
  • cloudformation: restore SSM parameters on failed updates (#5752) (945f5d3)
  • cloudformation: roll back without a transient stack FAILED status (#5878) (115a919)
  • cloudformation: scope SAM REST auth defaults to each operation (#6358) (2705818)
  • cloudformation: start one deletion per stack and refuse change sets on a stack being deleted (#5835) (1f6261f)
  • cloudformation: treat an AWS::NoValue property as omitted before provisioning (#6726) (0d74eb5)
  • cloudformation: validate prefix list entries before update diffing (#6725) (d58ce5c)
  • cloudfront: carry origin connection settings through CloudFormation (#5992) (9a7c62b)
  • cloudfront: hold an ACM certificate in use while a distribution serves it (#6946) (de24406)
  • cloudfront: honor origin connection timeouts and attempts, answer 504 (#5802) (5306e0e)
  • cloudfront: honor the origin completion and keep-alive timeouts (#6198) (8d25cd9)
  • cloudfront: retain distribution tags by ARN (#6797) (582dba6)
  • cloudfront: return modeled UpdateFunction ETtag header (#6801) (7332c69)
  • cloudfront: return the decoded function code from GetFunction (#6798) (955a935), closes #6749
  • cloudfront: serve a Lambda Web Function endpoint origin from Floci itself (#6022) (7fb6497)
  • cloudfront: serve custom origins that name Floci itself in-process (#6951) (43a01e2)
  • cloudmap: create the Route 53 hosted zone behind a DNS namespace (#7042) (f41f794)
  • cloudmap: keep an empty HealthCheckCustomConfig and report FailureThreshold 1 (#6792) (db86fc7), closes #6751
  • cloudmap: paginate namespace service and operation lists (#6629) (a1ebc10)
  • cloudtrail: isolate account buffers and partition matching (#6689) (9303ec2)
  • cloudtrail: keep a trail's KMS key and CloudWatch Logs delivery (#6989) (5ad2f64)
  • cloudwatch: accept the CloudWatchVersion20130116 JSON target (#6586) (bc75edb)
  • cloudwatch: evaluate composite alarms with CloudWatch's reasons and refusals (#6987) (6acadc3)
  • cloudwatch: filter DescribeAlarms by state, action, children and parents (#6862) (7b9f747)
  • cloudwatch: match FilterLogEvents with the filter pattern syntax (#5903) (9647561)
  • cloudwatch: preserve metric alarm state on definition updates (#6464) (f49376f)
  • cloudwatch: publish SNS actions on alarm state transitions (#5918) (f5811c3)
  • cloudwatch: reject PutMetricData datums without a MetricName (#6072) (b8d87df)
  • cloudwatch: report StateTransitionedTimestamp and AWS's StateValue enum order (#6719) (64069f9)
  • cloudwatch: return empty CompositeAlarms and LogAlarms from DescribeAlarms (#6363) (42f5019), closes #6362
  • cloudwatch: store datums sent in PutMetricData EntityMetricData (#6070) (03f5730), closes #6066
  • cloudwatch: validate manual state reason lengths (#6470) (75d7923)
  • codeartifact: block Archived version downloads on native per-format routes (#6782) (74a313a), closes CodeArtifactService#requireContainerBackedVersionDownloadable
  • codeartifact: bracket the sidecar container id resolution race in listPackageVersions (#6388) (cc1ce89)
  • codeartifact: close two gaps left by #6435's status overrides (#6506) (413bb88)
  • codeartifact: normalize NuGet versions before synthesizing a revision (#5970) (7032840)
  • codeartifact: pypi can have more than one asset per version in ListPackageVersionAssets (#6259) (49ed87c), closes #5962
  • codeartifact: release the sidecar concurrency permit when a pypiserver container is torn down (#6337) (a815434), closes #6262
  • codeartifact: retry Verdaccio configuration uploads (#5982) (241806a)
  • codebuild: honor build list sort order (#6125) (d2ee9f4)
  • codebuild: honor project listing sort options (#6120) (03836d5)
  • codebuild: paginate ListBuilds and ListBuildsForProject (#6707) (fc5598c)
  • codebuild: paginate ListProjects responses (#6163) (cc08eab)
  • codebuild: paginate ListReportGroups responses (#6524) (28d934f)
  • codebuild: retry source archive uploads (#6060) (cbdeb0c)
  • codedeploy: honor ListApplications continuation tokens (#6678) (95960f8)
  • codepipeline: guard worker polling intervals (#6274) (f6d6746)
  • codepipeline: stop superseded workers at stage boundaries (#5723) (7412469)
  • cognito: fire the CustomMessage trigger for UpdateUserAttributes and GetUserAttributeVerificationCode (#6205) (2c54151)
  • cognito: forward SignUp ValidationData and ClientMetadata to the pre-signup trigger (#5825) (9705b25)
  • cognito: give an email sign-in code eight digits (#5873) (9ea977c)
  • cognito: keep attribute updates after sender failures (#6493) (da9f7e9)
  • cognito: keep the sign-in's auth_time across managed login sessions and refresh (#5157) (d1a2708)
  • cognito: match custom message trigger event fields (#6445) (381ad1f)
  • cognito: omit absent authentication message metadata (#6440) (c5ab54d)
  • cognito: omit absent clientMetadata in custom message events (#6195) (e38980b)
  • cognito: pass ClientMetadata to the CustomMessage trigger for ResendCode and ForgotPassword (#6108) (538a81d)
  • cognito: refuse a reused TOTP code for SOFTWARE_TOKEN_MFA (#6808) (0ee1d10), closes #6804
  • cognito: return USER_ID_FOR_SRP in the SOFTWARE_TOKEN_MFA challenge (#6086) (645c97c), closes #6074
  • cognito: run signup triggers outside user locks (#5783) (4776bfb)
  • cognito: validate email attributes before storing users (#5460) (3ad8c25)
  • cognito: verify admin contact attribute updates (#6474) (b90b671)
  • cognito: verify SRP proofs in custom authentication (#6794) (da517ac)
  • config: a started configuration recorder keeps recording across a restart (#6938) (a5254bd)
  • config: answer ResourceNotFoundException for tags on a missing resource (#6047) (88b0522)
  • config: drop a conformance pack's tags when the pack is deleted (#5779) (f7240b8)
  • config: scope recorder and rule timing state by account (#5719) (fdfc741)
  • config: store PutConfigRule tags and drop them on DeleteConfigRule (#6080) (0ebcf84)
  • core: bind the DB proxies and EC2 port forwards with a 4096 backlog (#6744) (1356cbb)
  • core: give launched containers the port Floci listens on (#5754) (8362d08)
  • core: keep JSON requests in their selected region (#5697) (1d1479f)
  • core: let a native host path follow a configured persistent path (#5777) (f897dfc)
  • core: name the real pagination parameter in invalid-token errors (#5776) (0264c1b), closes #5574
  • core: pass the presigned credential of a Query POST to its handler (#6073) (32b64e5)
  • core: read an ARN's resource after its fifth colon, not its last (#5939) (fc1488d)
  • core: reject colons in region names (#5705) (ae3ff34)
  • core: repeat a request ID a controller set in every request ID header (#6914) (d2a5a82)
  • core: report the build version when FLOCI_VERSION is unset (#5768) (db8c441), closes #5767
  • core: route a Query action by its service's botocore model (#5879) (30d8d3f)
  • core: treat a request no protocol claims as the call its route runs (#6200) (2f57441)
  • count Unicode code points in Smithy length validation (#6456) (452633f)
  • dms: accept explicit default subnet group on CreateReplicationInstance (#5820) (20b7a36)
  • dms: list the default replication subnet group (#5771) (23e1b3a)
  • docker: adopt a surviving container on the network it was created on (#5811) (dfeb05a)
  • docker: bound concurrent container teardown (#5860) (ae285fc)
  • docker: fail a port-publishing container whose network does not exist (#5726) (84e5bed)
  • docker: fail an image pull that times out instead of using what the tag names (#5786) (7ecd225)
  • docker: let the daemon pick dynamic host ports (#5928) (8972b21)
  • docker: preserve explicitly configured DNS resolvers (#5727) (f1e00ef)
  • docker: retry core and EKS archive uploads (#5916) (d951fd5)
  • docker: run boto3 on Python 3.12 in the compat image (#5649) (9e6be8f)
  • docker: share one deadline across container teardown (#6077) (4fa1110)
  • dsql: enforce IAM and the cluster's policy on the control plane (#6328) (3944d6e)
  • dsql: evaluate the cluster's resource-based policy on connect (#6319) (f60cf12)
  • dsql: refuse a connection that sends no TLS server name (#6282) (d20084a)
  • dsql: refuse a startup packet or client message outside DSQL's limits (#6258) (564ae35)
  • dsql: run each transaction age check on a thread of its own (#6216) (2ef7ef0)
  • dsql: take TLS started with no SSLRequest, as DSQL does (#6296) (1f25fd8)
  • dynamodb: authorize PartiQL statements by operation (#6168) (5419b3c)
  • dynamodb: bill a vector attribute at four bytes per dimension (#6688) (3867b5f)
  • dynamodb: bill each BatchGetItem key like a GetItem (#6708) (0cc4984)
  • dynamodb: check and round PartiQL number literals as DynamoDB does (#6991) (21adc54)
  • dynamodb: check backup ARNs as AWS does (#6291) (9790b5f)
  • dynamodb: check the Scan segment pairing after the Select checks (#5857) (5b12c62)
  • dynamodb: compare numeric key attributes by value in UpdateItem (#5837) (ad57ac8)
  • dynamodb: enforce the aggregate batch write limit (#6633) (6ff4700)
  • dynamodb: enforce the default Select for IAM (#6702) (52c9c51)
  • dynamodb: evaluate legacy Expected under the item lock (#6278) (f94e058), closes #6276
  • dynamodb: export the table as of ExportTime (#6132) (da66550)
  • dynamodb: lift the PartiQL overlap refusal when a branch tests a key outside a range (#6602) (8b57546)
  • dynamodb: match AWS for unprojected GSI attributes in Query, Scan and PartiQL (#5911) (61102a7)
  • dynamodb: measure item size and UpdateItem statements like DynamoDB (#5934) (3b7782e), closes #4339
  • dynamodb: read PartiQL number literals as DynamoDB does (#6567) (17191a9)
  • dynamodb: refuse a PartiQL statement that is missing, empty or over 8192 characters (#6978) (5cfb16a)
  • dynamodb: refuse a PartiQL table alias as DynamoDB does (#7014) (6e2b51a)
  • dynamodb: refuse PartiQL requests whose members break their constraints (#6985) (c8143b9)
  • dynamodb: report a missing PartiQL term, path or table name as DynamoDB does (#6957) (aecabcb)
  • dynamodb: report an empty or mistyped ExclusiveStartKey value the way AWS does (#5861) (e21d25a)
  • dynamodb: return set members in DynamoDB's order (#6520) (2a5f52e)
  • dynamodb: return the item that a PartiQL write's failed condition saw with ALL_OLD (#6910) (772b444)
  • dynamodb: save each batch item inside its own item lock (#6314) (4f45541)
  • dynamodb: show table creation times to the millisecond (#6325) (80e5df9)
  • dynamodb: support legacy table discovery and batch cleanup (#5986) (0a37ea8)
  • dynamodb: trim number zeros in items written by UpdateItem (#6994) (cc76085)
  • dynamodb: wait for unfinished writes in full exports and point-in-time restores (#6781) (3649b18)
  • ec2: add opt-in Standard On-Demand vCPU admission (#6058) (6892011)
  • ec2: align Rocky 9 runtime with advertised release (#6377) (d2f06bd)
  • ec2: allow mixed DHCP DNS servers (#6941) (dfad9d6)
  • ec2: AND repeated filter names on every Describe action (#6170) (7c202a8)
  • ec2: apply TagSpecification on key pair, network ACL and image creates (#6551) (0634184)
  • ec2: apply the AWS public address rules and displace earlier Elastic IPs (#5963) (456ae15), closes #5671
  • ec2: create the EBS volumes a launch's block device mappings describe (#6734) (65df465)
  • ec2: create the key type and format CreateKeyPair asks for (#6112) (ff813c6), closes #6093 #6093
  • ec2: CreateNetworkInterface honours the PrivateIpAddresses entry marked Primary (#7031) (2a4f573)
  • ec2: derive subnet and EFS zone ids from the zone name (#5580) (#6923) (d7911da), closes #5486
  • ec2: detach Floci before deleting VPC networks (#5869) (5a4413d)
  • ec2: disable Nagle on both socat sockets of a published port forward (#6572) (f1816db), closes #6176
  • ec2: give RunInstances the private address it asks for (#6099) (50e515f), closes #5830
  • ec2: honor capacity-reservations-only launches (#6354) (81d399a)
  • ec2: honor default subnet filters (#6772) (1a5decb)
  • ec2: honor DHCP options dry runs and restore default set (#6448) (4244e64)
  • ec2: honor DryRun when creating VPCs, subnets and security groups (#6823) (d7763ff)
  • ec2: honor IncludePublicKey when describing key pairs (#6055) (9f9c16a)
  • ec2: ignore NoDevice block device mappings at launch (#5739) (5544a11)
  • ec2: ignore ports when revoking an all-traffic rule (#6895) (d68876e)
  • ec2: keep Ipv6CidrBlock and IcmpTypeCode on network ACL entries (#6680) (9e14ffe)
  • ec2: keep key pair names unique under concurrent requests (#6635) (986117a)
  • ec2: keep tags in the region of the resource they label (#5973) (1eb402d)
  • ec2: keep the KMS key a volume is created with (#6756) (a83fa9c)
  • ec2: keep the tags CreateFlowLogs is given (#6890) (8ececd8)
  • ec2: launch instances into capacity reservation groups (#6404) (60ef203)
  • ec2: let a systemd guest's init start sshd (#6882) (0e87e6f)
  • ec2: list i386 alongside x86_64 for t2 instance types (#5815) (feafbfe)
  • ec2: list requested launch template versions (#6329) (bc760f7)
  • ec2: model scheduled capacity reservations (#6764) (b5033e9)
  • ec2: normalize subnet IPv6 CIDRs and expose zone network borders (#6387) (5b24703)
  • ec2: pin Rocky 10 runtime to advertised release (#6379) (f7c9d9a)
  • ec2: preserve elastic IP pool and border group (#5821) (5fc58a9)
  • ec2: preserve IAM instance profile identity (#5671) (0be4581)
  • ec2: prevent deleting the local VPC route and return InvalidRoute.NotFound for missing routes (#5603) (340e727)
  • ec2: protect subnets and VPCs that load balancers use (#5663) (e520166)
  • ec2: read RunInstances security groups from the primary interface spec (#6964) (8dbcf6b)
  • ec2: record EbsOptimized from RunInstances (#6875) (3f36c4e)
  • ec2: refuse an explicit CreateNetworkInterface address that is already in use (#6908) (146ba44)
  • ec2: refuse key pairs AWS refuses and describe their type, create time and filters (#6093) (fbf3bff), closes PKCS#1 #6055
  • ec2: reject invalid IPv4 managed prefix list entries (#6566) (bffffed)
  • ec2: reject tag writes on missing, malformed or absent resources (#5996) (73da37b)
  • ec2: remove a VPC's network after a restart too (#6874) (ddae4fd), closes #5869
  • ec2: repeat the primary interface association on its primary private address in DescribeInstances (#6928) (bfa13df)
  • ec2: report image creation provenance and its three filters (#6059) (9f99c7c), closes #5663
  • ec2: report missing network interface security groups (#6582) (42314fc)
  • ec2: report targeted reservation capacity exhaustion (#6344) (5182449)
  • ec2: require IMDSv2 tokens when HttpTokens is required (#5966) (7504d71), closes #5964
  • ec2: resolve a NAT gateway's network interface and mark its Elastic IP associated (#5622) (1e42342), closes #5503
  • ec2: restore and stop the instances of every account (#5103) (8eddae4)
  • ec2: retain firewall identity during container teardown (#6492) (73fc6fd)
  • ec2: return the network interface association in DescribeInstances (#6872) (d726533)
  • ec2: revoke security group rules by SecurityGroupRuleId (#6192) (5ed0eca)
  • ec2: seed the default network before marking the scope seeded (#6637) (79e47cd)
  • ec2: skip addresses stored resources hold when the VPC network allocates (#6284) (d3c2dbb), closes #6283
  • ec2: write Amazon-provided VPC IPv6 blocks in canonical form (#6692) (c6927cc)
  • ecr: delete only the named tag in BatchDeleteImage (#6597) (9ce1b17)
  • ecr: explain unavailable registry responses (#6752) (c37e0aa)
  • ecr: give every data plane exchange its own registry connection (#5883) (de94e3c), closes #5573
  • ecr: never start the registry container while ECR is disabled (#6281) (a29df66)
  • ecr: paginate image listings (#6544) (b29c8f8)
  • ecr: pull rewritten ECS and Lambda images from localhost (#5882) (553411b)
  • ecr: return per-repository scanning batch failures (#6569) (671e4bf)
  • ecr: validate scanning batch repository names (#6587) (ad92d5f)
  • ecs: add opt-in dynamic awsvpc host ports (#6509) (c910de5)
  • ecs: apply EFS access point PosixUser and CreationInfo to task volumes (#5606) (b4c012f), closes #5480
  • ecs: bound FireLens socket volume paths (#6787) (2d3fb0c)

...and 310 more in this section.

GitHub caps a release description at 125000 characters, so this list is shortened. Every change is in CHANGELOG.md.

Check out latest releases or
releases around floci-io/floci 2.4.0

Don't miss a new floci release

NewReleases is sending notifications on new releases.

Get notifications