bug fixes: backend services patches - Implemented and deployed systemd-backed AMIs

docs/services/ec2.md

@@ -26,14 +26,16 @@ metadata.
 | AMI ID | Aliases | Docker image |
 |---|---|---|
 | `ami-0abcdef1234567890` | `ami-amazonlinux2` | `public.ecr.aws/amazonlinux/amazonlinux:2` |
-| `ami-0abcdef1234567891` | `ami-amazonlinux2023` | `public.ecr.aws/amazonlinux/amazonlinux:2023` |
-| `ami-0abcdef1234567892` | `ami-ubuntu2004` | `public.ecr.aws/docker/library/ubuntu:20.04` |
+| `ami-0abcdef1234567891` | `ami-amazonlinux2023` | `floci/ami-amazonlinux:2023` |
+| `ami-0abcdef1234567892` | `ami-ubuntu2004` | `floci/ami-ubuntu:20.04` |
 | `ami-ubuntu2204` | | `public.ecr.aws/docker/library/ubuntu:22.04` |
 | `ami-ubuntu2404-arm64` | `ami-ubuntu2404` | `public.ecr.aws/docker/library/ubuntu:24.04` |
 | `ami-ubuntu2404-amd64` | | `public.ecr.aws/docker/library/ubuntu:24.04` |
 | `ami-ubuntu2404-cloud-arm64` | `ami-ubuntu2404-cloud` | `floci/ami-ubuntu:24.04-arm64` |
 | `ami-debian12` | | `public.ecr.aws/docker/library/debian:12` |
+| `ami-debian13` | | `floci/ami-debian:13` |
 | `ami-alpine` | | `public.ecr.aws/docker/library/alpine:latest` |
+| `ami-fedora42` | | `floci/ami-fedora:42` |
 | `ami-0abcdef1234567893` | | `public.ecr.aws/amazonlinux/amazonlinux:2023` |
 
 Any unrecognized AMI ID (including real AWS AMI IDs like `ami-0abc12345678`) falls back to the catalog `defaultDockerImage` (`public.ecr.aws/amazonlinux/amazonlinux:2023` by default).

docs/services/index.md

@@ -65,6 +65,7 @@ Operation counts are exact. For dispatch-table services (Query and JSON 1.1) eac
 | [RDS Data API](rds-data.md) | `/Execute`, `/BeginTransaction`, `/CommitTransaction`, `/RollbackTransaction` | REST JSON | 4 |
 | [Timestream for InfluxDB](timestream-influxdb.md) | `POST /` + `X-Amz-Target: AmazonTimestreamInfluxDB.*` + InfluxDB container | JSON 1.0 + InfluxDB HTTP | 24 |
 | [MSK](msk.md) | `/v1/clusters/...`, `/api/v2/clusters/...` + Redpanda broker | REST JSON + Kafka | 8 |
+| [MSK Connect](kafka-connect.md) | `/v1/custom-plugins`, `/v1/connectors`, `/v1/worker-configurations` + Kafka Connect worker | REST JSON + Kafka Connect | 13 |
 | [Amazon MQ](amazonmq.md) | `/v1/brokers/...` + RabbitMQ broker | REST JSON + AMQP | 5 |
 | [MWAA](mwaa.md) | `/` REST paths for environments + CLI/web proxy | REST JSON | 10 |
 | [Athena](athena.md) | `POST /` + `X-Amz-Target: AmazonAthena.*` | JSON 1.1 | 4 |

docs/services/kafka-connect.md

@@ -0,0 +1,45 @@
+# MSK Connect
+
+**Protocol:** REST JSON
+**Signing name:** `kafkaconnect`
+
+Floci implements the MSK Connect control plane separately from MSK. Custom plugins are ZIP
+archives stored in Floci S3. A connector starts a pinned stock Apache Kafka Connect worker, extracts
+the referenced ZIP, and mounts only that extracted plugin directory into the worker.
+
+## Supported Actions
+
+| Action | Description |
+|---|---|
+| `CreateCustomPlugin` | Register a ZIP custom plugin from an S3 bucket ARN and key |
+| `ListCustomPlugins` | List custom plugins |
+| `DescribeCustomPlugin` | Describe a custom plugin |
+| `DeleteCustomPlugin` | Delete a custom plugin |
+| `CreateWorkerConfiguration` | Create a worker properties configuration |
+| `ListWorkerConfigurations` | List worker configurations |
+| `DescribeWorkerConfiguration` | Describe a worker configuration |
+| `DeleteWorkerConfiguration` | Delete a worker configuration |
+| `CreateConnector` | Start a connector using a custom plugin |
+| `ListConnectors` | List connectors |
+| `DescribeConnector` | Describe a connector |
+| `UpdateConnector` | Update connector configuration |
+| `DeleteConnector` | Stop and delete a connector |
+
+## Worker behavior
+
+Workers use the internal Redpanda address of a Floci-managed MSK cluster. The public bootstrap
+address supplied to `CreateConnector` is resolved to that cluster but is never passed into the
+container. This keeps the worker on Floci's Docker network while host clients continue using the
+public MSK bootstrap endpoint.
+
+No connector plugin is bundled. To run an S3 sink, upload a compatible S3 sink connector ZIP to
+Floci S3, create a custom plugin for it, and use that plugin in `CreateConnector`. The worker's
+container logs are streamed to CloudWatch Logs under `/aws/msk-connect/{connectorName}`.
+
+## Configuration
+
+| Variable | Default | Description |
+|---|---|---|
+| `FLOCI_SERVICES_KAFKACONNECT_ENABLED` | `true` | Enable or disable MSK Connect |
+| `FLOCI_SERVICES_KAFKACONNECT_MOCK` | `false` | Persist control-plane metadata without starting workers |
+| `FLOCI_SERVICES_KAFKACONNECT_WORKER_IMAGE` | `apache/kafka:3.9.0` | Pinned stock Kafka Connect worker image |

docs/services/kinesis.md

@@ -91,6 +91,15 @@ TPS over 10 will trigger the LimitExceededException"), independent of the ten-ca
 limit above. Floci does not simulate real-time request throttling for this or any other
 action, so that limit is intentionally unenforced here.
 
+## Current Limitations
+
+- `ListStreams`, `ListShards`, `ListTagsForStream`, and `ListStreamConsumers` do not yet
+  support AWS pagination tokens. `ListShards` honors `MaxResults`, but does not return a
+  continuation token.
+- Resource policy actions are not implemented.
+- KMS encryption settings are recorded in stream metadata, but record payloads are not
+  cryptographically encrypted.
+
 ## Configuration
 
 | Variable | Default | Description |