2.5.0 (2026-11-15)

Features

• accessanalyzer: add basic ValidatePolicy checks (#7085) (eb65ad8)
• account: implement GetContactInformation and PutContactInformation (#8262) (5f03ff9)
• add CloudWatch OTLP metrics ingestion (#7781) (2d8cdeb)
• apigateway: add documentation part operations (#7712) (856970a)
• apigateway: trust FLOCI_TLS_EXTRA_CA_PATH for HTTP and HTTP_PROXY integrations (#8285) (b2bdb2b)
• apigatewayv2: support IntegrationSubtype and invoke SQS-SendMessage on HTTP APIs (#7969) (8eaf5bf)
• appconfig: implement UpdateApplication (#7209) (1b87483)
• appsync: execute HTTP data sources and signed local AWS requests (#7609) (d5b7a11)
• athena: run Hive DDL against the Glue catalog (#8411) (cc9b5bf)
• athena: support named queries (#8002) (77587de), closes #8000
• bedrock-agentcore: add the harness control plane (#7387) (2e47b9c)
• bedrock-agentcore: keep runtime endpoint create tags and support tagging them (#7597) (c1a88b8)
• bedrock: add PutResourcePolicy, GetResourcePolicy and DeleteResourcePolicy for guardrails (#7188) (b987e82)
• bedrock: list and get foundation models and system-defined inference profiles (#7675) (30db535)
• bedrock: store resource-based policies on guardrail profiles (#7208) (a69b362), closes #6671
• cloudformation: add AWS::EFS::FileSystem, MountTarget and AccessPoint (#8074) (f1a6260), closes #7972
• cloudformation: carry DurableConfig and LoggingConfig through the SAM transform (#8101) (1e61e16)
• cloudformation: provision AWS::CloudFormation::StackSet (#7244) (09ac552)
• cloudformation: provision AWS::EC2::KeyPair with its private key in Parameter Store (#7128) (be315bf)
• cloudformation: provision AWS::ElasticLoadBalancingV2::ListenerCertificate (#8353) (0816789)
• cloudformation: provision Cognito user pool identity providers (#7350) (d0747f2)
• cloudformation: provision event bus v2 and subscriber (#7260) (4ba9a55)
• cloudformation: provision signing profiles and code signing configs (#7546) (b35e513)
• cloudfront: add CloudFront KeyValueStore support (#8108) (9831603)
• cloudwatch: support alarm action controls (#8383) (c5ac8e8)
• codeartifact: add Package Groups support (#8206) (a852078)
• codeartifact: retain Cargo crates from a same-domain upstream repository (#8423) (85492a4), closes #8261
• codeartifact: retain npm packages from a public external connection (#7198) (b3bee2d), closes #6889 #7104 RegistryFetcher#packumentUrl VerdaccioSidecarClient#copyPackageVersionAsset CodeArtifactService#listPackageVersions #7204
• codeartifact: retain NuGet packages from a public external connection (#7104) (300e62a)
• codeartifact: retain pypi packages from the public:pypi external connection (#7741) (8e4c199), closes CodeArtifactPypiExternalConnectionImporter#tryImportAsset CodeArtifactPypiController#packageIndex PypiserverSidecarClient#filenameEmbedsVersion
• codeartifact: retain versions from repository-to-repository upstreams (#8261) (d9a4301)
• codeartifact: support the cargo (crates.io) registry format (#8370) (15a632e)
• cognito: send signup confirmation links for CONFIRM_WITH_LINK (#7660) (68f5510), closes #link #5662
• cognito: support AdminListUserAuthEvents (#7404) (537e042), closes #6137
• docdb: support cluster snapshots and restores (#7585) (46a8cbe)
• dynamodb: emulate Contributor Insights on tables and global secondary indexes (#7326) (bb5e692)
• dynamodb: serve DescribeLimits and DescribeEndpoints (#8099) (60252c9)
• ec2-instance-connect: SendSSHPublicKey, verified by the unmodified AWS agent (#7473) (3701d4d)
• ec2: add Client VPN endpoints, associations, rules and routes (#7425) (a772b27)
• ec2: bind the host's /lib/modules read-only into systemd guests (#7354) (0de5566)
• ec2: delete launch template versions without reusing numbers (#7910) (0e244e5)
• ec2: EC2 Instance Connect Endpoint control plane (#7359) (196b672)
• ec2: EC2 Instance Connect Endpoint tunnel (open-tunnel / eice SSH over WebSocket) (#7519) (475fb18)
• ec2: report the service-network address as public IP when Floci runs in a container (#7384) (efe6cbc)
• ec2: support AMI block public access (#7134) (f489a6f)
• ec2: support GetConsoleOutput with the guest's SSH host keys (#7385) (ecd1138)
• ecs: support stop-first replacement on stable published ports (#7539) (4b09c3c), closes #7523
• eks: point pods that receive pod identity credentials at Floci through AWS_ENDPOINT_URL and AWS_ENDPOINT_URL_STS (#7771) (afb6608)
• eks: size the k3s node from a configured instance type while the API keeps the node group's type (#7773) (5d08621)
• elasticache: apply a changed access string to open sessions (#7101) (3f53b26)
• elasticache: support snapshots of cluster-mode-disabled replication groups (#7744) (42b28be)
• elbv2: make backend HTTP connection reuse configurable (#7557) (983fdec), closes #7524
• emr-serverless: give a job run's driver its driverEnv and S3 archives (#7107) (2b6a8b4), closes /.../pyspark_venv.tar.gz#environment
• emr-serverless: report the image digest each job run attempt resolved (#8307) (ddc844b)
• emr-serverless: run a Spark job's executors in their own containers (#8168) (438e01a)
• emr-serverless: update a started application's capacity and images (#8316) (f665d5f)
• emr: apply a cluster's spark-env and spark-hive-site to its steps (#7047) (2645136)
• emr: apply a step's Properties, core-site and spark-log4j2 (#7226) (b4ae0ce)
• emr: give a cluster a bootstrap failure ended its ErrorDetails (#8267) (16ff5a2)
• emr: give a cluster with HCatalog Hive's client and metastore (#7719) (6974d8c), closes #7636
• emr: give each docker cluster a real HDFS on its primary node (#7496) (3a64d2b)
• emr: keep a cluster's storage, HDFS included, across its steps (#7137) (ebf91d1)
• emr: run a cluster's core and task nodes in containers of their own (#8066) (7ebed87)
• emr: run a cluster's Spark steps on YARN on its primary node (#7864) (874493c)
• emr: run a custom JAR's MapReduce and apply Hadoop classifications (#7294) (db3efe8)
• emr: run a step's MapReduce and Hive's Tez on the cluster's YARN (#8151) (54ea160)
• emr: run hadoop-streaming and hadoop-lzo steps (#7264) (048070e)
• emr: run Hive steps in the docker runner mode (#7459) (5a46322)
• emr: run Hive's metastore service on a docker cluster with Hive (#7636) (ba9a9c8)
• emr: run s3-dist-cp steps (#7192) (a74a9b0)
• emrserverless: run Hive job runs in the docker runner mode (#7407) (710b248)
• eventbridge: authorize the role of Redshift Data API targets (#7095) (4d99aa9)
• eventbridge: create partner event buses from EventSourceName (#7968) (c6361ca)
• eventbridge: deliver AppSync mutation targets (#7488) (ca854a4)
• eventbridge: support native Redshift Data API targets (#6900) (6d32605)
• eventbridge: trust extra CAs from FLOCI_TLS_EXTRA_CA_PATH for API destinations (#7850) (9f94fcc), closes #5259
• eventbridgev2: add EventBridge V2 service (#6962) (dfaab8b)
• firehose: authorize the roles of a Redshift destination (#7296) (2be776a)
• firehose: deliver Redshift COPY loads to a Serverless workgroup (#7227) (1fe8eae)
• firehose: load Redshift COPY with temporary credentials of the stream role (#7337) (814232c)
• firehose: run the Lambda processor of a Redshift destination (#7230) (8c32e9f)
• helm: add a Helm chart for running Floci in Kubernetes (#7749) (a65def0)
• iam: check API Gateway's routes by botocore's models (#8060) (81894c5)
• iam: check FIS, RAM, OAM and three more services by their REST routes (#8154) (9f1cccf)
• iam: check Lake Formation, Macie and Inspector by their REST routes (#7869) (dfec973), closes #7461
• iam: check REST routes no rule maps by botocore's models (#7461) (251bb39), closes #7085 #7085 #7351
• iam: read a REST request's resources from its path and query (#7499) (9062572)
• iam: read IAM Access Analyzer's request resources (#7567) (a64fa37)
• inspector2: support disabling scans (#7181) (fd4abd3)
• kinesis: add configurable stream status windows (#8227) (c3e9dba)
• kinesis: support stream consumer resource tags (#8057) (f41c4ee)
• kms: list completed key rotations (#8146) (c3551d3)
• lambda-web: add a text/plain Content-Type to app responses that send none (#7285) (f1c7098)
• lambda-web: move a revision to Failed once its code is gone (#7065) (32a47da)
• lambda-web: write the platform's own Date header on app responses in place of the app's (#7257) (b7697f8)
• lambda: give each durable execution an X-Ray trace header (#8161) (f5e581a)
• lambda: list function URL configurations (#8410) (e7767b8)
• lambda: pass the X-Ray trace header through durable chained invokes (#8189) (ede4ebf)
• logs: add vended log delivery sources, destinations and deliveries (#7411) (3308ea2)
• logs: support saved query definitions (#7999) (#8003) (a6da82a)
• map Redshift IAM credentials to PostgreSQL roles (#8211) (b658720)
• mwaa: sign in through /aws_mwaa/login with a web login token (#8419) (0baf1a1)
• opensearch: report VPC domains under Endpoints.vpc and emulate VPC endpoints (#7351) (d74a084)
• paymentcryptography: the card values and the authorization cryptograms (#7400) (ab312d6)
• paymentcryptography: the data plane as a service of its own (#7396) (4617e4a)
• paymentcryptography: the key algorithms of the control plane (#7395) (648d363)
• paymentcryptography: the key exchange, with TR-31, RSA-OAEP and ECDH (#7862) (77d73ee)
• paymentcryptography: the Payment Cryptography control plane (#7090) (6906759)
• paymentcryptography: the PIN operations (#7397) (6130fe9)
• paymentcryptography: the TR-34 key block (#8136) (4cd8ab9)
• pipes: deliver to a Redshift cluster or Serverless workgroup through the Data API (#7165) (24b152a)
• quicksight: add metadata APIs and limited registered-user embedding (#7529) (f8670f6), closes #7522
• rds: add blue/green deployments for DB instances (#8104) (654473f), closes #8069
• rds: CreateDBSnapshot and RestoreDBInstanceFromDBSnapshot for MySQL and MariaDB (#7747) (46f0d91)
• rds: export DB snapshots to S3 as Parquet (#7289) (b65755d)
• redshift-serverless: allow cross-account restore of a snapshot its policy shares (#7801) (#7803) (e37f45f)
• redshift-serverless: read and list snapshots another account shares (#7899) (8a817ec)
• redshift: add COPY JOB create, list, show, alter and drop (#7465) (de71d91)
• redshift: add PutResourcePolicy, GetResourcePolicy and DeleteResourcePolicy (#7361) (d7797bf)
• redshift: copy cluster snapshots into the configured destination region (#7058) (dd423ee)
• redshift: enforce Lake Formation SELECT on Spectrum queries (#8414) (00183c0)
• redshift: execute S3 auto-copy and COPY JOB RUN (#7898) (4d4f20b)
• redshift: implement remaining COPY options and load diagnostics (#8075) (59c2b46)
• redshift: load empty fields of non-character columns as NULL in COPY (#7324) (432fa41)
• redshift: project DynamoDB zero-ETL changes into a current-state table (#8180) (eea61cd)
• redshift: prune external table partitions from query WHERE predicates (#7413) (a42779b)
• redshift: prune Spectrum partitions for bind parameters (#7758) (#7863) (2964140)
• redshift: prune Spectrum partitions in Extended Query and transaction blocks (#7758) (#7778) (d1205c3)
• redshift: read a Parquet column missing from a partition's files as NULL (#7406) (e82fa60)
• redshift: read S3 as the access keys a COPY names (#7334) (a93de12)
• redshift: require kms:Decrypt on an encrypted snapshot's key to restore it (#8309) (f09468f)
• redshift: restore a single table from a snapshot (#8290) (2d85e4e), closes #7806
• redshift: scheduled actions that pause and resume provisioned clusters (#8260) (d08c241)
• redshift: share a cluster snapshot with another account (#8077) (315367f)
• redshift: sign the Spectrum floci-duck transfer with the role session when S3 auth is enforced (#7162) (cedc107)
• redshift: support audit logging to S3 (RS-14 / INT-08) (#7699) (08be536)
• redshift: support COMPUPDATE, STATUPDATE, and TRIMBLANKS in COPY (#7751) (#7754) (6ca2b03)
• redshift: support CopyClusterSnapshot API action (#7748) (#7750) (e069209)
• redshift: support DATEFORMAT, TIMEFORMAT and ACCEPTANYDATE in COPY (#7263) (105d673)
• redshift: support FILLRECORD in COPY (#7269) (cd6e516)
• redshift: support MAXERROR in COPY (#7291) (d4eeada)
• redshift: support ModifyClusterSnapshot API action (#7755) (#7756) (92eff0a)
• redshift: support Redshift UNLOAD to Parquet (#7548) (f7cf6fe)
• redshift: take a DynamoDB table and a Serverless namespace in zero-ETL integrations (#7332) (6abdb4c)
• redshift: take an S3 bucket as the source of an integration (#7466) (8cff513)
• rekognition: add face collection lifecycle and search (#8001) (#8004) (a27670c)
• route53: support reusable delegation sets (#7020) (7f785fd)
• s3: track archived object restore state (#8166) (1686f29)
• s3vectors: support vector bucket policy operations (#7825) (d975742)
• securityhub: add member account operations and DisableOrganizationAdminAccount (#7791) (9f77c73), closes #2197
• securityhub: import and query ASFF findings (#7692) (6e75e40)
• servicequotas: implement ListServices action (#7254) (e95af9c)
• sfn: apply the EventBridge connection to HTTP Tasks (#7479) (3b68495)
• signer: serve the Signer control plane for profiles, permissions and job records (#7680) (1364078)
• sns: trust FLOCI_TLS_EXTRA_CA_PATH for HTTPS subscriptions (#8063) (35bdfdc), closes #8033
• ssm: generate the IAM request resources for SSM (#8203) (39c29de)
• stepfunctions: dispatch ECS Lambda mapping and secret SDK tasks (#7004) (812ab3b)
• stepfunctions: evaluate the execution role on DynamoDB, S3, RDS Data and Redshift Data tasks (#7722) (87eaaab)
• stepfunctions: evaluate the execution role on ECS, EMR and EMR Serverless tasks (#7723) (6f928e6)
• stepfunctions: evaluate the execution role on SNS and EventBridge tasks (#7622) (b1ba11c)
• stepfunctions: evaluate the execution role on SQS tasks (#7574) (bd65477)
• stepfunctions: evaluate the execution role on the remaining task integrations (#7724) (1b8e4fa)
• stepfunctions: support workflow variables in JSONPath states (#7106) (25780c0)
• support one-off ECS scheduled scaling (#7895) (fe24f77)
• xray: serve traces, summaries, the service graph and sampling (#7733) (b144879)

Performance Improvements

• apigateway: build the query parameter map only for a request with a query string (#8045) (d8978fd)
• apigateway: read the query parameter map through the request helper in the SigV4 check (#8425) (dc74687)
• apigateway: skip execute-api work on requests for other services (#7691) (ae196fb)
• apigateway: skip the key copy for a host that is no custom domain (#7727) (9a88ebf)
• cloudfront: skip the host lookup when no distribution exists (#7467) (d7a3461)
• cloudfront: stop copying strings for every distribution in the host lookup (#7742) (9822ad5)
• core: build the query parameter map only for a request with a query string (#7978) (ba28970)
• core: build the signed service route prefixes once (#7802) (d9a258a)
• core: drop per-request lookups and allocations on the shared request path (#7323) (0550365)
• core: parse the credential scope in the account filter only when needed (#7772) (fd7cc84)
• core: parse the request URI only when the Cognito or S3 filter needs it (#7932) (57e4e3f)
• core: read the query parameter map once per request (#8071) (14bcb85)
• core: read the SigV4 credential scope without regular expressions (#7658) (cf4b3f0)
• docker: preserve JVM image layers across version changes (#7417) (c9512d8)
• elbv2: drive TCP fixture health probes explicitly (#7328) (67b408a)
• emr: start a primary node's daemons together (#8182) (c1c1c24)
• iam: find an access key across accounts without scanning every key (#7716) (206b602)
• lambda-web: skip the host pattern on other services' requests (#7856) (fef0497)
• rds: run proxy relays on platform threads and buffer the IAM relay input (#7401) (57a961f)
• rds: wake PostgreSQL initialization on startup logs (#7877) (6565225)
• replace guessed runtime readiness waits (#7375) (8d9d740), closes #7380
• s3: build the query parameter map only for a request with a query string (#8022) (347881d)
• s3: read the query parameter map through the request helper (#8085) (94ba685)
• s3: speed up in-memory PutObject, GetObject, DeleteObject and ListObjectsV2 (#7386) (3dbbb46)
• share Jandex classes across test preparations (#7593) (9034305)
• sns: find a topic's subscriptions without copying every subscription key (#7631) (0c33083)
• sns: log each captured push and SMS at debug level (#7569) (a5291ca)
• sns: log each Publish at debug level (#7558) (c767d2d)
• sqs: copy the queue once when messages expire or move to a dead-letter queue (#7493) (f53ba4a)
• sqs: hash message MD5s with the optimized Digests helper (#7563) (4adde48)
• sqs: stop copying the whole queue on send and receive (#7478) (ca54394)
• sts: build the query parameter map only for a request with a query string (#7987) (a3a718b)

Bug Fixes

• account: check alternate contact requests against the model (#8312) (3e4d867)
• account: refuse the management account as an AccountId target (#8276) (869a5fc)
• acm: reissue the certificate on RenewCertificate (#7074) (62cf616), closes #7070
• acm: retain certificate tags during reimport (#8119) (c0a087a)
• apigateway: count usage plan calls per key and enforce quota and throttle (#7665) (c44a872)
• apigateway: filter GetUsagePlans by keyId (#7655) (413f490)
• apigateway: keep a REST API's apiKeySource and honor AUTHORIZER (#7382) (93cc09c)
• apigateway: keep execute-api independent of IoT enablement (#7076) (3d0fbad)
• apigateway: keep the caller's path encoding on HTTP integrations (#7489) (861d2ea)
• apigateway: key stage method settings by the patch path as sent (#7977) (54bc8fc)
• apigateway: register the $foreach loop scope for native VTL (#7859) (aff365d)
• apigateway: report the published regional hosted zones (#7487) (e46579e)
• apigateway: treat blank documentation part location fields as absent (#8153) (91ec6d2), closes #7706
• apigatewayv2: accept array aud claim in HTTP API JWT authorizer (#7377) (feb9364)
• apigatewayv2: page GetApis with MaxResults and NextToken (#7770) (b93afa9)
• apigatewayv2: retain integration descriptions (#7998) (#8126) (1bdc839)
• apigatewayv2: send HTTP_PROXY backends the client address in Forwarded (#7281) (ebd2b70)
• appconfigdata: consume configuration tokens only once (#7082) (b3dad93)
• appconfig: default omitted configuration profile type (#7037) (9f0856c)
• appconfig: honor final bake time and restore reverted configurations (#7156) (28bde18)
• appconfig: isolate resources and sessions by region (#7621) (a884257)
• appconfig: paginate ListApplications results (#7787) (c9fc00a)
• appconfig: paginate remaining list operations (#7835) (82603f1)
• applicationautoscaling: target-tracking alarms watch the real metric, not the policy type name (#6902) (2ad35bb), closes #6853
• appsync: accept a bare Cognito or OIDC JWT in the Authorization header (#8399) (704f895)
• appsync: implement JS subscription filter helper (#7442) (be50db3)
• appsync: make Cognito directive groups optional (#8381) (e4d7061)
• appsync: preserve resolver callback execution scope (#7512) (1d6ec2b)
• appsync: reject regex literals without misreading division (#7343) (56efb18)
• appsync: report Lambda data source function errors as Lambda: with the function's message (#7288) (9e270fb)
• appsync: require a format for type updates (#8149) (c0ef5b2)
• appsync: require definition and format when creating types (#8157) (44eb096)
• appsync: respect string normalization form (#7284) (a15fb6b)
• appsync: scan template holes and keyword object keys (#7320) (fca988c), closes #7240
• appsync: validate type updates before mutation (#8129) (5d1d626)
• athena: answer Trino JSON functions and ARRAY casts (#8407) (9bee320)
• athena: read and check a request naming no catalog as AwsDataCatalog (#7061) (bfd3bcb)
• athena: report a HUGEINT result column as bigint (#8254) (8185a34)
• athena: report a workgroup's configuration as AWS does (#7436) (7d84ce4)
• athena: report each result column's SQL type in GetQueryResults (#7926) (1da8982), closes #7897
• athena: take templated partition values from the object path (#8242) (01d61af)
• auth: reject ambiguous SigV4 authorization headers (#8332) (e182cda)
• autoscaling: derive group zones from selected subnets (#7475) (1743cb5)
• autoscaling: honor scaling activity ID filters (#7832) (69cc889), closes AndreKurait/floci#599
• autoscaling: launch with the launch configuration's block devices (#7098) (dbb1ff6)
• autoscaling: match AWS capacity target validation errors (#7344) (e09ca1a)
• autoscaling: preserve indexed standby request members (#7205) (dae514b)
• autoscaling: reject malformed tag propagation flags (#8079) (f8e5a88)
• autoscaling: retain indexed instance mutation members (#7217) (3c5e893)
• autoscaling: retry failed standby registrations (#7253) (830e558)
• autoscaling: scope target cleanup to group-owned instances (#7038) (e714fd9)
• autoscaling: settle completed refresh work before standby (#7333) (6a39049)
• autoscaling: settle refresh before removing replacements (#7338) (cffad85)
• autoscaling: use default launch template version when omitted (#7990) (11dafb4)
• autoscaling: use the modeled XML namespace (#7180) (1ccd6d3), closes #269
• autoscaling: validate tag propagation per action (#7537) (ee038af)
• backup: add pagination to ListBackupJobs and ListRecoveryPointsByBackupVault (#7541) (5b7468a)
• backup: keep a plan rule's TargetLogicallyAirGappedBackupVaultArn (#7176) (55545b5)
• backup: retain deleted plans for IncludeDeleted listings (#7871) (184f994)
• backup: return the deleted plan's id, ARN, version and deletion date from DeleteBackupPlan (#7276) (1f0b4cf)
• bedrock-agentcore: save a runtime's create tags with the runtime (#7130) (2d68edc), closes #7126
• bedrock-agentcore: serialize runtime endpoint mutations (#7502) (8f69e81)
• bedrock-agentcore: serialize runtime tags with deletion (#7721) (a28c52f)
• bedrock-agentcore: use runtime IDs and endpoint names in ARNs (#8088) (f2a0bfc)
• ci: derive Neptune prefetch images from configuration (#7834) (a5b3fab)
• ci: prefetch bind-directory Docker test images (#7651) (fcb2421)
• cloudformation: apply an AWS::EC2::FlowLog's Tags (#7490) (dbbf229)
• cloudformation: apply EnabledMfas on AWS::Cognito::UserPool (#7046) (ebdac90)
• cloudformation: apply IAM role session duration (#7405) (240193e)
• cloudformation: apply KinesisStreamSpecification on AWS::DynamoDB::Table (#7464) (8b756a3)
• cloudformation: clear an AppSync property the new template drops on update (#6995) (5e9df93)
• cloudformation: clear dropped API Gateway v2 route and authorizer settings (#7992) (195a036)
• cloudformation: clear dropped descriptions and the trail key prefix (#7884) (55bb5c0)
• cloudformation: clear dropped ECS service settings (#7780) (7ca797f)
• cloudformation: clear dropped stage variables and instance user data (#7736) (3c66249)
• cloudformation: clear EC2 network tags and properties the new template drops (#7124) (f55948c), closes #6606
• cloudformation: delete a custom resource a committed update replaced (#8223) (6341708)
• cloudformation: delete a stack whose create is still running only once the create stops (#7358) (70a185a)
• cloudformation: delete published Lambda versions with their stacks (#8371) (da23f42)
• cloudformation: deploy a service-managed stack set to accounts that join or leave its targets (#7243) (01c8424)
• cloudformation: drop a DynamoDB table's update snapshot once the update commits (#7448) (eaefd55)
• cloudformation: forward ECS service and task definition settings (#7644) (062389b)
• cloudformation: generate the create-only table from the registry and compare nested pointers (#8093) (410e09b)
• cloudformation: give a DB instance its security groups and encryption (#7867) (3d3e94d), closes #7603
• cloudformation: give an instance its launch template's instance profile (#7761) (e27a307), closes #7603
• cloudformation: honor DynamoDB on-demand billing mode (#7931) (b3de4b3)
• cloudformation: honor retained resources on stack deletion (#6723) (7cf516a)
• cloudformation: keep an ECS service's desired count when an update leaves it out (#8279) (4de81e8)
• cloudformation: keep NAT gateway secondary addresses the stack never declared (#7669) (0cb45a8)
• cloudformation: keep SMS_MFA on a user pool update until MFA is turned off (#7088) (f0a1b11), closes #7086
• cloudformation: keep tags added outside the stack on EC2 VPCs, security groups and instances (#7534) (cfbf86b)
• cloudformation: list a service-managed stack set's targets and tags in DescribeStackSet (#7242) (918ce95)
• cloudformation: name an https ResponseURL for a custom resource when TLS is on (#6993) (a0b39a4)
• cloudformation: preserve concurrent KeyPair parameter writes (#7367) (c0906b8)
• cloudformation: preserve KMS key spec and usage on create (#7612) (f2debe4)
• cloudformation: preserve mapped list values (#7511) (31451df)
• cloudformation: preserve security group identity and rule ownership (#7430) (7a7fef9)
• cloudformation: preserve SES receipt rule update order (#7071) (65b0881)
• cloudformation: preserve unquoted YAML dates as text (#8120) (f3b61cc)
• cloudformation: propagate tags to nested stacks (#7383) (fad0493)
• cloudformation: refuse a DynamoDB TimeToLiveSpecification that is not an object (#7286) (10b1a1b)
• cloudformation: register a target group's Targets and keep them in step on update (#8199) (7d7c873)
• cloudformation: replace a Route53 hosted zone on a Name or DelegationSetId change and roll back record set updates (#8205) (57c7462)
• cloudformation: replace exactly what the change set says for AppConfig profiles and ElastiCache clusters (#8204) (b4b659b)
• cloudformation: resolve sequence-form GetAtt references (#8080) (6ace00a)
• cloudformation: return stack IDs before provisioning completes (#7491) (af0461a)
• cloudformation: roll back an AppSync update when a later resource fails (#7186) (0c3af7d)
• cloudformation: roll back an AWS::EC2::SecurityGroup updated in place (#7562) (d280f45)
• cloudformation: send a stack's status changes to the default bus, with their request token (#7053) (2a3dbb1)
• cloudformation: store stack policies and return them (#7552) (a19b296)
• cloudformation: transform SAM layer versions (#7062) (7569a9a)
• cloudformation: update the tags of an AWS::Events::EventBus in place (#7799) (8b48aaf), closes #7796
• cloudfront: generate IAM routes and request resources (#7991) (e13bb4e)
• cloudfront: hold a viewer certificate to the rules its entry states (#8028) (9e6f62e)
• cloudfront: read policy Name and Comment from the config root only (#7252) (5680ec4)
• cloudfront: route origin access control updates through config (#8382) (029f6d1)
• cloudfront: tunnel WebSocket upgrades to custom origins as AWS does (#7148) (d2d9ed6)
• cloudhsmv2: preserve tags when copying backups (#7981) (5e0f318)
• cloudtrail: validate LookupEvents MaxResults (#7183) (5556bba)
• cloudwatch: decompress gzip JSON PutMetricData bodies (#7123) (3cb727a)
• cloudwatch: paginate ListDashboards results (#7789) (ddad6dd)
• cloudwatch: paginate ListMetrics results (#7236) (87936c1)
• codeartifact: clear managed Reposilite state after teardown (#7078) (01ecd4f)
• codeartifact: enforce publish:BLOCK on native Maven, npm, pypi and NuGet publishes (#7304) (0454c35)
• codeartifact: give every domain its root package group /* (#8355) (63607e8)
• codeartifact: keep Verdaccio alive through npm requests (#7274) (261072b)
• codeartifact: lease NuGet sidecars through requests (#7438) (d9d2a1e)
• codeartifact: resolve upstreams in AWS's order, through their external connections (#8356) (e286aef)
• codeartifact: retain pypi sidecar during proxy requests (#7454) (62bfd5e)
• codeartifact: route a literal slash scoped npm publish through the publish guards (#7445) (342c798), closes #7439
• codeartifact: share PyPI retention locks across package spellings (#8201) (5816d8a)
• codeartifact: stop npm retention from clobbering a real local dist-tags.latest (#7510) (0913285)
• codeartifact: stream asset uploads instead of buffering them as byte[] (#8170) (a3eea94)
• codeartifact: validate repository updates before mutation (#8083) (a6b5f5e)
• codedeploy: answer ApplicationNameRequiredException when applicationName is missing (#7392) (52055b7)
• codedeploy: match any EC2 deployment tag filter (#8040) (b3e5ecc)
• codedeploy: match any on-premises deployment tag filter (#8032) (d09ac7f)
• codedeploy: preserve deployment group creation tags (#8025) (d0d0e0e)
• codepipeline: preserve and manage custom action type tags (#8049) (455aa4b), closes #7950
• codepipeline: serialize failure writes with stop publication (#8073) (589e1e5)
• codepipeline: serialize stop publication with completion (#7939) (da5c0d8)
• codepipeline: snapshot actions before concurrent request reads (#7710) (a14dc18)
• codepipeline: synchronize action abandonment with registration (#7634) (cdcb79a)
• cognito: accept the sign-in alias in challenge responses (#8229) (a827dae), closes #8228
• cognito: answer CORS on the OAuth token, revoke and userInfo endpoints (#8027) (013e9b7)
• cognito: expose response headers for allowed browser origins (#8109) (021ce5e)
• cognito: fire PreTokenGeneration for client_credentials tokens (#7891) (43ad134), closes #7792
• cognito: hide unknown users in password authentication (#8005) (#8103) (13ab84e)
• cognito: honour case-insensitive sign-in configuration (#7831) (faf9c4e)
• cognito: name a custom domain's CloudFront distribution like the others (#7486) (86f8434)
• cognito: offer configured providers in managed login (#7518) (5762323)
• cognito: pass the groups' IAM roles to the pre token generation trigger (#8134) (63b8da9), closes #8222
• cognito: refuse a custom domain certificate from another partition or account (#7110) (504c9d2)
• cognito: reject non-integer MaxResults in auth event and WebAuthn listings (#7418) (6386e8f)
• cognito: reject undeclared custom user attributes (#7994) (#8124) (5da8045)
• cognito: report EXTERNAL_PROVIDER status for federated users (#7553) (ad8c358), closes #7545
• cognito: skip the primary recovery attribute as an MFA factor (#7191) (5495c70)
• config: add the recorder arn to its status and filter by Arn (#8142) (6b129de)
• config: check requests against the modeled constraints (#8363) (6de9638)
• config: give the configuration recorder an ARN and keep its tags (#8117) (acdbde8)
• config: keep recording strategy, exclusions and recording mode on configuration recorders (#7178) (c024c83)
• config: validate recorder selector list cardinality (#8269) (c6b41a4)
• controltower: accept the landing zone id as landingZoneIdentifier (#7298) (7f4f237), closes #7295
• controltower: generate IAM routes and request resources (#7872) (ef1e00f)
• controltower: serve tags for landing zones and enabled controls (#7403) (ac0662a)
• core: avoid Podman host-gateway aliases in container builder (#7572) (e9378bb)
• core: reject cross-service REST calls on colliding routes with 404 UnknownOperationException (#7623) (332d2c5)
• core: share URI rewrite workaround with Lambda and Cognito (#7610) (2c49f5e)
• core: work around double decoding on routed hosts (#7559) (a15dfb6)
• cur: check every request against the model's constraints (#8236) (68a5f2a)
• cur: keep report definition tags and serve the tag operations (#8095) (efd8971), closes #7952
• dns: preserve the queried address in UDP replies (#7988) (e5a35d6)
• docker: confirm concurrent container removal (#7412) (58cd1ec)
• docker: create a publishing container on its network off Docker Desktop (#7757) (a3a3efe)
• docker: dispose owned clients with their CDI beans (#7267) (699d472)
• docker: launch an image in Floci's own ECR without the registry base (#8243) (3e02ff9)
• docker: let the compat image reach the Docker socket on native Linux (#7378) (01f64e8)
• docker: rebuild local helpers for daemon platform and recipe (#7222) (7bae152), closes #301
• docker: recommend label=disable, not :z, when SELinux blocks the Podman socket (#7434) (bb6f46c)
• docker: start the Windows binary with or without Docker running (#7166) (2b1d91b)
• duck: forward stop signals through container init (#7371) (7bac1e3)
• dynamodb: accept ExpectedRevisionId NO_POLICY on a table with no resource policy (#8265) (f9eb910)
• dynamodb: apply parenthesized and nested operands in an UpdateExpression (#8215) (8c31942)
• dynamodb: authorize ListTables against its regional collection (#7336) (918c57a)
• dynamodb: check a deeply nested transaction's expressions before its items and name the refused value (#7325) (6c0336b)
• dynamodb: check all PutItem and DeleteItem enums in one list with the table name (#7452) (91f0f5f)
• dynamodb: check BatchGetItem and BatchWriteItem table names, list sizes and enums before the tables (#7650) (07d75c8)
• dynamodb: check ConditionalOperator on Query and Scan (#8023) (4620799)
• dynamodb: check each expression condition in written order, its names and values first (#7870) (6100784)
• dynamodb: check every number in an item request first and read its exponent as a long (#7203) (49edfcb)
• dynamodb: check the arguments of PartiQL set_add, set_delete and list_append (#7737) (5af751c)
• dynamodb: check the condition members of a PutItem or DeleteItem in order inside the validation envelope (#7505) (5080093)
• dynamodb: check the operands of a PartiQL condition function (#7726) (a102cd1)
• dynamodb: drop the table name from the PartiQL missing table error, and treat a CREATING table as missing (#7158) (89ecb59)
• dynamodb: emit INSERT when UpdateItem creates the item (#7432) (e27aa38), closes #7431
• dynamodb: honor OR in legacy Query and Scan filters (#8031) (b954b4f)
• dynamodb: keep index Query/Scan filters to projected attributes (#7922) (cd0c733), closes #7896
• dynamodb: list a missing table name in the older PutItem and DeleteItem checks (#8417) (558453d)
• dynamodb: list every CreateTable constraint error in one message (#7974) (809c003)
• dynamodb: name the partition key in a PartiQL INSERT's own condition (#7381) (4933126)
• dynamodb: parse the whole UpdateExpression before reading names and values (#8190) (38085d1)
• dynamodb: preserve stream sequence order under concurrent writes (#7777) (2b3f316)
• dynamodb: put UpdateItem expression errors in the validation envelope (#7882) (77242aa)
• dynamodb: read a nested PartiQL statement before refusing it (#7788) (755eee6)
• dynamodb: read a PartiQL function call statement before refusing it (#7779) (9ba53ec)
• dynamodb: read a ProjectionExpression with the lexer of the other expressions (#8416) (982b1fb)
• dynamodb: refuse a keyword after a dot in a PartiQL path (#7685) (dba4a4f)
• dynamodb: refuse a nested or repeated key condition attribute before the table lookup (#7883) (2e158f7)
• dynamodb: refuse a null or omitted required SearchVectors member (#8044) (3b4cae7)
• dynamodb: refuse a PartiQL EXISTS outside a transaction right after the syntax check (#7764) (d0b5038)
• dynamodb: refuse a PartiQL function call with the error for its place (#7715) (4296d11)
• dynamodb: refuse a PartiQL read of a multi-attribute key index (#7790) (2ceb668)
• dynamodb: refuse a PartiQL statement that is one term as DynamoDB does (#7068) (a2e12ee)
• dynamodb: refuse a query with more conditions than the key schema has (#7935) (77cb014)
• dynamodb: refuse a repeated section in an UpdateExpression (#8167) (891c0cd)
• dynamodb: refuse a reserved attribute name in written order before the table lookup (#8274) (c5e7c3d)
• dynamodb: refuse an empty attribute name in a TransactWriteItems item, key or value (#7389) (121dc22)
• dynamodb: refuse an ordering comparison or BETWEEN operand with no ordering (#7841) (7748d2b)
• dynamodb: refuse an over-limit UpdateItem statement before the condition (#8076) (67814c5)
• dynamodb: refuse an UpdateExpression operand that reads an absent attribute (#8266) (287c44b)
• dynamodb: refuse bad function calls and operand types in an UpdateExpression (#8195) (410ed8e)
• dynamodb: refuse duplicate set members, empty sets and false NULLs in every item operation (#7255) (e0d199c)
• dynamodb: refuse empty or unused transaction expressions and an unknown ReturnValuesOnConditionCheckFailure (#7319) (b821dcd)
• dynamodb: refuse provisioned capacity above the account and table quotas (#8156) (ef785e3)
• dynamodb: refuse transaction requests whose members break their constraints (#7279) (cf582c2)
• dynamodb: refuse unconvertible and out-of-range PartiQL number parameters before parsing the statement (#7179) (664db0c)
• dynamodb: refuse unknown characters and unclosed quotes in PartiQL, and accept $ in names (#7154) (cf17be9)
• dynamodb: reject malformed nested attribute values before writes (#8121) (e1cd3e3)
• dynamodb: remove several list indexes against the original list (#7989) (3a5610d), closes #7971
• dynamodb: report correct WarmThroughput for tables (#7648) (282b53c), closes #7114
• dynamodb: report the token and the text near a condition syntax error (#7360) (b0721f9)
• dynamodb: report too few PartiQL parameters in statement order (#7760) (767f50e)
• dynamodb: report WarmThroughput on each global secondary index (#7120) (2eb75ee)
• dynamodb: resume a Query after the ExclusiveStartKey position, whether or not an item has that key (#8021) (29253ff), closes #7970
• dynamodb: use the older check order and wording for a PutItem or DeleteItem without Item or Key or nested too deep (#7480) (e105843)
• dynamodb: use the older check order and wording for an UpdateItem without Key or nested too deep (#7608) (ddfc63f)
• dynamodb: validate update attribute values (#8145) (0924e6a)
• ec2: apply DescribeIpamPools filters (#7039) (759b6d1)
• ec2: expand Graviton instance type metadata (#7501) (71e8725), closes floci-io/floci#7500
• ec2: give back the VPC network leases of a NAT gateway's addresses (#7581) (1a44e72)
• ec2: give privileged systemd guests a private cgroup namespace (#7353) (639fbe3)
• ec2: honor CopyImageTags on CopyImage (#7097) (d173d65)
• ec2: honor CreateRoute DryRun before mutation (#7424) (dddc0b8)
• ec2: honor network interface selectors in AssociateAddress (#7506) (ee78a41)
• ec2: honour DryRun on the instance start, stop, reboot and terminate calls (#8252) (fa9190e)
• ec2: honour DryRun on the rest of the instance calls (#8289) (c407c82)
• ec2: honour DryRun on the volume and tag calls (#8244) (3ae36eb)
• ec2: implement filters for DescribeVpcEndpointServices (#7261) (e42f97d), closes #6958
• ec2: include processor manufacturer metadata (#7517) (3b8c524), closes floci-io/floci#7516
• ec2: include r5.large in the instance type catalog (#7146) (f77d032), closes #234
• ec2: keep a flow log's CloudWatch log group and default its destination type (#7197) (3e0d8d6)
• ec2: keep each instance in the reservation of its RunInstances call (#8257) (486f0e4), closes #8255
• ec2: keep guest port 80 available with IMDS (#8225) (045ecc4), closes #7937
• ec2: keep IPAM pool and allocation tags (#8158) (66bec3b)
• ec2: keep security group rule description updates consistent (#8277) (ae62fe0)
• ec2: leave the volume helper's bind directory to Docker in a container (#8245) (392d79e)
• ec2: let only the latest service-network lookup publish its address (#7583) (a613d7b), closes #7582
• ec2: make CreateVolume idempotent on its client token (#8301) (2337c34)
• ec2: name launch template network interface groups groupId on the wire (#7138) (5205565)
• ec2: offer i4i.large in the instance type catalog (#7824) (3700a6b)
• ec2: paginate instance type offerings (#7861) (fb4d825)
• ec2: preserve security group deletion scope and dependencies (#7920) (1820d64)
• ec2: propagate transit gateway attachments to the default propagation route table (#7060) (3b4a2ec)
• ec2: report block-device attachment failures (#7690) (a99119e)
• ec2: report NAT gateways as zonal and honor PrivateIpAddress (#7059) (dcf8ec7), closes #6767
• ec2: resolve interface identity for tag authorization (#8352) (16745c3)
• ec2: retain instance account and region during start (#7713) (62de6a7), closes AndreKurait/floci#547
• ec2: return modeled authentication error envelopes (#7613) (d34c844)
• ec2: select the subnet VPC default security group (#7762) (0687407), closes AndreKurait/floci#524
• ec2: serialize VPC deletion with Docker network creation (#7470) (d481f83)
• ec2: serve placement/availability-zone-id from instance metadata (#8405) (2fa6deb)
• ec2: set the link-local IMDS endpoint up again when an instance starts (#6873) (e3cdb72)
• ec2: support NAT gateway secondary addresses (#7327) (fbfe904)
• ec2: use EC2 envelopes for token and signature errors (#7640) (81ff586)
• ec2: validate launch template selectors and honor dry runs (#7497) (7b4e568)
• ec2: word an AMI and instance type architecture mismatch as RunInstances does (#8403) (246d82e)
• ecr: follow the registry when deleting the last repository replaces it (#7224) (38eb938)
• ecr: paginate repository descriptions (#7711) (d6aed93)
• ecr: prevent registry request stalls during background garbage collection (#7437) (a1f5b9b), closes #6150
• ecr: pull rewritten ECR images from an address Docker Desktop reaches (#7752) (fd8be9a)
• ecr: replace a backing registry left on another Docker network (#7544) (4e7d4a1)
• ecr: validate lifecycle policy documents before mutation (#7611) (f719d6a)
• ecr: wait for backing registry HTTP readiness (#7993) (b819568), closes #7700
• ecs: check ECS requests on the resources they name, from the generated request resources (#8341) (6305250)
• ecs: close an ECS Exec stream that attaches after the client has left (#7530) (e0b8da1)
• ecs: give an awsvpc task the address it reports (#7645) (2df2a1e), closes #7639
• ecs: pass awsfirelens logConfiguration secretOptions to the log router output (#8303) (16cb752)
• ecs: preserve requested service platform version (#7997) (#8125) (021e580)
• ecs: return RunTask before the task's images are pulled (#7753) (c4b22b2), closes #7670
• ecs: roll a load-balanced service healthy-first and drain the old task before stopping it (#8256) (a56739c)
• ecs: stop siblings when an essential container exits (#8321) (4649d6c)
• efs: keep IpAddressType and Ipv6Address on CreateMountTarget and require SubnetId (#8169) (9f9b116)
• efs: paginate access points and resource tags (#7538) (6e16b80)
• eks: allow a cluster name in more than one Region of an account (#8140) (55b2fb7), closes #7936 #7966
• eks: keep a cluster in CREATING until k3s has deployed its addons (#8283) (fdb4a81)
• eks: keep a cluster's API server port when its container is recreated (#8343) (acd884a)
• eks: lease stable VPC private IP and pass --node-ip to k3s across restarts (#7980) (7ade98e)
• eks: let guest kubelet own worker node registration (#7420) (f22d040), closes floci-io/floci#7419
• eks: page ListClusters with maxResults and nextToken (#7769) (ac39d83), closes #7625
• eks: populate cluster request IAM conditions (#8336) (259a073)
• eks: reclaim anonymous volumes during node teardown (#7458) (bc31464)
• eks: record a node's container address so ELB instance targets reach it (#8334) (0b19c15)
• eks: scope clusters to the request Region (#7936) (00d2ab3)
• eks: share a cluster node's mounts so CSI drivers can mount volumes (#8207) (25811dd)
• eks: tag node groups, Fargate profiles, add-ons, pod identity associations and access entries by ARN (#7113) (0a4cd51)
• elasticache: enforce IAM auth engine version, TLS, and user constraints (#6502) (886f626), closes #4502
• elasticache: keep requested EngineVersion and AutoMinorVersionUpgrade (#7177) (a712e51)
• elasticache: provision the built-in default user per account (#7136) (28b9dc6)
• elasticache: scope Describe listings to the request Region (#7946) (c769ce0)
• elb: assign the VPC default security group to a Classic load balancer created without one (#7100) (cb093f8)
• elbv2: accept request headers up to 64 KB as AWS does (#7115) (8c475d6)
• elbv2: add X-Amzn-Trace-Id to requests forwarded to targets (#7280) (7232153)
• elbv2: add X-Forwarded headers to ALB requests as AWS does (#7278) (5d8546a)
• elbv2: default omitted HTTPS listener SSL policies (#7579) (cf25c9f)
• elbv2: fail DescribeRules with RuleNotFound for an unknown rule ARN (#7492) (f8408ae)

...and 265 more in this section.

GitHub caps a release description at 125000 characters, so this list is shortened. Every change is in CHANGELOG.md.