fix(ses): sign in to the SMTP relay with the password, not as an OAuth token

Vert.x mail prefers XOAUTH2 whenever the server offers it, so against Gmail the
app password was sent as an OAuth token and refused (535 5.7.8). Limit the
relay to the password-based SASL methods.

README.md

@@ -203,7 +203,7 @@ Run AWS-compatible services locally without an AWS account, auth token, or paid
 <details>
 <summary><strong>Real Docker where fidelity matters</strong></summary>
 
-Lambda, RDS, Neptune, ElastiCache, MSK, ECS, EC2, EKS, OpenSearch, CodeBuild, and Managed Service for Apache Flink use real Docker-backed execution instead of shallow mocks.
+Lambda, RDS, Neptune, ElastiCache, MSK, MSK Connect, ECS, EC2, EKS, OpenSearch, CodeBuild, and Managed Service for Apache Flink use real Docker-backed execution instead of shallow mocks.
 
 </details>
 
@@ -244,7 +244,7 @@ LocalStack's community edition [sunset in March 2026](https://blog.localstack.cl
 | License | MIT | Restricted |
 | API Gateway v2 / HTTP API | Yes | No |
 | Cognito | Yes | No |
-| RDS, ElastiCache, MSK | Real Docker | No |
+| RDS, ElastiCache, MSK, MSK Connect | Real Docker | No |
 | Neptune (graph DB + Gremlin WebSocket) | Real Docker | No |
 | DocumentDB (MongoDB-compatible) | Real Docker | No |
 | ECS, EC2, EKS | Real Docker | No |
@@ -298,7 +298,7 @@ Floci supports local emulation for application services, data services, eventing
 | Containers and compute | ECS, EC2, Lightsail, EKS, MWAA, ECR, EFS, CodeBuild, CodeDeploy, CodePipeline, CodeGuru Reviewer, CodeArtifact, AWS Batch, Auto Scaling, Application Auto Scaling, Elastic Beanstalk, ELB v2, ELB Classic |
 | Data, analytics, and AI | Athena, Glue, Lake Formation, EMR, EMR Serverless, Redshift, Redshift Data API, Firehose, Managed Service for Apache Flink, OpenSearch, S3 Tables, S3 Vectors, Textract, Transcribe, Comprehend, Rekognition, Translate, Bedrock, Bedrock Runtime, Bedrock AgentCore, Bedrock AgentCore Control, SageMaker |
 | Databases and caching | RDS, RDS Data API, Neptune, DocumentDB, DMS, MemoryDB, ElastiCache, Timestream for InfluxDB |
-| Messaging and transfer | SES, Kinesis, MSK, Amazon MQ, Transfer Family, DataSync, IoT Core, Amazon Connect, Amazon AppIntegrations |
+| Messaging and transfer | SES, Kinesis, MSK, MSK Connect, Amazon MQ, Transfer Family, DataSync, IoT Core, Amazon Connect, Amazon AppIntegrations |
 | Security and governance | AWS Network Firewall, AWS RAM, Service Quotas, WAF v2, GuardDuty, Amazon Inspector, CloudTrail, CloudFront, Resource Groups Tagging API, Resource Explorer 2, CloudHSM v2, Organizations, AWS Account Management, IAM Access Analyzer, IAM Identity Center (SSO Admin, OIDC, Access Portal, SCIM), Identity Store, Amazon Macie, Amazon Detective, Security Hub, Amazon Verified Permissions, Control Catalog, Control Tower, Service Catalog, AWS Marketplace |
 | Cost and billing | AWS Budgets, Pricing, Cost Explorer, Cost and Usage Reports, BCM Pricing Calculator, BCM Data Exports |
 | Resilience, backup, and config | AWS FIS, AWS Backup, AWS Config, AppConfig, AppConfigData, CloudFormation, Cloud Control API |
@@ -342,6 +342,7 @@ For operation-level compatibility, see the [Services Overview](https://floci.io/
 | Neptune | Real Docker | Graph DB via TinkerPop Gremlin Server (default) or Neo4j for openCypher/Bolt (`NEPTUNE_DB_TYPE`); RDS-shaped control plane; SigV4 proxy on port 8182 |
 | DocumentDB | Real Docker, mock mode available | MongoDB-compatible cluster via real MongoDB containers; RDS-shaped control plane; MongoDB wire protocol on port 27017 |
 | MSK | Real Docker | Kafka-compatible broker via Redpanda |
+| MSK Connect | Real Docker | Stock Kafka Connect workers with S3 custom plugin ZIPs |
 | Amazon MQ | Real Docker | RabbitMQ broker via rabbitmq:3-management; AMQP + management console |
 | Athena | In-process with DuckDB sidecar | Real SQL execution over S3 and Glue-backed views |
 | Glue | In-process | Data Catalog, Schema Registry, tables consumed by Athena |

compatibility-tests/sdk-test-java/src/test/java/com/floci/test/CloudWatchMetricMathAlarmTest.java

@@ -0,0 +1,117 @@
+package com.floci.test;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import software.amazon.awssdk.services.cloudwatch.CloudWatchClient;
+import software.amazon.awssdk.services.cloudwatch.model.ComparisonOperator;
+import software.amazon.awssdk.services.cloudwatch.model.Dimension;
+import software.amazon.awssdk.services.cloudwatch.model.Metric;
+import software.amazon.awssdk.services.cloudwatch.model.MetricAlarm;
+import software.amazon.awssdk.services.cloudwatch.model.MetricDataQuery;
+import software.amazon.awssdk.services.cloudwatch.model.MetricStat;
+import software.amazon.awssdk.services.cloudwatch.model.StandardUnit;
+import software.amazon.awssdk.services.cloudwatch.model.Statistic;
+
+import java.util.List;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+@DisplayName("CloudWatch - Metric-math alarm definitions")
+class CloudWatchMetricMathAlarmTest {
+
+    private CloudWatchClient cloudWatch;
+    private String alarmName;
+
+    @BeforeEach
+    void setup() {
+        cloudWatch = TestFixtures.cloudWatchClient();
+        alarmName = TestFixtures.uniqueName("sdk-metric-math-alarm");
+    }
+
+    @AfterEach
+    void cleanup() {
+        try {
+            cloudWatch.deleteAlarms(request -> request.alarmNames(alarmName));
+        } finally {
+            cloudWatch.close();
+        }
+    }
+
+    @Test
+    void metricsRoundTripWithoutInventingSingleMetricFields() {
+        List<MetricDataQuery> metrics = metrics();
+        putMathAlarm(metrics);
+        assertMathAlarm(metrics);
+    }
+
+    @Test
+    void updatesReplaceQueriesAndSwitchBackToASingleMetric() {
+        putSingleMetricAlarm(300);
+        List<MetricDataQuery> original = metrics();
+        putMathAlarm(original);
+        assertMathAlarm(original);
+
+        List<MetricDataQuery> replacement = List.of(
+                original.get(0).toBuilder().expression("errors / requests").label("Ratio").build(),
+                original.get(1), original.get(2));
+        putMathAlarm(replacement);
+        assertMathAlarm(replacement);
+
+        putSingleMetricAlarm(120);
+        MetricAlarm alarm = describe();
+        assertThat(alarm.hasMetrics()).isFalse();
+        assertThat(alarm.period()).isEqualTo(120);
+        assertThat(alarm.metricName()).isEqualTo("5xx");
+        assertThat(alarm.namespace()).isEqualTo("AWS/ApiGateway");
+    }
+
+    private void putMathAlarm(List<MetricDataQuery> metrics) {
+        cloudWatch.putMetricAlarm(request -> request.alarmName(alarmName)
+                .comparisonOperator(ComparisonOperator.GREATER_THAN_THRESHOLD)
+                .evaluationPeriods(2).threshold(5.0).metrics(metrics));
+    }
+
+    private void putSingleMetricAlarm(int period) {
+        cloudWatch.putMetricAlarm(request -> request.alarmName(alarmName)
+                .comparisonOperator(ComparisonOperator.GREATER_THAN_THRESHOLD)
+                .evaluationPeriods(2).threshold(5.0).namespace("AWS/ApiGateway")
+                .metricName("5xx").statistic(Statistic.SUM).period(period));
+    }
+
+    private MetricAlarm describe() {
+        List<MetricAlarm> alarms = cloudWatch.describeAlarms(request -> request.alarmNames(alarmName)).metricAlarms();
+        assertThat(alarms).hasSize(1);
+        return alarms.get(0);
+    }
+
+    private void assertMathAlarm(List<MetricDataQuery> metrics) {
+        MetricAlarm alarm = describe();
+        assertThat(alarm.metrics()).containsExactlyElementsOf(metrics);
+        assertThat(alarm.period()).isNull();
+        assertThat(alarm.metricName()).isNull();
+        assertThat(alarm.namespace()).isNull();
+        assertThat(alarm.statistic()).isNull();
+        assertThat(alarm.extendedStatistic()).isNull();
+        assertThat(alarm.unit()).isNull();
+        assertThat(alarm.hasDimensions()).isFalse();
+        assertThat(alarm.evaluationPeriods()).isEqualTo(2);
+        assertThat(alarm.threshold()).isEqualTo(5.0);
+    }
+
+    private static List<MetricDataQuery> metrics() {
+        return List.of(
+                MetricDataQuery.builder().id("rate").expression("100 * errors / requests")
+                        .returnData(true).period(300).label("Error <rate> & requests").build(),
+                MetricDataQuery.builder().id("errors").returnData(false).accountId("123456789012")
+                        .metricStat(MetricStat.builder().period(300).stat("Sum").unit(StandardUnit.COUNT)
+                                .metric(Metric.builder().namespace("AWS/ApiGateway").metricName("5xx")
+                                        .dimensions(Dimension.builder().name("ApiName").value("api<&>").build())
+                                        .build()).build()).build(),
+                MetricDataQuery.builder().id("requests").returnData(false)
+                        .metricStat(MetricStat.builder().period(300).stat("Sum")
+                                .metric(Metric.builder().namespace("AWS/ApiGateway").metricName("Count").build())
+                                .build()).build());
+    }
+}

compatibility-tests/sdk-test-java/src/test/java/com/floci/test/CloudWatchTest.java

@@ -6,6 +6,7 @@ import software.amazon.awssdk.services.cloudwatch.model.*;
 
 import java.time.Instant;
 import java.time.temporal.ChronoUnit;
+import java.util.Map;
 
 import static org.assertj.core.api.Assertions.*;
 
@@ -185,4 +186,67 @@ class CloudWatchTest {
         );
         assertThat(noMatch.datapoints()).isEmpty();
     }
+
+    @Test
+    @DisplayName("PutMetricData stores datums nested under EntityMetricData")
+    void testPutMetricDataWithEntityMetricData() {
+        String namespace = "JavaTestEntityMetricData";
+        Instant now = Instant.now();
+
+        cloudWatchClient.putMetricData(request -> request
+                .namespace(namespace)
+                .metricData(datum -> datum
+                        .metricName("TopLevel")
+                        .value(1.0)
+                        .timestamp(now))
+                .entityMetricData(entityMetricData -> entityMetricData
+                        .entity(entity -> entity
+                                .keyAttributes(Map.of(
+                                        "Type", "AWS::Resource",
+                                        "ResourceType", "AWS::EC2::Instance",
+                                        "Identifier", "i-0123456789abcdef0")))
+                        .metricData(MetricDatum.builder()
+                                .metricName("mem_used_percent")
+                                .value(6.5)
+                                .unit(StandardUnit.PERCENT)
+                                .storageResolution(60)
+                                .timestamp(now)
+                                .dimensions(Dimension.builder().name("host").value("h1").build())
+                                .build()))
+                .strictEntityValidation(false)
+        );
+
+        ListMetricsResponse listed = cloudWatchClient.listMetrics(request -> request.namespace(namespace));
+        assertThat(listed.metrics())
+                .extracting(Metric::metricName)
+                .containsExactlyInAnyOrder("TopLevel", "mem_used_percent");
+
+        GetMetricStatisticsResponse stats = cloudWatchClient.getMetricStatistics(request -> request
+                .namespace(namespace)
+                .metricName("mem_used_percent")
+                .dimensions(Dimension.builder().name("host").value("h1").build())
+                .startTime(now.minus(1, ChronoUnit.HOURS))
+                .endTime(now.plus(1, ChronoUnit.MINUTES))
+                .period(3600)
+                .statistics(Statistic.SUM)
+        );
+        assertThat(stats.datapoints()).hasSize(1);
+        assertThat(stats.datapoints().get(0).sum()).isEqualTo(6.5);
+    }
+
+    @Test
+    @DisplayName("PutMetricData without MetricName throws MissingRequiredParameterException")
+    void testPutMetricDataWithoutMetricNameIsRejected() {
+        String namespace = "JavaTestMissingMetricName";
+
+        assertThatThrownBy(() -> cloudWatchClient.putMetricData(request -> request
+                .namespace(namespace)
+                .entityMetricData(entityMetricData -> entityMetricData
+                        .metricData(MetricDatum.builder().value(1.0).build()))))
+                .isInstanceOf(MissingRequiredParameterException.class)
+                .satisfies(e -> assertThat(((MissingRequiredParameterException) e).awsErrorDetails().errorCode())
+                        .isEqualTo("MissingParameter"));
+
+        assertThat(cloudWatchClient.listMetrics(request -> request.namespace(namespace)).metrics()).isEmpty();
+    }
 }

compatibility-tests/sdk-test-python/tests/test_cloudwatch.py

@@ -203,6 +203,8 @@ class TestCloudWatchAlarms:
 
             alarm = next(a for a in alarms if a["AlarmName"] == alarm_name)
             assert alarm["StateValue"] == "INSUFFICIENT_DATA"
+            assert response["CompositeAlarms"] == []
+            assert response["LogAlarms"] == []
         finally:
             cloudwatch_client.delete_alarms(AlarmNames=[alarm_name])
 

docker-compose.yml

@@ -12,6 +12,11 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./data:/app/data
+    # Optional SES SMTP relay settings (FLOCI_SERVICES_SES_SMTP_*), kept outside the repo
+    # because they hold a password. Without the file, sent emails stay in the SES mailbox.
+    env_file:
+      - path: ${HOME}/.config/thecloud/ses-smtp.env
+        required: false
     environment:
       FLOCI_SERVICES_DOCKER_NETWORK: floci_default
       FLOCI_SERVICES_RDS_PROXY_BASE_PORT: "7001"

docker/ec2/ami-images/amazonlinux-2023/Dockerfile

@@ -0,0 +1,11 @@
+FROM public.ecr.aws/amazonlinux/amazonlinux:2023
+
+RUN dnf install -y openssh-clients openssh-server systemd \
+    && dnf clean all \
+    && systemctl enable sshd
+
+COPY motd /etc/motd
+
+ENV container=docker
+STOPSIGNAL SIGRTMIN+3
+CMD ["/sbin/init"]

docker/ec2/ami-images/amazonlinux-2023/README.md

@@ -0,0 +1,10 @@
+# Amazon Linux 2023 EC2 guest
+
+Build the local guest image before launching `ami-0abcdef1234567891`:
+
+```text
+docker build --platform linux/amd64 -t floci/ami-amazonlinux:2023 docker/ec2/ami-images/amazonlinux-2023
+```
+
+The image runs systemd, provides SSH, and uses the Amazon Linux 2023 login banner.
+Allow TCP 80 in an instance security group to have Floci publish an Apache service on an allocated host port.

docker/ec2/ami-images/amazonlinux-2023/motd

@@ -0,0 +1,3 @@
+       __|  __|_  )
+       _|  (     /   Amazon Linux 2023
+      ___|\___|___|

docker/ec2/ami-images/debian-13/Dockerfile

@@ -0,0 +1,22 @@
+FROM docker.io/library/debian:trixie-slim
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        systemd \
+        systemd-sysv \
+        openssh-client \
+        openssh-server \
+        iproute2 \
+        iptables \
+        socat \
+        curl \
+        ca-certificates \
+    && systemctl enable ssh \
+    && printf '#!/bin/sh\nmkdir -p /run/sshd\nexec "$@"\n' > /usr/local/sbin/floci-init \
+    && chmod +x /usr/local/sbin/floci-init \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV container=docker
+STOPSIGNAL SIGRTMIN+3
+ENTRYPOINT ["/usr/local/sbin/floci-init"]
+CMD ["/sbin/init"]

docker/ec2/ami-images/debian-13/README.md

@@ -0,0 +1,10 @@
+# Debian 13 EC2 guest
+
+Build the local guest image before launching `ami-debian13`:
+
+```text
+docker build --platform linux/amd64 -t floci/ami-debian:13 docker/ec2/ami-images/debian-13
+```
+
+The image runs systemd and starts SSH on every EC2 boot. Enable application services with
+`systemctl enable --now <service>` so they restart after `StopInstances` and `StartInstances`.

docker/ec2/ami-images/fedora-42/Dockerfile

@@ -0,0 +1,17 @@
+FROM registry.fedoraproject.org/fedora:42
+
+RUN dnf install -y \
+        systemd \
+        openssh-clients \
+        openssh-server \
+        iproute \
+        iptables \
+        socat \
+        curl \
+        ca-certificates \
+    && dnf clean all \
+    && systemctl enable sshd
+
+ENV container=docker
+STOPSIGNAL SIGRTMIN+3
+CMD ["/sbin/init"]

docker/ec2/ami-images/fedora-42/README.md

@@ -0,0 +1,10 @@
+# Fedora 42 systemd EC2 guest
+
+Build the local guest image before launching `ami-fedora42`:
+
+```text
+docker build --platform linux/amd64 -t floci/ami-fedora:42 docker/ec2/ami-images/fedora-42
+```
+
+The image runs systemd and starts SSH on every EC2 boot. Enable application services with
+`systemctl enable --now <service>` so they restart after `StopInstances` and `StartInstances`.

docker/ec2/ami-images/opensuse-leap-15.6/Dockerfile

@@ -0,0 +1,4 @@
+FROM registry.opensuse.org/opensuse/leap:15.6
+
+RUN zypper --non-interactive install -y openssh iproute2 iptables socat curl ca-certificates \
+    && zypper clean --all

docker/ec2/ami-images/opensuse-leap-15.6/README.md

@@ -0,0 +1,9 @@
+# openSUSE Leap 15.6 EC2 guest
+
+Build the local guest image before launching `ami-opensuse-leap156`:
+
+```text
+docker build --platform linux/amd64 -t floci/ami-opensuse:15.6 docker/ec2/ami-images/opensuse-leap-15.6
+```
+
+The image includes OpenSSH and the EC2 metadata proxy dependencies.

docker/ec2/ami-images/ubuntu-20.04/Dockerfile

@@ -0,0 +1,19 @@
+FROM public.ecr.aws/docker/library/ubuntu:20.04
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        systemd \
+        systemd-sysv \
+        openssh-client \
+        openssh-server \
+        iproute2 \
+        iptables \
+        socat \
+        curl \
+        ca-certificates \
+    && systemctl enable ssh \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV container=docker
+STOPSIGNAL SIGRTMIN+3
+CMD ["/sbin/init"]

docker/ec2/ami-images/ubuntu-20.04/README.md

@@ -0,0 +1,10 @@
+# Ubuntu 20.04 systemd EC2 guest
+
+Build the local guest image before launching `ami-0abcdef1234567892`:
+
+```text
+docker build --platform linux/amd64 -t floci/ami-ubuntu:20.04 docker/ec2/ami-images/ubuntu-20.04
+```
+
+The image runs systemd and starts SSH on every EC2 boot. Enable application services with
+`systemctl enable --now <service>` so they restart after `StopInstances` and `StartInstances`.

docs/services/cloudformation.md

@@ -160,7 +160,7 @@ cross-resource references.
 | Kinesis Data Firehose | `DeliveryStream` |
 | IoT Core | `DomainConfiguration` (`ServerCertificates` resolves to a JSON string), `Policy` (deleted after detaching it from its principals; on AWS the delete fails with `DeleteConflictException` while the policy is attached), `Thing`, `TopicRule` |
 | CloudFront | `CachePolicy`, `Distribution`, `OriginAccessControl`, `OriginRequestPolicy`, `ResponseHeadersPolicy` |
-| CloudWatch | `Alarm`, `Dashboard` |
+| CloudWatch | `Alarm`, `CompositeAlarm`, `Dashboard`. Composite alarms have backing definitions with name Ref and Arn GetAtt, rollback, and replacement cleanup. Composite actions are stored only; suppression properties are rejected. |
 | CloudWatch Logs | `LogGroup`, `LogStream`, `MetricFilter` |
 | WAFv2 | `WebACL` |
 | Config | `ConfigRule` |

docs/services/cloudfront.md

@@ -3,7 +3,8 @@
 CloudFront management-plane and local content-delivery emulation. Supports distribution lifecycle,
 cache policies, origin request policies, response headers policies, origin access controls, origin
 access identities, public keys, trusted key groups, CloudFront Functions, invalidations, tagging, and
-GET/HEAD/OPTIONS delivery from S3 or custom origins.
+viewer delivery from S3 or custom origins for every CloudFront viewer method (GET, HEAD, OPTIONS, POST,
+PUT, PATCH and DELETE).
 
 **Protocol:** REST XML  
 **API version:** `2020-05-31`  
@@ -150,9 +151,17 @@ GET/HEAD/OPTIONS delivery from S3 or custom origins.
 - CNAME aliases are globally unique. `AssociateAlias` atomically transfers an alias from its current
   owner to the target distribution. Exact aliases take precedence over the most-specific matching
   wildcard alias.
-- Viewer GET/HEAD requests, and OPTIONS requests allowed by the matched cache behavior, addressed to
-  an enabled distribution's generated domain or alias are routed to the matching S3 or custom
-  origin. Origin forwarding preserves the raw path; custom-origin redirects are not followed.
+- Viewer requests addressed to an enabled distribution's generated domain or alias are routed to the
+  matching S3 or custom origin when the matched cache behavior's `AllowedMethods` includes the
+  method; any other method returns 403 `Invalid method.`. A behavior without `AllowedMethods` allows
+  GET and HEAD. Origin forwarding preserves the raw path; custom-origin redirects are not followed.
+- POST, PUT, PATCH and DELETE are forwarded to custom origins with the viewer request body and its
+  `Content-Type`. The body is streamed to the origin with the viewer's `Content-Length`, or chunked
+  when the viewer sent it chunked or, as HTTP/2 allows, with no length, so it is never held in
+  memory. Their responses are never cached, as on AWS. Signed URL and signed cookie enforcement
+  applies to them like any other method. Request bodies are bounded by the emulator-wide
+  `floci.protocols.max-request-size` limit (`FLOCI_PROTOCOLS_MAX_REQUEST_SIZE`, 2048 MB by default);
+  CloudFront accepts up to 64 GB, so raise it for larger uploads.
 - Every distribution is also served as `{id}.cloudfront.{host}` for each endpoint host Floci
   resolves: `localhost`, `localhost.floci.io`, `localhost.localstack.cloud`, `FLOCI_HOSTNAME` and
   every `FLOCI_DNS_EXTRA_SUFFIXES` entry. `{id}.cloudfront.localhost.floci.io` and
@@ -160,7 +169,7 @@ GET/HEAD/OPTIONS delivery from S3 or custom origins.
   HTTPS certificate, so a signed URL for either can be downloaded over `https://`. See
   [Downloading over HTTPS](#downloading-over-https).
 - Origin custom headers are persisted through the CloudFront API and CloudFormation. They replace
-  same-named viewer headers on custom-origin GET/HEAD/OPTIONS requests. For in-process S3 origins, a
+  every same-named forwarded viewer header on custom-origin requests. For in-process S3 origins, a
   configured `Origin` header is used for S3 CORS evaluation. AWS-prohibited names, malformed
   values, inconsistent quantities, duplicates, and quota violations are rejected with modeled
   CloudFront errors when the distribution is created or updated.
@@ -181,9 +190,48 @@ GET/HEAD/OPTIONS delivery from S3 or custom origins.
   service-principal bucket-policy grants (including the distribution `AWS:SourceArn`) when strict S3
   authentication is enabled. OAC `always`, `never`, and unsigned `no-override` requests follow their
   documented signing behavior; signed `no-override` viewer requests retain their authorization.
-- Cache-policy, origin-request-policy, and legacy `ForwardedValues` data-plane evaluation is not
-  implemented yet. Viewer query strings therefore follow CloudFront's default behavior and are not
-  forwarded to origins.
+- Requests to custom origins carry what the matched cache behavior forwards. With a cache policy,
+  the viewer headers, cookies and query strings selected by the cache policy's
+  `ParametersInCacheKeyAndForwardedToOrigin` and by the origin request policy are forwarded (the
+  union of both). `HeaderBehavior` `none`, `whitelist`, `allViewer`,
+  `allViewerAndWhitelistCloudFront` and `allExcept`, `CookieBehavior` and `QueryStringBehavior`
+  `none`, `whitelist`, `allExcept` and `all` are evaluated. A cache policy that selects nothing and no
+  origin request policy forwards no viewer headers, cookies or query strings, as on AWS.
+- A cache behavior without a cache policy uses its legacy `ForwardedValues`: `QueryString=true`
+  forwards every query string (`QueryStringCacheKeys` only narrows the cache key), cookies follow
+  `Forward` `none`, `whitelist` (with `*` and `?` wildcards) or `all`, and viewer headers are
+  forwarded by default except `Accept`, `Accept-Charset`, `Accept-Language`, `Authorization`,
+  `Host`, `Referer`, `User-Agent` and `X-HTTP-Method-Override`, which `Headers` can add back (`*`
+  forwards all of them). An origin request policy needs a cache policy on AWS, so a behavior without
+  one ignores it.
+- Whatever the policies, CloudFront sets `Host` to the origin's domain name unless the viewer's
+  `Host` is forwarded, sends `User-Agent: Amazon CloudFront` unless the viewer's `User-Agent` is
+  forwarded, appends the viewer address to `X-Forwarded-For`, adds a
+  `Via: <viewer HTTP version> <distribution domain> (CloudFront)` hop and an `X-Amz-Cf-Id`.
+  `Authorization` is always forwarded on POST, PUT, PATCH and DELETE, and on OPTIONS unless OPTIONS
+  is a cached method; `Content-Type` travels with a request body. Cache policy compression settings
+  normalize `Accept-Encoding` to `br,gzip`, `gzip`, `br` or `identity`. Forwarded cookies are sorted
+  by name, and cookies that are not `name=value` or whose name starts with `$` are dropped.
+  Hop-by-hop headers, `Expect`, `X-Edge-*`, `X-Real-IP`, `X-Forwarded-Proto` and viewer-supplied
+  `CloudFront-*` headers are never forwarded.
+- Of the CloudFront request headers, `CloudFront-Forwarded-Proto`, `CloudFront-Viewer-Address` and
+  `CloudFront-Viewer-Http-Version` are generated when a policy names them, or when an `allExcept`
+  header behavior does not exclude them (AWS documents Managed-AllViewerExceptHostHeader as adding
+  them). Device-type, geolocation, TLS, JA3/JA4 and header-order headers are not generated.
+- The eight AWS managed origin request policies are available by their AWS IDs through
+  `GetOriginRequestPolicy` and `ListOriginRequestPolicies` (`Type` is `managed` or `custom`), and
+  cannot be updated or deleted. AWS managed cache policies are not modeled: a behavior that
+  references one forwards nothing on its account, which matches `CachingDisabled`,
+  `CachingOptimized` and `CachingOptimizedForUncompressedObjects` but not `Amplify`,
+  `Elemental-MediaPackage` or the `UseOriginCacheControlHeaders` policies.
+- In-process S3 origins do not apply forwarding settings: viewer query strings, cookies and headers
+  do not change the S3 read.
+- Origin responses are streamed to the viewer, from in-process S3 origins and custom origins alike,
+  so a large object is never held in memory. A custom origin's `Content-Length` is passed on, and a
+  response it sends chunked stays chunked. Floci does not cache, so it serves objects larger than
+  50 GB the way CloudFront does with caching disabled; with caching enabled, CloudFront refuses them.
+- Origin `Set-Cookie` headers always reach the viewer. With legacy `Forward=none`, AWS strips them
+  from the response; Floci does not.
 - Custom origins that resolve to loopback, private, link-local, carrier-grade NAT, or other non-routable addresses are rejected by default. Development-only private origins must be explicitly allowlisted by exact hostname.
 - Response headers policies validate the AWS configuration shape and are applied after the origin
   response, including CORS preflight fields, origin override behavior, custom headers, security
@@ -339,3 +387,6 @@ as it is.
 - CloudFormation provisioning of custom `AWS::CloudFront::ResponseHeadersPolicy` resources
   (literal custom or managed policy IDs are supported on distributions)
 - Persistent edge caching and global CDN propagation
+- Forwarding POST, PUT, PATCH and DELETE to S3 origins. AWS passes them to S3, which evaluates them
+  against the bucket policy (OAC supports `PUT` and `DELETE`); Floci's in-process S3 origin answers
+  them with 403 `Access Denied`, as S3 does for a request that holds no write grant.

docs/services/cloudwatch.md

@@ -311,6 +311,7 @@ aws logs put-retention-policy \
 | `GetMetricStatistics` | Get metric statistics (Average, Sum, etc.) |
 | `GetMetricData` | Query metrics with math expressions |
 | `PutMetricAlarm` | Create a metric alarm |
+| `PutCompositeAlarm` | Create or update a composite alarm rule |
 | `DescribeAlarms` | List alarms |
 | `DeleteAlarms` | Delete alarms |
 | `SetAlarmState` | Manually set alarm state |
@@ -331,6 +332,31 @@ aws logs put-retention-policy \
 Metric streams are stored as definitions with their `running` or `stopped` state. Floci never
 delivers metrics to the Firehose delivery stream a metric stream names.
 
+Composite alarms support boolean rules over alarm states. Request `AlarmTypes` containing
+`CompositeAlarm` when describing them; the default describes metric alarms. Composite
+action lists are stored but not executed. Action suppression is not implemented and is
+rejected with `ValidationError`.
+
+### SNS alarm actions
+
+State transitions publish to same-account standard SNS topics in `AlarmActions`, `OKActions`, or
+`InsufficientDataActions`, including transitions from `SetAlarmState`. Unchanged states and
+`ActionsEnabled=false` suppress notifications. Scaling action retries remain independent.
+Failures are logged per target without blocking other targets. Notifications include a
+single-metric `Trigger`; durable retries, FIFO topics, and metric-math payloads are not covered.
+
+### Metric-math alarm definitions
+
+`PutMetricAlarm` stores the `Metrics` query definitions and `DescribeAlarms` returns them over
+both JSON and Query protocols. Expressions, labels, `ReturnData`, account IDs, query periods,
+and nested metric statistics (including dimensions and units) survive storage reloads.
+Metric-math alarm responses omit the single-metric fields, including top-level `Period`.
+Updating an alarm replaces its metric definition, so changing between `Metrics` and a single
+metric does not retain the previous definition.
+
+This is management-plane support: the alarm evaluator currently evaluates only single-metric
+alarms, not metric-math expressions. `SetAlarmState` remains available for manual transitions.
+
 ### Examples
 
 ```bash

docs/services/codedeploy.md

@@ -109,8 +109,8 @@ For `computePlatform: ECS`, `CreateDeployment` performs a full blue/green traffi
 3. Runs lifecycle hook Lambdas in order: `BeforeInstall` → (install) → `AfterInstall` → `BeforeAllowTraffic` → (traffic shift) → `AfterAllowTraffic`
 4. **Traffic shift** — atomically updates the ELB v2 listener's default forward rule:
    - `ECSAllAtOnce`: immediately shifts 100% of traffic to the green target group
-   - `ECSCanary*`: shifts the canary percentage first, waits a short interval (capped at 5 s in emulator), then shifts to 100%
-   - `ECSLinear*`: shifts traffic in equal increments (capped at 2 s per step in emulator)
+    - `ECSCanary*`: shifts the canary percentage first, waits the configured interval, then shifts to 100%
+    - `ECSLinear*`: shifts traffic in equal increments at the configured interval
 5. Promotes the green task set to **PRIMARY** on the ECS service and deletes the original blue task set
 6. Marks the deployment `Succeeded`; if any lifecycle hook reports `Failed`, the deployment is marked `Failed`
 

docs/services/cognito.md

@@ -75,9 +75,9 @@ AWS-shaped `/oauth2/authorize` and `/oauth2/idpresponse` endpoints to the config
 OIDC provider, exchanges the returned code, provisions or reconciles the federated user,
 and issues a Cognito authorization code for the registered callback.
 
-Only `ProviderType=OIDC` is supported by this flow. Floci does not provide a built-in hosted
-UI and does not implement social providers such as Google, Facebook, Login with Amazon or
-SignInWithApple.
+Only `ProviderType=OIDC` is supported by this flow. Floci does not implement social providers
+such as Google, Facebook, Login with Amazon or SignInWithApple. The pool's own users sign in on
+the hosted login page instead (see Well-Known And OAuth Endpoints below).
 
 Two deliberate divergences from AWS, both consequences of not calling out to a third
 party:
@@ -280,8 +280,8 @@ up, so an oversized request naming something that does not exist reports the req
 problem rather than `ResourceNotFoundException`, and an update violating both reports them
 in one message with the asset list first.
 
-Branding is presentation for the hosted UI, which Floci does not serve, so it is stored
-and returned rather than rendered. Two divergences follow from that:
+Branding is presentation for the hosted UI. Floci's hosted login page does not apply it, so it
+is stored and returned rather than rendered. Two divergences follow from that:
 
 - **`Settings` is stored opaquely.** AWS validates it against a deep schema, rejecting
   unknown properties with `Invalid settings provided. Validation errors: [{property:
@@ -304,17 +304,40 @@ and returned rather than rendered. Two divergences follow from that:
 | `GET /{userPoolId}/.well-known/jwks.json`            | JSON Web Key Set for JWT validation                              |
 | `GET /cognito-idp/oauth2/authorize`                  | OIDC authorization-code start endpoint                         |
 | `GET /cognito-idp/oauth2/idpresponse`                | OIDC provider callback endpoint                                |
-| `POST /cognito-idp/oauth2/token`                     | OAuth authorization-code and client-credentials token endpoint |
+| `GET, POST /cognito-idp/login`                       | Hosted login page for the pool's own users                     |
+| `GET /cognito-idp/logout`                            | Ends the hosted login session                                  |
+| `POST /cognito-idp/oauth2/token`                     | OAuth authorization-code, refresh-token and client-credentials token endpoint |
 
 The OAuth endpoints support browser-style OIDC authorization-code sign-in as well as the
 emulator-friendly client-credentials flow:
 
-- `GET /cognito-idp/oauth2/authorize` validates the app client and callback, then redirects
-  to the configured provider with an opaque state and nonce.
+- `GET /cognito-idp/oauth2/authorize` validates the app client and callback. With
+  `identity_provider` naming an OIDC provider it redirects there with an opaque state and nonce.
+  Without `identity_provider`, or with `identity_provider=COGNITO`, the pool's own users sign in
+  on the hosted login page; the client must list `COGNITO` in `SupportedIdentityProviders` (the
+  default when none are given).
+- `GET /cognito-idp/login` shows a user name (or email) and password form when the client lists
+  `COGNITO`, and a "Continue with <provider>" button for each of its other
+  `SupportedIdentityProviders`, which starts the federated sign-in above with the same authorize
+  parameters. A correct password
+  redirects to the registered callback with a one-time authorization code and `state`, and starts
+  a one-hour browser session (the `cognito` cookie), so the next authorize request returns a code
+  without the form unless it sends `prompt=login`. Wrong passwords, unknown users and
+  unconfirmed users get the same answer until the password is right. Users with a temporary
+  password, MFA or a pending reset are told so; those steps are not served on the page yet.
+- `GET /cognito-idp/logout?client_id=...&logout_uri=...` ends the session and redirects to
+  `logout_uri`, which must be one of the client's `LogoutURLs`. With `redirect_uri` and
+  `response_type=code` instead, it ends the session and shows the login page again.
+- PKCE: send `code_challenge` with `code_challenge_method=S256` to authorize, and the matching
+  `code_verifier` when redeeming the code. `nonce` is copied into the ID token.
+- Codes from the hosted login and from federated sign-in fire the Pre Token Generation trigger
+  with `triggerSource=TokenGeneration_HostedAuth`, and the hosted login fires Pre and Post
+  Authentication.
 - `GET /cognito-idp/oauth2/idpresponse` consumes the provider state, exchanges the provider
   code and redirects to the registered callback with a one-time Cognito authorization code.
-- `POST /cognito-idp/oauth2/token` redeems that authorization code once, or issues a machine
-  token for `grant_type=client_credentials`.
+- `POST /cognito-idp/oauth2/token` redeems that authorization code once, exchanges a
+  `refresh_token` for new access and ID tokens, or issues a machine token for
+  `grant_type=client_credentials`.
 
 `POST /cognito-idp/oauth2/token` is intentionally emulator-friendly rather than full Cognito parity:
 

docs/services/ec2.md

@@ -26,14 +26,16 @@ metadata.
 | AMI ID | Aliases | Docker image |
 |---|---|---|
 | `ami-0abcdef1234567890` | `ami-amazonlinux2` | `public.ecr.aws/amazonlinux/amazonlinux:2` |
-| `ami-0abcdef1234567891` | `ami-amazonlinux2023` | `public.ecr.aws/amazonlinux/amazonlinux:2023` |
-| `ami-0abcdef1234567892` | `ami-ubuntu2004` | `public.ecr.aws/docker/library/ubuntu:20.04` |
+| `ami-0abcdef1234567891` | `ami-amazonlinux2023` | `floci/ami-amazonlinux:2023` |
+| `ami-0abcdef1234567892` | `ami-ubuntu2004` | `floci/ami-ubuntu:20.04` |
 | `ami-ubuntu2204` | | `public.ecr.aws/docker/library/ubuntu:22.04` |
 | `ami-ubuntu2404-arm64` | `ami-ubuntu2404` | `public.ecr.aws/docker/library/ubuntu:24.04` |
 | `ami-ubuntu2404-amd64` | | `public.ecr.aws/docker/library/ubuntu:24.04` |
 | `ami-ubuntu2404-cloud-arm64` | `ami-ubuntu2404-cloud` | `floci/ami-ubuntu:24.04-arm64` |
 | `ami-debian12` | | `public.ecr.aws/docker/library/debian:12` |
+| `ami-debian13` | | `floci/ami-debian:13` |
 | `ami-alpine` | | `public.ecr.aws/docker/library/alpine:latest` |
+| `ami-fedora42` | | `floci/ami-fedora:42` |
 | `ami-0abcdef1234567893` | | `public.ecr.aws/amazonlinux/amazonlinux:2023` |
 
 Any unrecognized AMI ID (including real AWS AMI IDs like `ami-0abc12345678`) falls back to the catalog `defaultDockerImage` (`public.ecr.aws/amazonlinux/amazonlinux:2023` by default).

docs/services/elb.md

@@ -170,7 +170,17 @@ aws elbv2 delete-target-group \
 | Environment variable | Default | Description |
 |---|---|---|
 | `FLOCI_SERVICES_ELBV2_ENABLED` | `true` | Enable or disable the ELBv2 service |
+| `FLOCI_SERVICES_ELBV2_LISTENER_FORWARDER_IMAGE` | `alpine/socat:1.8.1.3` | Pinned sidecar image that publishes ALB listener ports from a Docker-hosted Floci container. |
 
 ## Listener Ports
 
-Listener sockets bind on the Floci host. Expose any listener ports you need in Docker Compose when Floci itself runs in a container, similar to RDS and ElastiCache proxy ports.
+ALB DNS names default to `name-id.elb.localhost`, which resolves to the host loopback address.
+When Floci runs in Docker, it creates a lifecycle-managed `socat` sidecar per active listener
+port. The sidecar publishes that same port on the host and forwards it to Floci, so no static
+Docker Compose port range is required. A host-port conflict prevents that listener from being
+reachable until the conflict is removed.
+
+Instance targets use their container bridge IP as the primary route. When Floci cannot route to
+that bridge IP, such as Docker Desktop or DinD isolation, it falls back to the instance's existing
+published application port through `host.docker.internal`. This fallback is conditional; direct
+bridge routing remains the normal path whenever it is reachable.

docs/services/index.md

@@ -65,6 +65,7 @@ Operation counts are exact. For dispatch-table services (Query and JSON 1.1) eac
 | [RDS Data API](rds-data.md) | `/Execute`, `/BeginTransaction`, `/CommitTransaction`, `/RollbackTransaction` | REST JSON | 4 |
 | [Timestream for InfluxDB](timestream-influxdb.md) | `POST /` + `X-Amz-Target: AmazonTimestreamInfluxDB.*` + InfluxDB container | JSON 1.0 + InfluxDB HTTP | 24 |
 | [MSK](msk.md) | `/v1/clusters/...`, `/api/v2/clusters/...` + Redpanda broker | REST JSON + Kafka | 8 |
+| [MSK Connect](kafka-connect.md) | `/v1/custom-plugins`, `/v1/connectors`, `/v1/worker-configurations` + Kafka Connect worker | REST JSON + Kafka Connect | 13 |
 | [Amazon MQ](amazonmq.md) | `/v1/brokers/...` + RabbitMQ broker | REST JSON + AMQP | 5 |
 | [MWAA](mwaa.md) | `/` REST paths for environments + CLI/web proxy | REST JSON | 10 |
 | [Athena](athena.md) | `POST /` + `X-Amz-Target: AmazonAthena.*` | JSON 1.1 | 4 |

docs/services/kafka-connect.md

@@ -0,0 +1,45 @@
+# MSK Connect
+
+**Protocol:** REST JSON
+**Signing name:** `kafkaconnect`
+
+Floci implements the MSK Connect control plane separately from MSK. Custom plugins are ZIP
+archives stored in Floci S3. A connector starts a pinned stock Apache Kafka Connect worker, extracts
+the referenced ZIP, and mounts only that extracted plugin directory into the worker.
+
+## Supported Actions
+
+| Action | Description |
+|---|---|
+| `CreateCustomPlugin` | Register a ZIP custom plugin from an S3 bucket ARN and key |
+| `ListCustomPlugins` | List custom plugins |
+| `DescribeCustomPlugin` | Describe a custom plugin |
+| `DeleteCustomPlugin` | Delete a custom plugin |
+| `CreateWorkerConfiguration` | Create a worker properties configuration |
+| `ListWorkerConfigurations` | List worker configurations |
+| `DescribeWorkerConfiguration` | Describe a worker configuration |
+| `DeleteWorkerConfiguration` | Delete a worker configuration |
+| `CreateConnector` | Start a connector using a custom plugin |
+| `ListConnectors` | List connectors |
+| `DescribeConnector` | Describe a connector |
+| `UpdateConnector` | Update connector configuration |
+| `DeleteConnector` | Stop and delete a connector |
+
+## Worker behavior
+
+Workers use the internal Redpanda address of a Floci-managed MSK cluster. The public bootstrap
+address supplied to `CreateConnector` is resolved to that cluster but is never passed into the
+container. This keeps the worker on Floci's Docker network while host clients continue using the
+public MSK bootstrap endpoint.
+
+No connector plugin is bundled. To run an S3 sink, upload a compatible S3 sink connector ZIP to
+Floci S3, create a custom plugin for it, and use that plugin in `CreateConnector`. The worker's
+container logs are streamed to CloudWatch Logs under `/aws/msk-connect/{connectorName}`.
+
+## Configuration
+
+| Variable | Default | Description |
+|---|---|---|
+| `FLOCI_SERVICES_KAFKACONNECT_ENABLED` | `true` | Enable or disable MSK Connect |
+| `FLOCI_SERVICES_KAFKACONNECT_MOCK` | `false` | Persist control-plane metadata without starting workers |
+| `FLOCI_SERVICES_KAFKACONNECT_WORKER_IMAGE` | `apache/kafka:3.9.0` | Pinned stock Kafka Connect worker image |

docs/services/kinesis.md

@@ -91,6 +91,15 @@ TPS over 10 will trigger the LimitExceededException"), independent of the ten-ca
 limit above. Floci does not simulate real-time request throttling for this or any other
 action, so that limit is intentionally unenforced here.
 
+## Current Limitations
+
+- `ListStreams`, `ListShards`, `ListTagsForStream`, and `ListStreamConsumers` do not yet
+  support AWS pagination tokens. `ListShards` honors `MaxResults`, but does not return a
+  continuation token.
+- Resource policy actions are not implemented.
+- KMS encryption settings are recorded in stream metadata, but record payloads are not
+  cryptographically encrypted.
+
 ## Configuration
 
 | Variable | Default | Description |

docs/services/lightsail.md

@@ -16,6 +16,7 @@ The local implementation keeps Lightsail state in Floci storage and is designed
 - Key pairs: create, import, get, list, delete, and download default key pair
 - Discovery: regions, blueprints, bundles, active names, operations, and operations for resource
 - Tags: tag and untag local Lightsail resources
+- Node.js instances: the `nodejs` blueprint uses the multi-architecture `node:24-bookworm` current LTS image, supports the selected SSH key, and persists application state in a named volume at `/opt/lightsail/app`. The volume starts with `releases/<timestamp>` and `current`; the in-container supervisor runs `npm start` from `current`, captures stdout and stderr under `logs/`, restarts crashes with capped exponential backoff, and retains the three newest releases. Application deployment remains SSH/manual in this phase: no deployment API or console workflow is provided.
 
 Read-only list operations for cloud-side Lightsail resource families that are not locally implemented yet return empty AWS-shaped lists. Cloud-only provisioning workflows such as container services, distributions, managed databases, load balancers, buckets, and snapshots are recognized from the AWS Lightsail API model and return an explicit `UnsupportedOperation` error instead of a custom endpoint or non-AWS response shape.
 

docs/services/s3.md

@@ -83,9 +83,10 @@ Static website requests use a bucket website hostname such as
 - index-document resolution for the site root and slash-terminated prefixes
 - `302` redirects that append a slash when an index document exists below a prefix
 - configured error documents and the default website error response
+- `RedirectAllRequestsTo` with a required hostname and optional `HTTP` or `HTTPS` protocol. Website GET and HEAD return a `301` absolute redirect that preserves the request path and query string.
 
 HEAD returns the same status and object metadata as GET without a response body.
-Redirect-all and advanced routing-rule configurations are not implemented.
+Advanced routing-rule configurations are not implemented.
 
 ## Range Reads
 

docs/services/step-functions.md

@@ -48,6 +48,15 @@ changes to `StateMachineName` or `StateMachineType` use replacement semantics.
 
 ## Execution history events
 
+## Execution pagination
+
+`ListExecutions` and `GetExecutionHistory` support `maxResults` from 0 to 1000, with AWS's
+default page size of 100. Both return opaque `nextToken` values bound to the request arguments
+and valid for 24 hours. `ListExecutions` is newest first, ordered by start date and then execution
+ARN. The same-millisecond tie-break is covered by focused unit tests; the live acceptance suite
+does not force identical execution timestamps. `GetExecutionHistory` is ascending by event ID by
+default and supports `reverseOrder`.
+
 `GetExecutionHistory` emits an event family around a Task state's `TaskStateEntered` and
 `TaskStateExited` pair. Which family depends on the resource type.
 

mkdocs.yml

@@ -142,6 +142,7 @@ nav:
     - RDS Data API: services/rds-data.md
     - Timestream for InfluxDB: services/timestream-influxdb.md
     - MSK (Kafka): services/msk.md
+    - MSK Connect: services/kafka-connect.md
     - Amazon MQ: services/amazonmq.md
     - Glue: services/glue.md
     - Lake Formation: services/lakeformation.md

src/main/java/io/github/hectorvent/floci/config/EmulatorConfig.java

@@ -302,6 +302,7 @@ public interface EmulatorConfig {
 
     interface ServiceStorageOverrides {
         SsmStorageConfig ssm();
+        KafkaConnectStorageConfig kafkaconnect();
         SqsStorageConfig sqs();
         S3StorageConfig s3();
         DynamoDbStorageConfig dynamodb();
@@ -365,6 +366,13 @@ public interface EmulatorConfig {
         long flushIntervalMs();
     }
 
+    interface KafkaConnectStorageConfig {
+        Optional<String> mode();
+
+        @WithDefault("5000")
+        long flushIntervalMs();
+    }
+
     interface SqsStorageConfig {
         Optional<String> mode();
     }
@@ -673,6 +681,7 @@ public interface EmulatorConfig {
         ApiGatewayServiceConfig apigateway();
         IamServiceConfig iam();
         MskServiceConfig msk();
+        KafkaConnectServiceConfig kafkaconnect();
         AmazonMqServiceConfig amazonmq();
         KinesisAnalyticsServiceConfig kinesisAnalytics();
         ElastiCacheServiceConfig elasticache();
@@ -1345,6 +1354,19 @@ public interface EmulatorConfig {
         int kafkaHostPortMax();
     }
 
+    interface KafkaConnectServiceConfig {
+        @WithDefault("true")
+        boolean enabled();
+
+        /** Metadata-only mode is useful where Docker is intentionally unavailable. */
+        @WithDefault("false")
+        boolean mock();
+
+        /** Stock Apache Kafka distribution, never a connector-plugin image. */
+        @WithDefault("apache/kafka:3.9.0")
+        String workerImage();
+    }
+
     interface AmazonMqServiceConfig {
         @WithDefault("true")
         boolean enabled();
@@ -2799,6 +2821,10 @@ public interface EmulatorConfig {
 
         @WithDefault("false")
         boolean mock();
+
+        /** Exact image used by the Docker-host listener forwarding sidecar. */
+        @WithDefault("alpine/socat:1.8.1.3")
+        String listenerForwarderImage();
     }
 
     interface EksServiceConfig {

src/main/java/io/github/hectorvent/floci/core/common/ResolvedServiceCatalog.java

@@ -146,6 +146,12 @@ public class ResolvedServiceCatalog {
                         "msk", config.storage().mode(), 5000L, null, ServiceProtocol.REST_JSON,
                         protocols(ServiceProtocol.REST_JSON),
                         Set.of(), Set.of("kafka"), Set.of(), Set.of(io.github.hectorvent.floci.services.msk.MskController.class)),
+                descriptor("kafkaconnect", "kafkaconnect", config.services().kafkaconnect().enabled(), true,
+                        "kafkaconnect", storageMode(config.storage().services().kafkaconnect().mode(), config.storage().mode()),
+                        config.storage().services().kafkaconnect().flushIntervalMs(), null, ServiceProtocol.REST_JSON,
+                        protocols(ServiceProtocol.REST_JSON),
+                        Set.of(), Set.of("kafkaconnect"), Set.of(),
+                        Set.of(io.github.hectorvent.floci.services.kafkaconnect.KafkaConnectController.class)),
                 descriptor("mq", "amazonmq", config.services().amazonmq().enabled(), true,
                         "amazonmq", config.storage().mode(), 5000L, null, ServiceProtocol.REST_JSON,
                         protocols(ServiceProtocol.REST_JSON),

src/main/java/io/github/hectorvent/floci/core/common/SmithyValidationErrors.java

@@ -0,0 +1,97 @@
+package io.github.hectorvent.floci.core.common;
+
+import java.util.List;
+
+/**
+ * The message AWS's Smithy validation layer answers when a request breaks its model's constraints:
+ * "1 validation error detected: a" or "N validation errors detected: a; b", each violation reading
+ * "Value at 'path' failed to satisfy constraint: ...". The wording is Smithy's, shared by every
+ * service built on it; only the error code differs by protocol.
+ */
+public final class SmithyValidationErrors {
+
+    private SmithyValidationErrors() {}
+
+    /**
+     * The message for one or more violations. An empty list is the caller's bug, so it fails rather
+     * than answering "0 validation errors"; check {@code isEmpty()} before throwing.
+     */
+    public static String message(List<String> violations) {
+        if (violations.isEmpty()) {
+            throw new IllegalArgumentException("no violations to report");
+        }
+        String count = violations.size() == 1
+                ? "1 validation error detected: "
+                : violations.size() + " validation errors detected: ";
+        return count + String.join("; ", violations);
+    }
+
+    /** The violation for a required member the request leaves out. */
+    public static String notNull(String path) {
+        return "Value null at '" + path + "' failed to satisfy constraint: Member must not be null";
+    }
+
+    /** The 400 error carrying {@link #message} under the protocol's validation error code. */
+    public static AwsException exception(String errorCode, List<String> violations) {
+        return new AwsException(errorCode, message(violations), 400);
+    }
+
+    public static AwsException exception(String errorCode, String violation) {
+        return exception(errorCode, List.of(violation));
+    }
+
+    /** The code most JSON services use, on both the awsJson and the restJson protocols. */
+    public static AwsException validationException(List<String> violations) {
+        return exception("ValidationException", violations);
+    }
+
+    public static AwsException validationException(String violation) {
+        return validationException(List.of(violation));
+    }
+
+    /** The awsQuery protocol's code. */
+    public static AwsException validationError(List<String> violations) {
+        return exception("ValidationError", violations);
+    }
+
+    public static AwsException validationError(String violation) {
+        return validationError(List.of(violation));
+    }
+
+    /** The code of REST JSON services that model their validation failure as BadRequestException. */
+    public static AwsException badRequest(List<String> violations) {
+        return exception("BadRequestException", violations);
+    }
+
+    public static AwsException badRequest(String violation) {
+        return badRequest(List.of(violation));
+    }
+
+    /** The violation for a number outside {@code min} to {@code max}, or {@code null} for one inside. */
+    public static String outOfRange(String path, long value, long min, long max) {
+        if (value < min) {
+            return "Value '" + value + "' at '" + path + "' failed to satisfy constraint: "
+                    + "Member must have value greater than or equal to " + min;
+        }
+        if (value > max) {
+            return "Value '" + value + "' at '" + path + "' failed to satisfy constraint: "
+                    + "Member must have value less than or equal to " + max;
+        }
+        return null;
+    }
+
+    /** The violation for a value outside its enum, listing the allowed values in the model's order. */
+    public static String notInEnum(String value, String path, List<String> allowed) {
+        return "Value '" + value + "' at '" + path + "' failed to satisfy constraint: "
+                + "Member must satisfy enum value set: " + allowed;
+    }
+
+    /**
+     * The violation for a list holding a value outside its members' enum. The list is checked as a
+     * whole, so the whole list is the offending value and the enum constraint is nested.
+     */
+    public static String notAllInEnum(List<String> values, String path, List<String> allowed) {
+        return "Value '" + values + "' at '" + path + "' failed to satisfy constraint: "
+                + "Member must satisfy constraint: [Member must satisfy enum value set: " + allowed + "]";
+    }
+}

src/main/java/io/github/hectorvent/floci/core/common/docker/ContainerLifecycleManager.java

@@ -110,6 +110,10 @@ public class ContainerLifecycleManager {
         }
     }
 
+    public String refreshImage(String image) {
+        return imageCacheService.refreshImage(image);
+    }
+
     /**
      * Creates a container without starting it. Use {@link #startCreated} to
      * start it after any pre-start setup (e.g. copying files into the
@@ -120,7 +124,7 @@ public class ContainerLifecycleManager {
      */
     public String create(ContainerSpec spec) {
         String resolvedImage = imageCacheService.ensureImageExists(spec.image());
-        return create(spec, resolvedImage, null);
+        return create(spec, resolvedImage, (String) null);
     }
 
     /**
@@ -135,6 +139,35 @@ public class ContainerLifecycleManager {
         return create(spec, resolvedImage, platform);
     }
 
+    public String create(ContainerSpec spec, String platform, ContainerCreationObserver observer) {
+        String resolvedImage = imageCacheService.ensureImageExists(spec.image(), platform,
+                new ImageCacheService.ImagePullObserver() {
+                    @Override
+                    public void started(String imageUri) {
+                        observer.imagePullStarted(imageUri);
+                    }
+
+                    @Override
+                    public void completed(String imageUri) {
+                        observer.imagePullCompleted(imageUri);
+                    }
+                });
+        observer.containerCreationStarted();
+        String containerId = create(spec, resolvedImage, platform);
+        observer.containerCreated(containerId);
+        return containerId;
+    }
+
+    public interface ContainerCreationObserver {
+        default void imagePullStarted(String imageUri) {}
+
+        default void imagePullCompleted(String imageUri) {}
+
+        default void containerCreationStarted() {}
+
+        default void containerCreated(String containerId) {}
+    }
+
     private String create(ContainerSpec spec, String resolvedImage, String platform) {
         String containerId = createWithCaBundle(spec, resolvedImage, platform);
         if (spec.hasNetworkConfiguration()) {

src/main/java/io/github/hectorvent/floci/core/common/docker/CurrentContainerNetworkResolver.java

@@ -5,6 +5,7 @@ import com.github.dockerjava.api.command.InspectContainerResponse;
 import com.github.dockerjava.api.model.ContainerNetwork;
 import com.github.dockerjava.api.model.ExposedPort;
 import com.github.dockerjava.api.model.Ports;
+import io.github.hectorvent.floci.config.EmulatorConfig;
 import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
 import org.jboss.logging.Logger;
@@ -32,14 +33,21 @@ public class CurrentContainerNetworkResolver {
 
     private final DockerClient dockerClient;
     private final ContainerDetector containerDetector;
+    private final EmulatorConfig config;
     private final Map<Integer, Integer> cachedPublishedPorts = new ConcurrentHashMap<>();
 
     private volatile Optional<CurrentContainerNetwork> cachedNetwork;
 
     @Inject
-    public CurrentContainerNetworkResolver(DockerClient dockerClient, ContainerDetector containerDetector) {
+    public CurrentContainerNetworkResolver(DockerClient dockerClient, ContainerDetector containerDetector,
+                                           EmulatorConfig config) {
         this.dockerClient = dockerClient;
         this.containerDetector = containerDetector;
+        this.config = config;
+    }
+
+    public CurrentContainerNetworkResolver(DockerClient dockerClient, ContainerDetector containerDetector) {
+        this(dockerClient, containerDetector, null);
     }
 
     public Optional<String> resolveNetworkName() {
@@ -148,11 +156,21 @@ public class CurrentContainerNetworkResolver {
         }
     }
 
+    /**
+     * Spawned containers join services.docker-network when it is set, so Floci's address on that
+     * network is the one they can reach. Floci can be attached to other networks too (for example
+     * the emulated VPC networks), whose addresses spawned containers cannot route to.
+     */
     private Optional<CurrentContainerNetwork> selectNetwork(Map<String, ContainerNetwork> networks) {
-        return networks.entrySet().stream()
-                .filter(entry -> isUsable(entry.getValue()))
-                .filter(entry -> isUserDefinedNetwork(entry.getKey()))
-                .findFirst()
+        Optional<String> configured = config == null ? Optional.empty()
+                : config.services().dockerNetwork().filter(name -> !name.isBlank());
+        return configured
+                .filter(name -> isUsable(networks.get(name)))
+                .map(name -> Map.entry(name, networks.get(name)))
+                .or(() -> networks.entrySet().stream()
+                        .filter(entry -> isUsable(entry.getValue()))
+                        .filter(entry -> isUserDefinedNetwork(entry.getKey()))
+                        .findFirst())
                 .or(() -> networks.entrySet().stream()
                         .filter(entry -> isUsable(entry.getValue()))
                         .findFirst())

src/main/java/io/github/hectorvent/floci/core/common/docker/PortAllocator.java

@@ -13,6 +13,7 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 import java.util.concurrent.ConcurrentSkipListSet;
+import java.util.function.IntConsumer;
 
 /**
  * Utility for allocating free TCP ports for Docker container port bindings.
@@ -55,6 +56,10 @@ public class PortAllocator {
      * @throws RuntimeException if no free port is available in the range
      */
     public synchronized int allocate(int basePort, int maxPort) {
+        return allocate(basePort, maxPort, ignored -> {});
+    }
+
+    public synchronized int allocate(int basePort, int maxPort, IntConsumer occupiedPortObserver) {
         // One Docker API round-trip per allocation, not one per candidate: the
         // snapshot is only as fresh as the moment allocate() started either way,
         // and this loop runs inside a lock every consumer of the shared
@@ -66,6 +71,7 @@ public class PortAllocator {
                 LOG.debugv("Allocated port {0} from range {1}-{2}", String.valueOf(port), String.valueOf(basePort), String.valueOf(maxPort));
                 return port;
             }
+            occupiedPortObserver.accept(port);
         }
         throw new RuntimeException("No free port available in range " + basePort + "-" + maxPort);
     }

src/main/java/io/github/hectorvent/floci/lifecycle/EmulatorInfoController.java

@@ -6,13 +6,20 @@ import io.github.hectorvent.floci.config.FlociCertificateAuthority;
 import io.github.hectorvent.floci.core.common.ContainerTeardown;
 import io.github.hectorvent.floci.core.common.ContainerTeardowns;
 import io.github.hectorvent.floci.core.common.ServiceRegistry;
+import io.github.hectorvent.floci.services.ec2.Ec2Service;
+import io.github.hectorvent.floci.services.lightsail.LightsailService;
+import io.github.hectorvent.floci.services.lightsail.LightsailContainerManager;
 import io.github.hectorvent.floci.lifecycle.inithook.InitializationHook;
 import jakarta.inject.Inject;
 import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
+import org.jboss.resteasy.reactive.RestForm;
+import org.jboss.resteasy.reactive.multipart.FileUpload;
 import org.jboss.logging.Logger;
 
 import io.github.hectorvent.floci.core.storage.StorageFactory;
@@ -44,15 +51,18 @@ public class EmulatorInfoController {
     private final Instance<ContainerTeardown> containerTeardowns;
     private final FlociCertificateAuthority certificateAuthority;
     private final EmulatorConfig config;
+    private final Ec2Service ec2Service;
+    private final LightsailService lightsailService;
 
     @Inject
     public EmulatorInfoController(ServiceRegistry serviceRegistry,
                                   InitLifecycleState initLifecycleState,
                                   StorageFactory storageFactory,
                                   Instance<Resettable> resettables,
-                                  Instance<ContainerTeardown> containerTeardowns,
-                                  FlociCertificateAuthority certificateAuthority,
-                                  EmulatorConfig config) {
+                                   Instance<ContainerTeardown> containerTeardowns,
+                                   FlociCertificateAuthority certificateAuthority,
+                                   EmulatorConfig config,
+                                    Ec2Service ec2Service, LightsailService lightsailService) {
         this.serviceRegistry = serviceRegistry;
         this.initLifecycleState = initLifecycleState;
         this.storageFactory = storageFactory;
@@ -60,6 +70,8 @@ public class EmulatorInfoController {
         this.containerTeardowns = containerTeardowns;
         this.certificateAuthority = certificateAuthority;
         this.config = config;
+        this.ec2Service = ec2Service;
+        this.lightsailService = lightsailService;
         this.version = resolveVersion();
     }
 
@@ -104,7 +116,41 @@ public class EmulatorInfoController {
     @GET
     @Path("/diagnose")
     public Response diagnose() {
-        return Response.ok(Map.of()).build();
+        return Response.ok(Map.of("ec2", Map.of("instances", ec2Service.diagnosticInstances()))).build();
+    }
+
+    @GET
+    @Path("/diagnostics/lightsail/instances/{instanceName}/host-ports")
+    public Response lightsailHostPorts(@PathParam("instanceName") String instanceName) {
+        return Response.ok(Map.of("mappings", lightsailService.hostPortMappings(config.defaultRegion(), instanceName))).build();
+    }
+
+    @POST
+    @Path("/diagnostics/lightsail/instances/{instanceName}/static-files")
+    @Consumes(MediaType.MULTIPART_FORM_DATA)
+    public Response deployLightsailStaticFiles(@PathParam("instanceName") String instanceName,
+                                                @RestForm("files") List<FileUpload> files) {
+        List<LightsailContainerManager.StaticFile> staticFiles = files == null ? List.of() : files.stream()
+                .map(file -> new LightsailContainerManager.StaticFile(file.fileName(), file.uploadedFile()))
+                .toList();
+        int deployed = lightsailService.deployStaticFiles(config.defaultRegion(), instanceName, staticFiles);
+        return Response.ok(Map.of("status", "deployed", "files", deployed)).build();
+    }
+
+    @POST
+    @Path("/diagnostics/lightsail/instances/{instanceName}/node-application")
+    @Consumes(MediaType.MULTIPART_FORM_DATA)
+    public Response deployLightsailNodeApplication(@PathParam("instanceName") String instanceName,
+                                                    @RestForm("files") List<FileUpload> files,
+                                                    @RestForm("startCommand") String startCommand,
+                                                    @RestForm("port") Integer port) {
+        List<LightsailContainerManager.StaticFile> applicationFiles = files == null ? List.of() : files.stream()
+                .map(file -> new LightsailContainerManager.StaticFile(file.fileName(), file.uploadedFile()))
+                .toList();
+        LightsailContainerManager.NodeDeployment deployment = lightsailService.deployNodeApplication(
+                config.defaultRegion(), instanceName, applicationFiles, startCommand, port == null ? 3000 : port);
+        return Response.ok(Map.of("status", "deployed", "files", deployment.files(), "port", deployment.port(),
+                "releaseId", deployment.releaseId())).build();
     }
 
     @GET

src/main/java/io/github/hectorvent/floci/services/apigateway/ApiGatewayController.java

@@ -43,6 +43,7 @@ import io.github.hectorvent.floci.services.apigatewayv2.model.Route;
 import io.github.hectorvent.floci.services.apigatewayv2.model.RouteResponse;
 import io.github.hectorvent.floci.services.apigatewayv2.model.Stage;
 import io.github.hectorvent.floci.services.apigatewayv2.model.VpcLink;
+import io.smallrye.common.annotation.Blocking;
 import jakarta.inject.Inject;
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.DELETE;
@@ -72,16 +73,25 @@ public class ApiGatewayController {
     private final ApiGatewayV2OpenApiImporter v2OpenApiImporter;
     private final RegionResolver regionResolver;
     private final ObjectMapper objectMapper;
+    private final ApiGatewayExecuteController executeController;
 
     @Inject
     public ApiGatewayController(ApiGatewayService service, ApiGatewayV2Service v2Service,
-                                ApiGatewayV2OpenApiImporter v2OpenApiImporter,
-                                RegionResolver regionResolver, ObjectMapper objectMapper) {
+                                 ApiGatewayV2OpenApiImporter v2OpenApiImporter,
+                                 RegionResolver regionResolver, ObjectMapper objectMapper,
+                                 ApiGatewayExecuteController executeController) {
         this.service = service;
         this.v2Service = v2Service;
         this.v2OpenApiImporter = v2OpenApiImporter;
         this.regionResolver = regionResolver;
         this.objectMapper = objectMapper;
+        this.executeController = executeController;
+    }
+
+    ApiGatewayController(ApiGatewayService service, ApiGatewayV2Service v2Service,
+                         ApiGatewayV2OpenApiImporter v2OpenApiImporter,
+                         RegionResolver regionResolver, ObjectMapper objectMapper) {
+        this(service, v2Service, v2OpenApiImporter, regionResolver, objectMapper, null);
     }
 
     private static final TypeReference<List<Map<String, String>>> PATCH_OPERATIONS =
@@ -129,6 +139,81 @@ public class ApiGatewayController {
 
     // ──────────────────────────── Specific v1 Paths (ORDER MATTERS) ────────────────────────────
 
+    @POST
+    @Path("/restapis/{apiId}/resources/{resourceId}/methods/{httpMethod}")
+    @Blocking
+    public Response testInvokeMethod(@Context HttpHeaders headers,
+                                     @PathParam("apiId") String apiId,
+                                     @PathParam("resourceId") String resourceId,
+                                     @PathParam("httpMethod") String httpMethod,
+                                     String body) {
+        String region = regionResolver.resolveRegion(headers);
+        try {
+            @SuppressWarnings("unchecked")
+            Map<String, Object> request = objectMapper.readValue(body == null ? "{}" : body, Map.class);
+            ApiGatewayExecuteController.TestInvokeRequest testRequest =
+                    new ApiGatewayExecuteController.TestInvokeRequest(
+                            (String) request.get("pathWithQueryString"),
+                            (String) request.get("body"),
+                            stringMap(request.get("headers")),
+                            stringListMap(request.get("multiValueHeaders")),
+                            stringMap(request.get("stageVariables")));
+            ApiGatewayExecuteController.TestInvokeResult result =
+                    executeController.testInvoke(region, apiId, resourceId, httpMethod, testRequest);
+            return Response.ok(toTestInvokeNode(result).toString()).type(MediaType.APPLICATION_JSON).build();
+        } catch (IOException | ClassCastException e) {
+            throw new AwsException("BadRequestException", e.getMessage(), 400);
+        }
+    }
+
+    private Map<String, String> stringMap(Object value) {
+        if (!(value instanceof Map<?, ?> map)) {
+            return Map.of();
+        }
+        Map<String, String> result = new HashMap<>();
+        map.forEach((key, entryValue) -> {
+            if (key instanceof String stringKey && entryValue instanceof String stringValue) {
+                result.put(stringKey, stringValue);
+            }
+        });
+        return result;
+    }
+
+    private Map<String, List<String>> stringListMap(Object value) {
+        if (!(value instanceof Map<?, ?> map)) {
+            return Map.of();
+        }
+        Map<String, List<String>> result = new HashMap<>();
+        map.forEach((key, entryValue) -> {
+            if (key instanceof String stringKey && entryValue instanceof List<?> list) {
+                result.put(stringKey, list.stream().filter(String.class::isInstance).map(String.class::cast).toList());
+            }
+        });
+        return result;
+    }
+
+    private ObjectNode toTestInvokeNode(ApiGatewayExecuteController.TestInvokeResult result) {
+        Response executionResponse = result.response();
+        ObjectNode node = objectMapper.createObjectNode();
+        node.put("status", executionResponse.getStatus());
+        Object entity = executionResponse.getEntity();
+        if (entity != null) {
+            node.put("body", entity instanceof byte[] bytes ? new String(bytes, StandardCharsets.UTF_8) : entity.toString());
+        }
+        ObjectNode responseHeaders = node.putObject("headers");
+        ObjectNode multiValueResponseHeaders = node.putObject("multiValueHeaders");
+        executionResponse.getStringHeaders().forEach((name, values) -> {
+            if (!values.isEmpty()) {
+                responseHeaders.put(name, values.get(values.size() - 1));
+                ArrayNode multiValues = multiValueResponseHeaders.putArray(name);
+                values.forEach(multiValues::add);
+            }
+        });
+        node.put("log", result.log());
+        node.put("latency", result.latency());
+        return node;
+    }
+
     @GET
     @Path("/restapis/{apiId}/resources/{resourceId}/methods/{httpMethod}/responses/{statusCode}")
     public Response getMethodResponse(@Context HttpHeaders headers,
@@ -159,6 +244,21 @@ public class ApiGatewayController {
         }
     }
 
+    @PATCH
+    @Path("/restapis/{apiId}/resources/{resourceId}/methods/{httpMethod}/responses/{statusCode}")
+    public Response updateMethodResponse(@Context HttpHeaders headers,
+                                         @PathParam("apiId") String apiId,
+                                         @PathParam("resourceId") String resourceId,
+                                         @PathParam("httpMethod") String httpMethod,
+                                         @PathParam("statusCode") String statusCode,
+                                         String body) {
+        String region = regionResolver.resolveRegion(headers);
+        List<Map<String, String>> patchOperations = parsePatchOperations(body);
+        MethodResponse response = service.updateMethodResponse(region, apiId, resourceId, httpMethod,
+                statusCode, patchOperations);
+        return Response.ok(toMethodResponseNode(response).toString()).type(MediaType.APPLICATION_JSON).build();
+    }
+
     @DELETE
     @Path("/restapis/{apiId}/resources/{resourceId}/methods/{httpMethod}/responses/{statusCode}")
     public Response deleteMethodResponse(@Context HttpHeaders headers,
@@ -387,12 +487,14 @@ public class ApiGatewayController {
 
     @GET
     @Path("/restapis/{apiId}/resources")
-    public Response getResources(@Context HttpHeaders headers, @PathParam("apiId") String apiId) {
+    public Response getResources(@Context HttpHeaders headers, @PathParam("apiId") String apiId,
+                                 @QueryParam("embed") List<String> embed) {
         String region = regionResolver.resolveRegion(headers);
         List<ApiGatewayResource> resources = service.getResources(region, apiId);
+        boolean embedMethods = embed != null && embed.contains("methods");
         ObjectNode root = objectMapper.createObjectNode();
         ArrayNode items = root.putArray("item");
-        resources.forEach(r -> items.add(toResourceNode(r)));
+        resources.forEach(r -> items.add(toResourceNode(r, embedMethods)));
         return Response.ok(root.toString()).type(MediaType.APPLICATION_JSON).build();
     }
 
@@ -2162,11 +2264,19 @@ public class ApiGatewayController {
     }
 
     private ObjectNode toResourceNode(ApiGatewayResource r) {
+        return toResourceNode(r, false);
+    }
+
+    private ObjectNode toResourceNode(ApiGatewayResource r, boolean embedMethods) {
         ObjectNode node = objectMapper.createObjectNode();
         node.put("id", r.getId());
         if (r.getParentId() != null) node.put("parentId", r.getParentId());
         if (r.getPathPart() != null) node.put("pathPart", r.getPathPart());
         node.put("path", r.getPath());
+        if (embedMethods && !r.getResourceMethods().isEmpty()) {
+            ObjectNode methods = node.putObject("resourceMethods");
+            r.getResourceMethods().forEach((method, config) -> methods.set(method, toMethodNode(config)));
+        }
         return node;
     }
 
@@ -2186,6 +2296,11 @@ public class ApiGatewayController {
             m.getRequestModels().forEach(models::put);
             node.set("requestModels", models);
         }
+        if (!m.getMethodResponses().isEmpty()) {
+            ObjectNode responses = node.putObject("methodResponses");
+            m.getMethodResponses().forEach((status, response) ->
+                    responses.set(status, toMethodResponseNode(response)));
+        }
         if (m.getMethodIntegration() != null) {
             node.set("methodIntegration", toIntegrationNode(m.getMethodIntegration()));
         }
@@ -2195,6 +2310,14 @@ public class ApiGatewayController {
     private ObjectNode toMethodResponseNode(MethodResponse r) {
         ObjectNode node = objectMapper.createObjectNode();
         node.put("statusCode", r.statusCode());
+        if (r.responseParameters() != null && !r.responseParameters().isEmpty()) {
+            ObjectNode parameters = node.putObject("responseParameters");
+            r.responseParameters().forEach(parameters::put);
+        }
+        if (r.responseModels() != null && !r.responseModels().isEmpty()) {
+            ObjectNode models = node.putObject("responseModels");
+            r.responseModels().forEach(models::put);
+        }
         return node;
     }
 

src/main/java/io/github/hectorvent/floci/services/apigateway/ApiGatewayExecuteController.java

@@ -43,6 +43,7 @@ import jakarta.ws.rs.*;
 import jakarta.ws.rs.core.*;
 import org.jboss.logging.Logger;
 
+import java.net.URI;
 import java.net.URLDecoder;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
@@ -54,6 +55,7 @@ import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Base64;
 import java.util.Collections;
+import java.util.Date;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.LinkedHashMap;
@@ -144,6 +146,12 @@ public class ApiGatewayExecuteController {
 
     private record AuthorizerResult(Response errorResponse, String principalId, Map<String, Object> context) {}
 
+    record TestInvokeRequest(String pathWithQueryString, String body, Map<String, String> headers,
+                             Map<String, List<String>> multiValueHeaders,
+                             Map<String, String> stageVariables) {}
+
+    record TestInvokeResult(Response response, String log, long latency) {}
+
     /**
      * What a gateway-generated error needs in order to render the REST API's gateway response for
      * it: where the request landed and the raw request, for {@code method.request.*},
@@ -471,6 +479,85 @@ public class ApiGatewayExecuteController {
         return response;
     }
 
+    /**
+     * Executes a REST API method without requiring a deployment or stage. This is the execution
+     * path behind TestInvokeMethod, not an alternate data-plane endpoint.
+     */
+    TestInvokeResult testInvoke(String region, String apiId, String resourceId, String httpMethod,
+                                TestInvokeRequest request) {
+        ApiGatewayResource resource = apiGatewayService.getResource(region, apiId, resourceId);
+        MethodConfig method = apiGatewayService.getMethod(region, apiId, resourceId, httpMethod);
+        Integration integration = method.getMethodIntegration();
+        if (integration == null) {
+            Response response = Response.status(500).entity("No integration configured").build();
+            return new TestInvokeResult(response, "Execution failed due to configuration error: No integration configured", 0);
+        }
+
+        String pathWithQueryString = request.pathWithQueryString() == null || request.pathWithQueryString().isBlank()
+                ? resource.getPath() : request.pathWithQueryString();
+        URI requestUri = URI.create("http://test-invoke" + (pathWithQueryString.startsWith("/")
+                ? pathWithQueryString : "/" + pathWithQueryString));
+        String path = requestUri.getRawPath();
+        HttpHeaders headers = new TestInvokeHeaders(request.headers(), request.multiValueHeaders());
+        UriInfo uriInfo = new TestInvokeUriInfo(requestUri);
+        Stage stage = new Stage();
+        stage.setStageName("test-invoke-stage");
+        stage.setVariables(request.stageVariables());
+        byte[] body = request.body() == null ? null : request.body().getBytes(StandardCharsets.UTF_8);
+        GatewayResponseScope scope = new GatewayResponseScope(region, apiId, stage.getStageName(), stage,
+                httpMethod, path, resource, headers, uriInfo, body);
+        String integrationType = integration.getType();
+        if (integrationType == null || integrationType.isBlank()) {
+            Response response = Response.status(500).entity("No integration type configured").build();
+            return new TestInvokeResult(response,
+                    "Execution failed due to configuration error: No integration type configured", 0);
+        }
+
+        long started = System.nanoTime();
+        Response response;
+        String log;
+        if ("AWS_PROXY".equalsIgnoreCase(integrationType)) {
+            String functionName = functionNameFromUri(integration.getUri());
+            if (functionName == null) {
+                response = Response.status(500).entity("Cannot resolve function from URI: " + integration.getUri()).build();
+                log = "Execution failed due to configuration error: Cannot resolve function from URI: "
+                        + integration.getUri();
+            } else {
+                String eventJson = buildProxyEvent(region, apiId, httpMethod, path, resource.getPath(), resource.getId(),
+                        stage.getStageName(), stage, headers, uriInfo, body, UUID.randomUUID().toString(),
+                        null, null, null, null);
+                log = "Endpoint request URI: " + integration.getUri()
+                        + "\nEndpoint request body after transformations: " + eventJson;
+                InvokeResult result = lambdaService.invoke(region, functionName, eventJson.getBytes(StandardCharsets.UTF_8),
+                        InvocationType.RequestResponse);
+                if (isGatewayGeneratedProxyFailure(result)) {
+                    response = Response.status(500)
+                            .entity("Execution failed due to configuration error: Malformed Lambda proxy response")
+                            .build();
+                    log += "\nExecution failed due to configuration error: Malformed Lambda proxy response";
+                } else {
+                    response = buildProxyResponse(result, false);
+                }
+            }
+        } else {
+            AuthorizerResult authorizerResult = new AuthorizerResult(null, null, null);
+            response = switch (integrationType.toUpperCase(Locale.ROOT)) {
+                case "AWS" -> invokeAwsIntegration(scope, region, httpMethod, path, stage.getStageName(), resource,
+                        integration, headers, uriInfo, body, authorizerResult);
+                case "HTTP_PROXY" -> invokeHttpProxy(scope, apiId, httpMethod, path, null, stage.getStageName(), resource,
+                        integration, headers, uriInfo, body);
+                case "HTTP" -> invokeHttpIntegration(scope, region, apiId, httpMethod, path, null, stage.getStageName(),
+                        resource, integration, headers, uriInfo, body, authorizerResult);
+                case "MOCK" -> invokeMock(scope, region, httpMethod, path, stage.getStageName(), resource, integration,
+                        headers, uriInfo, body, authorizerResult);
+                default -> Response.status(500).entity("Unsupported integration type: " + integration.getType()).build();
+            };
+            log = "Endpoint request URI: " + integration.getUri();
+        }
+        long latency = (System.nanoTime() - started) / 1_000_000L;
+        return new TestInvokeResult(response, log + "\nLatency: " + latency + " ms", latency);
+    }
+
     private void applyApiOwnerContext(ApiGatewayV2Service.ApiOwner owner) {
         requestContext.setAccountId(owner.accountId());
         requestContext.setRegion(owner.region());
@@ -952,7 +1039,8 @@ public class ApiGatewayExecuteController {
             return false;
         }
         try {
-            return !objectMapper.readTree(payload).isObject();
+            JsonNode response = objectMapper.readTree(payload);
+            return !response.isObject() || !response.has("statusCode");
         } catch (IOException e) {
             return true;
         }
@@ -1413,6 +1501,9 @@ public class ApiGatewayExecuteController {
         }
         try {
             JsonNode node = objectMapper.readTree(result.getPayload());
+            if (!node.isObject() || !node.has("statusCode")) {
+                return Response.status(502).build();
+            }
             int statusCode = node.path("statusCode").asInt(200);
             if (result.getFunctionError() != null && !node.has("statusCode")) statusCode = 502;
 
@@ -1475,6 +1566,191 @@ public class ApiGatewayExecuteController {
         return Optional.empty();
     }
 
+    private static final class TestInvokeHeaders implements HttpHeaders {
+        private final MultivaluedMap<String, String> headers = new MultivaluedHashMap<>();
+
+        private TestInvokeHeaders(Map<String, String> singleValueHeaders,
+                                  Map<String, List<String>> multiValueHeaders) {
+            if (singleValueHeaders != null) {
+                singleValueHeaders.forEach(headers::putSingle);
+            }
+            if (multiValueHeaders != null) {
+                multiValueHeaders.forEach((name, values) -> headers.put(name,
+                        values == null ? new ArrayList<>() : new ArrayList<>(values)));
+            }
+        }
+
+        @Override
+        public List<String> getRequestHeader(String name) {
+            for (Map.Entry<String, List<String>> entry : headers.entrySet()) {
+                if (entry.getKey().equalsIgnoreCase(name)) {
+                    return entry.getValue();
+                }
+            }
+            return List.of();
+        }
+
+        @Override
+        public String getHeaderString(String name) {
+            List<String> values = getRequestHeader(name);
+            return values == null || values.isEmpty() ? null : String.join(",", values);
+        }
+
+        @Override
+        public MultivaluedMap<String, String> getRequestHeaders() {
+            return headers;
+        }
+
+        @Override
+        public List<MediaType> getAcceptableMediaTypes() {
+            return List.of();
+        }
+
+        @Override
+        public List<Locale> getAcceptableLanguages() {
+            return List.of();
+        }
+
+        @Override
+        public MediaType getMediaType() {
+            return null;
+        }
+
+        @Override
+        public Locale getLanguage() {
+            return null;
+        }
+
+        @Override
+        public Map<String, Cookie> getCookies() {
+            return Map.of();
+        }
+
+        @Override
+        public Date getDate() {
+            return null;
+        }
+
+        @Override
+        public int getLength() {
+            return -1;
+        }
+    }
+
+    private static final class TestInvokeUriInfo implements UriInfo {
+        private final URI requestUri;
+        private final MultivaluedMap<String, String> queryParameters = new MultivaluedHashMap<>();
+
+        private TestInvokeUriInfo(URI requestUri) {
+            this.requestUri = requestUri;
+            String rawQuery = requestUri.getRawQuery();
+            if (rawQuery == null || rawQuery.isEmpty()) {
+                return;
+            }
+            for (String part : rawQuery.split("&")) {
+                String[] keyValue = part.split("=", 2);
+                String key = URLDecoder.decode(keyValue[0], StandardCharsets.UTF_8);
+                String value = keyValue.length == 2 ? URLDecoder.decode(keyValue[1], StandardCharsets.UTF_8) : "";
+                queryParameters.add(key, value);
+            }
+        }
+
+        @Override
+        public String getPath() {
+            return requestUri.getPath();
+        }
+
+        @Override
+        public String getPath(boolean decode) {
+            return decode ? requestUri.getPath() : requestUri.getRawPath();
+        }
+
+        @Override
+        public List<PathSegment> getPathSegments() {
+            return List.of();
+        }
+
+        @Override
+        public List<PathSegment> getPathSegments(boolean decode) {
+            return List.of();
+        }
+
+        @Override
+        public URI getRequestUri() {
+            return requestUri;
+        }
+
+        @Override
+        public UriBuilder getRequestUriBuilder() {
+            return UriBuilder.fromUri(requestUri);
+        }
+
+        @Override
+        public URI getAbsolutePath() {
+            return UriBuilder.fromUri(requestUri).replaceQuery(null).build();
+        }
+
+        @Override
+        public UriBuilder getAbsolutePathBuilder() {
+            return UriBuilder.fromUri(getAbsolutePath());
+        }
+
+        @Override
+        public URI getBaseUri() {
+            return URI.create("http://test-invoke/");
+        }
+
+        @Override
+        public UriBuilder getBaseUriBuilder() {
+            return UriBuilder.fromUri(getBaseUri());
+        }
+
+        @Override
+        public MultivaluedMap<String, String> getPathParameters() {
+            return new MultivaluedHashMap<>();
+        }
+
+        @Override
+        public MultivaluedMap<String, String> getPathParameters(boolean decode) {
+            return getPathParameters();
+        }
+
+        @Override
+        public MultivaluedMap<String, String> getQueryParameters() {
+            return queryParameters;
+        }
+
+        @Override
+        public MultivaluedMap<String, String> getQueryParameters(boolean decode) {
+            return queryParameters;
+        }
+
+        @Override
+        public List<String> getMatchedURIs() {
+            return List.of();
+        }
+
+        @Override
+        public List<String> getMatchedURIs(boolean decode) {
+            return List.of();
+        }
+
+        @Override
+        public List<Object> getMatchedResources() {
+            return List.of();
+        }
+
+        @Override
+        public URI resolve(URI uri) {
+            return getBaseUri().resolve(uri);
+        }
+
+        @Override
+        public URI relativize(URI uri) {
+            return getBaseUri().relativize(uri);
+        }
+    }
+
     // ──────────────────────────── AWS (non-proxy) ────────────────────────────
 
     private MultivaluedMap<String, String> parseFormEncodedBody(String body) {

src/main/java/io/github/hectorvent/floci/services/apigateway/ApiGatewayService.java

@@ -496,10 +496,16 @@ public class ApiGatewayService {
     }
 
     public MethodResponse putMethodResponse(String region, String apiId, String resourceId,
-                                            String httpMethod, String statusCode,
-                                            Map<String, Object> request) {
+                                             String httpMethod, String statusCode,
+                                             Map<String, Object> request) {
         MethodConfig method = getMethod(region, apiId, resourceId, httpMethod);
-        MethodResponse mr = new MethodResponse(statusCode, new HashMap<>());
+        @SuppressWarnings("unchecked")
+        Map<String, Boolean> responseParameters = (Map<String, Boolean>) request.get("responseParameters");
+        @SuppressWarnings("unchecked")
+        Map<String, String> responseModels = (Map<String, String>) request.get("responseModels");
+        MethodResponse mr = new MethodResponse(statusCode,
+                responseParameters != null ? new HashMap<>(responseParameters) : new HashMap<>(),
+                responseModels != null ? new HashMap<>(responseModels) : new HashMap<>());
         method.getMethodResponses().put(statusCode, mr);
         resourceStore.put(resourceKey(region, apiId, resourceId), getResource(region, apiId, resourceId));
         return mr;
@@ -524,6 +530,49 @@ public class ApiGatewayService {
         resourceStore.put(resourceKey(region, apiId, resourceId), getResource(region, apiId, resourceId));
     }
 
+    public MethodResponse updateMethodResponse(String region, String apiId, String resourceId,
+                                               String httpMethod, String statusCode,
+                                               List<Map<String, String>> patchOperations) {
+        MethodResponse response = getMethodResponse(region, apiId, resourceId, httpMethod, statusCode);
+        if (patchOperations == null) {
+            throw new AwsException("BadRequestException", "Invalid patch operation", 400);
+        }
+        Map<String, Boolean> responseParameters = response.responseParameters() != null
+                ? new HashMap<>(response.responseParameters()) : new HashMap<>();
+        Map<String, String> responseModels = response.responseModels() != null
+                ? new HashMap<>(response.responseModels()) : new HashMap<>();
+        for (Map<String, String> patch : patchOperations) {
+            String op = patch.get("op");
+            String path = patch.get("path");
+            String value = patch.get("value");
+            boolean remove = "remove".equals(op);
+            if (path == null || (!remove && !"add".equals(op) && !"replace".equals(op)) || (!remove && value == null)) {
+                throw new AwsException("BadRequestException", "Invalid patch operation", 400);
+            }
+            if (path.startsWith("/responseParameters/")) {
+                String name = unescapeJsonPointer(path.substring("/responseParameters/".length()));
+                if (remove) {
+                    responseParameters.remove(name);
+                } else {
+                    responseParameters.put(name, Boolean.parseBoolean(value));
+                }
+            } else if (path.startsWith("/responseModels/")) {
+                String contentType = unescapeJsonPointer(path.substring("/responseModels/".length()));
+                if (remove) {
+                    responseModels.remove(contentType);
+                } else {
+                    responseModels.put(contentType, value);
+                }
+            } else {
+                throw new AwsException("BadRequestException", "Invalid patch path '" + path + "'", 400);
+            }
+        }
+        MethodResponse updated = new MethodResponse(statusCode, responseParameters, responseModels);
+        getMethod(region, apiId, resourceId, httpMethod).getMethodResponses().put(statusCode, updated);
+        resourceStore.put(resourceKey(region, apiId, resourceId), getResource(region, apiId, resourceId));
+        return updated;
+    }
+
     // ──────────────────────────── Integrations ────────────────────────────
 
     public Integration putIntegration(String region, String apiId, String resourceId, String httpMethod, Map<String, Object> request) {
@@ -643,18 +692,44 @@ public class ApiGatewayService {
     public IntegrationResponse updateIntegrationResponse(String region, String apiId, String resourceId, String httpMethod, String statusCode, List<Map<String, String>> patchOperations) {
         IntegrationResponse response = getIntegrationResponse(region, apiId, resourceId, httpMethod, statusCode);
         String selectionPattern = response.selectionPattern();
-        if (patchOperations != null) {
-            for (Map<String, String> patch : patchOperations) {
-                String op = patch.get("op");
-                String path = patch.get("path");
-                String value = patch.get("value");
-                if (value == null || !("add".equals(op) || "replace".equals(op)) || !"/selectionPattern".equals(path)) {
-                    throw new AwsException("BadRequestException", "Invalid patch operation", 400);
+        String contentHandling = response.contentHandling();
+        Map<String, String> responseParameters = new HashMap<>(response.responseParameters());
+        Map<String, String> responseTemplates = new HashMap<>(response.responseTemplates());
+        if (patchOperations == null) {
+            throw new AwsException("BadRequestException", "Invalid patch operation", 400);
+        }
+        for (Map<String, String> patch : patchOperations) {
+            String op = patch.get("op");
+            String path = patch.get("path");
+            String value = patch.get("value");
+            boolean remove = "remove".equals(op);
+            if (path == null || (!remove && !"add".equals(op) && !"replace".equals(op)) || (!remove && value == null)) {
+                throw new AwsException("BadRequestException", "Invalid patch operation", 400);
+            }
+            if ("/selectionPattern".equals(path)) {
+                selectionPattern = remove ? null : value;
+            } else if ("/contentHandling".equals(path)) {
+                contentHandling = remove ? null : value;
+            } else if (path.startsWith("/responseParameters/")) {
+                String name = unescapeJsonPointer(path.substring("/responseParameters/".length()));
+                if (remove) {
+                    responseParameters.remove(name);
+                } else {
+                    responseParameters.put(name, value);
                 }
-                selectionPattern = value;
+            } else if (path.startsWith("/responseTemplates/")) {
+                String contentType = unescapeJsonPointer(path.substring("/responseTemplates/".length()));
+                if (remove) {
+                    responseTemplates.remove(contentType);
+                } else {
+                    responseTemplates.put(contentType, value);
+                }
+            } else {
+                throw new AwsException("BadRequestException", "Invalid patch path '" + path + "'", 400);
             }
         }
-        IntegrationResponse newResponse = new IntegrationResponse(response.statusCode(), selectionPattern, response.responseParameters(), response.responseTemplates());
+        IntegrationResponse newResponse = new IntegrationResponse(response.statusCode(), selectionPattern,
+                responseParameters, responseTemplates, contentHandling);
         getIntegration(region, apiId, resourceId, httpMethod).getIntegrationResponses().put(statusCode, newResponse);
         resourceStore.put(resourceKey(region, apiId, resourceId), getResource(region, apiId, resourceId));
         return newResponse;

src/main/java/io/github/hectorvent/floci/services/apigateway/model/MethodResponse.java

@@ -10,6 +10,7 @@ import java.util.Map;
 @RegisterForReflection
 public record MethodResponse(
         String statusCode,
-        Map<String, Boolean> responseParameters
+        Map<String, Boolean> responseParameters,
+        Map<String, String> responseModels
 ) {
 }

src/main/java/io/github/hectorvent/floci/services/cloudformation/provisioners/CloudWatchCompositeAlarmCfnProvisioner.java

@@ -0,0 +1,183 @@
+package io.github.hectorvent.floci.services.cloudformation.provisioners;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import io.github.hectorvent.floci.core.common.AwsException;
+import io.github.hectorvent.floci.services.cloudformation.model.StackResource;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.CloudWatchMetricsService;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.CompositeAlarm;
+import jakarta.enterprise.context.ApplicationScoped;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.TreeSet;
+import java.util.stream.Collectors;
+
+@ApplicationScoped
+public class CloudWatchCompositeAlarmCfnProvisioner implements CfnResourceProvisioner {
+    private static final String TYPE = "AWS::CloudWatch::CompositeAlarm";
+    private static final String SNAPSHOT = "FlociCompositeAlarmSnapshot";
+    private static final String TAG_KEYS = "FlociCompositeAlarmTagKeys";
+    private static final String EXPLICIT_NAME = "FlociCompositeAlarmExplicitName";
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+    private final CloudWatchMetricsService service;
+
+    public CloudWatchCompositeAlarmCfnProvisioner(CloudWatchMetricsService service) {
+        this.service = service;
+    }
+
+    @Override
+    public Set<String> resourceTypes() {
+        return Set.of(TYPE);
+    }
+
+    @Override
+    public void provision(StackResource resource, JsonNode props, ProvisionContext ctx) {
+        for (String unsupported : List.of("ActionsSuppressor", "ActionsSuppressorWaitPeriod",
+                "ActionsSuppressorExtensionPeriod")) {
+            if (props.has(unsupported)) {
+                throw new AwsException("ValidationError", "Composite action suppression is not supported", 400);
+            }
+        }
+        if (resource.getAttributes().containsKey(SNAPSHOT)) {
+            throw new AwsException("ResourceConflictException", "Alarm update cleanup is still pending", 400);
+        }
+        String explicit = ctx.resolveOptional(props, "AlarmName");
+        boolean removedName = explicit == null && "true".equals(resource.getAttributes().get(EXPLICIT_NAME));
+        String name = removedName ? ctx.generatePhysicalName(resource.getLogicalId(), 255, false)
+                : ctx.stablePhysicalName(explicit, resource.getLogicalId(), 255, false);
+        CompositeAlarm alarm = new CompositeAlarm();
+        alarm.setAlarmName(name);
+        alarm.setAlarmDescription(ctx.resolveOptional(props, "AlarmDescription"));
+        alarm.setAlarmRule(ctx.resolveOptional(props, "AlarmRule"));
+        alarm.setActionsEnabled(!"false".equals(ctx.resolveOptional(props, "ActionsEnabled")));
+        alarm.setTags(ctx.resolveTags(props, "Tags"));
+        actions(props, "AlarmActions", ctx, alarm.getAlarmActions());
+        actions(props, "OKActions", ctx, alarm.getOkActions());
+        actions(props, "InsufficientDataActions", ctx, alarm.getInsufficientDataActions());
+        Map<String, String> desiredTags = Map.copyOf(alarm.getTags());
+        Map<String, String> priorAttributes = Map.copyOf(resource.getAttributes());
+        boolean inPlace = ctx.reusesPriorEntity(name);
+        String updateSnapshot = null;
+        if (inPlace) {
+            ObjectNode snapshot = MAPPER.createObjectNode().put("region", ctx.region()).put("name", name);
+            List<CompositeAlarm> previous = service.describeCompositeAlarms(List.of(name), null, ctx.region());
+            if (!previous.isEmpty()) {
+                snapshot.set("alarm", MAPPER.valueToTree(previous.getFirst()));
+            }
+            snapshot.set("attributes", MAPPER.valueToTree(priorAttributes));
+            Set<String> changedKeys = new TreeSet<>(desiredTags.keySet());
+            changedKeys.addAll(tagKeys(resource.getAttributes().get(TAG_KEYS)));
+            snapshot.set("changedTagKeys", MAPPER.valueToTree(changedKeys));
+            updateSnapshot = snapshot.toString();
+        }
+        service.putCompositeAlarm(alarm, ctx.region(), inPlace);
+        if (inPlace) {
+            resource.getAttributes().put(SNAPSHOT, updateSnapshot);
+            reconcileTags(alarm.getAlarmArn(), tagKeys(priorAttributes.get(TAG_KEYS)), desiredTags, ctx.region());
+        }
+        resource.getAttributes().put(TAG_KEYS, MAPPER.valueToTree(desiredTags.keySet()).toString());
+        resource.setPhysicalId(name);
+        resource.getAttributes().put("Arn", alarm.getAlarmArn());
+        resource.getAttributes().put(EXPLICIT_NAME, Boolean.toString(explicit != null));
+        ReplacementCleanup.record(resource, ctx, priorAttributes);
+    }
+
+    private static void actions(JsonNode props, String field, ProvisionContext ctx, List<String> target) {
+        JsonNode values = ctx.engine().resolveNode(props.path(field));
+        if (values != null && values.isArray()) {
+            values.forEach(value -> target.add(value.asText()));
+        }
+    }
+
+    private static Set<String> tagKeys(String json) {
+        Set<String> keys = new TreeSet<>();
+        if (json != null) {
+            try {
+                MAPPER.readTree(json).forEach(value -> keys.add(value.asText()));
+            } catch (JsonProcessingException error) {
+                throw new IllegalStateException("Cannot read composite alarm tag ownership", error);
+            }
+        }
+        return keys;
+    }
+
+    private void reconcileTags(String arn, Set<String> owned, Map<String, String> desired, String region) {
+        List<String> removed = owned.stream().filter(key -> !desired.containsKey(key)).toList();
+        if (!removed.isEmpty()) {
+            service.untagResource(arn, removed, region);
+        }
+        if (!desired.isEmpty()) {
+            service.tagResource(arn, desired, region);
+        }
+    }
+
+    @Override
+    public void delete(String type, String physicalId, String region) {
+        service.deleteAlarms(List.of(physicalId), region);
+    }
+
+    @Override
+    public boolean retainsFailedUpdateState(StackResource resource) {
+        return resource.getAttributes().containsKey(SNAPSHOT);
+    }
+
+    @Override
+    public boolean rollbackUpdate(StackResource resource) {
+        if (ReplacementCleanup.rollback(resource, this::delete)) {
+            return true;
+        }
+        String raw = resource.getAttributes().get(SNAPSHOT);
+        if (raw == null) {
+            return false;
+        }
+        try {
+            JsonNode snapshot = MAPPER.readTree(raw);
+            String region = snapshot.path("region").asText();
+            if (snapshot.has("alarm")) {
+                CompositeAlarm original = MAPPER.treeToValue(snapshot.get("alarm"), CompositeAlarm.class);
+                Map<String, String> originalTags = Map.copyOf(original.getTags());
+                service.putCompositeAlarm(original, region);
+                Set<String> changed = tagKeys(snapshot.path("changedTagKeys").toString());
+                reconcileTags(original.getAlarmArn(), changed, originalTags.entrySet().stream()
+                        .filter(entry -> changed.contains(entry.getKey()))
+                        .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue)), region);
+            } else {
+                delete(TYPE, snapshot.path("name").asText(), region);
+            }
+            resource.getAttributes().clear();
+            snapshot.path("attributes").fields().forEachRemaining(entry ->
+                    resource.getAttributes().put(entry.getKey(), entry.getValue().asText()));
+        } catch (JsonProcessingException error) {
+            throw new IllegalStateException("Cannot read composite alarm rollback state", error);
+        }
+        return true;
+    }
+
+    @Override
+    public boolean hasReplacementUpdate(StackResource resource) {
+        return ReplacementCleanup.hasReplacement(resource);
+    }
+
+    @Override
+    public String updateCleanupPhysicalId(StackResource resource) {
+        return ReplacementCleanup.cleanupPhysicalId(resource);
+    }
+
+    @Override
+    public UpdateCleanupResult completeUpdate(StackResource resource) {
+        if (resource.getAttributes().containsKey(SNAPSHOT) && !ReplacementCleanup.hasReplacement(resource)) {
+            return new UpdateCleanupResult(true, true, null, 0, null);
+        }
+        return ReplacementCleanup.complete(resource, this::delete);
+    }
+
+    @Override
+    public void clearUpdate(StackResource resource) {
+        resource.getAttributes().remove(SNAPSHOT);
+        ReplacementCleanup.clear(resource);
+    }
+}

src/main/java/io/github/hectorvent/floci/services/cloudformation/provisioners/DynamoDbCfnProvisioner.java

@@ -109,6 +109,8 @@ public class DynamoDbCfnProvisioner implements CfnResourceProvisioner {
         List<AttributeDefinition> attrDefs = new ArrayList<>();
         List<GlobalSecondaryIndex> gsis = new ArrayList<>();
         List<LocalSecondaryIndex> lsis = new ArrayList<>();
+        Long readCapacity = null;
+        Long writeCapacity = null;
 
         if (props != null && props.has("KeySchema")) {
             for (JsonNode ks : props.get("KeySchema")) {
@@ -124,6 +126,11 @@ public class DynamoDbCfnProvisioner implements CfnResourceProvisioner {
                 attrDefs.add(new AttributeDefinition(attrName, attrType));
             }
         }
+        if (props != null && props.has("ProvisionedThroughput")) {
+            JsonNode throughput = props.get("ProvisionedThroughput");
+            readCapacity = Long.valueOf(engine.resolve(throughput.get("ReadCapacityUnits")));
+            writeCapacity = Long.valueOf(engine.resolve(throughput.get("WriteCapacityUnits")));
+        }
 
         if (props != null && props.has("GlobalSecondaryIndexes")) {
             for (JsonNode gsiNode : props.get("GlobalSecondaryIndexes")) {
@@ -179,7 +186,7 @@ public class DynamoDbCfnProvisioner implements CfnResourceProvisioner {
 
         TableDefinition table;
         try {
-            table = dynamoDbService.createTable(tableName, keySchema, attrDefs, null, null, gsis, lsis, region);
+            table = dynamoDbService.createTable(tableName, keySchema, attrDefs, readCapacity, writeCapacity, gsis, lsis, region);
         } catch (AwsException e) {
             if (!"ResourceInUseException".equals(e.getErrorCode())) {
                 throw e;

src/main/java/io/github/hectorvent/floci/services/cloudformation/provisioners/LambdaCfnProvisioner.java

@@ -111,7 +111,7 @@ public class LambdaCfnProvisioner implements CfnResourceProvisioner {
                         "Cannot replace Lambda function " + r.getPhysicalId()
                                 + " without a new FunctionName", 400);
             }
-            func = createLambdaFunction(region, desired, !replacement);
+            func = createLambdaFunction(region, desired, !replacement, r);
             if (replacement && r.getPhysicalId() != null) {
                 deleteReplacedLambda(region, r.getPhysicalId());
             }
@@ -343,13 +343,15 @@ public class LambdaCfnProvisioner implements CfnResourceProvisioner {
         return !Objects.equals(existingPackageType, desired.packageType());
     }
 
-    private LambdaFunction createLambdaFunction(String region, LambdaDesiredState desired, boolean allowAdopt) {
+    private LambdaFunction createLambdaFunction(String region, LambdaDesiredState desired, boolean allowAdopt,
+                                                StackResource resource) {
         try {
             return lambdaService.createFunction(region, desired.createRequest());
         } catch (AwsException e) {
             if (allowAdopt && ("ResourceConflictException".equals(e.getErrorCode())
                     || (e.getMessage() != null && e.getMessage().contains("Function already exist")))) {
-                return lambdaService.getFunction(region, desired.functionName());
+                LambdaFunction existing = lambdaService.getFunction(region, desired.functionName());
+                return updateLambdaFunction(region, existing, desired, resource);
             }
             throw e;
         }

src/main/java/io/github/hectorvent/floci/services/cloudformation/provisioners/LambdaVersionAliasCfnProvisioner.java

@@ -85,16 +85,9 @@ public class LambdaVersionAliasCfnProvisioner implements CfnResourceProvisioner
         }
         String description = ctx.resolveOptional(props, "Description");
 
-        // Version resources are immutable in CloudFormation. An update re-invokes provision with
-        // the prior physical id, and publishing again would mint a new version and repoint every
-        // Ref to it, so the version this resource already published is kept while it still exists.
-        String previous = r.getPhysicalId();
-        if (previous != null && existingVersionIsCurrent(ctx.region(), functionName, previous)) {
-            r.getAttributes().put("Version", previous.substring(previous.lastIndexOf(':') + 1));
-            r.getAttributes().put("FunctionArn", previous);
-            return;
-        }
-
+        // Lambda deduplicates an unchanged publish by $LATEST revision. Calling it here is
+        // essential on UpdateStack: after a dependent function updates its code, the Version
+        // must snapshot that new revision rather than retaining its prior physical id.
         LambdaFunction version = lambdaService.publishVersion(ctx.region(), functionName, description);
 
         // Matches real CloudFormation: Ref returns the qualified ARN, GetAtt Version the version
@@ -104,26 +97,6 @@ public class LambdaVersionAliasCfnProvisioner implements CfnResourceProvisioner
         r.getAttributes().put("FunctionArn", version.getFunctionArn());
     }
 
-    /** True when {@code physicalId} names a still-published version of the function in the template. */
-    private boolean existingVersionIsCurrent(String region, String functionName, String physicalId) {
-        int sep = physicalId.lastIndexOf(':');
-        if (sep <= 0) {
-            return false;
-        }
-        String version = physicalId.substring(sep + 1);
-        String baseArn = physicalId.substring(0, sep);
-        try {
-            LambdaFunction fn = lambdaService.getFunction(region, functionName);
-            if (!baseArn.equals(fn.getFunctionArn().replace(":$LATEST", ""))) {
-                return false; // the FunctionName property now points at a different function
-            }
-            return lambdaService.listVersionsByFunction(region, functionName).stream()
-                    .anyMatch(v -> version.equals(v.getVersion()));
-        } catch (AwsException e) {
-            return false;
-        }
-    }
-
     private void provisionAlias(StackResource r, JsonNode props, ProvisionContext ctx) {
         String functionName = ctx.resolveOptional(props, "FunctionName");
         String aliasName = ctx.resolveOptional(props, "Name");

src/main/java/io/github/hectorvent/floci/services/cloudformation/provisioners/ReplacementCleanup.java

@@ -9,9 +9,11 @@ import io.github.hectorvent.floci.services.cloudformation.model.StackResource;
 import org.jboss.logging.Logger;
 
 import java.util.ArrayList;
+import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 
 /**
  * The replacement lifecycle for provisioners whose replacing update simply creates the new entity
@@ -121,6 +123,22 @@ public final class ReplacementCleanup {
         return cleanup != null && cleanup.path("displaced").size() > 0;
     }
 
+    /** The physical IDs of replaced resources this resource still has to delete. */
+    static Set<String> owedPhysicalIds(StackResource r) {
+        Set<String> owed = new HashSet<>();
+        ObjectNode cleanup = read(r);
+        if (cleanup == null) {
+            return owed;
+        }
+        for (JsonNode entry : cleanup.path("displaced")) {
+            String physicalId = entry.path("physicalId").asText(null);
+            if (physicalId != null) {
+                owed.add(physicalId);
+            }
+        }
+        return owed;
+    }
+
     /**
      * The entity the cleanup is working on, or null when none is owed or {@code UpdateReplacePolicy:
      * Retain} keeps it. The engine announces one physical id per resource, so a resource owing more

src/main/java/io/github/hectorvent/floci/services/cloudfront/CloudFrontController.java

@@ -468,7 +468,7 @@ public class CloudFrontController {
                                               @QueryParam("Type") String type) {
         try {
             Page<OriginRequestPolicy> page = page(
-                    service.listOriginRequestPolicies(marker, paginationFetchLimit(maxItems)),
+                    service.listOriginRequestPolicies(marker, paginationFetchLimit(maxItems), type),
                     maxItems, OriginRequestPolicy::getId);
 
             XmlBuilder xml = new XmlBuilder()
@@ -479,7 +479,8 @@ public class CloudFrontController {
                     .start("Items");
             for (OriginRequestPolicy p : page.items()) {
                 xml.start("OriginRequestPolicySummary")
-                        .elem("Type", "custom")
+                        .elem("Type", CloudFrontService.isManagedOriginRequestPolicy(p.getId())
+                                ? "managed" : "custom")
                         .raw(xmlOriginRequestPolicyResponse(p))
                         .end("OriginRequestPolicySummary");
             }

src/main/java/io/github/hectorvent/floci/services/cloudfront/CloudFrontOriginHttpClient.java

@@ -3,6 +3,7 @@ package io.github.hectorvent.floci.services.cloudfront;
 import io.github.hectorvent.floci.core.common.SsrfProtection;
 import org.apache.hc.client5.http.DnsResolver;
 import org.apache.hc.client5.http.SystemDefaultDnsResolver;
+import org.apache.hc.client5.http.classic.methods.HttpUriRequestBase;
 import org.apache.hc.client5.http.config.ConnectionConfig;
 import org.apache.hc.client5.http.config.RequestConfig;
 import org.apache.hc.client5.http.config.TlsConfig;
@@ -13,33 +14,35 @@ import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager;
 import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
 import org.apache.hc.client5.http.impl.routing.DefaultRoutePlanner;
 import org.apache.hc.client5.http.protocol.HttpClientContext;
+import org.apache.hc.client5.http.routing.RoutingSupport;
 import org.apache.hc.client5.http.ssl.ClientTlsStrategyBuilder;
+import org.apache.hc.core5.http.ClassicHttpResponse;
 import org.apache.hc.core5.http.Header;
+import org.apache.hc.core5.http.HttpEntity;
+import org.apache.hc.core5.http.HttpException;
 import org.apache.hc.core5.http.HttpVersion;
-import org.apache.hc.core5.http.io.entity.EntityUtils;
-import org.apache.hc.core5.http.io.support.ClassicRequestBuilder;
+import org.apache.hc.core5.http.io.entity.InputStreamEntity;
 import org.apache.hc.core5.http2.HttpVersionPolicy;
 import org.apache.hc.core5.util.Timeout;
+import org.jboss.logging.Logger;
 
 import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLSession;
+import java.io.FilterInputStream;
 import java.io.IOException;
+import java.io.InputStream;
 import java.io.InterruptedIOException;
 import java.net.InetAddress;
-import java.net.URI;
 import java.net.UnknownHostException;
-import java.net.http.HttpClient;
 import java.net.http.HttpHeaders;
 import java.net.http.HttpRequest;
-import java.net.http.HttpResponse;
 import java.time.Duration;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 import java.util.Map;
-import java.util.Optional;
 import java.util.Set;
 import java.util.TreeMap;
+import java.util.TreeSet;
 import java.util.stream.Collectors;
 
 /**
@@ -49,8 +52,11 @@ import java.util.stream.Collectors;
  */
 final class CloudFrontOriginHttpClient implements AutoCloseable {
 
+    private static final Logger LOG = Logger.getLogger(CloudFrontOriginHttpClient.class);
+
     private static final Duration CONNECT_TIMEOUT = Duration.ofSeconds(10);
     private static final Duration RESPONSE_TIMEOUT = Duration.ofSeconds(30);
+    static final int MAX_CONNECTIONS = 100;
 
     private final CloseableHttpClient client;
 
@@ -84,8 +90,10 @@ final class CloudFrontOriginHttpClient implements AutoCloseable {
                         .setDnsResolver(validatingResolver)
                         .setDefaultConnectionConfig(connectionConfig)
                         .setDefaultTlsConfig(tlsConfig)
-                        .setMaxConnTotal(100)
-                        .setMaxConnPerRoute(20);
+                        // CloudFront has no per-origin connection limit, and a streamed response holds its
+                        // connection for the whole transfer, so one origin may use the whole pool.
+                        .setMaxConnTotal(MAX_CONNECTIONS)
+                        .setMaxConnPerRoute(MAX_CONNECTIONS);
         if (sslContext != null) {
             connectionManagerBuilder.setTlsSocketStrategy(ClientTlsStrategyBuilder.create()
                     .setSslContext(sslContext)
@@ -111,28 +119,159 @@ final class CloudFrontOriginHttpClient implements AutoCloseable {
                 .build();
     }
 
-    HttpResponse<byte[]> send(HttpRequest request, HttpResponse.BodyHandler<byte[]> bodyHandler)
-            throws IOException, InterruptedException {
-        return send(request, Map.of(), bodyHandler);
+    /**
+     * An origin response whose body has not been read. The caller reads {@code body} as it needs it
+     * and closes it, which releases the connection. {@code contentLength} is the length the body
+     * arrives with, {@code -1} when it comes chunked or with none.
+     */
+    record OpenResponse(int statusCode, HttpHeaders headers, long contentLength, InputStream body) {
     }
 
-    HttpResponse<byte[]> send(HttpRequest request, Map<String, String> originHeaders,
-                              HttpResponse.BodyHandler<byte[]> bodyHandler)
+    /**
+     * Sends {@code request} with {@code forwardedHeaders} added and {@code requestBody}, when it is
+     * not {@code null}, streamed as the entity, with {@code requestBodyLength} as its
+     * {@code Content-Length}, or chunked when the length is negative. Each origin header replaces
+     * every same-named request or forwarded header, so a viewer cannot repeat a header to smuggle its
+     * own value past an origin custom header. The response comes back before its body is read, so
+     * neither body has to fit in memory.
+     */
+    OpenResponse open(HttpRequest request,
+                      List<CloudFrontOriginRequestBuilder.Header> forwardedHeaders,
+                      Map<String, String> originHeaders, InputStream requestBody, long requestBodyLength)
+            throws IOException, InterruptedException {
+        // No entity content type: the caller's Content-Type request header is sent as is.
+        HttpUriRequestBase originRequest = originRequest(request, forwardedHeaders, originHeaders,
+                requestBody != null ? new InputStreamEntity(requestBody, requestBodyLength, null) : null);
+        ClassicHttpResponse response;
+        try {
+            response = client.executeOpen(RoutingSupport.determineHost(originRequest), originRequest, context(request));
+        } catch (HttpException e) {
+            throw new IOException("CloudFront origin request has no target host", e);
+        } catch (InterruptedIOException e) {
+            if (Thread.currentThread().isInterrupted()) {
+                throw new InterruptedException("CloudFront origin request interrupted");
+            }
+            throw e;
+        }
+        try {
+            HttpEntity entity = response.getEntity();
+            InputStream body = entity != null
+                    ? new ResponseBody(entity.getContent(), originRequest, response)
+                    : new ResponseBody(InputStream.nullInputStream(), null, response);
+            // The entity's length follows the framing the body arrives with; with no entity, as for a
+            // HEAD, the header describes the body a GET would get.
+            long contentLength = entity != null ? entity.getContentLength() : headerContentLength(response);
+            return new OpenResponse(response.getCode(), responseHeaders(response), contentLength, body);
+        } catch (IOException | RuntimeException e) {
+            originRequest.cancel();
+            closeAborted(response);
+            throw e;
+        }
+    }
+
+    /**
+     * An origin response body that releases its connection when it is closed. Closed at its end, the
+     * connection goes back to the pool. Closed before its end, as when a viewer goes away or a custom
+     * error page replaces it, the request is cancelled and the connection closed, since closing the
+     * response normally reads the rest of the body to reuse the connection, however long it is.
+     */
+    private static final class ResponseBody extends FilterInputStream {
+
+        private final HttpUriRequestBase request;
+        private final ClassicHttpResponse response;
+        private boolean finished;
+
+        ResponseBody(InputStream content, HttpUriRequestBase request, ClassicHttpResponse response) {
+            super(content);
+            this.request = request;
+            this.response = response;
+        }
+
+        @Override
+        public int read() throws IOException {
+            int b = super.read();
+            finished |= b < 0;
+            return b;
+        }
+
+        @Override
+        public int read(byte[] buffer, int offset, int length) throws IOException {
+            int read = super.read(buffer, offset, length);
+            finished |= read < 0;
+            return read;
+        }
+
+        @Override
+        public void close() throws IOException {
+            if (finished || request == null) {
+                try {
+                    super.close();
+                } finally {
+                    response.close();
+                }
+                return;
+            }
+            request.cancel();
+            closeAborted(response);
+        }
+    }
+
+    /** Closes a response whose request was cancelled; reading the rest of it fails, as it should. */
+    private static void closeAborted(ClassicHttpResponse response) {
+        try {
+            response.close();
+        } catch (IOException e) {
+            LOG.debugv("Closed an unfinished CloudFront origin response: {0}", e.getMessage());
+        }
+    }
+
+    private static long headerContentLength(ClassicHttpResponse response) {
+        Header header = response.getFirstHeader("Content-Length");
+        if (header == null) {
+            return -1;
+        }
+        try {
+            return Long.parseLong(header.getValue().trim());
+        } catch (NumberFormatException e) {
+            LOG.debugv("Ignoring an invalid custom-origin Content-Length: {0}", e.getMessage());
+            return -1;
+        }
+    }
+
+    private HttpUriRequestBase originRequest(HttpRequest request,
+                                             List<CloudFrontOriginRequestBuilder.Header> forwardedHeaders,
+                                             Map<String, String> originHeaders, HttpEntity entity)
             throws IOException, InterruptedException {
         if (Thread.currentThread().isInterrupted()) {
             throw new InterruptedException("CloudFront origin request interrupted");
         }
         if (request.bodyPublisher().filter(publisher -> publisher.contentLength() != 0).isPresent()) {
-            throw new IOException("CloudFront origin request bodies are not supported");
+            throw new IOException("CloudFront origin request bodies must be passed separately");
         }
 
-        ClassicRequestBuilder builder = ClassicRequestBuilder.create(request.method())
-                .setUri(request.uri())
-                .setVersion(HttpVersion.HTTP_1_1);
-        request.headers().map().forEach((name, values) ->
-                values.forEach(value -> builder.addHeader(name, value)));
-        originHeaders.forEach(builder::setHeader);
+        // A request that can be cancelled, so a response closed before its end is not read to the end.
+        HttpUriRequestBase builder = new HttpUriRequestBase(request.method(), request.uri());
+        builder.setVersion(HttpVersion.HTTP_1_1);
+        Set<String> replaced = new TreeSet<>(String.CASE_INSENSITIVE_ORDER);
+        replaced.addAll(originHeaders.keySet());
+        request.headers().map().forEach((name, values) -> {
+            if (!replaced.contains(name)) {
+                values.forEach(value -> builder.addHeader(name, value));
+            }
+        });
+        for (CloudFrontOriginRequestBuilder.Header header : forwardedHeaders) {
+            if (!replaced.contains(header.name())) {
+                builder.addHeader(header.name(), header.value());
+            }
+        }
+        originHeaders.forEach(builder::addHeader);
+        if (entity != null) {
+            builder.setEntity(entity);
+        }
+        return builder;
+    }
 
+    private static HttpClientContext context(HttpRequest request) {
         HttpClientContext context = HttpClientContext.create();
         Duration responseTimeout = request.timeout().orElse(RESPONSE_TIMEOUT);
         context.setRequestConfig(RequestConfig.custom()
@@ -142,28 +281,16 @@ final class CloudFrontOriginHttpClient implements AutoCloseable {
                 .setContentCompressionEnabled(false)
                 .setProtocolUpgradeEnabled(false)
                 .build());
+        return context;
+    }
 
-        try {
-            return client.execute(builder.build(), context, response -> {
-                Map<String, List<String>> responseHeaders = new TreeMap<>(String.CASE_INSENSITIVE_ORDER);
-                for (Header header : response.getHeaders()) {
-                    responseHeaders.computeIfAbsent(header.getName(), ignored -> new ArrayList<>())
-                            .add(header.getValue());
-                }
-                byte[] body = response.getEntity() != null
-                        ? EntityUtils.toByteArray(response.getEntity())
-                        : new byte[0];
-                return new PinnedHttpResponse(
-                        response.getCode(), request,
-                        HttpHeaders.of(responseHeaders, (name, value) -> true),
-                        body, request.uri());
-            });
-        } catch (InterruptedIOException e) {
-            if (Thread.currentThread().isInterrupted()) {
-                throw new InterruptedException("CloudFront origin request interrupted");
-            }
-            throw e;
+    private static HttpHeaders responseHeaders(ClassicHttpResponse response) {
+        Map<String, List<String>> responseHeaders = new TreeMap<>(String.CASE_INSENSITIVE_ORDER);
+        for (Header header : response.getHeaders()) {
+            responseHeaders.computeIfAbsent(header.getName(), ignored -> new ArrayList<>())
+                    .add(header.getValue());
         }
+        return HttpHeaders.of(responseHeaders, (name, value) -> true);
     }
 
     @Override
@@ -171,29 +298,6 @@ final class CloudFrontOriginHttpClient implements AutoCloseable {
         client.close();
     }
 
-    private record PinnedHttpResponse(
-            int statusCode,
-            HttpRequest request,
-            HttpHeaders headers,
-            byte[] body,
-            URI uri) implements HttpResponse<byte[]> {
-
-        @Override
-        public Optional<HttpResponse<byte[]>> previousResponse() {
-            return Optional.empty();
-        }
-
-        @Override
-        public Optional<SSLSession> sslSession() {
-            return Optional.empty();
-        }
-
-        @Override
-        public HttpClient.Version version() {
-            return HttpClient.Version.HTTP_1_1;
-        }
-    }
-
     private record ValidatingDnsResolver(DnsResolver delegate, Set<String> allowedHosts)
             implements DnsResolver {
 

src/main/java/io/github/hectorvent/floci/services/cloudfront/CloudFrontOriginRequestBuilder.java

@@ -0,0 +1,497 @@
+package io.github.hectorvent.floci.services.cloudfront;
+
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.Comparator;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ThreadLocalRandom;
+
+/**
+ * Decides what CloudFront sends to a custom origin for one viewer request: the viewer headers,
+ * cookies and query strings the matched cache behavior forwards, and the headers CloudFront adds on
+ * its own. Implemented to the CloudFront Developer Guide:
+ *
+ * <ul>
+ *   <li>With a cache policy, only what the cache policy's
+ *       {@code ParametersInCacheKeyAndForwardedToOrigin} or the origin request policy selects is
+ *       forwarded; the two selections are unioned.</li>
+ *   <li>Without a cache policy (legacy cache settings), {@code ForwardedValues} applies, and viewer
+ *       headers are forwarded by default except the ones the custom-origin request table says
+ *       CloudFront removes.</li>
+ *   <li>Every origin request carries {@code User-Agent: Amazon CloudFront} unless the viewer's
+ *       {@code User-Agent} is forwarded, an {@code X-Forwarded-For} ending in the viewer address,
+ *       CloudFront's {@code Via} hop and an {@code X-Amz-Cf-Id}. {@code Host} is the origin's own
+ *       name unless the viewer's {@code Host} is forwarded.</li>
+ * </ul>
+ *
+ * <p>This class holds no state and does no I/O. Origin custom headers are applied afterwards by the
+ * transport, which lets them replace same-named viewer headers.
+ */
+final class CloudFrontOriginRequestBuilder {
+
+    static final String CLOUDFRONT_USER_AGENT = "Amazon CloudFront";
+
+    private static final Set<String> BODY_METHODS = Set.of("POST", "PUT", "PATCH", "DELETE");
+    /**
+     * Never copied from a viewer request: hop-by-hop and framing fields the transport owns, and
+     * fields CloudFront removes or sets itself whatever the policy says.
+     */
+    private static final Set<String> NEVER_FORWARDED = Set.of(
+            "connection", "keep-alive", "proxy-connection", "proxy-authenticate",
+            "proxy-authorization", "te", "trailer", "transfer-encoding", "upgrade",
+            "content-length", "expect", "x-amz-cf-id", "x-real-ip", "x-forwarded-proto");
+    /** Removed by legacy cache settings unless the behavior's {@code Headers} names them. */
+    private static final Set<String> LEGACY_REMOVED = Set.of(
+            "accept", "accept-charset", "accept-language", "authorization", "host", "referer",
+            "user-agent", "x-http-method-override");
+    private static final String FORWARDED_PROTO = "CloudFront-Forwarded-Proto";
+    private static final String VIEWER_ADDRESS = "CloudFront-Viewer-Address";
+    private static final String VIEWER_HTTP_VERSION = "CloudFront-Viewer-Http-Version";
+    /** The CloudFront request headers Floci can derive from a local viewer connection. */
+    private static final List<String> GENERATED_HEADERS =
+            List.of(FORWARDED_PROTO, VIEWER_ADDRESS, VIEWER_HTTP_VERSION);
+
+    private CloudFrontOriginRequestBuilder() {
+    }
+
+    /** One request header field, in the order it was received or will be sent. */
+    record Header(String name, String value) {
+    }
+
+    /**
+     * The viewer request as CloudFront received it. {@code rawQuery} has CloudFront's signing
+     * parameters removed already; {@code httpVersion} is the viewer's protocol version, such as
+     * {@code 1.1} or {@code 2.0}.
+     */
+    record ViewerRequest(String method, List<Header> headers, String rawQuery,
+                         String clientAddress, int clientPort, String scheme, String httpVersion) {
+    }
+
+    /**
+     * The forwarding configuration of the cache behavior that matched the request. A behavior
+     * without a cache policy uses legacy cache settings, where only {@code forwardedValues} applies.
+     * The policy maps use the shapes {@link CloudFrontPolicyConfigCodec} stores.
+     */
+    record Forwarding(boolean legacy, Map<?, ?> cachePolicyParameters,
+                      Map<?, ?> originRequestPolicy, Map<?, ?> forwardedValues,
+                      boolean optionsCached) {
+
+        static Forwarding legacy(Map<?, ?> forwardedValues, boolean optionsCached) {
+            return new Forwarding(true, null, null, forwardedValues, optionsCached);
+        }
+
+        static Forwarding policies(Map<?, ?> cachePolicyParameters, Map<?, ?> originRequestPolicy,
+                                   boolean optionsCached) {
+            return new Forwarding(false, cachePolicyParameters, originRequestPolicy, null,
+                    optionsCached);
+        }
+    }
+
+    /**
+     * What CloudFront sends to the origin before origin custom headers are applied. {@code rawQuery}
+     * is {@code null} when no query string is forwarded. A {@code Host} header is present only when
+     * the viewer's {@code Host} is forwarded.
+     */
+    record OriginRequest(List<Header> headers, String rawQuery) {
+
+        static OriginRequest empty() {
+            return new OriginRequest(List.of(), null);
+        }
+    }
+
+    static OriginRequest build(ViewerRequest viewer, Forwarding forwarding, String viaHost) {
+        Selections selections = forwarding.legacy()
+                ? legacySelections(forwarding.forwardedValues())
+                : policySelections(forwarding.cachePolicyParameters(),
+                        forwarding.originRequestPolicy());
+        Set<String> connectionTokens = connectionTokens(viewer.headers());
+        boolean forwardsAuthorization = BODY_METHODS.contains(viewer.method())
+                || ("OPTIONS".equals(viewer.method()) && !forwarding.optionsCached());
+
+        List<Header> headers = new ArrayList<>();
+        List<String> cookieHeaders = new ArrayList<>();
+        List<String> forwardedFor = new ArrayList<>();
+        List<String> via = new ArrayList<>();
+        List<String> acceptEncoding = new ArrayList<>();
+        boolean userAgentForwarded = false;
+        for (Header header : viewer.headers()) {
+            String name = normalize(header.name());
+            if (name.isEmpty() || NEVER_FORWARDED.contains(name) || connectionTokens.contains(name)
+                    || name.startsWith("x-edge-") || name.startsWith("cloudfront-")) {
+                continue;
+            }
+            switch (name) {
+                case "cookie" -> cookieHeaders.add(header.value());
+                case "x-forwarded-for" -> forwardedFor.add(header.value());
+                case "via" -> {
+                    if (selections.forwardsHeader(name)) {
+                        via.add(header.value());
+                    }
+                }
+                case "accept-encoding" -> {
+                    if (selections.normalizesAcceptEncoding()) {
+                        acceptEncoding.add(header.value());
+                    } else if (selections.forwardsHeader(name)) {
+                        headers.add(header);
+                    }
+                }
+                case "authorization" -> {
+                    if (forwardsAuthorization || selections.forwardsHeader(name)) {
+                        headers.add(header);
+                    }
+                }
+                case "content-type" -> {
+                    if (BODY_METHODS.contains(viewer.method()) || selections.forwardsHeader(name)) {
+                        headers.add(header);
+                    }
+                }
+                default -> {
+                    if (selections.forwardsHeader(name)) {
+                        headers.add(header);
+                        userAgentForwarded |= "user-agent".equals(name);
+                    }
+                }
+            }
+        }
+
+        if (!userAgentForwarded) {
+            headers.add(new Header("User-Agent", CLOUDFRONT_USER_AGENT));
+        }
+        if (!acceptEncoding.isEmpty()) {
+            String normalized = normalizedAcceptEncoding(acceptEncoding, selections);
+            if (normalized != null) {
+                headers.add(new Header("Accept-Encoding", normalized));
+            }
+        }
+        String cookies = forwardedCookies(cookieHeaders, selections.cookies());
+        if (cookies != null) {
+            headers.add(new Header("Cookie", cookies));
+        }
+        for (String generated : GENERATED_HEADERS) {
+            String value = selections.generatesHeader(normalize(generated))
+                    ? generatedValue(generated, viewer) : null;
+            if (value != null) {
+                headers.add(new Header(generated, value));
+            }
+        }
+        String clientForwardedFor = forwardedFor(forwardedFor, viewer.clientAddress());
+        if (clientForwardedFor != null) {
+            headers.add(new Header("X-Forwarded-For", clientForwardedFor));
+        }
+        via.add(viewerProtocolVersion(viewer.httpVersion()) + " " + viaHost + " (CloudFront)");
+        headers.add(new Header("Via", String.join(", ", via)));
+        headers.add(new Header("X-Amz-Cf-Id", requestId()));
+
+        return new OriginRequest(List.copyOf(headers),
+                forwardedQuery(viewer.rawQuery(), selections.queryStrings()));
+    }
+
+    private static Selections policySelections(Map<?, ?> cachePolicyParameters,
+                                               Map<?, ?> originRequestPolicy) {
+        List<Selection> headers = new ArrayList<>();
+        List<Selection> cookies = new ArrayList<>();
+        List<Selection> queryStrings = new ArrayList<>();
+        for (Map<?, ?> source : new Map<?, ?>[] {cachePolicyParameters, originRequestPolicy}) {
+            if (source == null) {
+                continue;
+            }
+            headers.add(Selection.of(source.get("HeadersConfig"), "HeaderBehavior", "Headers", true));
+            cookies.add(Selection.of(source.get("CookiesConfig"), "CookieBehavior", "Cookies", false));
+            queryStrings.add(Selection.of(
+                    source.get("QueryStringsConfig"), "QueryStringBehavior", "QueryStrings", false));
+        }
+        boolean gzip = cachePolicyParameters != null
+                && isTrue(cachePolicyParameters.get("EnableAcceptEncodingGzip"));
+        boolean brotli = cachePolicyParameters != null
+                && isTrue(cachePolicyParameters.get("EnableAcceptEncodingBrotli"));
+        return new Selections(false, headers, false, cookies, queryStrings, gzip, brotli,
+                gzip || brotli);
+    }
+
+    /**
+     * Legacy {@code ForwardedValues}: headers are forwarded by default apart from the ones CloudFront
+     * removes, {@code Headers} adds names back (or everything with {@code *}), cookie names may use
+     * {@code *} and {@code ?} wildcards, and {@code QueryString=true} forwards every query string
+     * ({@code QueryStringCacheKeys} only narrows the cache key).
+     */
+    private static Selections legacySelections(Map<?, ?> forwardedValues) {
+        List<String> headerNames = stringList(forwardedValues, "Headers");
+        boolean allHeaders = headerNames.contains("*");
+        Selection headers = allHeaders
+                ? new Selection("all", List.of(), true, false)
+                : new Selection("whitelist", headerNames, true, false);
+
+        String cookiesForward = forwardedValues != null && forwardedValues.get("CookiesForward") != null
+                ? forwardedValues.get("CookiesForward").toString() : "none";
+        Selection cookies = new Selection(cookiesForward, stringList(forwardedValues, "CookieNames"),
+                false, true);
+
+        boolean queryString = forwardedValues != null && isTrue(forwardedValues.get("QueryString"));
+        Selection queryStrings = new Selection(queryString ? "all" : "none", List.of(), false, false);
+
+        return new Selections(true, List.of(headers), !allHeaders, List.of(cookies),
+                List.of(queryStrings), true, true, !headers.includes("accept-encoding"));
+    }
+
+    private static Set<String> connectionTokens(List<Header> headers) {
+        Set<String> tokens = new HashSet<>();
+        for (Header header : headers) {
+            if ("connection".equals(normalize(header.name())) && header.value() != null) {
+                for (String token : header.value().split(",")) {
+                    String normalized = normalize(token);
+                    if (!normalized.isEmpty()) {
+                        tokens.add(normalized);
+                    }
+                }
+            }
+        }
+        return tokens;
+    }
+
+    /**
+     * Accept-Encoding normalization: the formats caching is enabled for that the viewer accepts, as
+     * {@code br,gzip}, {@code gzip} or {@code br}. A cache policy sends {@code identity} when the
+     * viewer accepts none of them; legacy settings drop the header instead.
+     */
+    private static String normalizedAcceptEncoding(List<String> values, Selections selections) {
+        Set<String> accepted = new HashSet<>();
+        for (String value : values) {
+            for (String coding : value.split(",")) {
+                int parameters = coding.indexOf(';');
+                String name = normalize(parameters >= 0 ? coding.substring(0, parameters) : coding);
+                if (!name.isEmpty()) {
+                    accepted.add(name);
+                }
+            }
+        }
+        boolean brotli = selections.brotli() && accepted.contains("br");
+        boolean gzip = selections.gzip() && accepted.contains("gzip");
+        if (brotli && gzip) {
+            return "br,gzip";
+        }
+        if (brotli) {
+            return "br";
+        }
+        if (gzip) {
+            return "gzip";
+        }
+        return selections.legacy() ? null : "identity";
+    }
+
+    /**
+     * The viewer cookies the behavior forwards, sorted by name as CloudFront sorts them. Pairs that are
+     * not {@code name=value}, and names starting with {@code $}, are dropped.
+     */
+    private static String forwardedCookies(List<String> cookieHeaders, List<Selection> selections) {
+        List<String[]> cookies = new ArrayList<>();
+        for (String cookieHeader : cookieHeaders) {
+            if (cookieHeader == null) {
+                continue;
+            }
+            for (String pair : cookieHeader.split(";")) {
+                int eq = pair.indexOf('=');
+                String name = eq > 0 ? pair.substring(0, eq).trim() : "";
+                if (name.isEmpty() || name.startsWith("$")) {
+                    continue;
+                }
+                if (selections.stream().anyMatch(selection -> selection.includes(name))) {
+                    cookies.add(new String[] {name, pair.substring(eq + 1).trim()});
+                }
+            }
+        }
+        if (cookies.isEmpty()) {
+            return null;
+        }
+        cookies.sort(Comparator.comparing(cookie -> cookie[0]));
+        List<String> pairs = new ArrayList<>(cookies.size());
+        for (String[] cookie : cookies) {
+            pairs.add(cookie[0] + "=" + cookie[1]);
+        }
+        return String.join("; ", pairs);
+    }
+
+    /** The raw query pairs the behavior forwards, in viewer order and with their original encoding. */
+    private static String forwardedQuery(String rawQuery, List<Selection> selections) {
+        if (rawQuery == null || rawQuery.isEmpty()) {
+            return null;
+        }
+        if (selections.stream().anyMatch(selection -> "all".equals(selection.behavior()))) {
+            return rawQuery;
+        }
+        List<String> kept = new ArrayList<>();
+        for (String pair : rawQuery.split("&")) {
+            if (pair.isEmpty()) {
+                continue;
+            }
+            int eq = pair.indexOf('=');
+            String name = decodeQueryName(eq >= 0 ? pair.substring(0, eq) : pair);
+            if (selections.stream().anyMatch(selection -> selection.includes(name))) {
+                kept.add(pair);
+            }
+        }
+        return kept.isEmpty() ? null : String.join("&", kept);
+    }
+
+    private static String decodeQueryName(String rawName) {
+        try {
+            return URLDecoder.decode(rawName, StandardCharsets.UTF_8);
+        } catch (IllegalArgumentException malformed) {
+            // A name that is not valid percent-encoding can only match a policy entry literally.
+            return rawName;
+        }
+    }
+
+    private static String generatedValue(String header, ViewerRequest viewer) {
+        return switch (header) {
+            case FORWARDED_PROTO -> viewer.scheme() != null
+                    ? viewer.scheme().toLowerCase(Locale.ROOT) : null;
+            case VIEWER_ADDRESS -> viewer.clientAddress() != null && viewer.clientPort() > 0
+                    ? viewer.clientAddress() + ":" + viewer.clientPort() : null;
+            case VIEWER_HTTP_VERSION -> viewer.httpVersion();
+            default -> null;
+        };
+    }
+
+    /** CloudFront appends the viewer's address to any {@code X-Forwarded-For} the viewer sent. */
+    private static String forwardedFor(List<String> viewerValues, String clientAddress) {
+        List<String> values = new ArrayList<>(viewerValues);
+        if (clientAddress != null && !clientAddress.isBlank()) {
+            values.add(clientAddress);
+        }
+        return values.isEmpty() ? null : String.join(",", values);
+    }
+
+    private static String viewerProtocolVersion(String httpVersion) {
+        return httpVersion == null || httpVersion.isBlank() ? "1.1" : httpVersion;
+    }
+
+    /** A request identifier shaped like CloudFront's: 40 random bytes, URL-safe Base64. */
+    private static String requestId() {
+        byte[] bytes = new byte[40];
+        ThreadLocalRandom.current().nextBytes(bytes);
+        return Base64.getUrlEncoder().encodeToString(bytes);
+    }
+
+    private static boolean isTrue(Object value) {
+        return value instanceof Boolean bool ? bool : value != null && "true".equalsIgnoreCase(value.toString());
+    }
+
+    private static List<String> stringList(Map<?, ?> map, String key) {
+        Object value = map != null ? map.get(key) : null;
+        if (!(value instanceof List<?> list)) {
+            return List.of();
+        }
+        List<String> strings = new ArrayList<>(list.size());
+        for (Object item : list) {
+            if (item != null) {
+                strings.add(item.toString());
+            }
+        }
+        return strings;
+    }
+
+    private static String normalize(String name) {
+        return name == null ? "" : name.trim().toLowerCase(Locale.ROOT);
+    }
+
+    /** The resolved selections of one request, unioned across the policies that apply. */
+    private record Selections(boolean legacy, List<Selection> headers, boolean legacyDefaults,
+                              List<Selection> cookies, List<Selection> queryStrings,
+                              boolean gzip, boolean brotli, boolean normalizesAcceptEncoding) {
+
+        /**
+         * Whether a viewer header is forwarded: a policy selects it, or legacy settings forward it
+         * by default.
+         */
+        boolean forwardsHeader(String normalizedName) {
+            if (headers.stream().anyMatch(selection -> selection.includes(normalizedName))) {
+                return true;
+            }
+            return legacyDefaults && !LEGACY_REMOVED.contains(normalizedName);
+        }
+
+        /**
+         * Whether CloudFront adds one of its own request headers: a whitelist or
+         * {@code allViewerAndWhitelistCloudFront} list names it, or {@code allExcept} does not
+         * exclude it (the managed AllViewerExceptHostHeader policy is documented to add them).
+         */
+        boolean generatesHeader(String normalizedName) {
+            for (Selection selection : headers) {
+                boolean generated = switch (selection.behavior()) {
+                    case "whitelist", "allViewerAndWhitelistCloudFront" -> selection.lists(normalizedName);
+                    case "allExcept" -> !selection.lists(normalizedName);
+                    default -> false;
+                };
+                if (generated) {
+                    return true;
+                }
+            }
+            return false;
+        }
+    }
+
+    /**
+     * One policy's choice of names of one kind: headers, cookies or query strings. Header names match
+     * case-insensitively, cookie and query string names case-sensitively. Legacy cookie allowlists may
+     * use {@code *} and {@code ?} wildcards.
+     */
+    private record Selection(String behavior, List<String> names, boolean ignoreCase,
+                             boolean wildcards) {
+
+        static Selection of(Object block, String behaviorKey, String listKey, boolean ignoreCase) {
+            if (!(block instanceof Map<?, ?> map) || map.get(behaviorKey) == null) {
+                return new Selection("none", List.of(), ignoreCase, false);
+            }
+            return new Selection(map.get(behaviorKey).toString(), stringList(map, listKey),
+                    ignoreCase, false);
+        }
+
+        boolean includes(String name) {
+            return switch (behavior) {
+                case "whitelist" -> lists(name);
+                case "all", "allViewer", "allViewerAndWhitelistCloudFront" -> true;
+                case "allExcept" -> !lists(name);
+                default -> false;
+            };
+        }
+
+        boolean lists(String name) {
+            for (String candidate : names) {
+                boolean matches = wildcards
+                        ? wildcardMatches(candidate, name)
+                        : ignoreCase ? candidate.equalsIgnoreCase(name) : candidate.equals(name);
+                if (matches) {
+                    return true;
+                }
+            }
+            return false;
+        }
+
+        private static boolean wildcardMatches(String pattern, String name) {
+            return wildcardMatches(pattern, 0, name, 0);
+        }
+
+        private static boolean wildcardMatches(String pattern, int p, String name, int n) {
+            if (p == pattern.length()) {
+                return n == name.length();
+            }
+            char c = pattern.charAt(p);
+            if (c == '*') {
+                for (int i = n; i <= name.length(); i++) {
+                    if (wildcardMatches(pattern, p + 1, name, i)) {
+                        return true;
+                    }
+                }
+                return false;
+            }
+            return n < name.length() && (c == '?' || c == name.charAt(n))
+                    && wildcardMatches(pattern, p + 1, name, n + 1);
+        }
+    }
+}

src/main/java/io/github/hectorvent/floci/services/cloudfront/CloudFrontRequestRouter.java

@@ -166,6 +166,35 @@ public final class CloudFrontRequestRouter {
         return allowedMethodsOrDefault(dflt != null ? dflt.getAllowedMethods() : null);
     }
 
+    /**
+     * The settings that decide what the cache behavior serving a normalized path forwards to its
+     * origin: cache policy, origin request policy, legacy {@code ForwardedValues} and cached methods.
+     */
+    public record BehaviorForwarding(String cachePolicyId, String originRequestPolicyId,
+                                     Map<String, Object> forwardedValues,
+                                     List<String> cachedMethods) {
+    }
+
+    /** Returns the forwarding settings of the cache behavior that serves a normalized path. */
+    public static BehaviorForwarding matchForwarding(DistributionConfig config, String normalizedPath) {
+        List<CacheBehavior> behaviors = config.getCacheBehaviors();
+        if (behaviors != null) {
+            for (CacheBehavior behavior : behaviors) {
+                if (pathPatternMatches(behavior.getPathPattern(), normalizedPath)) {
+                    return new BehaviorForwarding(behavior.getCachePolicyId(),
+                            behavior.getOriginRequestPolicyId(), behavior.getForwardedValues(),
+                            behavior.getCachedMethods());
+                }
+            }
+        }
+        DefaultCacheBehavior dflt = config.getDefaultCacheBehavior();
+        if (dflt == null) {
+            return new BehaviorForwarding(null, null, null, null);
+        }
+        return new BehaviorForwarding(dflt.getCachePolicyId(), dflt.getOriginRequestPolicyId(),
+                dflt.getForwardedValues(), dflt.getCachedMethods());
+    }
+
     private static List<String> allowedMethodsOrDefault(List<String> methods) {
         return methods == null || methods.isEmpty() ? List.of("GET", "HEAD") : methods;
     }

src/main/java/io/github/hectorvent/floci/services/cloudfront/CloudFrontService.java

@@ -59,6 +59,7 @@ public class CloudFrontService {
             Set.of("s3", "mediastore", "mediapackagev2", "lambda");
     private static final Set<String> OAC_SIGNING_BEHAVIORS =
             Set.of("always", "never", "no-override");
+    private static final Set<String> FUNCTION_RUNTIMES = Set.of("cloudfront-js-1.0", "cloudfront-js-2.0");
     private static final int MAX_ORIGIN_CUSTOM_HEADERS = 30;
     private static final int MAX_CUSTOM_HEADER_NAME_LENGTH = 256;
     private static final int MAX_CUSTOM_HEADER_VALUE_LENGTH = 1_783;
@@ -83,6 +84,24 @@ public class CloudFrontService {
             "60669652-455b-4ae9-85a4-c4c02393f86c";
     private static final Map<String, ResponseHeadersPolicy> MANAGED_RESPONSE_HEADERS_POLICIES =
             managedResponseHeadersPolicies();
+    static final String MANAGED_ALL_VIEWER_ORIGIN_REQUEST_POLICY_ID =
+            "216adef6-5c7f-47e4-b989-5492eafa07d3";
+    static final String MANAGED_ALL_VIEWER_AND_CLOUDFRONT_HEADERS_ORIGIN_REQUEST_POLICY_ID =
+            "33f36d7e-f396-46d9-90e0-52428a34d9dc";
+    static final String MANAGED_ALL_VIEWER_EXCEPT_HOST_HEADER_ORIGIN_REQUEST_POLICY_ID =
+            "b689b0a8-53d0-40ab-baf2-68738e2966ac";
+    static final String MANAGED_CORS_CUSTOM_ORIGIN_ORIGIN_REQUEST_POLICY_ID =
+            "59781a5b-3903-41f3-afcb-af62929ccde1";
+    static final String MANAGED_CORS_S3_ORIGIN_ORIGIN_REQUEST_POLICY_ID =
+            "88a5eaf4-2fd4-4709-b370-b4c650ea3fcf";
+    static final String MANAGED_MEDIATAILOR_ORIGIN_REQUEST_POLICY_ID =
+            "775133bc-15f2-49f9-abea-afb2e0bf67d2";
+    static final String MANAGED_HOST_HEADER_ONLY_ORIGIN_REQUEST_POLICY_ID =
+            "bf0718e1-ba1e-49d1-88b1-f726733018ae";
+    static final String MANAGED_USER_AGENT_REFERER_ORIGIN_REQUEST_POLICY_ID =
+            "acba4595-bd28-49b8-b9fe-13317c0390fa";
+    private static final Map<String, OriginRequestPolicy> MANAGED_ORIGIN_REQUEST_POLICIES =
+            managedOriginRequestPolicies();
 
     private final StorageBackend<String, Distribution> distStore;
     private final StorageBackend<String, List<Invalidation>> invalidationStore;
@@ -543,14 +562,19 @@ public class CloudFrontService {
     }
 
     public OriginRequestPolicy getOriginRequestPolicy(String id) {
-        return orpStore.get(id).orElseThrow(() ->
-                new AwsException("NoSuchOriginRequestPolicy",
+        return orpStore.get(id)
+                .or(() -> Optional.ofNullable(MANAGED_ORIGIN_REQUEST_POLICIES.get(id)))
+                .orElseThrow(() -> new AwsException("NoSuchOriginRequestPolicy",
                         "The specified origin request policy does not exist.", 404));
     }
 
     public synchronized OriginRequestPolicy updateOriginRequestPolicy(String id, String ifMatch,
                                                                        OriginRequestPolicy updated) {
         OriginRequestPolicy existing = getOriginRequestPolicy(id);
+        if (isManagedOriginRequestPolicy(id)) {
+            throw new AwsException("IllegalUpdate",
+                    "AWS managed origin request policies cannot be updated.", 400);
+        }
         if (!existing.getEtag().equals(ifMatch)) {
             throw new AwsException("InvalidIfMatchVersion",
                     "The If-Match version is missing or not valid for the resource.", 400);
@@ -564,6 +588,10 @@ public class CloudFrontService {
 
     public synchronized void deleteOriginRequestPolicy(String id, String ifMatch) {
         OriginRequestPolicy existing = getOriginRequestPolicy(id);
+        if (isManagedOriginRequestPolicy(id)) {
+            throw new AwsException("IllegalDelete",
+                    "AWS managed origin request policies cannot be deleted.", 400);
+        }
         if (!existing.getEtag().equals(ifMatch)) {
             throw new AwsException("InvalidIfMatchVersion",
                     "The If-Match version is missing or not valid for the resource.", 400);
@@ -577,12 +605,34 @@ public class CloudFrontService {
     }
 
     public List<OriginRequestPolicy> listOriginRequestPolicies(String marker, int maxItems) {
-        List<OriginRequestPolicy> all = new ArrayList<>(orpStore.scan(k -> true));
+        return listOriginRequestPolicies(marker, maxItems, null);
+    }
+
+    /**
+     * Lists custom and AWS managed origin request policies; {@code type} narrows the list to the
+     * AWS lowercase {@code managed} or {@code custom} value.
+     */
+    public List<OriginRequestPolicy> listOriginRequestPolicies(String marker, int maxItems, String type) {
+        if (type != null && !"custom".equals(type) && !"managed".equals(type)) {
+            throw new AwsException("InvalidArgument",
+                    "Origin request policy Type must be managed or custom.", 400);
+        }
+        List<OriginRequestPolicy> all = new ArrayList<>();
+        if (!"managed".equals(type)) {
+            all.addAll(orpStore.scan(k -> true));
+        }
+        if (!"custom".equals(type)) {
+            all.addAll(MANAGED_ORIGIN_REQUEST_POLICIES.values());
+        }
         all.sort((a, b) -> a.getName() != null && b.getName() != null
                 ? a.getName().compareTo(b.getName()) : a.getId().compareTo(b.getId()));
         return paginate(all, marker, maxItems, OriginRequestPolicy::getId);
     }
 
+    static boolean isManagedOriginRequestPolicy(String id) {
+        return MANAGED_ORIGIN_REQUEST_POLICIES.containsKey(id);
+    }
+
     // ── Response Headers Policies ─────────────────────────────────────────────
 
     public synchronized ResponseHeadersPolicy createResponseHeadersPolicy(ResponseHeadersPolicy policy) {
@@ -840,6 +890,112 @@ public class CloudFrontService {
         return Map.copyOf(policies);
     }
 
+    /**
+     * The AWS managed origin request policies, with the IDs and settings the CloudFront Developer
+     * Guide lists under "Use managed origin request policies".
+     */
+    private static Map<String, OriginRequestPolicy> managedOriginRequestPolicies() {
+        Map<String, OriginRequestPolicy> policies = new LinkedHashMap<>();
+        policies.put(MANAGED_ALL_VIEWER_ORIGIN_REQUEST_POLICY_ID, managedOriginRequestPolicy(
+                MANAGED_ALL_VIEWER_ORIGIN_REQUEST_POLICY_ID, "Managed-AllViewer",
+                "Includes all values (headers, cookies, and query strings) from the viewer request",
+                selection("HeaderBehavior", "allViewer", "Headers", List.of()),
+                selection("CookieBehavior", "all", "Cookies", List.of()),
+                selection("QueryStringBehavior", "all", "QueryStrings", List.of())));
+        policies.put(MANAGED_ALL_VIEWER_AND_CLOUDFRONT_HEADERS_ORIGIN_REQUEST_POLICY_ID,
+                managedOriginRequestPolicy(
+                        MANAGED_ALL_VIEWER_AND_CLOUDFRONT_HEADERS_ORIGIN_REQUEST_POLICY_ID,
+                        "Managed-AllViewerAndCloudFrontHeaders-2022-06",
+                        "Includes all values from the viewer request and all CloudFront headers "
+                                + "released through June 2022",
+                        selection("HeaderBehavior", "allViewerAndWhitelistCloudFront", "Headers",
+                                List.of("CloudFront-Forwarded-Proto", "CloudFront-Is-Android-Viewer",
+                                        "CloudFront-Is-Desktop-Viewer", "CloudFront-Is-IOS-Viewer",
+                                        "CloudFront-Is-Mobile-Viewer", "CloudFront-Is-SmartTV-Viewer",
+                                        "CloudFront-Is-Tablet-Viewer", "CloudFront-Viewer-Address",
+                                        "CloudFront-Viewer-ASN", "CloudFront-Viewer-City",
+                                        "CloudFront-Viewer-Country", "CloudFront-Viewer-Country-Name",
+                                        "CloudFront-Viewer-Country-Region",
+                                        "CloudFront-Viewer-Country-Region-Name",
+                                        "CloudFront-Viewer-Http-Version", "CloudFront-Viewer-Latitude",
+                                        "CloudFront-Viewer-Longitude", "CloudFront-Viewer-Metro-Code",
+                                        "CloudFront-Viewer-Postal-Code", "CloudFront-Viewer-Time-Zone",
+                                        "CloudFront-Viewer-TLS")),
+                        selection("CookieBehavior", "all", "Cookies", List.of()),
+                        selection("QueryStringBehavior", "all", "QueryStrings", List.of())));
+        policies.put(MANAGED_ALL_VIEWER_EXCEPT_HOST_HEADER_ORIGIN_REQUEST_POLICY_ID,
+                managedOriginRequestPolicy(
+                        MANAGED_ALL_VIEWER_EXCEPT_HOST_HEADER_ORIGIN_REQUEST_POLICY_ID,
+                        "Managed-AllViewerExceptHostHeader",
+                        "Includes all values from the viewer request except the Host header",
+                        selection("HeaderBehavior", "allExcept", "Headers", List.of("Host")),
+                        selection("CookieBehavior", "all", "Cookies", List.of()),
+                        selection("QueryStringBehavior", "all", "QueryStrings", List.of())));
+        policies.put(MANAGED_CORS_CUSTOM_ORIGIN_ORIGIN_REQUEST_POLICY_ID, managedOriginRequestPolicy(
+                MANAGED_CORS_CUSTOM_ORIGIN_ORIGIN_REQUEST_POLICY_ID, "Managed-CORS-CustomOrigin",
+                "Includes the header that enables CORS requests when the origin is a custom origin",
+                selection("HeaderBehavior", "whitelist", "Headers", List.of("Origin")),
+                selection("CookieBehavior", "none", "Cookies", List.of()),
+                selection("QueryStringBehavior", "none", "QueryStrings", List.of())));
+        policies.put(MANAGED_CORS_S3_ORIGIN_ORIGIN_REQUEST_POLICY_ID, managedOriginRequestPolicy(
+                MANAGED_CORS_S3_ORIGIN_ORIGIN_REQUEST_POLICY_ID, "Managed-CORS-S3Origin",
+                "Includes the headers that enable CORS requests when the origin is an Amazon S3 bucket",
+                selection("HeaderBehavior", "whitelist", "Headers", List.of(
+                        "Origin", "Access-Control-Request-Headers", "Access-Control-Request-Method")),
+                selection("CookieBehavior", "none", "Cookies", List.of()),
+                selection("QueryStringBehavior", "none", "QueryStrings", List.of())));
+        policies.put(MANAGED_MEDIATAILOR_ORIGIN_REQUEST_POLICY_ID, managedOriginRequestPolicy(
+                MANAGED_MEDIATAILOR_ORIGIN_REQUEST_POLICY_ID,
+                "Managed-Elemental-MediaTailor-PersonalizedManifests",
+                "For use with an origin that is an AWS Elemental MediaTailor endpoint",
+                selection("HeaderBehavior", "whitelist", "Headers", List.of(
+                        "Origin", "Access-Control-Request-Headers", "Access-Control-Request-Method",
+                        "User-Agent", "X-Forwarded-For")),
+                selection("CookieBehavior", "none", "Cookies", List.of()),
+                selection("QueryStringBehavior", "all", "QueryStrings", List.of())));
+        policies.put(MANAGED_HOST_HEADER_ONLY_ORIGIN_REQUEST_POLICY_ID, managedOriginRequestPolicy(
+                MANAGED_HOST_HEADER_ONLY_ORIGIN_REQUEST_POLICY_ID, "Managed-HostHeaderOnly",
+                "Includes only the Host header from the viewer request",
+                selection("HeaderBehavior", "whitelist", "Headers", List.of("Host")),
+                selection("CookieBehavior", "none", "Cookies", List.of()),
+                selection("QueryStringBehavior", "none", "QueryStrings", List.of())));
+        policies.put(MANAGED_USER_AGENT_REFERER_ORIGIN_REQUEST_POLICY_ID, managedOriginRequestPolicy(
+                MANAGED_USER_AGENT_REFERER_ORIGIN_REQUEST_POLICY_ID, "Managed-UserAgentRefererHeaders",
+                "Includes only the User-Agent and Referer headers",
+                selection("HeaderBehavior", "whitelist", "Headers", List.of("User-Agent", "Referer")),
+                selection("CookieBehavior", "none", "Cookies", List.of()),
+                selection("QueryStringBehavior", "none", "QueryStrings", List.of())));
+        return Map.copyOf(policies);
+    }
+
+    private static OriginRequestPolicy managedOriginRequestPolicy(
+            String id, String name, String comment, Map<String, Object> headers,
+            Map<String, Object> cookies, Map<String, Object> queryStrings) {
+        Map<String, Object> config = new LinkedHashMap<>();
+        config.put("HeadersConfig", headers);
+        config.put("CookiesConfig", cookies);
+        config.put("QueryStringsConfig", queryStrings);
+        OriginRequestPolicy policy = new OriginRequestPolicy();
+        policy.setId(id);
+        policy.setName(name);
+        policy.setComment(comment);
+        policy.setEtag("E23ZP02F085DFQ");
+        policy.setLastModifiedTime(Instant.EPOCH);
+        policy.setConfig(Map.copyOf(config));
+        return policy;
+    }
+
+    /** One policy selection block, in the shape {@link CloudFrontPolicyConfigCodec} stores. */
+    private static Map<String, Object> selection(String behaviorKey, String behavior,
+                                                 String listKey, List<String> names) {
+        Map<String, Object> block = new LinkedHashMap<>();
+        block.put(behaviorKey, behavior);
+        if (!names.isEmpty()) {
+            block.put(listKey, List.copyOf(names));
+        }
+        return Map.copyOf(block);
+    }
+
     private static ResponseHeadersPolicy managedResponseHeadersPolicy(
             String id, String name, String comment, Map<String, Object> config) {
         ResponseHeadersPolicy policy = new ResponseHeadersPolicy();
@@ -1072,6 +1228,7 @@ public class CloudFrontService {
     // ── CloudFront Functions ──────────────────────────────────────────────────
 
     public synchronized CloudFrontFunction createFunction(CloudFrontFunction fn) {
+        validateFunctionRuntime(fn.getRuntime());
         fn.setStage("DEVELOPMENT");
         fn.setStatus("UNPUBLISHED");
         fn.setEtag(UUID.randomUUID().toString());
@@ -1096,6 +1253,7 @@ public class CloudFrontService {
 
     public synchronized CloudFrontFunction updateFunction(String name, String ifMatch,
                                                           CloudFrontFunction updated) {
+        validateFunctionRuntime(updated.getRuntime());
         CloudFrontFunction existing = describeFunction(name, null);
         if (!existing.getEtag().equals(ifMatch)) {
             throw new AwsException("InvalidIfMatchVersion",
@@ -1168,6 +1326,13 @@ public class CloudFrontService {
         return effectiveStage;
     }
 
+    private static void validateFunctionRuntime(String runtime) {
+        if (runtime != null && !FUNCTION_RUNTIMES.contains(runtime)) {
+            throw new AwsException("InvalidArgument",
+                    "The parameter Runtime must be cloudfront-js-1.0 or cloudfront-js-2.0.", 400);
+        }
+    }
+
     private static AwsException invalidFunctionStage(String stage) {
         return new AwsException("InvalidArgument",
                 "The parameter Stage must be DEVELOPMENT or LIVE: " + stage, 400);

src/main/java/io/github/hectorvent/floci/services/cloudfront/CloudFrontServingController.java

@@ -10,24 +10,36 @@ import io.github.hectorvent.floci.services.cloudfront.model.OriginAccessControl;
 import io.github.hectorvent.floci.services.s3.S3Service;
 import io.github.hectorvent.floci.services.s3.model.S3Object;
 import io.quarkus.vertx.http.runtime.CurrentVertxRequest;
+import io.vertx.core.http.HttpServerRequest;
+import io.vertx.core.http.HttpVersion;
+import io.vertx.core.net.SocketAddress;
 import jakarta.annotation.PreDestroy;
 import jakarta.inject.Inject;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DELETE;
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.HEAD;
 import jakarta.ws.rs.OPTIONS;
+import jakarta.ws.rs.PATCH;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.PUT;
 import jakarta.ws.rs.Path;
 import jakarta.ws.rs.PathParam;
 import jakarta.ws.rs.core.Context;
 import jakarta.ws.rs.core.HttpHeaders;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.StreamingOutput;
 import jakarta.ws.rs.core.UriInfo;
 import org.jboss.logging.Logger;
+import org.jboss.resteasy.reactive.server.core.CurrentRequestManager;
 
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.PushbackInputStream;
 import java.net.IDN;
 import java.net.URI;
 import java.net.http.HttpRequest;
-import java.net.http.HttpResponse;
 import java.nio.charset.StandardCharsets;
 import java.time.Duration;
 import java.time.Instant;
@@ -53,14 +65,19 @@ import java.util.Set;
  * <ul>
  *   <li>S3 origins are read in-process through {@link S3Service} (the bucket is derived from the
  *       origin domain name).</li>
- *   <li>Custom origins are fetched over HTTP(S) with {@link java.net.http.HttpClient}.</li>
+ *   <li>Custom origins are fetched over HTTP(S) with {@link CloudFrontOriginHttpClient}, carrying the
+ *       viewer headers, cookies and query strings the matched behavior forwards, as decided by
+ *       {@link CloudFrontOriginRequestBuilder}.</li>
  *   <li>When an origin returns an error status, a matching {@code CustomErrorResponse} is applied —
  *       most importantly the single-page-app fallback that rewrites 403/404 to 200 {@code /index.html}.
  *       If the configured error page is itself missing, the received status is returned (no loop).</li>
  * </ul>
  *
  * <p>Viewer-protocol-policy enforcement is intentionally out of scope for this layer: the emulator
- * is HTTP-first. GET/HEAD are served, and OPTIONS is served only when the matched behavior allows it.
+ * is HTTP-first. Every CloudFront viewer method (GET, HEAD, OPTIONS, POST, PUT, PATCH, DELETE) is
+ * served when the matched behavior's {@code AllowedMethods} includes it. POST, PUT, PATCH and DELETE
+ * are forwarded to custom origins with the viewer request body and {@code Authorization} header; they
+ * are not forwarded to in-process S3 origins.
  */
 @Path("/_cloudfront/{distId}")
 public class CloudFrontServingController {
@@ -80,6 +97,8 @@ public class CloudFrontServingController {
 
     private static final java.util.Set<String> CLOUDFRONT_SIGNING_PARAMS =
             java.util.Set.of("Expires", "Signature", "Key-Pair-Id", "Policy", "Hash-Algorithm");
+    /** Viewer methods that can carry a request body and that CloudFront never caches. */
+    private static final Set<String> BODY_METHODS = Set.of("POST", "PUT", "PATCH", "DELETE");
 
     private final CloudFrontService service;
     private final S3Service s3Service;
@@ -117,7 +136,7 @@ public class CloudFrontServingController {
                 RequestHost.of(request),
                 headers.getHeaderString(HttpHeaders.AUTHORIZATION),
                 request.getHeader("Origin"), "GET", null, null,
-                request.getHeader("Pragma"));
+                request.getHeader("Pragma"), null);
     }
 
     @HEAD
@@ -131,7 +150,7 @@ public class CloudFrontServingController {
                 RequestHost.of(request),
                 headers.getHeaderString(HttpHeaders.AUTHORIZATION),
                 request.getHeader("Origin"), "HEAD", null, null,
-                request.getHeader("Pragma"));
+                request.getHeader("Pragma"), null);
     }
 
     @OPTIONS
@@ -147,7 +166,86 @@ public class CloudFrontServingController {
                 request.getHeader("Origin"), "OPTIONS",
                 request.getHeader("Access-Control-Request-Method"),
                 request.getHeader("Access-Control-Request-Headers"),
-                request.getHeader("Pragma"));
+                request.getHeader("Pragma"), null);
+    }
+
+    @POST
+    @Path("/{proxy:.*}")
+    @Consumes(MediaType.WILDCARD)
+    public Response post(@PathParam("distId") String distId, @PathParam("proxy") String proxy,
+                         @Context HttpHeaders headers, @Context UriInfo uriInfo, InputStream body) {
+        return serveWithBody(distId, "POST", headers, uriInfo, body);
+    }
+
+    @PUT
+    @Path("/{proxy:.*}")
+    @Consumes(MediaType.WILDCARD)
+    public Response put(@PathParam("distId") String distId, @PathParam("proxy") String proxy,
+                        @Context HttpHeaders headers, @Context UriInfo uriInfo, InputStream body) {
+        return serveWithBody(distId, "PUT", headers, uriInfo, body);
+    }
+
+    @PATCH
+    @Path("/{proxy:.*}")
+    @Consumes(MediaType.WILDCARD)
+    public Response patch(@PathParam("distId") String distId, @PathParam("proxy") String proxy,
+                          @Context HttpHeaders headers, @Context UriInfo uriInfo, InputStream body) {
+        return serveWithBody(distId, "PATCH", headers, uriInfo, body);
+    }
+
+    @DELETE
+    @Path("/{proxy:.*}")
+    @Consumes(MediaType.WILDCARD)
+    public Response delete(@PathParam("distId") String distId, @PathParam("proxy") String proxy,
+                           @Context HttpHeaders headers, @Context UriInfo uriInfo, InputStream body) {
+        return serveWithBody(distId, "DELETE", headers, uriInfo, body);
+    }
+
+    private Response serveWithBody(String distId, String method, HttpHeaders headers,
+                                   UriInfo uriInfo, InputStream body) {
+        HttpServerRequest request = currentVertxRequest.getCurrent().request();
+        String rawViewerPath = rawViewerPath(request.uri());
+        return serve(distId, rawViewerPath, decodedViewerPath(rawViewerPath),
+                uriInfo.getRequestUri().getScheme(),
+                RequestHost.of(request),
+                headers.getHeaderString(HttpHeaders.AUTHORIZATION),
+                request.getHeader("Origin"), method, null, null,
+                request.getHeader("Pragma"),
+                viewerBody(body, headers.getHeaderString("Transfer-Encoding"),
+                        headers.getHeaderString(HttpHeaders.CONTENT_LENGTH)));
+    }
+
+    /**
+     * The viewer's request body and its length. It is {@code -1} when the body comes chunked, which
+     * takes precedence over any {@code Content-Length} as HTTP has it, and otherwise the
+     * {@code Content-Length}. With neither header an HTTP/1.1 request has no body, but an HTTP/2 one
+     * can still send one, so the body is looked at: one that is already at its end is empty, and one
+     * that is not is forwarded chunked.
+     */
+    static ViewerBody viewerBody(InputStream body, String transferEncoding, String contentLength) {
+        InputStream stream = body != null ? body : InputStream.nullInputStream();
+        if (transferEncoding != null) {
+            return new ViewerBody(stream, -1);
+        }
+        if (contentLength != null && !contentLength.isBlank()) {
+            try {
+                return new ViewerBody(stream, Long.parseLong(contentLength.trim()));
+            } catch (NumberFormatException e) {
+                LOG.debugv("Treating an invalid viewer Content-Length as chunked: {0}", e.getMessage());
+                return new ViewerBody(stream, -1);
+            }
+        }
+        PushbackInputStream peekable = new PushbackInputStream(stream, 1);
+        try {
+            int first = peekable.read();
+            if (first < 0) {
+                return new ViewerBody(InputStream.nullInputStream(), 0);
+            }
+            peekable.unread(first);
+        } catch (IOException e) {
+            LOG.debugv("Could not read the start of a viewer request body: {0}", e.getMessage());
+        }
+        return new ViewerBody(peekable, -1);
     }
 
     private Response serve(String distId, String rawViewerPath, String decodedViewerPath,
@@ -156,7 +254,8 @@ public class CloudFrontServingController {
                            String viewerOrigin, String method,
                            String accessControlRequestMethod,
                            String accessControlRequestHeaders,
-                           String pragma) {
+                           String pragma,
+                           ViewerBody viewerBody) {
         boolean includeBody = !"HEAD".equals(method);
         boolean preflightRequest = "OPTIONS".equals(method)
                 && viewerOrigin != null && !viewerOrigin.isBlank()
@@ -199,11 +298,17 @@ public class CloudFrontServingController {
 
         OriginResponse origin = route(dist, normalized, rawViewerPath, decodedViewerPath,
                 viewerScheme, viewerAuthorization, method, viewerOrigin,
-                accessControlRequestMethod, accessControlRequestHeaders);
+                accessControlRequestMethod, accessControlRequestHeaders, viewerBody);
 
         if (origin.status() >= 400) {
-            Response fallback = applyCustomError(
-                    dist, origin, viewerScheme, viewerAuthorization, includeBody, directives);
+            Response fallback;
+            try {
+                fallback = applyCustomError(
+                        dist, origin, viewerScheme, viewerAuthorization, includeBody, directives);
+            } catch (RuntimeException e) {
+                origin.closeStream();
+                throw e;
+            }
             if (fallback != null) {
                 return fallback;
             }
@@ -345,7 +450,8 @@ public class CloudFrontServingController {
                                  String viewerScheme, String viewerAuthorization,
                                  String method, String viewerOrigin,
                                  String accessControlRequestMethod,
-                                 String accessControlRequestHeaders) {
+                                 String accessControlRequestHeaders,
+                                 ViewerBody viewerBody) {
         DistributionConfig config = distribution.getConfig();
         String originId = CloudFrontRequestRouter.matchTargetOriginId(config, normalized);
         Origin origin = CloudFrontRequestRouter.findOrigin(config, originId);
@@ -357,6 +463,14 @@ public class CloudFrontServingController {
                 return fetchS3Preflight(origin, viewerOrigin, accessControlRequestMethod,
                         accessControlRequestHeaders);
             }
+            if (BODY_METHODS.contains(method)) {
+                // AWS forwards these methods and S3 evaluates them against the bucket policy (OAC
+                // supports PUT and DELETE). The in-process origin authorizes reads only, so a write is
+                // answered as S3 answers a request that holds no write grant.
+                LOG.debugv("CloudFront does not forward {0} requests to in-process S3 origin {1}",
+                        method, origin.getId());
+                return OriginResponse.error(403, "Access Denied");
+            }
             String key = CloudFrontRequestRouter.resolveOriginKey(
                     origin.getOriginPath(), decodedViewerPath, config.getDefaultRootObject());
             return fetchFromS3(
@@ -364,11 +478,86 @@ public class CloudFrontServingController {
         }
         String forwardUri = CloudFrontRequestRouter.resolveForwardUri(
                 origin.getOriginPath(), rawViewerPath, config.getDefaultRootObject());
-        // CloudFront forwards viewer query strings only when selected by a cache policy,
-        // origin request policy, or legacy ForwardedValues configuration. Those policy
-        // semantics are not modeled in the data plane yet, so the AWS default is to omit them.
-        return fetchFromCustomOrigin(origin, forwardUri, null, viewerScheme, method,
-                viewerOrigin, accessControlRequestMethod, accessControlRequestHeaders);
+        CloudFrontOriginRequestBuilder.OriginRequest originRequest =
+                CloudFrontOriginRequestBuilder.build(viewerRequest(method, viewerScheme),
+                        forwarding(config, normalized), distribution.getDomainName());
+        return fetchFromCustomOrigin(
+                origin, forwardUri, originRequest, viewerScheme, method, viewerBody);
+    }
+
+    /** The live viewer request, with CloudFront's signing parameters removed from its query. */
+    private CloudFrontOriginRequestBuilder.ViewerRequest viewerRequest(
+            String method, String viewerScheme) {
+        HttpServerRequest request = currentVertxRequest.getCurrent().request();
+        List<CloudFrontOriginRequestBuilder.Header> headers = new ArrayList<>();
+        for (Map.Entry<String, String> header : request.headers()) {
+            headers.add(new CloudFrontOriginRequestBuilder.Header(header.getKey(), header.getValue()));
+        }
+        String appQuery = stripCloudFrontSigningParams(request.query());
+        SocketAddress client = request.remoteAddress();
+        return new CloudFrontOriginRequestBuilder.ViewerRequest(method, headers,
+                appQuery.isEmpty() ? null : appQuery,
+                client != null ? client.hostAddress() : null,
+                client != null ? client.port() : -1,
+                viewerScheme, httpVersion(request.version()));
+    }
+
+    private static String httpVersion(HttpVersion version) {
+        if (version == null) {
+            return null;
+        }
+        return switch (version) {
+            case HTTP_1_0 -> "1.0";
+            case HTTP_1_1 -> "1.1";
+            case HTTP_2 -> "2.0";
+        };
+    }
+
+    /**
+     * Resolves what the matched behavior forwards: legacy {@code ForwardedValues} when it has no cache
+     * policy, otherwise its cache policy parameters and origin request policy.
+     */
+    private CloudFrontOriginRequestBuilder.Forwarding forwarding(
+            DistributionConfig config, String normalized) {
+        CloudFrontRequestRouter.BehaviorForwarding behavior =
+                CloudFrontRequestRouter.matchForwarding(config, normalized);
+        boolean optionsCached = behavior.cachedMethods() != null
+                && behavior.cachedMethods().contains("OPTIONS");
+        if (behavior.cachePolicyId() == null || behavior.cachePolicyId().isBlank()) {
+            return CloudFrontOriginRequestBuilder.Forwarding.legacy(
+                    behavior.forwardedValues(), optionsCached);
+        }
+        return CloudFrontOriginRequestBuilder.Forwarding.policies(
+                cachePolicyParameters(behavior.cachePolicyId()),
+                originRequestPolicyConfig(behavior.originRequestPolicyId()), optionsCached);
+    }
+
+    private Map<?, ?> cachePolicyParameters(String cachePolicyId) {
+        try {
+            Map<String, Object> config = service.getCachePolicy(cachePolicyId).getConfig();
+            return config != null
+                    && config.get("ParametersInCacheKeyAndForwardedToOrigin") instanceof Map<?, ?> parameters
+                    ? parameters : null;
+        } catch (AwsException e) {
+            // AWS managed cache policies are not modeled. The common ones (CachingDisabled,
+            // CachingOptimized) forward no viewer values, which is what an unknown id contributes.
+            LOG.debugv("Cache policy {0} is not defined; it forwards no viewer values", cachePolicyId);
+            return null;
+        }
+    }
+
+    private Map<?, ?> originRequestPolicyConfig(String originRequestPolicyId) {
+        if (originRequestPolicyId == null || originRequestPolicyId.isBlank()) {
+            return null;
+        }
+        try {
+            return service.getOriginRequestPolicy(originRequestPolicyId).getConfig();
+        } catch (AwsException e) {
+            // Distribution writes do not validate this reference, so keep serving without the policy
+            // but make the dangling id visible.
+            LOG.warnv("Distribution references missing origin request policy {0}", originRequestPolicyId);
+            return null;
+        }
     }
 
     private OriginResponse fetchFromS3(
@@ -386,10 +575,12 @@ public class CloudFrontServingController {
             authorizeS3OriginRead(
                     distribution, origin, bucket, key, viewerAuthorization);
             if (includeBody) {
-                S3Object obj = s3Service.getObject(bucket, key);
-                byte[] data = obj.getData() != null ? obj.getData() : new byte[0];
+                // The body is streamed to the viewer, so an object of any size is served without
+                // being read into the heap; the metadata and the stream come from one snapshot.
+                S3Service.ObjectRead read = s3Service.openObject(bucket, key, null);
+                S3Object obj = read.object();
                 response = new OriginResponse(
-                        200, contentType(obj), data, data.length, s3ObjectHeaders(obj));
+                        200, contentType(obj), null, read.body(), obj.getSize(), s3ObjectHeaders(obj));
             } else {
                 S3Object meta = s3Service.headObject(bucket, key);
                 response = new OriginResponse(
@@ -398,8 +589,13 @@ public class CloudFrontServingController {
         } catch (AwsException e) {
             response = OriginResponse.error(e.getHttpStatus(), e.getMessage());
         }
-        return withS3CorsHeaders(
-                bucket, origin, includeBody ? "GET" : "HEAD", response);
+        try {
+            return withS3CorsHeaders(
+                    bucket, origin, includeBody ? "GET" : "HEAD", response);
+        } catch (RuntimeException e) {
+            response.closeStream();
+            throw e;
+        }
     }
 
     private void authorizeS3OriginRead(
@@ -490,15 +686,17 @@ public class CloudFrontServingController {
                         "This CORS request is not allowed."));
     }
 
-    /** Fetches from a custom (non-S3) origin. {@code forwardUri} already includes the origin path. */
-    private OriginResponse fetchFromCustomOrigin(Origin origin, String forwardUri, String rawQuery,
-                                                 String viewerScheme, String method, String viewerOrigin,
-                                                 String accessControlRequestMethod,
-                                                 String accessControlRequestHeaders) {
+    /**
+     * Fetches from a custom (non-S3) origin. {@code forwardUri} already includes the origin path;
+     * {@code originRequest} carries the forwarded query and headers.
+     */
+    private OriginResponse fetchFromCustomOrigin(Origin origin, String forwardUri,
+                                                 CloudFrontOriginRequestBuilder.OriginRequest originRequest,
+                                                 String viewerScheme, String method, ViewerBody viewerBody) {
         boolean includeBody = !"HEAD".equals(method);
         try {
             URI target = buildCustomOriginUri(
-                    origin, viewerScheme, forwardUri, rawQuery);
+                    origin, viewerScheme, forwardUri, originRequest.rawQuery());
             HttpRequest.Builder rb = HttpRequest.newBuilder()
                     .uri(target)
                     .timeout(Duration.ofSeconds(30));
@@ -517,18 +715,19 @@ public class CloudFrontServingController {
                 }
             }
             rb.method(method, HttpRequest.BodyPublishers.noBody());
-            if ("OPTIONS".equals(method)) {
-                addRequestHeader(rb, "Origin", viewerOrigin);
-                addRequestHeader(rb, "Access-Control-Request-Method", accessControlRequestMethod);
-                addRequestHeader(rb, "Access-Control-Request-Headers", accessControlRequestHeaders);
-            }
-            HttpResponse<byte[]> resp = httpClient.send(
-                    rb.build(), originHeaders, HttpResponse.BodyHandlers.ofByteArray());
+            // Both bodies are streamed, so neither has to fit in memory: the viewer's goes out with its
+            // own Content-Length, or chunked as it came, and the origin's comes back as it arrives.
+            ViewerBody requestBody = originRequestBody(method, viewerBody);
+            CloudFrontOriginHttpClient.OpenResponse resp = httpClient.open(rb.build(), originRequest.headers(),
+                    originHeaders, requestBody != null ? requestBody.stream() : null,
+                    requestBody != null ? requestBody.length() : -1);
             String ct = resp.headers().firstValue("content-type").orElse(DEFAULT_CONTENT_TYPE);
-            byte[] body = resp.body() != null ? resp.body() : new byte[0];
-            long contentLength = includeBody ? body.length : responseContentLength(resp);
-            return new OriginResponse(resp.statusCode(), ct, includeBody ? body : null,
-                    contentLength, resp.headers().map());
+            long contentLength = resp.contentLength();
+            if (!includeBody) {
+                resp.body().close();
+                return new OriginResponse(resp.statusCode(), ct, null, contentLength, resp.headers().map());
+            }
+            return new OriginResponse(resp.statusCode(), ct, null, resp.body(), contentLength, resp.headers().map());
         } catch (InterruptedException e) {
             Thread.currentThread().interrupt();
             LOG.warnv("CloudFront custom origin fetch was interrupted for host {0}",
@@ -542,6 +741,24 @@ public class CloudFrontServingController {
         }
     }
 
+    /**
+     * The body CloudFront sends to the origin: POST, PUT and PATCH always carry one (possibly empty, so
+     * the origin still sees {@code Content-Length: 0}); DELETE carries one only when the viewer sent it.
+     */
+    private static ViewerBody originRequestBody(String method, ViewerBody viewerBody) {
+        if (viewerBody == null || !BODY_METHODS.contains(method)) {
+            return null;
+        }
+        if ("DELETE".equals(method) && viewerBody.length() == 0) {
+            return null;
+        }
+        return viewerBody;
+    }
+
+    /** A viewer request body, read as it is forwarded, and its length, {@code -1} when it comes chunked. */
+    record ViewerBody(InputStream stream, long length) {
+    }
+
     private static String originAccessIdentityId(Origin origin) {
         Map<String, String> config = origin.getS3OriginConfig();
         String value = config != null ? config.get("OriginAccessIdentity") : null;
@@ -639,15 +856,6 @@ public class CloudFrontServingController {
         return normalized.toLowerCase(Locale.ROOT);
     }
 
-    private static long responseContentLength(HttpResponse<?> response) {
-        try {
-            return response.headers().firstValueAsLong("content-length").orElse(-1L);
-        } catch (NumberFormatException e) {
-            LOG.debugv("Ignoring invalid custom-origin Content-Length: {0}", e.getMessage());
-            return -1L;
-        }
-    }
-
     private static String safeOriginName(Origin origin) {
         try {
             return normalizeOriginHost(origin.getDomainName());
@@ -688,8 +896,7 @@ public class CloudFrontServingController {
         String pagePath = str(cer.get("ResponsePagePath"));
         if (pagePath.isBlank()) {
             // ResponseCode override with no custom page: keep the origin body, change the status.
-            return toResponse(new OriginResponse(responseCode, origin.contentType(), origin.body(),
-                    origin.contentLength(), origin.headers()), includeBody, directives);
+            return toResponse(origin.withStatus(responseCode), includeBody, directives);
         }
 
         String errNormalized = CloudFrontRequestRouter.normalizePath(pagePath);
@@ -699,6 +906,8 @@ public class CloudFrontServingController {
             return null;
         }
 
+        // The custom error page replaces the origin's error response, which is not sent.
+        origin.closeStream();
         OriginResponse page;
         if (CloudFrontRequestRouter.isS3Origin(errOrigin)) {
             String key = CloudFrontRequestRouter.resolveOriginKey(errOrigin.getOriginPath(), errNormalized, null);
@@ -707,16 +916,15 @@ public class CloudFrontServingController {
         } else {
             String forwardUri = CloudFrontRequestRouter.resolveForwardUri(errOrigin.getOriginPath(), errNormalized, null);
             page = fetchFromCustomOrigin(
-                    errOrigin, forwardUri, null, viewerScheme,
-                    includeBody ? "GET" : "HEAD", null, null, null);
+                    errOrigin, forwardUri, CloudFrontOriginRequestBuilder.OriginRequest.empty(),
+                    viewerScheme, includeBody ? "GET" : "HEAD", null);
         }
         if (page.status() >= 400) {
             // Custom error page unavailable → return the status received from the error-page origin
             // (AWS behavior), without recursively applying custom error handling.
             return toResponse(page, includeBody, directives);
         }
-        return toResponse(new OriginResponse(responseCode, page.contentType(), page.body(),
-                page.contentLength(), page.headers()), includeBody, directives);
+        return toResponse(page.withStatus(responseCode), includeBody, directives);
     }
 
     private Map<String, Object> matchCustomError(DistributionConfig config, int status) {
@@ -734,21 +942,43 @@ public class CloudFrontServingController {
 
     private Response toResponse(OriginResponse origin, boolean includeBody,
                                 ResponseHeadersPolicyConfigCodec.Directives directives) {
-        Response.ResponseBuilder rb = Response.status(origin.status());
-        HeaderCollection collected = collectResponseHeaders(origin, includeBody);
-        applyResponseHeadersPolicy(collected.headers(), directives, collected.forbiddenPolicyHeaders());
-        for (HeaderValues header : collected.headers().values()) {
-            if ("date".equalsIgnoreCase(header.name())) {
-                currentVertxRequest.getCurrent().response()
-                        .putHeader(header.name(), header.values());
-            } else {
-                header.values().forEach(value -> rb.header(header.name(), value));
+        try {
+            Response.ResponseBuilder rb = Response.status(origin.status());
+            HeaderCollection collected = collectResponseHeaders(origin, includeBody);
+            applyResponseHeadersPolicy(collected.headers(), directives, collected.forbiddenPolicyHeaders());
+            for (HeaderValues header : collected.headers().values()) {
+                if ("date".equalsIgnoreCase(header.name())) {
+                    currentVertxRequest.getCurrent().response()
+                            .putHeader(header.name(), header.values());
+                } else {
+                    header.values().forEach(value -> rb.header(header.name(), value));
+                }
             }
+            if (includeBody && origin.stream() != null) {
+                // A disconnected viewer can skip StreamingOutput entirely, so its finally block
+                // alone cannot release the origin connection.
+                CurrentRequestManager.get().registerCompletionCallback(ignored -> origin.closeStream());
+                InputStream body = origin.stream();
+                StreamingOutput entity = output -> {
+                    try (InputStream in = body) {
+                        in.transferTo(output);
+                    }
+                };
+                rb.entity(entity);
+            } else {
+                if (origin.stream() != null) {
+                    // A body that will not be sent, as for a HEAD, still holds its source open.
+                    origin.closeStream();
+                }
+                if (includeBody && origin.body() != null) {
+                    rb.entity(origin.body());
+                }
+            }
+            return rb.build();
+        } catch (RuntimeException e) {
+            origin.closeStream();
+            throw e;
         }
-        if (includeBody && origin.body() != null) {
-            rb.entity(origin.body());
-        }
-        return rb.build();
     }
 
     /**
@@ -784,7 +1014,8 @@ public class CloudFrontServingController {
         if (origin.contentType() != null) {
             setHeader(headers, "Content-Type", origin.contentType());
         }
-        if (!includeBody && origin.contentLength() >= 0) {
+        // A byte body sets its own length; a HEAD response and a streamed body need it stated.
+        if ((!includeBody || origin.stream() != null) && origin.contentLength() >= 0) {
             setHeader(headers, "Content-Length", Long.toString(origin.contentLength()));
         }
         return new HeaderCollection(headers, forbiddenPolicyHeaders);
@@ -935,12 +1166,7 @@ public class CloudFrontServingController {
                                 "Access-Control-Request-Method"));
             }
         });
-        return new OriginResponse(
-                response.status(),
-                response.contentType(),
-                response.body(),
-                response.contentLength(),
-                headers);
+        return response.withHeaders(headers);
     }
 
     private static String originCustomHeader(Origin origin, String requestedName) {
@@ -1006,12 +1232,6 @@ public class CloudFrontServingController {
         return values;
     }
 
-    private static void addRequestHeader(HttpRequest.Builder request, String name, String value) {
-        if (value != null && !value.isBlank()) {
-            request.header(name, value);
-        }
-    }
-
     private static String str(Object value) {
         return value != null ? value.toString() : "";
     }
@@ -1039,12 +1259,42 @@ public class CloudFrontServingController {
                                     Set<String> forbiddenPolicyHeaders) {
     }
 
-    /** The result of fetching from an origin, including end-to-end response headers. */
-    private record OriginResponse(int status, String contentType, byte[] body, long contentLength,
-                                  Map<String, List<String>> headers) {
+    /**
+     * The result of fetching from an origin, including end-to-end response headers. An origin's
+     * content, from an S3 object or a custom origin, is an open {@code stream} instead of
+     * {@code body}, so it never passes through the heap; the viewer response writes and closes it.
+     * {@code body} holds the bytes of a response Floci makes itself, such as an error.
+     */
+    private record OriginResponse(int status, String contentType, byte[] body, InputStream stream,
+                                  long contentLength, Map<String, List<String>> headers) {
+        OriginResponse(int status, String contentType, byte[] body, long contentLength,
+                       Map<String, List<String>> headers) {
+            this(status, contentType, body, null, contentLength, headers);
+        }
+
         static OriginResponse error(int status, String message) {
             byte[] b = message == null ? new byte[0] : message.getBytes(StandardCharsets.UTF_8);
             return new OriginResponse(status, MediaType.TEXT_PLAIN, b, b.length, Map.of());
         }
+
+        OriginResponse withStatus(int newStatus) {
+            return new OriginResponse(newStatus, contentType, body, stream, contentLength, headers);
+        }
+
+        OriginResponse withHeaders(Map<String, List<String>> newHeaders) {
+            return new OriginResponse(status, contentType, body, stream, contentLength, newHeaders);
+        }
+
+        /** Closes the stream of a response that will not be written. */
+        void closeStream() {
+            if (stream == null) {
+                return;
+            }
+            try {
+                stream.close();
+            } catch (IOException e) {
+                LOG.debugv("Could not close an unsent origin body: {0}", e.getMessage());
+            }
+        }
     }
 }

src/main/java/io/github/hectorvent/floci/services/cloudwatch/dashboards/CloudWatchDashboardsService.java

@@ -179,29 +179,82 @@ public class CloudWatchDashboardsService {
     }
 
     public Map<String, String> listTagsForResource(String resourceArn, String region) {
-        return findByArn(resourceArn, region).map(Dashboard::getTags).orElse(Map.of());
+        return requireDashboard(resourceArn, region).getTags();
     }
 
     public void tagResource(String resourceArn, Map<String, String> tags, String region) {
-        findByArn(resourceArn, region).ifPresent(dashboard -> {
-            dashboard.getTags().putAll(tags);
-            dashboardStore.put(key(region, dashboard.getDashboardName()), dashboard);
-        });
+        Dashboard dashboard = requireDashboard(resourceArn, region);
+        dashboard.getTags().putAll(tags);
+        dashboardStore.put(key(region, dashboard.getDashboardName()), dashboard);
     }
 
     public void untagResource(String resourceArn, List<String> tagKeys, String region) {
-        findByArn(resourceArn, region).ifPresent(dashboard -> {
-            tagKeys.forEach(dashboard.getTags()::remove);
-            dashboardStore.put(key(region, dashboard.getDashboardName()), dashboard);
-        });
+        Dashboard dashboard = requireDashboard(resourceArn, region);
+        tagKeys.forEach(dashboard.getTags()::remove);
+        dashboardStore.put(key(region, dashboard.getDashboardName()), dashboard);
+    }
+
+    /**
+     * Resolves the dashboard an ARN names, or reports that nothing does. The tag operations
+     * declare {@code ResourceNotFoundException}, which is a different shape from the
+     * {@code ResourceNotFound} that {@code GetDashboard} declares,
+     * so this is not the {@link #notFound(String)} used by the rest of this service.
+     */
+    private Dashboard requireDashboard(String resourceArn, String region) {
+        return findByArn(resourceArn, region).orElseThrow(() ->
+                new AwsException("ResourceNotFoundException",
+                        "Dashboard does not exist: " + resourceArn, 404));
     }
 
     private java.util.Optional<Dashboard> findByArn(String resourceArn, String region) {
         return dashboardStore.scan(k -> k.startsWith(region + "::")).stream()
-                .filter(d -> d.getDashboardArn() != null && d.getDashboardArn().equals(resourceArn))
+                .filter(d -> namesDashboard(resourceArn, d.getDashboardArn()))
                 .findFirst();
     }
 
+    /**
+     * Whether {@code candidate} is an ARN for the dashboard whose own ARN is {@code stored}.
+     *
+     * <p>Both the region-ful and the regionless form resolve, deliberately, because the two
+     * disagree here and a caller may hold either. Dashboards are a global resource and AWS
+     * documents their ARN without a region on both the TagResource and the ListTagsForResource
+     * pages, {@code arn:aws:cloudwatch::<account-id>:dashboard/<dashboard-name>}, while Floci
+     * mints a region-ful one. That divergence used to be invisible on this path: an ARN
+     * matching nothing was a silent success answering an empty tag map. Now that it is an
+     * error, a caller sending the documented ARN for a dashboard that exists would be told the
+     * dashboard does not, so the lookup accepts both shapes.
+     *
+     * <p>What Floci mints is left alone here on purpose. Clients may already hold the ARNs it
+     * has handed out, so bringing the minted shape into line with AWS is a separate change
+     * from making the lookup tolerant, and only the second one is needed to keep this path
+     * correct.
+     *
+     * <p>Only an absent region is accepted in place of the dashboard's own, so an ARN naming
+     * some other region is still a miss rather than resolving to a same-named dashboard
+     * elsewhere.
+     */
+    private static boolean namesDashboard(String candidate, String stored) {
+        if (candidate == null || stored == null) {
+            return false;
+        }
+        return candidate.equals(stored) || candidate.equals(withoutRegion(stored));
+    }
+
+    /**
+     * Blanks the region field of an ARN, turning
+     * {@code arn:aws:cloudwatch:us-east-1:123:dashboard/x} into
+     * {@code arn:aws:cloudwatch::123:dashboard/x}. An ARN with fewer than six fields is
+     * returned unchanged, since there is no region field to blank.
+     */
+    private static String withoutRegion(String arn) {
+        String[] fields = arn.split(":", 6);
+        if (fields.length < 6) {
+            return arn;
+        }
+        fields[3] = "";
+        return String.join(":", fields);
+    }
+
     private static String key(String region, String dashboardName) {
         return region + "::" + dashboardName;
     }

src/main/java/io/github/hectorvent/floci/services/cloudwatch/metrics/AlarmEvaluator.java

@@ -275,9 +275,10 @@ public class AlarmEvaluator {
 
     private static boolean isEvaluable(MetricAlarm alarm) {
         return alarm.getRegion() != null
+                && alarm.getMetrics().isEmpty()
                 && alarm.getNamespace() != null && !alarm.getNamespace().isBlank()
                 && alarm.getMetricName() != null && !alarm.getMetricName().isBlank()
-                && alarm.getPeriod() > 0
+                && alarm.getPeriod() != null && alarm.getPeriod() > 0
                 && alarm.getEvaluationPeriods() > 0
                 && alarm.getComparisonOperator() != null;
     }

src/main/java/io/github/hectorvent/floci/services/cloudwatch/metrics/AlarmSnsNotifier.java

@@ -0,0 +1,155 @@
+package io.github.hectorvent.floci.services.cloudwatch.metrics;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import io.github.hectorvent.floci.core.common.AwsArnUtils;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.MetricAlarm;
+import io.github.hectorvent.floci.services.sns.SnsService;
+import jakarta.enterprise.context.ApplicationScoped;
+import org.jboss.logging.Logger;
+
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+
+/** Publishes SNS actions once per state transition, independently of scaling action retries. */
+@ApplicationScoped
+public class AlarmSnsNotifier {
+
+    /** The names CloudWatch writes in the alarm message's Region field; other regions use their ID. */
+    private static final Map<String, String> REGION_NAMES = Map.ofEntries(
+            Map.entry("us-east-1", "US East (N. Virginia)"),
+            Map.entry("us-east-2", "US East (Ohio)"),
+            Map.entry("us-west-1", "US West (N. California)"),
+            Map.entry("us-west-2", "US West (Oregon)"),
+            Map.entry("ca-central-1", "Canada (Central)"),
+            Map.entry("ca-west-1", "Canada West (Calgary)"),
+            Map.entry("sa-east-1", "South America (Sao Paulo)"),
+            Map.entry("eu-west-1", "EU (Ireland)"),
+            Map.entry("eu-west-2", "EU (London)"),
+            Map.entry("eu-west-3", "EU (Paris)"),
+            Map.entry("eu-central-1", "EU (Frankfurt)"),
+            Map.entry("eu-central-2", "EU (Zurich)"),
+            Map.entry("eu-north-1", "EU (Stockholm)"),
+            Map.entry("eu-south-1", "EU (Milan)"),
+            Map.entry("eu-south-2", "EU (Spain)"),
+            Map.entry("me-south-1", "Middle East (Bahrain)"),
+            Map.entry("me-central-1", "Middle East (UAE)"),
+            Map.entry("il-central-1", "Israel (Tel Aviv)"),
+            Map.entry("af-south-1", "Africa (Cape Town)"),
+            Map.entry("ap-east-1", "Asia Pacific (Hong Kong)"),
+            Map.entry("ap-south-1", "Asia Pacific (Mumbai)"),
+            Map.entry("ap-south-2", "Asia Pacific (Hyderabad)"),
+            Map.entry("ap-northeast-1", "Asia Pacific (Tokyo)"),
+            Map.entry("ap-northeast-2", "Asia Pacific (Seoul)"),
+            Map.entry("ap-northeast-3", "Asia Pacific (Osaka)"),
+            Map.entry("ap-southeast-1", "Asia Pacific (Singapore)"),
+            Map.entry("ap-southeast-2", "Asia Pacific (Sydney)"),
+            Map.entry("ap-southeast-3", "Asia Pacific (Jakarta)"),
+            Map.entry("ap-southeast-4", "Asia Pacific (Melbourne)"));
+
+    private static final Logger LOG = Logger.getLogger(AlarmSnsNotifier.class);
+    private static final DateTimeFormatter TIMESTAMP_FORMAT = DateTimeFormatter
+            .ofPattern("yyyy-MM-dd'T'HH:mm:ss.SSSZ", Locale.ROOT).withZone(ZoneOffset.UTC);
+    private final SnsService snsService;
+    private final ObjectMapper objectMapper;
+
+    public AlarmSnsNotifier(SnsService snsService, ObjectMapper objectMapper) {
+        this.snsService = snsService;
+        this.objectMapper = objectMapper;
+    }
+
+    record Notification(String topicArn, String message, String subject, String region) {}
+
+    List<Notification> prepareTransition(MetricAlarm alarm, String oldState) {
+        if (!alarm.isActionsEnabled() || alarm.getStateValue().equals(oldState)) {
+            return List.of();
+        }
+        List<String> actions = switch (alarm.getStateValue()) {
+            case "ALARM" -> alarm.getAlarmActions();
+            case "OK" -> alarm.getOkActions();
+            case "INSUFFICIENT_DATA" -> alarm.getInsufficientDataActions();
+            default -> List.of();
+        };
+        if (actions == null) {
+            return List.of();
+        }
+        List<Notification> notifications = new ArrayList<>();
+        for (String action : actions) {
+            if (!AwsArnUtils.isArnFor(action, "sns")) {
+                continue;
+            }
+            try {
+                AwsArnUtils.Arn topic = AwsArnUtils.parse(action);
+                String subject = alarm.getStateValue() + ": \"" + alarm.getAlarmName() + "\"";
+                if (subject.length() > 100) {
+                    subject = subject.substring(0, 100);
+                }
+                notifications.add(new Notification(action, message(alarm, oldState), subject, topic.region()));
+            } catch (Exception e) {
+                LOG.warnv(e, "Unable to publish alarm {0} state {1} to SNS action {2}",
+                        alarm.getAlarmName(), alarm.getStateValue(), action);
+            }
+        }
+        return notifications;
+    }
+
+    void publish(List<Notification> notifications) {
+        for (Notification notification : notifications) {
+            try {
+                snsService.publish(notification.topicArn(), null, notification.message(),
+                        notification.subject(), notification.region());
+            } catch (Exception error) {
+                LOG.warnv(error, "Unable to publish alarm transition {0} to SNS action {1}",
+                        notification.subject(), notification.topicArn());
+            }
+        }
+    }
+
+    private String message(MetricAlarm alarm, String oldState) throws JsonProcessingException {
+        AwsArnUtils.Arn arn = AwsArnUtils.parse(alarm.getAlarmArn());
+        Map<String, Object> payload = new LinkedHashMap<>();
+        payload.put("AlarmName", alarm.getAlarmName());
+        payload.put("AlarmDescription", alarm.getAlarmDescription());
+        payload.put("AWSAccountId", arn.accountId());
+        payload.put("AlarmConfigurationUpdatedTimestamp", timestamp(alarm.getAlarmConfigurationUpdatedTimestamp()));
+        payload.put("NewStateValue", alarm.getStateValue());
+        payload.put("NewStateReason", alarm.getStateReason());
+        payload.put("StateChangeTime", timestamp(alarm.getStateUpdatedTimestamp()));
+        payload.put("Region", REGION_NAMES.getOrDefault(arn.region(), arn.region()));
+        payload.put("AlarmArn", alarm.getAlarmArn());
+        payload.put("OldStateValue", oldState);
+        payload.put("OKActions", alarm.getOkActions());
+        payload.put("AlarmActions", alarm.getAlarmActions());
+        payload.put("InsufficientDataActions", alarm.getInsufficientDataActions());
+        Map<String, Object> trigger = new LinkedHashMap<>();
+        trigger.put("MetricName", alarm.getMetricName());
+        trigger.put("Namespace", alarm.getNamespace());
+        trigger.put("StatisticType", "Statistic");
+        trigger.put("Statistic", alarm.getStatistic() != null
+                ? alarm.getStatistic().toUpperCase(Locale.ROOT) : null);
+        trigger.put("Unit", alarm.getUnit());
+        trigger.put("Dimensions", alarm.getDimensions());
+        trigger.put("Period", alarm.getPeriod());
+        trigger.put("EvaluationPeriods", alarm.getEvaluationPeriods());
+        if (alarm.getDatapointsToAlarm() != null) {
+            trigger.put("DatapointsToAlarm", alarm.getDatapointsToAlarm());
+        }
+        trigger.put("ComparisonOperator", alarm.getComparisonOperator());
+        trigger.put("Threshold", alarm.getThreshold());
+        trigger.put("TreatMissingData", alarm.getTreatMissingData());
+        trigger.put("EvaluateLowSampleCountPercentile", alarm.getEvaluateLowSampleCountPercentile() != null
+                ? alarm.getEvaluateLowSampleCountPercentile() : "");
+        payload.put("Trigger", trigger);
+        return objectMapper.writeValueAsString(payload);
+    }
+
+    private String timestamp(long epochSeconds) {
+        return TIMESTAMP_FORMAT.format(Instant.ofEpochSecond(epochSeconds));
+    }
+}

src/main/java/io/github/hectorvent/floci/services/cloudwatch/metrics/CloudWatchMetricsException.java

@@ -0,0 +1,34 @@
+package io.github.hectorvent.floci.services.cloudwatch.metrics;
+
+import io.github.hectorvent.floci.core.common.AwsException;
+
+/**
+ * A CloudWatch error whose Query code and JSON shape name differ.
+ *
+ * <p>CloudWatch is awsQueryCompatible: the Query {@code <Code>} and the
+ * {@code x-amzn-query-error} header carry the {@code awsQueryError} code
+ * ({@code MissingParameter}), while a JSON 1.0 or CBOR body's {@code __type} names the
+ * model shape ({@code MissingRequiredParameterException}). The AWS SDK v2 picks the typed
+ * exception from {@code __type}, so the code alone yields a generic {@code CloudWatchException}.
+ * Keeping {@link #getErrorCode()} as the Query code and overriding {@link #jsonType()}
+ * reproduces both surfaces.
+ */
+class CloudWatchMetricsException extends AwsException {
+
+    private final String jsonType;
+
+    private CloudWatchMetricsException(String errorCode, String jsonType, String message, int httpStatus) {
+        super(errorCode, message, httpStatus);
+        this.jsonType = jsonType;
+    }
+
+    static CloudWatchMetricsException missingParameter(String parameter) {
+        return new CloudWatchMetricsException("MissingParameter", "MissingRequiredParameterException",
+                "The parameter " + parameter + " is required.", 400);
+    }
+
+    @Override
+    public String jsonType() {
+        return jsonType;
+    }
+}

src/main/java/io/github/hectorvent/floci/services/cloudwatch/metrics/CloudWatchMetricsJsonHandler.java

@@ -5,13 +5,21 @@ import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.ArrayNode;
 import com.fasterxml.jackson.databind.node.ObjectNode;
 import io.github.hectorvent.floci.core.common.AwsErrorResponse;
+import io.github.hectorvent.floci.core.common.AwsException;
 import io.github.hectorvent.floci.core.common.PaginatedResult;
 import io.github.hectorvent.floci.services.cloudwatch.dashboards.CloudWatchDashboardsService;
 import io.github.hectorvent.floci.services.cloudwatch.dashboards.model.Dashboard;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.Alarm;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.AlarmMetricDataQuery;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.CompositeAlarm;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.Dimension;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.MetricAlarm;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.MetricDatum;
 import io.github.hectorvent.floci.services.cloudwatch.metricstreams.CloudWatchMetricStreamsService;
 import io.github.hectorvent.floci.services.cloudwatch.metricstreams.model.MetricStream;
 import io.github.hectorvent.floci.services.cloudwatch.metricstreams.model.MetricStreamFilter;
 import io.github.hectorvent.floci.services.cloudwatch.metricstreams.model.MetricStreamStatisticsConfiguration;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.AlarmMetricDataQuery;
 import io.github.hectorvent.floci.services.cloudwatch.metrics.model.Dimension;
 import io.github.hectorvent.floci.services.cloudwatch.metrics.model.MetricAlarm;
 import io.github.hectorvent.floci.services.cloudwatch.metrics.model.MetricDatum;
@@ -56,6 +64,7 @@ public class CloudWatchMetricsJsonHandler {
             case "ListMetrics" -> handleListMetrics(request, region);
             case "GetMetricStatistics" -> handleGetMetricStatistics(request, region);
             case "PutMetricAlarm" -> handlePutMetricAlarm(request, region);
+            case "PutCompositeAlarm" -> handlePutCompositeAlarm(request, region);
             case "DescribeAlarms" -> handleDescribeAlarms(request, region);
             case "DeleteAlarms" -> handleDeleteAlarms(request, region);
             case "SetAlarmState" -> handleSetAlarmState(request, region);
@@ -81,10 +90,14 @@ public class CloudWatchMetricsJsonHandler {
 
     private Response handlePutMetricData(JsonNode request, String region) {
         String namespace = request.path("Namespace").asText();
-        LOG.infov("JSON PutMetricData raw: {0}", request);
-        List<MetricDatum> datums = parseMetricDataJson(request.path("MetricData"));
-        LOG.infov("JSON PutMetricData parsed {0} datums, sums={1}", datums.size(),
-                datums.stream().map(d -> d.getMetricName() + "=" + d.getSum()).toList());
+        List<MetricDatum> datums = parseMetricDataJson(request.path("MetricData"), "MetricData");
+        int entityIndex = 0;
+        for (JsonNode entityMetricData : request.path("EntityMetricData")) {
+            entityIndex++;
+            datums.addAll(parseMetricDataJson(entityMetricData.path("MetricData"),
+                    "EntityMetricData.member." + entityIndex + ".MetricData"));
+        }
+        LOG.debugv("JSON PutMetricData parsed {0} datums for namespace {1}", datums.size(), namespace);
         metricsService.putMetricData(namespace, datums, region);
         return Response.ok(objectMapper.createObjectNode()).build();
     }
@@ -151,12 +164,17 @@ public class CloudWatchMetricsJsonHandler {
 
     private Response handlePutMetricAlarm(JsonNode request, String region) {
         MetricAlarm alarm = new MetricAlarm();
-        alarm.setAlarmName(request.path("AlarmName").asText());
-        alarm.setAlarmDescription(request.path("AlarmDescription").asText(null));
+        parseAlarmFields(request, alarm);
         alarm.setMetricName(request.path("MetricName").asText(null));
         alarm.setNamespace(request.path("Namespace").asText(null));
         alarm.setStatistic(request.path("Statistic").asText(null));
-        alarm.setPeriod(request.path("Period").asInt(60));
+        JsonNode metrics = request.path("Metrics");
+        if (metrics.isArray()) {
+            for (JsonNode query : metrics) {
+                alarm.getMetrics().add(objectMapper.convertValue(query, AlarmMetricDataQuery.class));
+            }
+        }
+        alarm.setPeriod(alarm.getMetrics().isEmpty() ? request.path("Period").asInt(60) : null);
         alarm.setUnit(request.path("Unit").asText(null));
         alarm.setEvaluationPeriods(request.path("EvaluationPeriods").asInt(1));
         alarm.setDatapointsToAlarm(request.hasNonNull("DatapointsToAlarm")
@@ -164,9 +182,33 @@ public class CloudWatchMetricsJsonHandler {
         alarm.setThreshold(request.path("Threshold").asDouble(0));
         alarm.setComparisonOperator(request.path("ComparisonOperator").asText(null));
         alarm.setTreatMissingData(request.path("TreatMissingData").asText(null));
-        alarm.setActionsEnabled(request.path("ActionsEnabled").asBoolean(true));
         alarm.setDimensions(parseDimensionsJson(request.path("Dimensions")));
 
+        metricsService.putMetricAlarm(alarm, region);
+        return Response.ok(objectMapper.createObjectNode()).build();
+    }
+
+    private Response handlePutCompositeAlarm(JsonNode request, String region) {
+        rejectSuppressor(request);
+        CompositeAlarm alarm = new CompositeAlarm();
+        parseAlarmFields(request, alarm);
+        alarm.setAlarmRule(request.path("AlarmRule").asText(null));
+        metricsService.putCompositeAlarm(alarm, region);
+        return Response.ok(objectMapper.createObjectNode()).build();
+    }
+
+    private static void rejectSuppressor(JsonNode request) {
+        if (request.has("ActionsSuppressor") || request.has("ActionsSuppressorWaitPeriod")
+                || request.has("ActionsSuppressorExtensionPeriod")) {
+            throw new AwsException("ValidationError", "Composite action suppression is not supported", 400);
+        }
+    }
+
+    private void parseAlarmFields(JsonNode request, Alarm alarm) {
+        alarm.setAlarmName(request.path("AlarmName").asText());
+        alarm.setAlarmDescription(request.path("AlarmDescription").asText(null));
+        alarm.setActionsEnabled(request.path("ActionsEnabled").asBoolean(true));
+
         JsonNode alarmActions = request.path("AlarmActions");
         if (alarmActions.isArray()) {
             alarmActions.forEach(a -> alarm.getAlarmActions().add(a.asText()));
@@ -187,8 +229,6 @@ public class CloudWatchMetricsJsonHandler {
             alarm.setTags(tags);
         }
 
-        metricsService.putMetricAlarm(alarm, region);
-        return Response.ok(objectMapper.createObjectNode()).build();
     }
 
     private Response handleDescribeAlarms(JsonNode request, String region) {
@@ -199,32 +239,42 @@ public class CloudWatchMetricsJsonHandler {
         }
         String prefix = request.has("AlarmNamePrefix") ? request.path("AlarmNamePrefix").asText() : null;
 
-        List<MetricAlarm> alarms = metricsService.describeAlarms(alarmNames, prefix, region);
+        List<String> types = new ArrayList<>();
+        request.path("AlarmTypes").forEach(value -> types.add(value.asText()));
+        metricsService.validateAlarmTypes(types);
+        List<MetricAlarm> alarms = types.isEmpty() || types.contains("MetricAlarm")
+                ? metricsService.describeAlarms(alarmNames, prefix, region) : List.of();
 
         ObjectNode response = objectMapper.createObjectNode();
         ArrayNode arr = response.putArray("MetricAlarms");
         for (MetricAlarm a : alarms) {
             ObjectNode node = arr.addObject();
-            node.put("AlarmName", a.getAlarmName());
-            if (a.getAlarmArn() != null) node.put("AlarmArn", a.getAlarmArn());
-            if (a.getAlarmDescription() != null) node.put("AlarmDescription", a.getAlarmDescription());
-            ArrayNode alarmActions = node.putArray("AlarmActions");
-            a.getAlarmActions().forEach(alarmActions::add);
-            ArrayNode okActions = node.putArray("OKActions");
-            a.getOkActions().forEach(okActions::add);
-            ArrayNode insufficientDataActions = node.putArray("InsufficientDataActions");
-            a.getInsufficientDataActions().forEach(insufficientDataActions::add);
-            if (a.getMetricName() != null) node.put("MetricName", a.getMetricName());
-            if (a.getNamespace() != null) node.put("Namespace", a.getNamespace());
-            if (a.getStatistic() != null) node.put("Statistic", a.getStatistic());
-            ArrayNode dimensions = node.putArray("Dimensions");
-            a.getDimensions().forEach(d -> {
-                ObjectNode dimNode = dimensions.addObject();
-                dimNode.put("Name", d.name());
-                dimNode.put("Value", d.value());
-            });
-            node.put("Period", a.getPeriod());
-            if (a.getUnit() != null) node.put("Unit", a.getUnit());
+            describeAlarmFields(node, a);
+            if (!a.getMetrics().isEmpty()) {
+                node.set("Metrics", objectMapper.valueToTree(a.getMetrics()));
+            } else {
+                if (a.getMetricName() != null) {
+                    node.put("MetricName", a.getMetricName());
+                }
+                if (a.getNamespace() != null) {
+                    node.put("Namespace", a.getNamespace());
+                }
+                if (a.getStatistic() != null) {
+                    node.put("Statistic", a.getStatistic());
+                }
+                ArrayNode dimensions = node.putArray("Dimensions");
+                a.getDimensions().forEach(d -> {
+                    ObjectNode dimNode = dimensions.addObject();
+                    dimNode.put("Name", d.name());
+                    dimNode.put("Value", d.value());
+                });
+                if (a.getPeriod() != null) {
+                    node.put("Period", a.getPeriod());
+                }
+                if (a.getUnit() != null) {
+                    node.put("Unit", a.getUnit());
+                }
+            }
             node.put("EvaluationPeriods", a.getEvaluationPeriods());
             if (a.getDatapointsToAlarm() != null) {
                 node.put("DatapointsToAlarm", a.getDatapointsToAlarm());
@@ -232,15 +282,48 @@ public class CloudWatchMetricsJsonHandler {
             node.put("Threshold", a.getThreshold());
             if (a.getComparisonOperator() != null) node.put("ComparisonOperator", a.getComparisonOperator());
             if (a.getTreatMissingData() != null) node.put("TreatMissingData", a.getTreatMissingData());
-            node.put("ActionsEnabled", a.isActionsEnabled());
-            if (a.getStateValue() != null) node.put("StateValue", a.getStateValue());
-            if (a.getStateReason() != null) node.put("StateReason", a.getStateReason());
-            if (a.getStateReasonData() != null) node.put("StateReasonData", a.getStateReasonData());
-            node.put("StateUpdatedTimestamp", a.getStateUpdatedTimestamp());
+
         }
+        ArrayNode composites = response.putArray("CompositeAlarms");
+        if (types.contains("CompositeAlarm")) {
+            for (CompositeAlarm alarm : metricsService.describeCompositeAlarms(alarmNames, prefix, region)) {
+                ObjectNode node = composites.addObject();
+                describeAlarmFields(node, alarm);
+                node.put("AlarmRule", alarm.getAlarmRule());
+            }
+        }
+        response.putArray("LogAlarms");
         return Response.ok(response).build();
     }
 
+    private void describeAlarmFields(ObjectNode node, Alarm a) {
+        node.put("AlarmName", a.getAlarmName());
+        if (a.getAlarmArn() != null) {
+            node.put("AlarmArn", a.getAlarmArn());
+        }
+        if (a.getAlarmDescription() != null) {
+            node.put("AlarmDescription", a.getAlarmDescription());
+        }
+        ArrayNode alarmActions = node.putArray("AlarmActions");
+        a.getAlarmActions().forEach(alarmActions::add);
+        ArrayNode okActions = node.putArray("OKActions");
+        a.getOkActions().forEach(okActions::add);
+        ArrayNode insufficientDataActions = node.putArray("InsufficientDataActions");
+        a.getInsufficientDataActions().forEach(insufficientDataActions::add);
+        node.put("ActionsEnabled", a.isActionsEnabled());
+        if (a.getStateValue() != null) {
+            node.put("StateValue", a.getStateValue());
+        }
+        if (a.getStateReason() != null) {
+            node.put("StateReason", a.getStateReason());
+        }
+        if (a.getStateReasonData() != null) {
+            node.put("StateReasonData", a.getStateReasonData());
+        }
+        node.put("StateUpdatedTimestamp", a.getStateUpdatedTimestamp());
+        node.put("AlarmConfigurationUpdatedTimestamp", a.getAlarmConfigurationUpdatedTimestamp());
+    }
+
     private Response handleDeleteAlarms(JsonNode request, String region) {
         List<String> alarmNames = new ArrayList<>();
         JsonNode namesNode = request.path("AlarmNames");
@@ -586,12 +669,18 @@ public class CloudWatchMetricsJsonHandler {
         return configurations;
     }
 
-    private List<MetricDatum> parseMetricDataJson(JsonNode node) {
+    private List<MetricDatum> parseMetricDataJson(JsonNode node, String listPath) {
         List<MetricDatum> datums = new ArrayList<>();
         if (!node.isArray()) return datums;
+        int index = 0;
         for (JsonNode item : node) {
+            index++;
+            JsonNode metricName = item.path("MetricName");
+            if (!metricName.isTextual() || metricName.asText().isEmpty()) {
+                throw CloudWatchMetricsException.missingParameter(listPath + ".member." + index + ".MetricName");
+            }
             MetricDatum datum = new MetricDatum();
-            datum.setMetricName(item.path("MetricName").asText());
+            datum.setMetricName(metricName.asText());
             datum.setValue(item.path("Value").asDouble(0));
             datum.setUnit(item.path("Unit").asText(null));
             JsonNode ts = item.path("Timestamp");

src/main/java/io/github/hectorvent/floci/services/cloudwatch/metrics/CloudWatchMetricsQueryHandler.java

@@ -1,5 +1,6 @@
 package io.github.hectorvent.floci.services.cloudwatch.metrics;
 
+import io.github.hectorvent.floci.core.common.AwsException;
 import io.github.hectorvent.floci.core.common.AwsNamespaces;
 import io.github.hectorvent.floci.core.common.AwsQueryResponse;
 import io.github.hectorvent.floci.core.common.PaginatedResult;
@@ -7,10 +8,17 @@ import io.github.hectorvent.floci.core.common.Pagination;
 import io.github.hectorvent.floci.core.common.XmlBuilder;
 import io.github.hectorvent.floci.services.cloudwatch.dashboards.CloudWatchDashboardsService;
 import io.github.hectorvent.floci.services.cloudwatch.dashboards.model.Dashboard;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.Alarm;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.AlarmMetricDataQuery;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.CompositeAlarm;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.Dimension;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.MetricAlarm;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.MetricDatum;
 import io.github.hectorvent.floci.services.cloudwatch.metricstreams.CloudWatchMetricStreamsService;
 import io.github.hectorvent.floci.services.cloudwatch.metricstreams.model.MetricStream;
 import io.github.hectorvent.floci.services.cloudwatch.metricstreams.model.MetricStreamFilter;
 import io.github.hectorvent.floci.services.cloudwatch.metricstreams.model.MetricStreamStatisticsConfiguration;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.AlarmMetricDataQuery;
 import io.github.hectorvent.floci.services.cloudwatch.metrics.model.Dimension;
 import io.github.hectorvent.floci.services.cloudwatch.metrics.model.MetricAlarm;
 import io.github.hectorvent.floci.services.cloudwatch.metrics.model.MetricDatum;
@@ -25,11 +33,16 @@ import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import org.jboss.logging.Logger;
+import java.util.SortedSet;
+import java.util.TreeSet;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 @ApplicationScoped
 public class CloudWatchMetricsQueryHandler {
 
     private static final Logger LOG = Logger.getLogger(CloudWatchMetricsQueryHandler.class);
+    private static final Pattern ENTITY_METRIC_DATA_MEMBER = Pattern.compile("EntityMetricData\\.member\\.(\\d{1,9})\\.");
 
     private CloudWatchMetricsService metricsService;
     private final CloudWatchDashboardsService dashboardsService;
@@ -52,6 +65,7 @@ public class CloudWatchMetricsQueryHandler {
             case "GetMetricStatistics" -> handleGetMetricStatistics(params, region);
             case "GetMetricData" -> handleGetMetricData(params, region);
             case "PutMetricAlarm" -> handlePutMetricAlarm(params, region);
+            case "PutCompositeAlarm" -> handlePutCompositeAlarm(params, region);
             case "DescribeAlarms" -> handleDescribeAlarms(params, region);
             case "DeleteAlarms" -> handleDeleteAlarms(params, region);
             case "SetAlarmState" -> handleSetAlarmState(params, region);
@@ -153,7 +167,8 @@ public class CloudWatchMetricsQueryHandler {
             xml.elem("Unit", dp.unit()).end("member");
         }
         xml.end("Datapoints");
-        return Response.ok(AwsQueryResponse.envelope("GetMetricStatistics", AwsNamespaces.CW, xml.build())).build();
+        return Response.ok(AwsQueryResponse.envelope("GetMetricStatistics",
+                AwsNamespaces.CW, xml.build())).build();
     }
 
     private Response handleGetMetricData(MultivaluedMap<String, String> params, String region) {
@@ -237,6 +252,26 @@ public class CloudWatchMetricsQueryHandler {
         return Response.ok(AwsQueryResponse.envelopeNoResult("PutMetricAlarm", null)).build();
     }
 
+    private Response handlePutCompositeAlarm(MultivaluedMap<String, String> params, String region) {
+        if (params.containsKey("ActionsSuppressor") || params.containsKey("ActionsSuppressorWaitPeriod")
+                || params.containsKey("ActionsSuppressorExtensionPeriod")) {
+            throw new AwsException("ValidationError", "Composite action suppression is not supported", 400);
+        }
+        CompositeAlarm alarm = new CompositeAlarm();
+        parseAlarmFields(params, alarm);
+        alarm.setAlarmRule(params.getFirst("AlarmRule"));
+        metricsService.putCompositeAlarm(alarm, region);
+        return Response.ok(AwsQueryResponse.envelopeNoResult("PutCompositeAlarm", null)).build();
+    }
+
+    private static List<String> alarmMembers(MultivaluedMap<String, String> params, String key) {
+        List<String> values = new ArrayList<>();
+        for (int i = 1; params.getFirst(key + ".member." + i) != null; i++) {
+            values.add(params.getFirst(key + ".member." + i));
+        }
+        return values;
+    }
+
     private Response handleDescribeAlarms(MultivaluedMap<String, String> params, String region) {
         List<String> alarmNames = new ArrayList<>();
         for (int i = 1; ; i++) {
@@ -246,13 +281,24 @@ public class CloudWatchMetricsQueryHandler {
         }
         String prefix = params.getFirst("AlarmNamePrefix");
 
-        List<MetricAlarm> alarms = metricsService.describeAlarms(alarmNames, prefix, region);
+        List<String> types = alarmMembers(params, "AlarmTypes");
+        metricsService.validateAlarmTypes(types);
+        List<MetricAlarm> alarms = types.isEmpty() || types.contains("MetricAlarm")
+                ? metricsService.describeAlarms(alarmNames, prefix, region) : List.of();
 
         var xml = new XmlBuilder().start("MetricAlarms");
         for (MetricAlarm a : alarms) {
             toAlarmXml(xml, a);
         }
-        xml.end("MetricAlarms");
+        xml.end("MetricAlarms").start("CompositeAlarms");
+        if (types.contains("CompositeAlarm")) {
+            for (CompositeAlarm alarm : metricsService.describeCompositeAlarms(alarmNames, prefix, region)) {
+                xml.start("member");
+                describeAlarmFields(xml, alarm);
+                xml.elem("AlarmRule", alarm.getAlarmRule()).end("member");
+            }
+        }
+        xml.end("CompositeAlarms").start("LogAlarms").end("LogAlarms");
         return Response.ok(AwsQueryResponse.envelope("DescribeAlarms", null, xml.build())).build();
     }
 
@@ -590,42 +636,63 @@ public class CloudWatchMetricsQueryHandler {
     // ──────────────────────────── Parsing Helpers ────────────────────────────
 
     private List<MetricDatum> parseMetricData(MultivaluedMap<String, String> params) {
-        LOG.infov("Query PutMetricData params: {0}", params);
+        List<MetricDatum> datums = parseMetricData(params, "MetricData");
+        // An empty EntityMetricData entry serializes to no keys, so its index is absent
+        // while later entries keep theirs: iterate the indexes present, not 1..first gap.
+        SortedSet<Integer> entityIndexes = new TreeSet<>();
+        for (String key : params.keySet()) {
+            Matcher matcher = ENTITY_METRIC_DATA_MEMBER.matcher(key);
+            if (matcher.lookingAt()) {
+                entityIndexes.add(Integer.parseInt(matcher.group(1)));
+            }
+        }
+        for (int index : entityIndexes) {
+            datums.addAll(parseMetricData(params, "EntityMetricData.member." + index + ".MetricData"));
+        }
+        LOG.debugv("Query PutMetricData parsed {0} datums", datums.size());
+        return datums;
+    }
+
+    private List<MetricDatum> parseMetricData(MultivaluedMap<String, String> params, String listPrefix) {
         List<MetricDatum> datums = new ArrayList<>();
         for (int i = 1; ; i++) {
-            String metricName = params.getFirst("MetricData.member." + i + ".MetricName");
-            if (metricName == null) {
-                break;
+            String memberPrefix = listPrefix + ".member." + i + ".";
+            String metricName = params.getFirst(memberPrefix + "MetricName");
+            if (metricName == null || metricName.isEmpty()) {
+                if (metricName == null && params.keySet().stream().noneMatch(key -> key.startsWith(memberPrefix))) {
+                    break;
+                }
+                throw CloudWatchMetricsException.missingParameter(memberPrefix + "MetricName");
             }
             MetricDatum datum = new MetricDatum();
             datum.setMetricName(metricName);
-            datum.setUnit(params.getFirst("MetricData.member." + i + ".Unit"));
+            datum.setUnit(params.getFirst(listPrefix + ".member." + i + ".Unit"));
 
-            String valueStr = params.getFirst("MetricData.member." + i + ".Value");
+            String valueStr = params.getFirst(listPrefix + ".member." + i + ".Value");
             if (valueStr != null) {
                 datum.setValue(parseDouble(valueStr, 0));
             }
 
-            String tsStr = params.getFirst("MetricData.member." + i + ".Timestamp");
+            String tsStr = params.getFirst(listPrefix + ".member." + i + ".Timestamp");
             if (tsStr != null) {
                 Instant ts = parseInstant(tsStr);
                 datum.setTimestamp(ts != null ? ts.getEpochSecond() : 0);
             }
 
             // StatisticValues
-            String sc = params.getFirst("MetricData.member." + i + ".StatisticValues.SampleCount");
+            String sc = params.getFirst(listPrefix + ".member." + i + ".StatisticValues.SampleCount");
             if (sc != null) {
                 datum.setSampleCount(parseDouble(sc, 0));
-                datum.setSum(parseDouble(params.getFirst("MetricData.member." + i + ".StatisticValues.Sum"), 0));
-                datum.setMinimum(parseDouble(params.getFirst("MetricData.member." + i + ".StatisticValues.Minimum"), 0));
-                datum.setMaximum(parseDouble(params.getFirst("MetricData.member." + i + ".StatisticValues.Maximum"), 0));
+                datum.setSum(parseDouble(params.getFirst(listPrefix + ".member." + i + ".StatisticValues.Sum"), 0));
+                datum.setMinimum(parseDouble(params.getFirst(listPrefix + ".member." + i + ".StatisticValues.Minimum"), 0));
+                datum.setMaximum(parseDouble(params.getFirst(listPrefix + ".member." + i + ".StatisticValues.Maximum"), 0));
             }
 
             // Dimensions
             List<Dimension> dims = new ArrayList<>();
             for (int j = 1; ; j++) {
-                String dimName = params.getFirst("MetricData.member." + i + ".Dimensions.member." + j + ".Name");
-                String dimValue = params.getFirst("MetricData.member." + i + ".Dimensions.member." + j + ".Value");
+                String dimName = params.getFirst(listPrefix + ".member." + i + ".Dimensions.member." + j + ".Name");
+                String dimValue = params.getFirst(listPrefix + ".member." + i + ".Dimensions.member." + j + ".Value");
                 if (dimName == null) {
                     break;
                 }
@@ -653,14 +720,12 @@ public class CloudWatchMetricsQueryHandler {
 
     private MetricAlarm parseAlarm(MultivaluedMap<String, String> params) {
         MetricAlarm a = new MetricAlarm();
-        a.setAlarmName(params.getFirst("AlarmName"));
-        a.setAlarmDescription(params.getFirst("AlarmDescription"));
-        String actionsEnabled = params.getFirst("ActionsEnabled");
-        a.setActionsEnabled(actionsEnabled == null || Boolean.parseBoolean(actionsEnabled));
+        parseAlarmFields(params, a);
         a.setMetricName(params.getFirst("MetricName"));
         a.setNamespace(params.getFirst("Namespace"));
         a.setStatistic(params.getFirst("Statistic"));
-        a.setPeriod(parseIntParam(params, "Period", 60));
+        a.setMetrics(parseAlarmMetricQueries(params));
+        a.setPeriod(a.getMetrics().isEmpty() ? parseIntParam(params, "Period", 60) : null);
         a.setUnit(params.getFirst("Unit"));
         a.setEvaluationPeriods(parseIntParam(params, "EvaluationPeriods", 1));
         String datapointsToAlarm = params.getFirst("DatapointsToAlarm");
@@ -680,38 +745,100 @@ public class CloudWatchMetricsQueryHandler {
         }
         a.setDimensions(dims);
 
-        // Actions
-        for (int i = 1; ; i++) {
-            String act = params.getFirst("OKActions.member." + i);
-            if (act == null) break;
-            a.getOkActions().add(act);
-        }
-        for (int i = 1; ; i++) {
-            String act = params.getFirst("AlarmActions.member." + i);
-            if (act == null) break;
-            a.getAlarmActions().add(act);
-        }
-        for (int i = 1; ; i++) {
-            String act = params.getFirst("InsufficientDataActions.member." + i);
-            if (act == null) break;
-            a.getInsufficientDataActions().add(act);
-        }
-
-        // Tags
-        Map<String, String> tags = new LinkedHashMap<>();
-        for (int i = 1; ; i++) {
-            String key = params.getFirst("Tags.member." + i + ".Key");
-            if (key == null) break;
-            tags.put(key, params.getFirst("Tags.member." + i + ".Value"));
-        }
-        a.setTags(tags);
-
         return a;
     }
 
+    private void parseAlarmFields(MultivaluedMap<String, String> params, Alarm alarm) {
+        alarm.setAlarmName(params.getFirst("AlarmName"));
+        alarm.setAlarmDescription(params.getFirst("AlarmDescription"));
+        String actionsEnabled = params.getFirst("ActionsEnabled");
+        alarm.setActionsEnabled(actionsEnabled == null || Boolean.parseBoolean(actionsEnabled));
+        alarm.setAlarmActions(alarmMembers(params, "AlarmActions"));
+        alarm.setOkActions(alarmMembers(params, "OKActions"));
+        alarm.setInsufficientDataActions(alarmMembers(params, "InsufficientDataActions"));
+        Map<String, String> tags = new LinkedHashMap<>();
+        for (int i = 1; params.getFirst("Tags.member." + i + ".Key") != null; i++) {
+            tags.put(params.getFirst("Tags.member." + i + ".Key"), params.getFirst("Tags.member." + i + ".Value"));
+        }
+        alarm.setTags(tags);
+    }
+
+    private List<AlarmMetricDataQuery> parseAlarmMetricQueries(MultivaluedMap<String, String> params) {
+        List<AlarmMetricDataQuery> queries = new ArrayList<>();
+        for (int index = 1; ; index++) {
+            String prefix = "Metrics.member." + index;
+            String id = params.getFirst(prefix + ".Id");
+            if (id == null) {
+                break;
+            }
+            AlarmMetricDataQuery.MetricStat metricStat = null;
+            String metricPrefix = prefix + ".MetricStat.Metric";
+            if (params.getFirst(metricPrefix + ".Namespace") != null) {
+                List<AlarmMetricDataQuery.MetricDimension> dimensions = null;
+                for (int dimensionIndex = 1; ; dimensionIndex++) {
+                    String dimensionPrefix = metricPrefix + ".Dimensions.member." + dimensionIndex;
+                    String name = params.getFirst(dimensionPrefix + ".Name");
+                    if (name == null) {
+                        break;
+                    }
+                    if (dimensions == null) {
+                        dimensions = new ArrayList<>();
+                    }
+                    dimensions.add(new AlarmMetricDataQuery.MetricDimension(
+                            name, params.getFirst(dimensionPrefix + ".Value")));
+                }
+                AlarmMetricDataQuery.Metric metric = new AlarmMetricDataQuery.Metric(
+                        params.getFirst(metricPrefix + ".Namespace"),
+                        params.getFirst(metricPrefix + ".MetricName"), dimensions);
+                metricStat = new AlarmMetricDataQuery.MetricStat(metric,
+                        optionalInteger(params.getFirst(prefix + ".MetricStat.Period")),
+                        params.getFirst(prefix + ".MetricStat.Stat"), params.getFirst(prefix + ".MetricStat.Unit"));
+            }
+            String returnData = params.getFirst(prefix + ".ReturnData");
+            queries.add(new AlarmMetricDataQuery(id, params.getFirst(prefix + ".Expression"),
+                    params.getFirst(prefix + ".Label"), returnData == null ? null : Boolean.valueOf(returnData),
+                    optionalInteger(params.getFirst(prefix + ".Period")),
+                    params.getFirst(prefix + ".AccountId"), metricStat));
+        }
+        return queries;
+    }
+
+    private static Integer optionalInteger(String value) {
+        return value == null ? null : Integer.valueOf(value);
+    }
+
     private void toAlarmXml(XmlBuilder xml, MetricAlarm a) {
-        xml.start("member")
-                .elem("AlarmName", a.getAlarmName())
+        xml.start("member");
+        describeAlarmFields(xml, a);
+        if (!a.getMetrics().isEmpty()) {
+            toAlarmMetricsXml(xml, a.getMetrics());
+        } else {
+            xml.start("Dimensions");
+            for (Dimension d : a.getDimensions()) {
+                xml.start("member").elem("Name", d.name()).elem("Value", d.value()).end("member");
+            }
+            xml.end("Dimensions")
+                    .elem("MetricName", a.getMetricName())
+                    .elem("Namespace", a.getNamespace())
+                    .elem("Statistic", a.getStatistic())
+                    .elem("Period", a.getPeriod() == null ? null : a.getPeriod().toString())
+                    .elem("Unit", a.getUnit());
+        }
+
+        xml.elem("EvaluationPeriods", String.valueOf(a.getEvaluationPeriods()))
+                .elem("Threshold", String.valueOf(a.getThreshold()))
+                .elem("ComparisonOperator", a.getComparisonOperator())
+                .elem("TreatMissingData", a.getTreatMissingData());
+        // Only an alarm the caller gave an M for carries the member, matching what AWS returns.
+        if (a.getDatapointsToAlarm() != null) {
+            xml.elem("DatapointsToAlarm", String.valueOf(a.getDatapointsToAlarm()));
+        }
+
+        xml.end("member");
+    }
+
+    private void describeAlarmFields(XmlBuilder xml, Alarm a) {
+        xml.elem("AlarmName", a.getAlarmName())
                 .elem("AlarmArn", a.getAlarmArn())
                 .elem("AlarmDescription", a.getAlarmDescription());
         xml.start("AlarmActions");
@@ -726,31 +853,41 @@ public class CloudWatchMetricsQueryHandler {
         xml.start("InsufficientDataActions");
         a.getInsufficientDataActions().forEach(act -> xml.elem("member", act));
         xml.end("InsufficientDataActions");
-        xml.start("Dimensions");
-        for (Dimension d : a.getDimensions()) {
-            xml.start("member").elem("Name", d.name()).elem("Value", d.value()).end("member");
-        }
-        xml.end("Dimensions");
-
         xml.elem("StateValue", a.getStateValue())
                 .elem("StateReason", a.getStateReason())
                 .elem("StateReasonData", a.getStateReasonData())
-                .elem("StateUpdatedTimestamp", Instant.ofEpochSecond(a.getStateUpdatedTimestamp()).toString())
-                .elem("MetricName", a.getMetricName())
-                .elem("Namespace", a.getNamespace())
-                .elem("Statistic", a.getStatistic())
-                .elem("Period", String.valueOf(a.getPeriod()))
-                .elem("Unit", a.getUnit())
-                .elem("EvaluationPeriods", String.valueOf(a.getEvaluationPeriods()))
-                .elem("Threshold", String.valueOf(a.getThreshold()))
-                .elem("ComparisonOperator", a.getComparisonOperator())
-                .elem("TreatMissingData", a.getTreatMissingData());
-        // Only an alarm the caller gave an M for carries the member, matching what AWS returns.
-        if (a.getDatapointsToAlarm() != null) {
-            xml.elem("DatapointsToAlarm", String.valueOf(a.getDatapointsToAlarm()));
-        }
+                .elem("StateUpdatedTimestamp", Instant.ofEpochSecond(a.getStateUpdatedTimestamp()).toString());
+    }
 
-        xml.end("member");
+    private void toAlarmMetricsXml(XmlBuilder xml, List<AlarmMetricDataQuery> metrics) {
+        xml.start("Metrics");
+        for (AlarmMetricDataQuery query : metrics) {
+            xml.start("member").elem("Id", query.id()).elem("Expression", query.expression())
+                    .elem("Label", query.label()).elem("AccountId", query.accountId())
+                    .elem("Period", query.period() == null ? null : query.period().toString())
+                    .elem("ReturnData", query.returnData() == null ? null : query.returnData().toString());
+            AlarmMetricDataQuery.MetricStat stat = query.metricStat();
+            if (stat != null) {
+                xml.start("MetricStat");
+                AlarmMetricDataQuery.Metric metric = stat.metric();
+                if (metric != null) {
+                    xml.start("Metric").elem("Namespace", metric.namespace()).elem("MetricName", metric.metricName());
+                    if (metric.dimensions() != null) {
+                        xml.start("Dimensions");
+                        for (AlarmMetricDataQuery.MetricDimension dimension : metric.dimensions()) {
+                            xml.start("member").elem("Name", dimension.name()).elem("Value", dimension.value())
+                                    .end("member");
+                        }
+                        xml.end("Dimensions");
+                    }
+                    xml.end("Metric");
+                }
+                xml.elem("Period", stat.period() == null ? null : stat.period().toString())
+                        .elem("Stat", stat.stat()).elem("Unit", stat.unit()).end("MetricStat");
+            }
+            xml.end("member");
+        }
+        xml.end("Metrics");
     }
 
     private Instant parseInstant(String value) {

src/main/java/io/github/hectorvent/floci/services/cloudwatch/metrics/CloudWatchMetricsService.java

@@ -1,10 +1,15 @@
 package io.github.hectorvent.floci.services.cloudwatch.metrics;
 
+import com.fasterxml.jackson.core.type.TypeReference;
+import io.github.hectorvent.floci.core.common.AwsArnUtils;
 import io.github.hectorvent.floci.core.common.AwsException;
 import io.github.hectorvent.floci.core.common.RegionResolver;
+import io.github.hectorvent.floci.core.common.SmithyValidationErrors;
 import io.github.hectorvent.floci.core.storage.AccountAwareStorageBackend;
 import io.github.hectorvent.floci.core.storage.StorageBackend;
 import io.github.hectorvent.floci.core.storage.StorageFactory;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.Alarm;
+import io.github.hectorvent.floci.services.cloudwatch.metrics.model.CompositeAlarm;
 import io.github.hectorvent.floci.services.cloudwatch.metrics.model.Dimension;
 import io.github.hectorvent.floci.services.cloudwatch.metrics.model.MetricAlarm;
 import io.github.hectorvent.floci.services.cloudwatch.metrics.model.MetricDatum;
@@ -14,11 +19,16 @@ import jakarta.inject.Inject;
 import org.jboss.logging.Logger;
 
 import java.time.Instant;
+import java.util.ArrayDeque;
 import java.util.ArrayList;
 import java.util.Comparator;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Iterator;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 import java.util.UUID;
 import java.util.stream.Collectors;
 
@@ -27,25 +37,41 @@ public class CloudWatchMetricsService {
 
     private static final Logger LOG = Logger.getLogger(CloudWatchMetricsService.class);
 
+    private static final List<String> ALARM_TYPES = List.of("CompositeAlarm", "MetricAlarm", "LogAlarm");
+
     private final StorageBackend<String, MetricDatum> metricStore;
-    private final StorageBackend<String, MetricAlarm> alarmStore;
+    private final StorageBackend<String, Alarm> alarmStore;
     private final RegionResolver regionResolver;
+    private final AlarmSnsNotifier alarmSnsNotifier;
+
+    public CloudWatchMetricsService(StorageFactory storageFactory, RegionResolver regionResolver) {
+        this(storageFactory, regionResolver, null);
+    }
 
     @Inject
-    public CloudWatchMetricsService(StorageFactory storageFactory, RegionResolver regionResolver) {
+    public CloudWatchMetricsService(StorageFactory storageFactory, RegionResolver regionResolver,
+                                    AlarmSnsNotifier alarmSnsNotifier) {
         this.metricStore = storageFactory.create("cloudwatchmetrics", "cwmetrics.json",
                 new TypeReference<Map<String, MetricDatum>>() {});
         this.alarmStore = storageFactory.create("cloudwatchmetrics", "cwalarms.json",
-                new TypeReference<Map<String, MetricAlarm>>() {});
+                new TypeReference<Map<String, Alarm>>() {});
         this.regionResolver = regionResolver;
+        this.alarmSnsNotifier = alarmSnsNotifier;
     }
 
     CloudWatchMetricsService(StorageBackend<String, MetricDatum> metricStore,
-                             StorageBackend<String, MetricAlarm> alarmStore,
+                             StorageBackend<String, Alarm> alarmStore,
                              RegionResolver regionResolver) {
+        this(metricStore, alarmStore, regionResolver, null);
+    }
+
+    CloudWatchMetricsService(StorageBackend<String, MetricDatum> metricStore,
+                             StorageBackend<String, Alarm> alarmStore,
+                             RegionResolver regionResolver, AlarmSnsNotifier alarmSnsNotifier) {
         this.metricStore = metricStore;
         this.alarmStore = alarmStore;
         this.regionResolver = regionResolver;
+        this.alarmSnsNotifier = alarmSnsNotifier;
     }
 
     public void putMetricData(String namespace, List<MetricDatum> datums, String region) {
@@ -282,85 +308,293 @@ public class CloudWatchMetricsService {
         };
     }
 
-    public void putMetricAlarm(MetricAlarm alarm, String region) {
+    public synchronized void putMetricAlarm(MetricAlarm alarm, String region) {
+        putAlarm(alarm, region);
+        evaluateComposites(region, Set.of(alarm.getAlarmName()), null);
+    }
+
+    public void putCompositeAlarm(CompositeAlarm alarm, String region) {
+        putCompositeAlarm(alarm, region, true);
+    }
+
+    public synchronized void putCompositeAlarm(CompositeAlarm alarm, String region, boolean replaceExisting) {
+        if (!replaceExisting && alarmStore.get(region + "::" + alarm.getAlarmName()).isPresent()) {
+            throw new AwsException("AlreadyExists", "Alarm already exists: " + alarm.getAlarmName(), 400);
+        }
+        Set<String> references = alarmReferences(alarm, region);
+        if (references.size() > 100) {
+            throw new AwsException("LimitExceeded", "AlarmRule references more than 100 child alarms", 400);
+        }
+        List<CompositeAlarm> existing = describeCompositeAlarms(null, null, region);
+        for (String reference : references) {
+            long parents = existing.stream().filter(parent -> !parent.getAlarmName().equals(alarm.getAlarmName()))
+                    .filter(parent -> alarmReferences(parent, region).contains(reference))
+                    .count();
+            if (parents >= 150) {
+                throw new AwsException("LimitExceeded", "An alarm can be referenced by at most 150 composite alarms", 400);
+            }
+        }
+        boolean created = alarmStore.get(region + "::" + alarm.getAlarmName()).isEmpty();
+        putAlarm(alarm, region);
+        if (created) {
+            evaluateComposites(region, Set.of(), alarm.getAlarmName());
+        }
+    }
+
+    private Set<String> alarmReferences(CompositeAlarm alarm, String region) {
+        return CompositeAlarmRule.parse(alarm.getAlarmRule()).references().stream()
+                .map(reference -> AwsArnUtils.isArn(reference) ? reference
+                        : regionResolver.buildArn("cloudwatch", region, "alarm:" + reference))
+                .collect(Collectors.toSet());
+    }
+
+    private void putAlarm(Alarm alarm, String region) {
+        String name = alarm.getAlarmName();
+        if (name == null || name.isBlank() || name.length() > 255) {
+            throw SmithyValidationErrors.validationError(name == null ? SmithyValidationErrors.notNull("alarmName")
+                    : "Value '" + name + "' at 'alarmName' failed to satisfy constraint: Member must have length "
+                            + (name.length() > 255 ? "less than or equal to 255" : "greater than or equal to 1"));
+        }
+        Alarm previous = alarmStore.get(region + "::" + name).orElse(null);
+        if (previous != null) {
+            if (!previous.getClass().equals(alarm.getClass())) {
+                throw new AwsException("ValidationError", "An alarm of another type already has this name", 400);
+            }
+            if (alarm instanceof CompositeAlarm) {
+                alarm.setStateValue(previous.getStateValue());
+                alarm.setStateReason(previous.getStateReason());
+                alarm.setStateReasonData(previous.getStateReasonData());
+                alarm.setStateUpdatedTimestamp(previous.getStateUpdatedTimestamp());
+                alarm.setTags(new HashMap<>(previous.getTags()));
+            }
+        }
         if (alarm.getAlarmArn() == null) {
-            alarm.setAlarmArn(regionResolver.buildArn("cloudwatch", region, "alarm:" + alarm.getAlarmName()));
+            alarm.setAlarmArn(regionResolver.buildArn("cloudwatch", region, "alarm:" + name));
         }
         alarm.setRegion(region);
         alarm.setAlarmConfigurationUpdatedTimestamp(Instant.now().getEpochSecond());
-        alarmStore.put(region + "::" + alarm.getAlarmName(), alarm);
-        LOG.infov("PutMetricAlarm: {0} in {1}", alarm.getAlarmName(), region);
+        alarmStore.put(region + "::" + name, alarm);
+        LOG.infov("Put {0}: {1} in {2}", alarm.getClass().getSimpleName(), name, region);
     }
 
-    /** Every stored alarm, across all regions. Used by the background {@link AlarmEvaluator}
-     * tick, which has no per-request region to scope a lookup to. */
+    /** Metric alarms evaluated by the existing metric evaluator. */
     public List<MetricAlarm> allAlarms() {
-        return alarmStore.scan(k -> true);
+        return alarmStore.scan(k -> true).stream().filter(MetricAlarm.class::isInstance)
+                .map(MetricAlarm.class::cast).toList();
     }
 
-    public List<MetricAlarm> describeAlarms(List<String> alarmNames, String alarmNamePrefix, String region) {
-        String prefix = region + "::";
-        List<MetricAlarm> all = alarmStore.scan(k -> k.startsWith(prefix));
-
-        if (alarmNames != null && !alarmNames.isEmpty()) {
-            return all.stream().filter(a -> alarmNames.contains(a.getAlarmName())).toList();
-        }
-        if (alarmNamePrefix != null && !alarmNamePrefix.isBlank()) {
-            return all.stream().filter(a -> a.getAlarmName().startsWith(alarmNamePrefix)).toList();
-        }
-        return all;
+    public List<MetricAlarm> describeAlarms(List<String> names, String prefix, String region) {
+        return matchingAlarms(names, prefix, region).stream().filter(MetricAlarm.class::isInstance)
+                .map(MetricAlarm.class::cast).toList();
     }
 
-    public void deleteAlarms(List<String> alarmNames, String region) {
+    public void validateAlarmTypes(List<String> types) {
+        if (!ALARM_TYPES.containsAll(types)) {
+            throw SmithyValidationErrors.validationError(
+                    SmithyValidationErrors.notAllInEnum(types, "alarmTypes", ALARM_TYPES));
+        }
+    }
+
+    public List<CompositeAlarm> describeCompositeAlarms(List<String> names, String prefix, String region) {
+        return matchingAlarms(names, prefix, region).stream().filter(CompositeAlarm.class::isInstance)
+                .map(CompositeAlarm.class::cast).toList();
+    }
+
+    private List<Alarm> matchingAlarms(List<String> names, String prefix, String region) {
+        return alarmStore.scan(k -> k.startsWith(region + "::")).stream()
+                .filter(a -> names == null || names.isEmpty() || names.contains(a.getAlarmName()))
+                .filter(a -> prefix == null || a.getAlarmName().startsWith(prefix)).toList();
+    }
+
+    private Map<String, Alarm> alarmIndex(String region) {
+        Map<String, Alarm> alarms = new HashMap<>();
+        for (Alarm alarm : alarmStore.scan(k -> k.startsWith(region + "::"))) {
+            alarms.put(alarm.getAlarmName(), alarm);
+            alarms.put(alarm.getAlarmArn(), alarm);
+        }
+        return alarms;
+    }
+
+    private void evaluateComposites(String region, Set<String> changedAlarmNames, String newAlarm) {
+        if (changedAlarmNames.isEmpty() && newAlarm == null) {
+            return;
+        }
+        Map<String, Alarm> alarms = alarmIndex(region);
+        Set<String> changed = new HashSet<>(changedAlarmNames);
+        for (String name : changedAlarmNames) {
+            changed.add(regionResolver.buildArn("cloudwatch", region, "alarm:" + name));
+        }
+        Map<String, CompositeAlarmRule.Rule> candidates = new HashMap<>();
+        for (Alarm alarm : new HashSet<>(alarms.values())) {
+            if (alarm instanceof CompositeAlarm composite && !changedAlarmNames.contains(alarm.getAlarmName())) {
+                candidates.put(alarm.getAlarmName(), CompositeAlarmRule.parse(composite.getAlarmRule()));
+            }
+        }
+        Set<String> affected = new HashSet<>(changed);
+        Map<String, CompositeAlarmRule.Rule> pending = new HashMap<>();
+        boolean discovered;
+        do {
+            discovered = false;
+            Iterator<Map.Entry<String, CompositeAlarmRule.Rule>> iterator = candidates.entrySet().iterator();
+            while (iterator.hasNext()) {
+                Map.Entry<String, CompositeAlarmRule.Rule> next = iterator.next();
+                if (next.getKey().equals(newAlarm) || next.getValue().references().stream().anyMatch(affected::contains)) {
+                    pending.put(next.getKey(), next.getValue());
+                    affected.add(next.getKey());
+                    affected.add(alarms.get(next.getKey()).getAlarmArn());
+                    iterator.remove();
+                    discovered = true;
+                }
+            }
+        } while (discovered);
+        Set<String> cycles = pending.keySet().stream()
+                .filter(name -> isCyclic(name, alarms)).collect(Collectors.toSet());
+        boolean progress;
+        do {
+            progress = false;
+            Iterator<Map.Entry<String, CompositeAlarmRule.Rule>> iterator = pending.entrySet().iterator();
+            while (iterator.hasNext()) {
+                Map.Entry<String, CompositeAlarmRule.Rule> next = iterator.next();
+                boolean blocked = next.getValue().references().stream().map(alarms::get)
+                        .anyMatch(child -> child != null && pending.containsKey(child.getAlarmName()));
+                if (blocked || cycles.contains(next.getKey())) {
+                    continue;
+                }
+                if (!next.getKey().equals(newAlarm)
+                        && next.getValue().references().stream().noneMatch(changed::contains)) {
+                    iterator.remove();
+                    progress = true;
+                    continue;
+                }
+                Alarm alarm = alarms.get(next.getKey());
+                boolean triggered = next.getValue().evaluate(reference -> {
+                    Alarm child = alarms.get(reference);
+                    return child == null ? null : child.getStateValue();
+                });
+                String state = triggered ? "ALARM" : "OK";
+                if (!state.equals(alarm.getStateValue())) {
+                    alarm.setStateValue(state);
+                    alarm.setStateReason("AlarmRule evaluated to " + state);
+                    alarm.setStateReasonData(null);
+                    alarm.setStateUpdatedTimestamp(Instant.now().getEpochSecond());
+                    alarmStore.put(region + "::" + alarm.getAlarmName(), alarm);
+                    changed.add(alarm.getAlarmName());
+                    changed.add(alarm.getAlarmArn());
+                }
+                iterator.remove();
+                progress = true;
+            }
+        } while (progress && !pending.isEmpty());
+        if (!pending.isEmpty()) {
+            LOG.debugv("Composite alarm evaluation stopped at cyclic dependencies: {0}", pending.keySet());
+        }
+    }
+
+    public synchronized void deleteAlarms(List<String> alarmNames, String region) {
+        Map<String, Alarm> alarms = alarmIndex(region);
+        long composites = alarmNames.stream().map(alarms::get).filter(CompositeAlarm.class::isInstance).count();
+        if (composites > 1) {
+            throw new AwsException("ValidationError", "DeleteAlarms accepts at most one composite alarm", 400);
+        }
         for (String name : alarmNames) {
+            if (isCyclic(name, alarms)) {
+                throw new AwsException("ValidationError", "Break the composite alarm cycle before deleting " + name, 400);
+            }
+        }
+        Set<String> deletedNames = new HashSet<>();
+        for (String name : alarmNames) {
+            if (alarmStore.get(region + "::" + name).isPresent()) {
+                deletedNames.add(name);
+            }
             alarmStore.delete(region + "::" + name);
         }
+        evaluateComposites(region, deletedNames, null);
         LOG.infov("Deleted alarms: {0} in {1}", alarmNames, region);
     }
 
-    public void setAlarmState(String alarmName, String stateValue, String stateReason, String stateReasonData, String region) {
-        String key = region + "::" + alarmName;
-        MetricAlarm alarm = alarmStore.get(key)
-                .orElseThrow(() -> new AwsException("ResourceNotFound", "Alarm not found: " + alarmName, 404));
-
-        alarm.setStateValue(stateValue);
-        alarm.setStateReason(stateReason);
-        alarm.setStateReasonData(stateReasonData);
-        alarm.setStateUpdatedTimestamp(Instant.now().getEpochSecond());
-
-        alarmStore.put(key, alarm);
-        LOG.infov("SetAlarmState: {0} -> {1}", alarmName, stateValue);
+    private boolean isCyclic(String name, Map<String, Alarm> alarms) {
+        Set<String> visited = new HashSet<>();
+        ArrayDeque<String> pending = new ArrayDeque<>();
+        pending.add(name);
+        while (!pending.isEmpty()) {
+            Alarm next = alarms.get(pending.remove());
+            if (next instanceof CompositeAlarm composite && visited.add(next.getAlarmName())) {
+                for (String reference : CompositeAlarmRule.parse(composite.getAlarmRule()).references()) {
+                    Alarm child = alarms.get(reference);
+                    if (child != null && child.getAlarmName().equals(name)) {
+                        return true;
+                    }
+                    if (child != null) {
+                        pending.add(child.getAlarmName());
+                    }
+                }
+            }
+        }
+        return false;
     }
 
-    public Map<String, String> listTagsForResource(String resourceArn, String region) {
+    public void setAlarmState(String alarmName, String stateValue, String stateReason, String stateReasonData, String region) {
+        List<AlarmSnsNotifier.Notification> notifications = List.of();
+        synchronized (this) {
+            String key = region + "::" + alarmName;
+            Alarm alarm = alarmStore.get(key)
+                    .orElseThrow(() -> new AwsException("ResourceNotFound", "Alarm not found: " + alarmName, 404));
+
+            String oldState = alarm.getStateValue();
+            alarm.setStateValue(stateValue);
+            alarm.setStateReason(stateReason);
+            alarm.setStateReasonData(stateReasonData);
+            alarm.setStateUpdatedTimestamp(Instant.now().getEpochSecond());
+
+            alarmStore.put(key, alarm);
+            evaluateComposites(region, Set.of(alarmName), null);
+            LOG.infov("SetAlarmState: {0} -> {1}", alarmName, stateValue);
+            if (alarmSnsNotifier != null && alarm instanceof MetricAlarm metricAlarm) {
+                notifications = alarmSnsNotifier.prepareTransition(metricAlarm, oldState);
+            }
+        }
+        if (alarmSnsNotifier != null) {
+            alarmSnsNotifier.publish(notifications);
+        }
+    }
+
+    /**
+     * Resolves the alarm an ARN names, or reports that nothing does.
+     *
+     * <p>CloudWatch's three tag operations each declare {@code ResourceNotFoundException},
+     * which is a different shape from the {@code ResourceNotFound} that {@code SetAlarmState}
+     * and {@code GetDashboard} declare; the SDK maps the two codes to two exception classes,
+     * so the tag path uses the longer one rather than the code used elsewhere in this service.
+     *
+     * <p>The message names the ARN rather than asserting it was an alarm, because both tag
+     * handlers route every ARN that is not a dashboard and not a metric stream here. That
+     * includes kinds AWS considers taggable and Floci does not serve, a Contributor Insights
+     * {@code insight-rule/} ARN being the one AWS documents; reporting that no resource
+     * matches the ARN is true of those, where "alarm not found" would not be.
+     */
+    private Alarm requireAlarm(String resourceArn, String region) {
         return alarmStore.scan(k -> k.startsWith(region + "::"))
                 .stream()
-                .filter(a -> resourceArn.equals(a.getAlarmArn()))
+                .filter(a -> a.getAlarmArn() != null && a.getAlarmArn().equals(resourceArn))
                 .findFirst()
-                .map(MetricAlarm::getTags)
-                .orElse(Map.of());
+                .orElseThrow(() -> new AwsException("ResourceNotFoundException",
+                        "No CloudWatch resource matches the ARN " + resourceArn + ".", 404));
     }
 
-    public void tagResource(String resourceArn, Map<String, String> tags, String region) {
-        alarmStore.scan(k -> k.startsWith(region + "::"))
-                .stream()
-                .filter(a -> resourceArn.equals(a.getAlarmArn()))
-                .findFirst()
-                .ifPresent(alarm -> {
-                    alarm.getTags().putAll(tags);
-                    alarmStore.put(region + "::" + alarm.getAlarmName(), alarm);
-                });
+    public synchronized Map<String, String> listTagsForResource(String resourceArn, String region) {
+        return new HashMap<>(requireAlarm(resourceArn, region).getTags());
     }
 
-    public void untagResource(String resourceArn, List<String> tagKeys, String region) {
-        alarmStore.scan(k -> k.startsWith(region + "::"))
-                .stream()
-                .filter(a -> resourceArn.equals(a.getAlarmArn()))
-                .findFirst()
-                .ifPresent(alarm -> {
-                    tagKeys.forEach(alarm.getTags()::remove);
-                    alarmStore.put(region + "::" + alarm.getAlarmName(), alarm);
-                });
+    public synchronized void tagResource(String resourceArn, Map<String, String> tags, String region) {
+        Alarm alarm = requireAlarm(resourceArn, region);
+        alarm.getTags().putAll(tags);
+        alarmStore.put(region + "::" + alarm.getAlarmName(), alarm);
+    }
+
+    public synchronized void untagResource(String resourceArn, List<String> tagKeys, String region) {
+        Alarm alarm = requireAlarm(resourceArn, region);
+        tagKeys.forEach(alarm.getTags()::remove);
+        alarmStore.put(region + "::" + alarm.getAlarmName(), alarm);
     }
 
     // ──────────────────────────── Helpers ────────────────────────────

src/main/java/io/github/hectorvent/floci/services/cloudwatch/metrics/CompositeAlarmRule.java

@@ -0,0 +1,184 @@
+package io.github.hectorvent.floci.services.cloudwatch.metrics;
+
+import io.github.hectorvent.floci.core.common.AwsException;
+import io.github.hectorvent.floci.core.common.SmithyValidationErrors;
+
+import java.util.HashSet;
+import java.util.Set;
+import java.util.function.Function;
+
+/** CloudWatch's boolean alarm language, parsed completely before any alarm is stored. */
+final class CompositeAlarmRule {
+    private final String input;
+    private final Set<String> references = new HashSet<>();
+    private int offset;
+    private int elements;
+
+    private CompositeAlarmRule(String input) {
+        this.input = input;
+    }
+
+    static Rule parse(String input) {
+        if (input == null || input.isBlank() || input.length() > 10240) {
+            throw SmithyValidationErrors.validationError(input == null ? SmithyValidationErrors.notNull("alarmRule")
+                    : "Value '" + input + "' at 'alarmRule' failed to satisfy constraint: Member must have length "
+                            + (input.length() > 10240 ? "less than or equal to 10240" : "greater than or equal to 1"));
+        }
+        CompositeAlarmRule parser = new CompositeAlarmRule(input);
+        Expression expression = parser.or();
+        parser.whitespace();
+        if (parser.offset != input.length()) {
+            throw invalid("Invalid AlarmRule");
+        }
+        return new Rule(expression, Set.copyOf(parser.references));
+    }
+
+    private Expression or() {
+        Expression left = and();
+        while (word("OR")) {
+            Expression prior = left;
+            Expression right = and();
+            left = states -> prior.evaluate(states) || right.evaluate(states);
+        }
+        return left;
+    }
+
+    private Expression and() {
+        Expression left = atom();
+        while (word("AND")) {
+            Expression prior = left;
+            Expression right = atom();
+            left = states -> prior.evaluate(states) && right.evaluate(states);
+        }
+        return left;
+    }
+
+    private Expression atom() {
+        boolean negate = false;
+        while (word("NOT")) {
+            negate = !negate;
+        }
+        Expression operand = primary();
+        return negate ? states -> !operand.evaluate(states) : operand;
+    }
+
+    private Expression primary() {
+        element();
+        if (character('(')) {
+            Expression nested = or();
+            require(')');
+            element();
+            return nested;
+        }
+        if (word("TRUE")) {
+            return states -> true;
+        }
+        if (word("FALSE")) {
+            return states -> false;
+        }
+        String state;
+        if (word("ALARM")) {
+            state = "ALARM";
+        } else if (word("OK")) {
+            state = "OK";
+        } else if (word("INSUFFICIENT_DATA")) {
+            state = "INSUFFICIENT_DATA";
+        } else {
+            throw invalid("Expected an alarm state, boolean, NOT, or parenthesis");
+        }
+        require('(');
+        whitespace();
+        String name;
+        if (character('"')) {
+            StringBuilder quoted = new StringBuilder();
+            boolean closed = false;
+            while (offset < input.length()) {
+                char next = input.charAt(offset++);
+                if (next == '"') {
+                    closed = true;
+                    break;
+                }
+                if (next == '\\') {
+                    if (offset == input.length()) {
+                        throw invalid("Unterminated quoted alarm name");
+                    }
+                    next = input.charAt(offset++);
+                    if (next != '\\' && next != '"') {
+                        throw invalid("Invalid quoted alarm name escape");
+                    }
+                }
+                quoted.append(next);
+            }
+            if (!closed) {
+                throw invalid("Unterminated quoted alarm name");
+            }
+            name = quoted.toString();
+        } else {
+            int start = offset;
+            while (offset < input.length() && input.charAt(offset) != ')') {
+                offset++;
+            }
+            name = input.substring(start, offset).trim();
+        }
+        if (name.isEmpty()) {
+            throw invalid("An alarm name or ARN is required");
+        }
+        require(')');
+        references.add(name);
+        return states -> state.equals(states.apply(name));
+    }
+
+    private void element() {
+        if (++elements > 500) {
+            throw invalid("AlarmRule exceeds 500 child alarms, booleans, and parentheses");
+        }
+    }
+
+    private boolean word(String word) {
+        whitespace();
+        if (!input.startsWith(word, offset)) {
+            return false;
+        }
+        int end = offset + word.length();
+        if (end < input.length() && (Character.isLetterOrDigit(input.charAt(end)) || input.charAt(end) == '_')) {
+            return false;
+        }
+        offset = end;
+        return true;
+    }
+
+    private boolean character(char expected) {
+        whitespace();
+        if (offset < input.length() && input.charAt(offset) == expected) {
+            offset++;
+            return true;
+        }
+        return false;
+    }
+
+    private void require(char expected) {
+        if (!character(expected)) {
+            throw invalid("Expected '" + expected + "' in AlarmRule");
+        }
+    }
+
+    private void whitespace() {
+        while (offset < input.length() && Character.isWhitespace(input.charAt(offset))) {
+            offset++;
+        }
+    }
+
+    private static AwsException invalid(String message) {
+        return new AwsException("ValidationError", message, 400);
+    }
+
+    record Rule(Expression expression, Set<String> references) {
+        boolean evaluate(Function<String, String> states) {
+            return expression.evaluate(states);
+        }
+    }
+
+    interface Expression {
+        boolean evaluate(Function<String, String> states);
+    }
+}

src/main/java/io/github/hectorvent/floci/services/cloudwatch/metrics/model/Alarm.java

@@ -0,0 +1,87 @@
+package io.github.hectorvent.floci.services.cloudwatch.metrics.model;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import io.quarkus.runtime.annotations.RegisterForReflection;
+
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+@RegisterForReflection
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, include = JsonTypeInfo.As.EXISTING_PROPERTY,
+        property = "alarmType", defaultImpl = MetricAlarm.class)
+@JsonSubTypes({@JsonSubTypes.Type(value = MetricAlarm.class, name = "MetricAlarm"),
+        @JsonSubTypes.Type(value = CompositeAlarm.class, name = "CompositeAlarm")})
+public abstract class Alarm {
+    private String alarmName;
+    private String alarmArn;
+    private String alarmDescription;
+    private long alarmConfigurationUpdatedTimestamp;
+    private boolean actionsEnabled;
+    private List<String> okActions = new ArrayList<>();
+    private List<String> alarmActions = new ArrayList<>();
+    private List<String> insufficientDataActions = new ArrayList<>();
+    private String stateValue = "INSUFFICIENT_DATA";
+    private String stateReason = "Unchecked";
+    private String stateReasonData;
+    private long stateUpdatedTimestamp;
+    private Map<String, String> tags = new HashMap<>();
+    private String region;
+
+
+    protected Alarm() {
+        long now = Instant.now().getEpochSecond();
+        this.alarmConfigurationUpdatedTimestamp = now;
+        this.stateUpdatedTimestamp = now;
+    }
+
+    public abstract String getAlarmType();
+
+    public String getAlarmName() { return alarmName; }
+    public void setAlarmName(String alarmName) { this.alarmName = alarmName; }
+
+    public String getAlarmArn() { return alarmArn; }
+    public void setAlarmArn(String alarmArn) { this.alarmArn = alarmArn; }
+
+    public String getAlarmDescription() { return alarmDescription; }
+    public void setAlarmDescription(String alarmDescription) { this.alarmDescription = alarmDescription; }
+
+    public long getAlarmConfigurationUpdatedTimestamp() { return alarmConfigurationUpdatedTimestamp; }
+    public void setAlarmConfigurationUpdatedTimestamp(long timestamp) { this.alarmConfigurationUpdatedTimestamp = timestamp; }
+
+    public boolean isActionsEnabled() { return actionsEnabled; }
+    public void setActionsEnabled(boolean actionsEnabled) { this.actionsEnabled = actionsEnabled; }
+
+    public List<String> getOkActions() { return okActions; }
+    public void setOkActions(List<String> okActions) { this.okActions = okActions; }
+
+    public List<String> getAlarmActions() { return alarmActions; }
+    public void setAlarmActions(List<String> alarmActions) { this.alarmActions = alarmActions; }
+
+    public List<String> getInsufficientDataActions() { return insufficientDataActions; }
+    public void setInsufficientDataActions(List<String> insufficientDataActions) { this.insufficientDataActions = insufficientDataActions; }
+
+    public String getStateValue() { return stateValue; }
+    public void setStateValue(String stateValue) { this.stateValue = stateValue; }
+
+    public String getStateReason() { return stateReason; }
+    public void setStateReason(String stateReason) { this.stateReason = stateReason; }
+
+    public String getStateReasonData() { return stateReasonData; }
+    public void setStateReasonData(String stateReasonData) { this.stateReasonData = stateReasonData; }
+
+    public long getStateUpdatedTimestamp() { return stateUpdatedTimestamp; }
+    public void setStateUpdatedTimestamp(long stateUpdatedTimestamp) { this.stateUpdatedTimestamp = stateUpdatedTimestamp; }
+
+    public Map<String, String> getTags() { return tags; }
+    public void setTags(Map<String, String> tags) { this.tags = tags; }
+
+
+    public String getRegion() { return region; }
+    public void setRegion(String region) { this.region = region; }
+}

src/main/java/io/github/hectorvent/floci/services/cloudwatch/metrics/model/AlarmMetricDataQuery.java

@@ -0,0 +1,46 @@
+package io.github.hectorvent.floci.services.cloudwatch.metrics.model;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.quarkus.runtime.annotations.RegisterForReflection;
+
+import java.util.List;
+
+/** The persisted AWS wire shape of a metric-math alarm query, including optional members. */
+@RegisterForReflection
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public record AlarmMetricDataQuery(
+        @JsonProperty("Id") String id,
+        @JsonProperty("Expression") String expression,
+        @JsonProperty("Label") String label,
+        @JsonProperty("ReturnData") Boolean returnData,
+        @JsonProperty("Period") Integer period,
+        @JsonProperty("AccountId") String accountId,
+        @JsonProperty("MetricStat") MetricStat metricStat) {
+
+    @RegisterForReflection
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public record MetricStat(
+            @JsonProperty("Metric") Metric metric,
+            @JsonProperty("Period") Integer period,
+            @JsonProperty("Stat") String stat,
+            @JsonProperty("Unit") String unit) { }
+
+    @RegisterForReflection
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public record Metric(
+            @JsonProperty("Namespace") String namespace,
+            @JsonProperty("MetricName") String metricName,
+            @JsonProperty("Dimensions") List<MetricDimension> dimensions) { }
+
+    @RegisterForReflection
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public record MetricDimension(
+            @JsonProperty("Name") String name,
+            @JsonProperty("Value") String value) { }
+}

src/main/java/io/github/hectorvent/floci/services/cloudwatch/metrics/model/CompositeAlarm.java

@@ -0,0 +1,14 @@
+package io.github.hectorvent.floci.services.cloudwatch.metrics.model;
+
+import io.quarkus.runtime.annotations.RegisterForReflection;
+
+@RegisterForReflection
+public class CompositeAlarm extends Alarm {
+    private String alarmRule;
+
+    @Override
+    public String getAlarmType() { return "CompositeAlarm"; }
+
+    public String getAlarmRule() { return alarmRule; }
+    public void setAlarmRule(String alarmRule) { this.alarmRule = alarmRule; }
+}

src/main/java/io/github/hectorvent/floci/services/cloudwatch/metrics/model/MetricAlarm.java

@@ -3,32 +3,22 @@ package io.github.hectorvent.floci.services.cloudwatch.metrics.model;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import io.quarkus.runtime.annotations.RegisterForReflection;
 
-import java.time.Instant;
 import java.util.ArrayList;
-import java.util.HashMap;
 import java.util.List;
-import java.util.Map;
 
 @RegisterForReflection
 @JsonIgnoreProperties(ignoreUnknown = true)
-public class MetricAlarm {
-    private String alarmName;
-    private String alarmArn;
-    private String alarmDescription;
-    private long alarmConfigurationUpdatedTimestamp;
-    private boolean actionsEnabled;
-    private List<String> okActions = new ArrayList<>();
-    private List<String> alarmActions = new ArrayList<>();
-    private List<String> insufficientDataActions = new ArrayList<>();
-    private String stateValue = "INSUFFICIENT_DATA";
-    private String stateReason = "Unchecked";
-    private String stateReasonData;
-    private long stateUpdatedTimestamp;
+public class MetricAlarm extends Alarm {
+    @Override
+    public String getAlarmType() { return "MetricAlarm"; }
+
     private String metricName;
     private String namespace;
     private String statistic;
     private List<Dimension> dimensions = new ArrayList<>();
-    private int period;
+    /** Single-metric period; absent for alarms whose periods are defined in Metrics. */
+    private Integer period;
+    private List<AlarmMetricDataQuery> metrics = new ArrayList<>();
     private String unit;
     private int evaluationPeriods;
     /**
@@ -43,50 +33,6 @@ public class MetricAlarm {
     private String comparisonOperator;
     private String treatMissingData = "missing";
     private String evaluateLowSampleCountPercentile;
-    private Map<String, String> tags = new HashMap<>();
-    private String region;
-
-    public MetricAlarm() {
-        long now = Instant.now().getEpochSecond();
-        this.alarmConfigurationUpdatedTimestamp = now;
-        this.stateUpdatedTimestamp = now;
-    }
-
-    public String getAlarmName() { return alarmName; }
-    public void setAlarmName(String alarmName) { this.alarmName = alarmName; }
-
-    public String getAlarmArn() { return alarmArn; }
-    public void setAlarmArn(String alarmArn) { this.alarmArn = alarmArn; }
-
-    public String getAlarmDescription() { return alarmDescription; }
-    public void setAlarmDescription(String alarmDescription) { this.alarmDescription = alarmDescription; }
-
-    public long getAlarmConfigurationUpdatedTimestamp() { return alarmConfigurationUpdatedTimestamp; }
-    public void setAlarmConfigurationUpdatedTimestamp(long timestamp) { this.alarmConfigurationUpdatedTimestamp = timestamp; }
-
-    public boolean isActionsEnabled() { return actionsEnabled; }
-    public void setActionsEnabled(boolean actionsEnabled) { this.actionsEnabled = actionsEnabled; }
-
-    public List<String> getOkActions() { return okActions; }
-    public void setOkActions(List<String> okActions) { this.okActions = okActions; }
-
-    public List<String> getAlarmActions() { return alarmActions; }
-    public void setAlarmActions(List<String> alarmActions) { this.alarmActions = alarmActions; }
-
-    public List<String> getInsufficientDataActions() { return insufficientDataActions; }
-    public void setInsufficientDataActions(List<String> insufficientDataActions) { this.insufficientDataActions = insufficientDataActions; }
-
-    public String getStateValue() { return stateValue; }
-    public void setStateValue(String stateValue) { this.stateValue = stateValue; }
-
-    public String getStateReason() { return stateReason; }
-    public void setStateReason(String stateReason) { this.stateReason = stateReason; }
-
-    public String getStateReasonData() { return stateReasonData; }
-    public void setStateReasonData(String stateReasonData) { this.stateReasonData = stateReasonData; }
-
-    public long getStateUpdatedTimestamp() { return stateUpdatedTimestamp; }
-    public void setStateUpdatedTimestamp(long stateUpdatedTimestamp) { this.stateUpdatedTimestamp = stateUpdatedTimestamp; }
 
     public String getMetricName() { return metricName; }
     public void setMetricName(String metricName) { this.metricName = metricName; }
@@ -100,8 +46,13 @@ public class MetricAlarm {
     public List<Dimension> getDimensions() { return dimensions; }
     public void setDimensions(List<Dimension> dimensions) { this.dimensions = dimensions; }
 
-    public int getPeriod() { return period; }
-    public void setPeriod(int period) { this.period = period; }
+    public Integer getPeriod() { return period; }
+    public void setPeriod(Integer period) { this.period = period; }
+
+    public List<AlarmMetricDataQuery> getMetrics() { return metrics; }
+    public void setMetrics(List<AlarmMetricDataQuery> metrics) {
+        this.metrics = metrics == null ? new ArrayList<>() : new ArrayList<>(metrics);
+    }
 
     public String getUnit() { return unit; }
     public void setUnit(String unit) { this.unit = unit; }
@@ -124,11 +75,4 @@ public class MetricAlarm {
     public String getEvaluateLowSampleCountPercentile() { return evaluateLowSampleCountPercentile; }
     public void setEvaluateLowSampleCountPercentile(String percentile) { this.evaluateLowSampleCountPercentile = percentile; }
 
-    public Map<String, String> getTags() { return tags; }
-    public void setTags(Map<String, String> tags) { this.tags = tags; }
-
-    /** Not part of the AWS shape; set by {@code putMetricAlarm} so a background evaluator
-     * that only holds the alarm object still knows which region's metric data to query. */
-    public String getRegion() { return region; }
-    public void setRegion(String region) { this.region = region; }
 }

src/main/java/io/github/hectorvent/floci/services/cloudwatch/metricstreams/CloudWatchMetricStreamsService.java

@@ -196,21 +196,30 @@ public class CloudWatchMetricStreamsService {
     }
 
     public Map<String, String> listTagsForResource(String resourceArn, String region) {
-        return findByArn(resourceArn, region).map(MetricStream::getTags).orElse(Map.of());
+        return requireStream(resourceArn, region).getTags();
     }
 
     public void tagResource(String resourceArn, Map<String, String> tags, String region) {
-        findByArn(resourceArn, region).ifPresent(stream -> {
-            stream.getTags().putAll(tags);
-            streamStore.put(key(region, stream.getName()), stream);
-        });
+        MetricStream stream = requireStream(resourceArn, region);
+        stream.getTags().putAll(tags);
+        streamStore.put(key(region, stream.getName()), stream);
     }
 
     public void untagResource(String resourceArn, List<String> tagKeys, String region) {
-        findByArn(resourceArn, region).ifPresent(stream -> {
-            tagKeys.forEach(stream.getTags()::remove);
-            streamStore.put(key(region, stream.getName()), stream);
-        });
+        MetricStream stream = requireStream(resourceArn, region);
+        tagKeys.forEach(stream.getTags()::remove);
+        streamStore.put(key(region, stream.getName()), stream);
+    }
+
+    /**
+     * Resolves the stream an ARN names, or reports that nothing does. The tag operations declare
+     * {@code ResourceNotFoundException}, the same code {@code GetMetricStream} already answers
+     * with, so an unknown ARN here reads the same way an unknown name does.
+     */
+    private MetricStream requireStream(String resourceArn, String region) {
+        return findByArn(resourceArn, region).orElseThrow(() ->
+                new AwsException("ResourceNotFoundException",
+                        "Metric stream " + resourceArn + " does not exist.", 404));
     }
 
     private Optional<MetricStream> findByArn(String resourceArn, String region) {

src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildRunner.java

@@ -15,6 +15,7 @@ import io.github.hectorvent.floci.core.common.docker.ContainerLifecycleManager;
 import io.github.hectorvent.floci.core.common.docker.ContainerLogStreamer;
 import io.github.hectorvent.floci.core.common.docker.ContainerSpec;
 import io.github.hectorvent.floci.core.common.docker.ContainerStorageHelper;
+import io.github.hectorvent.floci.core.common.docker.DockerClientProducer;
 import io.github.hectorvent.floci.services.codebuild.BuildspecParser.ParsedArtifacts;
 import io.github.hectorvent.floci.services.codebuild.BuildspecParser.ParsedBuildspec;
 import io.github.hectorvent.floci.services.codebuild.model.Build;
@@ -38,6 +39,7 @@ import java.io.ByteArrayOutputStream;
 import java.io.Closeable;
 import java.io.IOException;
 import java.io.InputStream;
+import java.net.URI;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -195,9 +197,10 @@ public class CodeBuildRunner implements ContainerTeardown {
             String logGroup = "/aws/codebuild/" + project.getName();
             String logStream = logStreamer.generateLogStreamName(buildId.replace(":", "/"));
 
-            String image = build.getEnvironment() != null && build.getEnvironment().getImage() != null
+            String requestedImage = build.getEnvironment() != null && build.getEnvironment().getImage() != null
                     ? build.getEnvironment().getImage()
                     : project.getEnvironment().getImage();
+            String image = resolveBuildImage(requestedImage);
 
             boolean privileged = (project.getEnvironment() != null
                     && Boolean.TRUE.equals(project.getEnvironment().getPrivilegedMode()))
@@ -214,8 +217,11 @@ public class CodeBuildRunner implements ContainerTeardown {
 
             // Keep the container alive so each phase can be run with docker exec.
             // No bind mount needed — source and artifacts are transferred with docker cp.
-            ContainerSpec spec = containerBuilder.newContainer(image)
-                    .withCmd(List.of("sh", "-c", "tail -f /dev/null"))
+            String startupCommand = "aws/codebuild/standard:7.0".equals(requestedImage)
+                    ? "apt-get update && apt-get install -y --no-install-recommends zip && tail -f /dev/null"
+                    : "tail -f /dev/null";
+            ContainerBuilder.Builder container = containerBuilder.newContainer(image)
+                    .withCmd(List.of("sh", "-c", startupCommand))
                     .withEnv(envList)
                     .withDockerNetwork(config.services().codebuild().dockerNetwork())
                     .withEmbeddedDns()
@@ -223,8 +229,9 @@ public class CodeBuildRunner implements ContainerTeardown {
                     .withPrivileged(privileged)
                     .withLogRotation()
                     .withLabels(ContainerStorageHelper.resourceIdentityLabels(
-                            "codebuild", buildId, regionResolver.getAccountId(), region))
-                    .build();
+                            "codebuild", buildId, regionResolver.getAccountId(), region));
+            exposeDockerSocketIfPrivileged(container, privileged, config.docker());
+            ContainerSpec spec = container.build();
 
             ContainerLifecycleManager.ContainerInfo info = lifecycleManager.createAndStart(spec);
             containerId = info.containerId();
@@ -261,7 +268,8 @@ public class CodeBuildRunner implements ContainerTeardown {
             if (installResult.stopped()) { finishStopped(build); return; }
             if (installResult.failed()) {
                 completePhaseWithError(build, "INSTALL", "FAILED", installResult.errorMessage());
-                buildFailed = true;
+                finishFailed(build);
+                return;
             } else {
                 completePhase(build, "INSTALL", "SUCCEEDED");
             }
@@ -276,7 +284,8 @@ public class CodeBuildRunner implements ContainerTeardown {
                 if (preBuildResult.stopped()) { finishStopped(build); return; }
                 if (preBuildResult.failed()) {
                     completePhaseWithError(build, "PRE_BUILD", "FAILED", preBuildResult.errorMessage());
-                    buildFailed = true;
+                    finishFailed(build);
+                    return;
                 } else {
                     completePhase(build, "PRE_BUILD", "SUCCEEDED");
                 }
@@ -294,7 +303,8 @@ public class CodeBuildRunner implements ContainerTeardown {
                 if (buildResult.stopped()) { finishStopped(build); return; }
                 if (buildResult.failed()) {
                     completePhaseWithError(build, "BUILD", "FAILED", buildResult.errorMessage());
-                    buildFailed = true;
+                    finishFailed(build);
+                    return;
                 } else {
                     completePhase(build, "BUILD", "SUCCEEDED");
                 }
@@ -311,7 +321,8 @@ public class CodeBuildRunner implements ContainerTeardown {
             if (postBuildResult.stopped()) { finishStopped(build); return; }
             if (postBuildResult.failed()) {
                 completePhaseWithError(build, "POST_BUILD", "FAILED", postBuildResult.errorMessage());
-                buildFailed = true;
+                finishFailed(build);
+                return;
             } else {
                 completePhase(build, "POST_BUILD", "SUCCEEDED");
             }
@@ -384,6 +395,27 @@ public class CodeBuildRunner implements ContainerTeardown {
         }
     }
 
+    private String resolveBuildImage(String image) {
+        if ("aws/codebuild/standard:7.0".equals(image)) {
+            return "golang:1.23-bookworm";
+        }
+        return image;
+    }
+
+    static void exposeDockerSocketIfPrivileged(ContainerBuilder.Builder container, boolean privileged,
+                                               EmulatorConfig.DockerConfig dockerConfig) {
+        if (!privileged) {
+            return;
+        }
+        String dockerHost = DockerClientProducer.resolveDockerConnection(dockerConfig, System::getenv).host();
+        URI dockerUri = URI.create(dockerHost);
+        if (!"unix".equals(dockerUri.getScheme()) || dockerUri.getPath() == null || dockerUri.getPath().isBlank()) {
+            LOG.debugv("CodeBuild privileged mode cannot mount non-Unix Docker endpoint {0}", dockerHost);
+            return;
+        }
+        container.withBind(dockerUri.getPath(), "/var/run/docker.sock");
+    }
+
     private String resolveAndAcquireSource(String region, Build build, Project project,
                                            String buildspecOverride, Path workspace) throws IOException {
         String sourceType = project.getSource() != null ? project.getSource().getType() : "NO_SOURCE";
@@ -660,25 +692,20 @@ public class CodeBuildRunner implements ContainerTeardown {
     private void uploadArtifacts(String region, Build build, Project project,
                                  ParsedArtifacts artifacts, Path workspace) throws IOException {
         String type = artifacts.type();
-        if ("NO_ARTIFACTS".equals(type) && project.getArtifacts() != null) {
-            type = project.getArtifacts().getType();
+        if ("NO_ARTIFACTS".equals(type) && build.getArtifacts() != null) {
+            type = build.getArtifacts().getType();
         }
-        if (type == null || "NO_ARTIFACTS".equals(type) || "CODEPIPELINE".equals(type)) {
+        if (type == null || "NO_ARTIFACTS".equals(type)) {
             return;
         }
-        if (!"S3".equals(type)) {
+        if (!"S3".equals(type) && !"CODEPIPELINE".equals(type)) {
             return;
         }
 
         String packaging = artifacts.packaging();
-        if ("ZIP".equals(packaging) && project.getArtifacts() != null
-                && project.getArtifacts().getPackaging() != null) {
-            packaging = project.getArtifacts().getPackaging();
-        }
-
-        String location = project.getArtifacts() != null ? project.getArtifacts().getLocation() : null;
-        if (location == null || location.isBlank()) {
-            return;
+        if ("ZIP".equals(packaging) && build.getArtifacts() != null
+                && build.getArtifacts().getPackaging() != null) {
+            packaging = build.getArtifacts().getPackaging();
         }
 
         List<String> filePatterns = artifacts.files();
@@ -698,6 +725,16 @@ public class CodeBuildRunner implements ContainerTeardown {
             return;
         }
 
+        if ("CODEPIPELINE".equals(type)) {
+            build.setOutputArtifact(zipFiles(baseDir, matchedFiles, artifacts.discardPaths()));
+            return;
+        }
+
+        String location = build.getArtifacts() != null ? build.getArtifacts().getLocation() : null;
+        if (location == null || location.isBlank()) {
+            return;
+        }
+
         int slash = location.indexOf('/');
         String bucket = slash > 0 ? location.substring(0, slash) : location;
         String prefix = slash > 0 ? location.substring(slash + 1) : "";
@@ -841,6 +878,13 @@ public class CodeBuildRunner implements ContainerTeardown {
         build.setBuildComplete(true);
         build.setBuildStatus("FAILED");
         build.setCurrentPhase("COMPLETED");
+        BuildPhase completed = new BuildPhase();
+        completed.setPhaseType("COMPLETED");
+        completed.setPhaseStatus("FAILED");
+        completed.setStartTime(System.currentTimeMillis() / 1000.0);
+        completed.setEndTime(System.currentTimeMillis() / 1000.0);
+        completed.setDurationInSeconds(0L);
+        build.getPhases().add(completed);
     }
 
     private Optional<BuildPhase> findPhase(Build build, String phaseType) {

src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildService.java

@@ -489,6 +489,14 @@ public class CodeBuildService {
         return build;
     }
 
+    /**
+     * Returns the CODEPIPELINE output produced by one completed build. This is runtime state,
+     * like the build itself, and must not be inferred from a project-wide artifact location.
+     */
+    public byte[] getBuildOutputArtifact(String region, String account, String buildId) {
+        return getBuild(region, account, buildId).getOutputArtifact();
+    }
+
     public List<Build> batchGetBuilds(String region, String account, List<String> buildIds) {
         Map<String, Build> store = buildsFor(account, region);
         return buildIds.stream()

src/main/java/io/github/hectorvent/floci/services/codebuild/model/Build.java

@@ -1,5 +1,6 @@
 package io.github.hectorvent.floci.services.codebuild.model;
 
+import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import io.quarkus.runtime.annotations.RegisterForReflection;
 
@@ -29,6 +30,7 @@ public class Build {
     private Integer timeoutInMinutes;
     private Integer queuedTimeoutInMinutes;
     private String encryptionKey;
+    private byte[] outputArtifact;
 
     public String getId() { return id; }
     public void setId(String id) { this.id = id; }
@@ -83,4 +85,11 @@ public class Build {
 
     public String getEncryptionKey() { return encryptionKey; }
     public void setEncryptionKey(String encryptionKey) { this.encryptionKey = encryptionKey; }
+
+    @JsonIgnore
+    public byte[] getOutputArtifact() { return outputArtifact != null ? outputArtifact.clone() : null; }
+
+    public void setOutputArtifact(byte[] outputArtifact) {
+        this.outputArtifact = outputArtifact != null ? outputArtifact.clone() : null;
+    }
 }

src/main/java/io/github/hectorvent/floci/services/codedeploy/CodeDeployService.java

@@ -17,10 +17,19 @@ import io.github.hectorvent.floci.services.codedeploy.model.OnPremisesInstance;
 import io.github.hectorvent.floci.services.ec2.Ec2Service;
 import io.github.hectorvent.floci.services.ecs.EcsService;
 import io.github.hectorvent.floci.services.ecs.model.CreateTaskSetRequest;
+import io.github.hectorvent.floci.services.ecs.model.EcsLoadBalancer;
+import io.github.hectorvent.floci.services.ecs.model.EcsServiceModel;
+import io.github.hectorvent.floci.services.ecs.model.LaunchType;
 import io.github.hectorvent.floci.services.ecs.model.TaskSet;
 import io.github.hectorvent.floci.services.elbv2.ElbV2Service;
+import io.github.hectorvent.floci.services.elbv2.model.Action;
+import io.github.hectorvent.floci.services.elbv2.model.Rule;
 import io.github.hectorvent.floci.services.elbv2.model.TargetGroup;
+import io.github.hectorvent.floci.services.elbv2.model.TargetHealth;
 import io.github.hectorvent.floci.services.lambda.LambdaService;
+import io.github.hectorvent.floci.services.lambda.model.LambdaAlias;
+import io.github.hectorvent.floci.services.lambda.model.LambdaFunction;
+import io.github.hectorvent.floci.services.s3.S3Service;
 import io.github.hectorvent.floci.services.ssm.SsmCommandService;
 import io.github.hectorvent.floci.services.lambda.model.InvocationType;
 import io.github.hectorvent.floci.services.lambda.model.InvokeResult;
@@ -29,6 +38,8 @@ import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
 import org.jboss.logging.Logger;
 
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
 import java.time.Clock;
 import java.time.Duration;
 import java.time.Instant;
@@ -36,6 +47,8 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 import java.util.UUID;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipInputStream;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.CopyOnWriteArrayList;
@@ -53,8 +66,16 @@ public class CodeDeployService {
     // Lambda/ECS validation hooks must call PutLifecycleEventHookExecutionStatus within one hour.
     private static final Duration DEFAULT_HOOK_CALLBACK_TIMEOUT = Duration.ofHours(1);
     private static final Duration STOP_POLL_INTERVAL = Duration.ofMillis(200);
+    private static final int ECS_READINESS_MAX_POLLS = 150;
+    private static final int ECS_TARGET_HEALTH_MAX_POLLS = 900;
+
+    @FunctionalInterface
+    interface Sleeper {
+        void sleep(long millis) throws InterruptedException;
+    }
 
     private final LambdaService lambdaService;
+    private final S3Service s3Service;
     private final EcsService ecsService;
     private final ElbV2Service elbV2Service;
     private final SsmCommandService ssmCommandService;
@@ -65,21 +86,48 @@ public class CodeDeployService {
     private final StorageFactory storageFactory;
     private final Duration hookCallbackTimeout;
     private final Clock clock;
+    private final Sleeper sleeper;
 
     @Inject
     public CodeDeployService(LambdaService lambdaService, EcsService ecsService,
                              ElbV2Service elbV2Service, SsmCommandService ssmCommandService,
                              Ec2Service ec2Service, ObjectMapper mapper, RegionResolver regionResolver,
-                             StorageFactory storageFactory) {
+                              StorageFactory storageFactory, S3Service s3Service) {
         this(lambdaService, ecsService, elbV2Service, ssmCommandService, ec2Service, mapper,
-                regionResolver, storageFactory, DEFAULT_HOOK_CALLBACK_TIMEOUT, Clock.systemUTC());
+                regionResolver, storageFactory, DEFAULT_HOOK_CALLBACK_TIMEOUT, Clock.systemUTC(), s3Service, Thread::sleep);
     }
 
     CodeDeployService(LambdaService lambdaService, EcsService ecsService,
                       ElbV2Service elbV2Service, SsmCommandService ssmCommandService,
                       Ec2Service ec2Service, ObjectMapper mapper, RegionResolver regionResolver,
-                      StorageFactory storageFactory, Duration hookCallbackTimeout, Clock clock) {
+                      StorageFactory storageFactory) {
+        this(lambdaService, ecsService, elbV2Service, ssmCommandService, ec2Service, mapper,
+                regionResolver, storageFactory, DEFAULT_HOOK_CALLBACK_TIMEOUT, Clock.systemUTC(), null, Thread::sleep);
+    }
+
+    CodeDeployService(LambdaService lambdaService, EcsService ecsService,
+                      ElbV2Service elbV2Service, SsmCommandService ssmCommandService,
+                       Ec2Service ec2Service, ObjectMapper mapper, RegionResolver regionResolver,
+                       StorageFactory storageFactory, Duration hookCallbackTimeout, Clock clock) {
+        this(lambdaService, ecsService, elbV2Service, ssmCommandService, ec2Service, mapper,
+                regionResolver, storageFactory, hookCallbackTimeout, clock, null, Thread::sleep);
+    }
+
+    CodeDeployService(LambdaService lambdaService, EcsService ecsService,
+                      ElbV2Service elbV2Service, SsmCommandService ssmCommandService,
+                      Ec2Service ec2Service, ObjectMapper mapper, RegionResolver regionResolver,
+                      StorageFactory storageFactory, Duration hookCallbackTimeout, Clock clock, S3Service s3Service) {
+        this(lambdaService, ecsService, elbV2Service, ssmCommandService, ec2Service, mapper,
+                regionResolver, storageFactory, hookCallbackTimeout, clock, s3Service, Thread::sleep);
+    }
+
+    CodeDeployService(LambdaService lambdaService, EcsService ecsService,
+                      ElbV2Service elbV2Service, SsmCommandService ssmCommandService,
+                      Ec2Service ec2Service, ObjectMapper mapper, RegionResolver regionResolver,
+                      StorageFactory storageFactory, Duration hookCallbackTimeout, Clock clock, S3Service s3Service,
+                      Sleeper sleeper) {
         this.lambdaService = lambdaService;
+        this.s3Service = s3Service;
         this.ecsService = ecsService;
         this.elbV2Service = elbV2Service;
         this.ssmCommandService = ssmCommandService;
@@ -90,6 +138,7 @@ public class CodeDeployService {
         this.storageFactory = storageFactory;
         this.hookCallbackTimeout = hookCallbackTimeout;
         this.clock = clock;
+        this.sleeper = sleeper;
     }
 
     // ---- Durable (persisted) ----
@@ -109,8 +158,8 @@ public class CodeDeployService {
     private final ConcurrentHashMap<String, ConcurrentHashMap<String, Deployment>> deployments = new ConcurrentHashMap<>();
     // key: region -> deploymentId -> targetId -> DeploymentTarget wrapper
     private final ConcurrentHashMap<String, ConcurrentHashMap<String, ConcurrentHashMap<String, Map<String, Object>>>> deploymentTargets = new ConcurrentHashMap<>();
-    // key: lifecycleEventHookExecutionId -> CompletableFuture<status>
-    private final ConcurrentHashMap<String, CompletableFuture<String>> hookFutures = new ConcurrentHashMap<>();
+    // key: lifecycleEventHookExecutionId -> the deployment event that owns the callback
+    private final ConcurrentHashMap<String, HookExecution> hookExecutions = new ConcurrentHashMap<>();
     // key: deploymentId -> stop flag
     private final ConcurrentHashMap<String, AtomicBoolean> stopFlags = new ConcurrentHashMap<>();
 
@@ -203,6 +252,28 @@ public class CodeDeployService {
         String afterAllowTraffic;
     }
 
+    private static final class HookExecution {
+        final String deploymentId;
+        final String lifecycleEventName;
+        final CompletableFuture<String> future;
+
+        HookExecution(String deploymentId, String lifecycleEventName, CompletableFuture<String> future) {
+            this.deploymentId = deploymentId;
+            this.lifecycleEventName = lifecycleEventName;
+            this.future = future;
+        }
+    }
+
+    private static final class AliasRoutingSnapshot {
+        final String functionVersion;
+        final Map<String, Double> routingConfig;
+
+        AliasRoutingSnapshot(LambdaAlias alias) {
+            this.functionVersion = alias.getFunctionVersion();
+            this.routingConfig = alias.getRoutingConfig() == null ? Map.of() : Map.copyOf(alias.getRoutingConfig());
+        }
+    }
+
     private static final class ServerAppSpecInfo {
         String os;
         Map<String, List<Map<String, Object>>> hooks; // hookName → [{location, timeout, runas}]
@@ -578,8 +649,10 @@ public class CodeDeployService {
             return createServerDeployment(region, appName, groupName, group, configName, revision, description);
         }
 
-        AppSpecInfo appSpec = parseAppSpec(revision);
         String effectiveConfig = configName != null ? configName : group.getDeploymentConfigName();
+        validateLambdaDeployment(region, app, group, effectiveConfig);
+        AppSpecInfo appSpec = parseAppSpec(revision);
+        validateLambdaTarget(region, appSpec);
 
         String deploymentId = generateDeploymentId();
         double now = Instant.now().toEpochMilli() / 1000.0;
@@ -695,10 +768,16 @@ public class CodeDeployService {
     }
 
     public String putLifecycleEventHookExecutionStatus(String deploymentId, String executionId, String status) {
-        CompletableFuture<String> future = hookFutures.get(executionId);
-        if (future != null && !future.isDone()) {
-            future.complete(status);
+        if (!"Succeeded".equals(status) && !"Failed".equals(status)) {
+            throw new AwsException("InvalidLifecycleEventHookExecutionStatusException",
+                    "Lifecycle event hook execution status must be Succeeded or Failed", 400);
         }
+        HookExecution execution = hookExecutions.get(executionId);
+        if (execution == null || !execution.deploymentId.equals(deploymentId) || execution.future.isDone()) {
+            throw new AwsException("InvalidLifecycleEventHookExecutionIdException",
+                    "Lifecycle event hook execution ID is not valid for this deployment", 400);
+        }
+        execution.future.complete(status);
         return executionId;
     }
 
@@ -1063,12 +1142,17 @@ public class CodeDeployService {
             for (Map<String, String> filter : ec2TagFilters) {
                 String key = filter.get("Key");
                 String value = filter.get("Value");
-                if (key != null && value != null) {
+                String type = filter.get("Type");
+                if ("KEY_ONLY".equals(type) && key != null) {
+                    filters.computeIfAbsent("tag-key", k -> new ArrayList<>()).add(key);
+                } else if ("VALUE_ONLY".equals(type) && value != null) {
+                    filters.computeIfAbsent("tag-value", k -> new ArrayList<>()).add(value);
+                } else if (key != null && value != null) {
                     filters.computeIfAbsent("tag:" + key, k -> new ArrayList<>()).add(value);
                 }
             }
             try {
-                ec2Service.describeInstances(region, null, filters).stream()
+                ec2Service.describeInstances(region, List.of(), filters).stream()
                         .flatMap(r -> r.getInstances().stream())
                         .map(inst -> inst.getInstanceId())
                         .filter(id -> id != null)
@@ -1118,38 +1202,53 @@ public class CodeDeployService {
         if (revision == null) {
             throw new AwsException("InvalidRevisionException", "Revision is required", 400);
         }
-        Object appSpecContent = revision.get("appSpecContent");
-        if (!(appSpecContent instanceof Map)) {
-            throw new AwsException("InvalidRevisionException", "Missing appSpecContent in revision", 400);
-        }
-        String content = (String) ((Map<String, Object>) appSpecContent).get("content");
+        String content = appSpecContent(revision);
         if (content == null || content.isBlank()) {
             throw new AwsException("InvalidRevisionException", "Missing content in appSpecContent", 400);
         }
 
         AppSpecInfo info = new AppSpecInfo();
         try {
-            JsonNode root = mapper.readTree(content);
-            JsonNode resources = root.get("Resources");
-            if (resources != null && resources.isArray() && !resources.isEmpty()) {
-                JsonNode firstResource = resources.get(0);
-                if (firstResource.isObject()) {
-                    JsonNode resourceNode = firstResource.fields().next().getValue();
-                    JsonNode props = resourceNode.path("Properties");
-                    info.functionName = props.path("Name").asText(null);
-                    info.aliasName = props.path("Alias").asText(null);
-                    info.currentVersion = props.path("CurrentVersion").asText(null);
-                    info.targetVersion = props.path("TargetVersion").asText(null);
-                }
+            JsonNode root = yamlMapper.readTree(content);
+            if (!root.isObject() || !"0.0".equals(root.path("version").asText())) {
+                throw new IllegalArgumentException("AppSpec version must be 0.0");
+            }
+            JsonNode resources = root.path("Resources");
+            if (!resources.isArray() || resources.size() != 1 || !resources.get(0).isObject()
+                    || resources.get(0).size() != 1) {
+                throw new IllegalArgumentException("Lambda AppSpec must contain exactly one resource");
+            }
+            JsonNode resourceNode = resources.get(0).elements().next();
+            if (!"AWS::Lambda::Function".equals(resourceNode.path("Type").asText())) {
+                throw new IllegalArgumentException("Lambda AppSpec resource Type must be AWS::Lambda::Function");
+            }
+            JsonNode props = resourceNode.path("Properties");
+            info.functionName = requiredAppSpecText(props, "Name");
+            info.aliasName = requiredAppSpecText(props, "Alias");
+            info.currentVersion = requiredAppSpecText(props, "CurrentVersion");
+            info.targetVersion = requiredAppSpecText(props, "TargetVersion");
+            if (info.currentVersion.equals(info.targetVersion)) {
+                throw new IllegalArgumentException("CurrentVersion and TargetVersion must differ");
             }
             JsonNode hooks = root.get("Hooks");
-            if (hooks != null && hooks.isArray()) {
+            if (hooks != null) {
+                if (!hooks.isArray()) {
+                    throw new IllegalArgumentException("Hooks must be an array");
+                }
                 for (JsonNode hook : hooks) {
-                    if (hook.has("BeforeAllowTraffic")) {
-                        info.beforeAllowTraffic = hook.get("BeforeAllowTraffic").asText(null);
+                    if (!hook.isObject() || hook.size() != 1) {
+                        throw new IllegalArgumentException("Each Hook must contain exactly one lifecycle event");
                     }
-                    if (hook.has("AfterAllowTraffic")) {
-                        info.afterAllowTraffic = hook.get("AfterAllowTraffic").asText(null);
+                    Map.Entry<String, JsonNode> entry = hook.fields().next();
+                    String hookFunction = requiredAppSpecText(hook, entry.getKey());
+                    if ("BeforeAllowTraffic".equals(entry.getKey())) {
+                        if (info.beforeAllowTraffic != null) { throw new IllegalArgumentException("Duplicate BeforeAllowTraffic hook"); }
+                        info.beforeAllowTraffic = hookFunction;
+                    } else if ("AfterAllowTraffic".equals(entry.getKey())) {
+                        if (info.afterAllowTraffic != null) { throw new IllegalArgumentException("Duplicate AfterAllowTraffic hook"); }
+                        info.afterAllowTraffic = hookFunction;
+                    } else {
+                        throw new IllegalArgumentException("Unsupported Lambda lifecycle event: " + entry.getKey());
                     }
                 }
             }
@@ -1157,13 +1256,73 @@ public class CodeDeployService {
             throw new AwsException("InvalidRevisionException", "Failed to parse AppSpec content: " + e.getMessage(), 400);
         }
 
-        if (info.functionName == null || info.aliasName == null || info.targetVersion == null) {
-            throw new AwsException("InvalidRevisionException",
-                    "AppSpec must specify Name, Alias, and TargetVersion", 400);
-        }
         return info;
     }
 
+    @SuppressWarnings("unchecked")
+    private String appSpecContent(Map<String, Object> revision) {
+        Object appSpecContent = revision.get("appSpecContent");
+        if (appSpecContent instanceof Map<?, ?> content) {
+            Object value = ((Map<String, Object>) content).get("content");
+            if (value instanceof String text && !text.isBlank()) {
+                return text;
+            }
+        }
+        Object s3Location = revision.get("s3Location");
+        if (!(s3Location instanceof Map<?, ?> location) || s3Service == null) {
+            throw new AwsException("InvalidRevisionException", "Missing AppSpec content in revision", 400);
+        }
+        String bucket = String.valueOf(location.get("bucket"));
+        String key = String.valueOf(location.get("key"));
+        byte[] artifact = s3Service.getObject(bucket, key).getData();
+        InputStream input = artifact == null ? InputStream.nullInputStream() : new ByteArrayInputStream(artifact);
+        try (ZipInputStream zip = new ZipInputStream(input)) {
+            ZipEntry entry;
+            while ((entry = zip.getNextEntry()) != null) {
+                String name = entry.getName();
+                if (!entry.isDirectory() && ("appspec.yml".equalsIgnoreCase(name) || "appspec.yaml".equalsIgnoreCase(name))) {
+                    return new String(zip.readAllBytes(), java.nio.charset.StandardCharsets.UTF_8);
+                }
+            }
+        } catch (Exception e) {
+            throw new AwsException("InvalidRevisionException", "Could not read AppSpec from S3 revision: " + e.getMessage(), 400);
+        }
+        throw new AwsException("InvalidRevisionException", "S3 revision does not contain appspec.yml or appspec.yaml", 400);
+    }
+
+    private String requiredAppSpecText(JsonNode node, String field) {
+        JsonNode value = node.get(field);
+        if (value == null || !value.isTextual() || value.asText().isBlank()) {
+            throw new IllegalArgumentException("AppSpec must specify a non-empty " + field);
+        }
+        return value.asText();
+    }
+
+    private void validateLambdaDeployment(String region, Application app, DeploymentGroup group, String configName) {
+        if (!"Lambda".equals(app.getComputePlatform())) {
+            throw new AwsException("InvalidDeploymentConfigException", "Application compute platform must be Lambda", 400);
+        }
+        if (group.getComputePlatform() != null && !"Lambda".equals(group.getComputePlatform())) {
+            throw new AwsException("InvalidDeploymentConfigException", "Deployment group compute platform must be Lambda", 400);
+        }
+        DeploymentConfig config = getDeploymentConfig(region, configName);
+        if (!"Lambda".equals(config.getComputePlatform())) {
+            throw new AwsException("InvalidDeploymentConfigException", "Deployment configuration compute platform must be Lambda", 400);
+        }
+    }
+
+    private void validateLambdaTarget(String region, AppSpecInfo appSpec) {
+        LambdaAlias alias = lambdaService.getAlias(region, appSpec.functionName, appSpec.aliasName);
+        if (!appSpec.currentVersion.equals(alias.getFunctionVersion())) {
+            throw new AwsException("InvalidRevisionException", "AppSpec CurrentVersion does not match the alias version", 400);
+        }
+        List<String> versions = lambdaService.listVersionsByFunction(region, appSpec.functionName).stream()
+                .map(LambdaFunction::getVersion).toList();
+        if (!versions.contains(appSpec.currentVersion) || !versions.contains(appSpec.targetVersion)) {
+            throw new AwsException("InvalidRevisionException", "AppSpec version does not exist", 400);
+        }
+    }
+
     @SuppressWarnings("unchecked")
     private EcsAppSpecInfo parseEcsAppSpec(Map<String, Object> revision) {
         if (revision == null) {
@@ -1180,7 +1339,13 @@ public class CodeDeployService {
 
         EcsAppSpecInfo info = new EcsAppSpecInfo();
         try {
-            JsonNode root = mapper.readTree(content);
+            JsonNode root;
+            try {
+                root = mapper.readTree(content);
+            } catch (Exception ignored) {
+                // CodePipeline's AppSpecTemplatePath conventionally points to YAML.
+                root = yamlMapper.readTree(content);
+            }
             JsonNode resources = root.get("Resources");
             if (resources != null && resources.isArray() && !resources.isEmpty()) {
                 JsonNode firstResource = resources.get(0);
@@ -1367,7 +1532,28 @@ public class CodeDeployService {
                 // its startedBy, which is how a client tells a CodeDeploy set from an external one.
                 createTaskSet.setExternalId(deploymentId);
                 createTaskSet.setStartedBy("CODE_DEPLOY");
+                EcsServiceModel targetService = ecsService.describeServices(clusterName, List.of(serviceName), region)
+                        .getFirst();
+                if (targetService.getCapacityProviderStrategy() != null
+                        && !targetService.getCapacityProviderStrategy().isEmpty()) {
+                    createTaskSet.setCapacityProviderStrategy(targetService.getCapacityProviderStrategy());
+                } else {
+                    createTaskSet.setLaunchType(targetService.getLaunchType());
+                }
+                if (greenTgArn != null) {
+                    EcsLoadBalancer loadBalancer = new EcsLoadBalancer();
+                    loadBalancer.setTargetGroupArn(greenTgArn);
+                    loadBalancer.setContainerName(appSpec.containerName);
+                    loadBalancer.setContainerPort(appSpec.containerPort);
+                    createTaskSet.setLoadBalancers(List.of(loadBalancer));
+                }
                 greenTaskSet = ecsService.createTaskSet(createTaskSet, region);
+                verifyGreenTaskSet(region, clusterName, serviceName, deploymentId, targetService, greenTaskSet,
+                        greenTgArn);
+                if (greenTaskSet.getLaunchType() == LaunchType.FARGATE) {
+                    greenTaskSet = waitForGreenTaskSetRunning(region, clusterName, serviceName, greenTaskSet,
+                            stopFlag);
+                }
                 appendTaskSetInfo(ecsTargetMap, greenTaskSet, greenTgArn, 0.0);
                 finishLifecycleEvent(installEvent, "Succeeded");
             } catch (Exception e) {
@@ -1406,11 +1592,13 @@ public class CodeDeployService {
 
             // AllowTraffic: shift ELB traffic blue → green
             if (!listenerArns.isEmpty() && blueTgArn != null && greenTgArn != null) {
+                waitForGreenTargets(region, greenTgArn, stopFlag);
+                if (stopFlag.get()) { finishEcsStopped(deployment, ecsTargetMap); return; }
                 executeEcsAllowTraffic(region, deployment, configName, ecsTargetMap,
                         listenerArns, blueTgArn, greenTgArn, stopFlag);
+                verifyListenersForwardToGreen(region, listenerArns, greenTgArn);
             } else {
-                Map<String, Object> allowEvent = addLifecycleEvent(ecsTargetMap, "AllowTraffic");
-                finishLifecycleEvent(allowEvent, "Succeeded");
+                throw new IllegalStateException("ECS deployment group must have production listeners and blue/green target groups");
             }
 
             if (stopFlag.get()) { finishEcsStopped(deployment, ecsTargetMap); return; }
@@ -1438,10 +1626,11 @@ public class CodeDeployService {
                 try {
                     ecsService.deleteTaskSet(clusterName, serviceName,
                             blueTaskSet.getTaskSetArn(), true, region);
+                    verifyBlueTaskSetDrained(region, clusterName, serviceName, blueTaskSet.getTaskSetArn());
                     finishLifecycleEvent(terminateEvent, "Succeeded");
                 } catch (Exception e) {
-                    LOG.debugv("Could not delete blue task set: {0}", e.getMessage());
-                    finishLifecycleEvent(terminateEvent, "Succeeded");
+                    finishLifecycleEvent(terminateEvent, "Failed");
+                    throw e;
                 }
             }
 
@@ -1460,10 +1649,126 @@ public class CodeDeployService {
         }
     }
 
-    private void executeEcsAllowTraffic(String region, Deployment deployment, String configName,
-                                        Map<String, Object> ecsTargetMap, List<String> listenerArns,
-                                        String blueTgArn, String greenTgArn,
-                                        AtomicBoolean stopFlag) throws InterruptedException {
+    void verifyGreenTaskSet(String region, String clusterName, String serviceName, String deploymentId,
+                            EcsServiceModel targetService, TaskSet createdTaskSet, String greenTgArn) {
+        if (createdTaskSet == null || createdTaskSet.getTaskSetArn() == null) {
+            throw new IllegalStateException("ECS did not create a green task set");
+        }
+        List<TaskSet> taskSets = ecsService.describeTaskSets(clusterName, serviceName,
+                List.of(createdTaskSet.getTaskSetArn()), region);
+        if (taskSets.size() != 1) {
+            throw new IllegalStateException("ECS did not retain the green task set");
+        }
+        TaskSet greenTaskSet = taskSets.getFirst();
+        if (!deploymentId.equals(greenTaskSet.getExternalId())
+                || !"CODE_DEPLOY".equals(greenTaskSet.getStartedBy())
+                || !"ACTIVE".equals(greenTaskSet.getStatus())) {
+            throw new IllegalStateException("ECS green task set is not a CodeDeploy active task set");
+        }
+        if (greenTaskSet.getLaunchType() != LaunchType.FARGATE && greenTaskSet.getLaunchType() != LaunchType.EC2) {
+            throw new IllegalStateException("ECS green task set does not use FARGATE or EC2");
+        }
+        if (targetService.getLaunchType() != null && greenTaskSet.getLaunchType() != targetService.getLaunchType()) {
+            throw new IllegalStateException("ECS green task set launch type does not match the service");
+        }
+        if (greenTaskSet.getLaunchType() == LaunchType.EC2
+                && !hasRunningTasks(greenTaskSet)) {
+            throw new IllegalStateException("ECS green task set has no running tasks");
+        }
+        if (greenTgArn == null || greenTaskSet.getLoadBalancers() == null || greenTaskSet.getLoadBalancers().stream()
+                .noneMatch(loadBalancer -> greenTgArn.equals(loadBalancer.getTargetGroupArn()))) {
+            throw new IllegalStateException("ECS green task set is not registered with the green target group");
+        }
+    }
+
+    /** Fargate task launch is asynchronous, so the initial CreateTaskSet result is not yet stable. */
+    TaskSet waitForGreenTaskSetRunning(String region, String clusterName, String serviceName,
+                                       TaskSet createdTaskSet, AtomicBoolean stopFlag) throws InterruptedException {
+        for (int poll = 0; poll < ECS_READINESS_MAX_POLLS && !stopFlag.get(); poll++) {
+            List<TaskSet> taskSets = ecsService.describeTaskSets(clusterName, serviceName,
+                    List.of(createdTaskSet.getTaskSetArn()), region);
+            if (taskSets.size() == 1 && hasRunningTasks(taskSets.getFirst())) {
+                return taskSets.getFirst();
+            }
+            sleeper.sleep(STOP_POLL_INTERVAL.toMillis());
+        }
+        if (!stopFlag.get()) {
+            throw new IllegalStateException("ECS green task set has no running tasks");
+        }
+        return createdTaskSet;
+    }
+
+    private boolean hasRunningTasks(TaskSet taskSet) {
+        return taskSet.getComputedDesiredCount() > 0
+                && taskSet.getRunningCount() >= taskSet.getComputedDesiredCount();
+    }
+
+    /** A production listener is switched only once green tasks are registered and routable. */
+    void waitForGreenTargets(String region, String greenTgArn, AtomicBoolean stopFlag)
+            throws InterruptedException {
+        boolean registeredTargets = false;
+        for (int poll = 0; poll < ECS_TARGET_HEALTH_MAX_POLLS && !stopFlag.get(); poll++) {
+            List<TargetHealth> targets = elbV2Service.describeTargetHealth(region, greenTgArn, null);
+            registeredTargets = !targets.isEmpty();
+            if (registeredTargets && targets.stream().allMatch(target -> "healthy".equals(target.getState()))) {
+                return;
+            }
+            sleeper.sleep(STOP_POLL_INTERVAL.toMillis());
+        }
+        if (!stopFlag.get()) {
+            throw new IllegalStateException(registeredTargets
+                    ? "ECS green target group has unhealthy targets"
+                    : "ECS green target group has no registered targets");
+        }
+    }
+
+    void verifyListenersForwardToGreen(String region, List<String> listenerArns, String greenTgArn) {
+        for (String listenerArn : listenerArns) {
+            List<Rule> defaultRules = elbV2Service.describeRules(region, listenerArn, null).stream()
+                    .filter(Rule::isDefault)
+                    .toList();
+            if (defaultRules.size() != 1 || !forwardsOnlyTo(defaultRules.getFirst().getActions(), greenTgArn)) {
+                throw new IllegalStateException("Production listener did not switch to the green target group");
+            }
+        }
+    }
+
+    private boolean forwardsOnlyTo(List<Action> actions, String greenTgArn) {
+        if (actions == null) {
+            return false;
+        }
+        List<Action> forwardActions = actions.stream()
+                .filter(action -> "forward".equals(action.getType()))
+                .toList();
+        return !forwardActions.isEmpty()
+                && forwardActions.stream().allMatch(action -> forwardsOnlyTo(action, greenTgArn));
+    }
+
+    private boolean forwardsOnlyTo(Action action, String greenTgArn) {
+        if (action.getTargetGroups() == null || action.getTargetGroups().isEmpty()) {
+            return greenTgArn.equals(action.getTargetGroupArn());
+        }
+        boolean greenReceivesTraffic = action.getTargetGroups().stream()
+                .anyMatch(target -> greenTgArn.equals(target.getTargetGroupArn()) && effectiveWeight(target) > 0);
+        boolean otherTargetReceivesTraffic = action.getTargetGroups().stream()
+                .anyMatch(target -> !greenTgArn.equals(target.getTargetGroupArn()) && effectiveWeight(target) > 0);
+        return greenReceivesTraffic && !otherTargetReceivesTraffic;
+    }
+
+    private int effectiveWeight(Action.TargetGroupTuple target) {
+        return target.getWeight() != null ? target.getWeight() : 1;
+    }
+
+    void verifyBlueTaskSetDrained(String region, String clusterName, String serviceName, String blueTaskSetArn) {
+        if (!ecsService.describeTaskSets(clusterName, serviceName, List.of(blueTaskSetArn), region).isEmpty()) {
+            throw new IllegalStateException("ECS blue task set was not drained");
+        }
+    }
+
+    void executeEcsAllowTraffic(String region, Deployment deployment, String configName,
+                                Map<String, Object> ecsTargetMap, List<String> listenerArns,
+                                String blueTgArn, String greenTgArn,
+                                AtomicBoolean stopFlag) throws InterruptedException {
         TrafficRoutingInfo trc = getTrafficRoutingInfo(region, configName);
         Map<String, Object> event = addLifecycleEvent(ecsTargetMap, "AllowTraffic");
         try {
@@ -1473,9 +1778,9 @@ public class CodeDeployService {
                         elbV2Service.shiftListenerForward(region, listenerArn,
                                 blueTgArn, greenTgArn, trc.percentage);
                     }
-                    long waitMs = Math.min(trc.intervalSeconds * 1000L, 5000L);
+                    long waitMs = trc.intervalSeconds * 1000L;
                     if (waitMs > 0 && !stopFlag.get()) {
-                        Thread.sleep(waitMs);
+                        sleeper.sleep(waitMs);
                     }
                     if (!stopFlag.get()) {
                         for (String listenerArn : listenerArns) {
@@ -1493,9 +1798,9 @@ public class CodeDeployService {
                                     blueTgArn, greenTgArn, pct);
                         }
                         if (pct < 100) {
-                            long waitMs = Math.min(trc.intervalSeconds * 1000L, 2000L);
+                            long waitMs = trc.intervalSeconds * 1000L;
                             if (waitMs > 0) {
-                                Thread.sleep(waitMs);
+                                sleeper.sleep(waitMs);
                             }
                         }
                     }
@@ -1588,6 +1893,9 @@ public class CodeDeployService {
     private void runStateMachine(String region, Deployment deployment, AppSpecInfo appSpec,
                                   Map<String, Object> lambdaTargetMap, AtomicBoolean stopFlag, String configName) {
         String deploymentId = deployment.getDeploymentId();
+        AliasRoutingSnapshot aliasSnapshot = new AliasRoutingSnapshot(
+                lambdaService.getAlias(region, appSpec.functionName, appSpec.aliasName));
+        boolean trafficShifted = false;
         try {
             deployment.setStatus("InProgress");
             deployment.setStartTime(Instant.now().toEpochMilli() / 1000.0);
@@ -1605,16 +1913,30 @@ public class CodeDeployService {
 
             if (stopFlag.get()) { finishStopped(deployment, lambdaTargetMap); return; }
 
+            // Once AllowTraffic starts, a failed partial shift must be restored from the captured snapshot.
+            trafficShifted = true;
             executeAllowTraffic(region, deployment, appSpec, configName, lambdaTargetMap, stopFlag);
 
-            if (stopFlag.get()) { finishStopped(deployment, lambdaTargetMap); return; }
+            if (stopFlag.get()) {
+                rollbackAliasIfEnabled(region, deployment, appSpec, aliasSnapshot, "DEPLOYMENT_STOP_ON_REQUEST");
+                finishStopped(deployment, lambdaTargetMap);
+                return;
+            }
 
             if (appSpec.afterAllowTraffic != null) {
                 boolean ok = invokeHook(region, deployment, appSpec.afterAllowTraffic,
                         "AfterAllowTraffic", lambdaTargetMap, stopFlag);
-                if (stopFlag.get()) { finishStopped(deployment, lambdaTargetMap); return; }
-                if (!ok) { finishFailed(deployment, lambdaTargetMap, "HOOK_EXECUTION_FAILURE",
-                        "Hook function reported failure: AfterAllowTraffic"); return; }
+                if (stopFlag.get()) {
+                    rollbackAliasIfEnabled(region, deployment, appSpec, aliasSnapshot, "DEPLOYMENT_STOP_ON_REQUEST");
+                    finishStopped(deployment, lambdaTargetMap);
+                    return;
+                }
+                if (!ok) {
+                    rollbackAliasIfEnabled(region, deployment, appSpec, aliasSnapshot, "DEPLOYMENT_FAILURE");
+                    finishFailed(deployment, lambdaTargetMap, "HOOK_EXECUTION_FAILURE",
+                            "Hook function reported failure: AfterAllowTraffic");
+                    return;
+                }
             }
 
             updateTargetStatus(lambdaTargetMap, "Succeeded");
@@ -1623,18 +1945,24 @@ public class CodeDeployService {
 
         } catch (InterruptedException e) {
             Thread.currentThread().interrupt();
+            if (trafficShifted) {
+                rollbackAliasIfEnabled(region, deployment, appSpec, aliasSnapshot, "DEPLOYMENT_STOP_ON_REQUEST");
+            }
             finishStopped(deployment, lambdaTargetMap);
         } catch (Exception e) {
             LOG.warnv("Deployment {0} failed: {1}", deploymentId, e.getMessage());
+            if (trafficShifted) {
+                rollbackAliasIfEnabled(region, deployment, appSpec, aliasSnapshot, "DEPLOYMENT_FAILURE");
+            }
             finishFailed(deployment, lambdaTargetMap, "DeploymentFailed", e.getMessage());
         } finally {
             stopFlags.remove(deploymentId);
         }
     }
 
-    private void executeAllowTraffic(String region, Deployment deployment, AppSpecInfo appSpec,
-                                      String configName, Map<String, Object> lambdaTargetMap,
-                                      AtomicBoolean stopFlag) throws InterruptedException {
+    private boolean executeAllowTraffic(String region, Deployment deployment, AppSpecInfo appSpec,
+                                       String configName, Map<String, Object> lambdaTargetMap,
+                                       AtomicBoolean stopFlag) throws InterruptedException {
         TrafficRoutingInfo trc = getTrafficRoutingInfo(region, configName);
         Map<String, Object> event = addLifecycleEvent(lambdaTargetMap, "AllowTraffic");
 
@@ -1647,12 +1975,11 @@ public class CodeDeployService {
                     lambdaService.updateAlias(region, appSpec.functionName, appSpec.aliasName,
                             appSpec.currentVersion, null, routing);
 
-                    // Wait the canary interval (capped at 5s for emulator speed)
-                    long waitMs = Math.min(trc.intervalSeconds * 1000L, 5000L);
+                    long waitMs = trc.intervalSeconds * 1000L;
                     if (waitMs > 0 && !stopFlag.get()) {
-                        Thread.sleep(waitMs);
+                        sleeper.sleep(waitMs);
                     }
-                    if (stopFlag.get()) { return; }
+                    if (stopFlag.get()) { return true; }
 
                     // Step 2: flip 100% to targetVersion
                     lambdaService.updateAlias(region, appSpec.functionName, appSpec.aliasName,
@@ -1669,9 +1996,9 @@ public class CodeDeployService {
                             double weight = pct / 100.0;
                             lambdaService.updateAlias(region, appSpec.functionName, appSpec.aliasName,
                                     appSpec.currentVersion, null, Map.of(appSpec.targetVersion, weight));
-                            long waitMs = Math.min(trc.intervalSeconds * 1000L, 2000L);
+                            long waitMs = trc.intervalSeconds * 1000L;
                             if (waitMs > 0) {
-                                Thread.sleep(waitMs);
+                                sleeper.sleep(waitMs);
                             }
                         }
                     }
@@ -1683,18 +2010,35 @@ public class CodeDeployService {
                 }
             }
             finishLifecycleEvent(event, "Succeeded");
+            return true;
         } catch (Exception e) {
             finishLifecycleEvent(event, "Failed");
             throw e;
         }
     }
 
+    @SuppressWarnings("unchecked")
+    private void rollbackAliasIfEnabled(String region, Deployment deployment, AppSpecInfo appSpec,
+                                        AliasRoutingSnapshot snapshot, String event) {
+        DeploymentGroup group = getDeploymentGroup(region, deployment.getApplicationName(), deployment.getDeploymentGroupName());
+        Map<String, Object> config = group.getAutoRollbackConfiguration();
+        if (config == null || !Boolean.TRUE.equals(config.get("enabled"))) {
+            return;
+        }
+        Object events = config.get("events");
+        if (!(events instanceof List<?> list) || !list.contains(event)) {
+            return;
+        }
+        lambdaService.updateAlias(region, appSpec.functionName, appSpec.aliasName,
+                snapshot.functionVersion, null, snapshot.routingConfig);
+    }
+
     private boolean invokeHook(String region, Deployment deployment, String hookFunctionName,
                                 String lifecycleEventName, Map<String, Object> lambdaTargetMap,
                                 AtomicBoolean stopFlag) throws InterruptedException {
         String executionId = UUID.randomUUID().toString();
         CompletableFuture<String> future = new CompletableFuture<>();
-        hookFutures.put(executionId, future);
+        hookExecutions.put(executionId, new HookExecution(deployment.getDeploymentId(), lifecycleEventName, future));
 
         Map<String, Object> event = addLifecycleEvent(lambdaTargetMap, lifecycleEventName);
 
@@ -1757,7 +2101,7 @@ public class CodeDeployService {
             }
             return "Succeeded".equals(status);
         } finally {
-            hookFutures.remove(executionId);
+            hookExecutions.remove(executionId);
         }
     }
 

src/main/java/io/github/hectorvent/floci/services/codepipeline/CodePipelineService.java

@@ -12,6 +12,9 @@ import io.github.hectorvent.floci.core.storage.StorageBackend;
 import io.github.hectorvent.floci.core.storage.StorageFactory;
 import io.github.hectorvent.floci.services.codebuild.CodeBuildService;
 import io.github.hectorvent.floci.services.codebuild.model.Build;
+import io.github.hectorvent.floci.services.codebuild.model.ProjectArtifacts;
+import io.github.hectorvent.floci.services.cloudformation.CloudFormationService;
+import io.github.hectorvent.floci.services.cloudformation.model.Stack;
 import io.github.hectorvent.floci.services.codedeploy.CodeDeployService;
 import io.github.hectorvent.floci.services.codedeploy.model.Deployment;
 import io.github.hectorvent.floci.services.codepipeline.model.CodePipelineExecution;
@@ -19,6 +22,10 @@ import io.github.hectorvent.floci.services.codepipeline.model.CodePipelineExecut
 import io.github.hectorvent.floci.services.codepipeline.model.CodePipelinePipeline;
 import io.github.hectorvent.floci.services.codepipeline.model.CodePipelinePipeline.TransitionState;
 import io.github.hectorvent.floci.services.codepipeline.model.CodePipelineStoredItem;
+import io.github.hectorvent.floci.services.ecs.EcsService;
+import io.github.hectorvent.floci.services.ecs.model.ContainerDefinition;
+import io.github.hectorvent.floci.services.ecs.model.RegisterTaskDefinitionRequest;
+import io.github.hectorvent.floci.services.ecs.model.TaskDefinition;
 import io.github.hectorvent.floci.services.lambda.LambdaService;
 import io.github.hectorvent.floci.services.lambda.model.InvocationType;
 import io.github.hectorvent.floci.services.lambda.model.InvokeResult;
@@ -30,6 +37,7 @@ import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
 import org.jboss.logging.Logger;
 
+import java.io.ByteArrayInputStream;
 import java.nio.charset.StandardCharsets;
 import java.time.Instant;
 import java.util.ArrayList;
@@ -42,12 +50,15 @@ import java.util.Optional;
 import java.util.Set;
 import java.util.UUID;
 import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ExecutionException;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
 import java.util.concurrent.RejectedExecutionException;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipInputStream;
 
 @ApplicationScoped
 public class CodePipelineService {
@@ -59,6 +70,8 @@ public class CodePipelineService {
     private static final long SOURCE_POLL_INTERVAL_MS = 500L;
     private static final String SOURCE_POLL_TYPE = "source-poll";
     private static final String MISSING_SOURCE_REVISION = "missing";
+    private static final int MAX_ARTIFACT_ENTRY_SIZE = 256 * 1024 * 1024;
+    private static final int MAX_EXTRACTED_ARTIFACT_SIZE = 256 * 1024 * 1024;
 
     private final AccountAwareStorageBackend<CodePipelinePipeline> pipelineStore;
     private final AccountAwareStorageBackend<CodePipelineExecution> executionStore;
@@ -66,6 +79,8 @@ public class CodePipelineService {
     private final ObjectMapper mapper;
     private final CodeBuildService codeBuildService;
     private final CodeDeployService codeDeployService;
+    private final EcsService ecsService;
+    private final CloudFormationService cloudFormationService;
     private final LambdaService lambdaService;
     private final S3Service s3Service;
     private final ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor();
@@ -76,13 +91,13 @@ public class CodePipelineService {
     // monitor for its whole run, so counting under that monitor would block StartPipelineExecution
     // until the running execution finished.
     private final KeyedLockPool startLocks = new KeyedLockPool();
-    private final Map<String, byte[]> runtimeArtifacts = new ConcurrentHashMap<>();
 
     @Inject
     @SuppressWarnings("unchecked")
     public CodePipelineService(StorageFactory storageFactory, ObjectMapper mapper,
-                               CodeBuildService codeBuildService, CodeDeployService codeDeployService,
-                               LambdaService lambdaService, S3Service s3Service) {
+                                 CodeBuildService codeBuildService, CodeDeployService codeDeployService,
+                                 LambdaService lambdaService, S3Service s3Service,
+                                 CloudFormationService cloudFormationService, EcsService ecsService) {
         this.pipelineStore = storageFactory.create(
                 "codepipeline", "codepipeline-pipelines.json", new TypeReference<Map<String, CodePipelinePipeline>>() {});
         this.executionStore = storageFactory.create(
@@ -92,10 +107,20 @@ public class CodePipelineService {
         this.mapper = mapper;
         this.codeBuildService = codeBuildService;
         this.codeDeployService = codeDeployService;
+        this.ecsService = ecsService;
+        this.cloudFormationService = cloudFormationService;
         this.lambdaService = lambdaService;
         this.s3Service = s3Service;
     }
 
+    CodePipelineService(StorageFactory storageFactory, ObjectMapper mapper,
+                        CodeBuildService codeBuildService, CodeDeployService codeDeployService,
+                        LambdaService lambdaService, S3Service s3Service,
+                        CloudFormationService cloudFormationService) {
+        this(storageFactory, mapper, codeBuildService, codeDeployService, lambdaService, s3Service,
+                cloudFormationService, null);
+    }
+
     public JsonNode handle(String action, JsonNode request, String region, String account) {
         return switch (action) {
             case "CreatePipeline" -> createPipeline(request, region, account);
@@ -745,22 +770,82 @@ public class CodePipelineService {
         String pipelineName = text(request, "pipelineName");
         CodePipelineExecution source = requireExecution(
                 account, region, pipelineName, text(request, "pipelineExecutionId"));
-        ObjectNode start = mapper.createObjectNode();
-        start.put("name", pipelineName);
-        start.set("sourceRevisions", mapper.valueToTree(source.getSourceRevisions()));
-        ArrayNode vars = start.putArray("variables");
-        source.getVariables().forEach(v -> vars.addObject()
-                .put("name", v.get("name"))
-                .put("value", v.get("resolvedValue")));
-        return startPipelineExecution(start, region, account);
+        CodePipelinePipeline pipeline = requirePipeline(account, region, pipelineName);
+        String stageName = text(request, "stageName");
+        String retryMode = text(request, "retryMode");
+        requireStage(pipeline, stageName);
+        if (!List.of("FAILED_ACTIONS", "ALL_ACTIONS").contains(retryMode)) {
+            throw new AwsException("ValidationException", "retryMode must be FAILED_ACTIONS or ALL_ACTIONS", 400);
+        }
+        if (!"Failed".equals(stageExecutionStatus(source, stageName))) {
+            throw new AwsException("PipelineExecutionNotRetryableException",
+                    "Stage execution is not failed: " + stageName, 400);
+        }
+
+        List<String> actionNames = new ArrayList<>();
+        for (JsonNode stage : pipeline.getDeclaration().path("stages")) {
+            if (!stageName.equals(stage.path("name").asText())) {
+                continue;
+            }
+            for (JsonNode action : stage.path("actions")) {
+                String actionName = action.path("name").asText();
+                if ("ALL_ACTIONS".equals(retryMode) || source.getActionExecutions().stream()
+                        .anyMatch(a -> stageName.equals(a.getStageName()) && actionName.equals(a.getActionName())
+                                && "Failed".equals(a.getStatus()))) {
+                    actionNames.add(actionName);
+                }
+            }
+        }
+        if (actionNames.isEmpty()) {
+            throw new AwsException("PipelineExecutionNotRetryableException",
+                    "Stage execution has no failed actions: " + stageName, 400);
+        }
+
+        CodePipelineExecution retry = new CodePipelineExecution();
+        retry.setAccountId(account);
+        retry.setRegion(region);
+        retry.setPipelineExecutionId(UUID.randomUUID().toString());
+        retry.setPipelineName(pipelineName);
+        retry.setPipelineVersion(pipeline.getVersion());
+        retry.setExecutionMode(pipeline.getDeclaration().path("executionMode").asText(DEFAULT_EXECUTION_MODE));
+        retry.setExecutionType("STANDARD");
+        retry.setStatus("InProgress");
+        retry.setStatusSummary("Stage execution retry started.");
+        retry.setStartTime(now());
+        retry.setLastUpdateTime(retry.getStartTime());
+        retry.setSourceRevisions(new ArrayList<>(source.getSourceRevisions()));
+        retry.setVariables(new ArrayList<>(source.getVariables()));
+        retry.setArtifacts(new LinkedHashMap<>(source.getArtifacts()));
+        retry.setRetryStageName(stageName);
+        retry.setRetryActionNames(actionNames);
+        retry.setTrigger(Map.of("triggerType", "RetryStageExecution", "triggerDetail", stageName));
+        if (!persistExecutionIfSlotAvailable(retry)) {
+            throw new AwsException("ConcurrentPipelineExecutionsLimitExceededException",
+                    "The pipeline has reached the limit for concurrent pipeline executions", 400);
+        }
+        applyExecutionMode(retry);
+        try {
+            executor.submit(() -> runExecution(pipeline, retry));
+        } catch (RejectedExecutionException exception) {
+            retry.setStatus("Failed");
+            retry.setStatusSummary("Pipeline execution could not be scheduled.");
+            retry.setLastUpdateTime(now());
+            putExecution(retry);
+            throw new AwsException("ConflictException", "Pipeline execution could not be scheduled.", 400);
+        }
+        return mapper.createObjectNode().put("pipelineExecutionId", retry.getPipelineExecutionId());
     }
 
     private ObjectNode rollbackStage(JsonNode request, String region, String account) {
         CodePipelineExecution target = requireExecution(
                 account, region, text(request, "pipelineName"), text(request, "targetPipelineExecutionId"));
-        ObjectNode started = retryStageExecution(mapper.createObjectNode()
-                .put("pipelineName", target.getPipelineName())
-                .put("pipelineExecutionId", target.getPipelineExecutionId()), region, account);
+        ObjectNode start = mapper.createObjectNode().put("name", target.getPipelineName());
+        start.set("sourceRevisions", mapper.valueToTree(target.getSourceRevisions()));
+        ArrayNode vars = start.putArray("variables");
+        target.getVariables().forEach(v -> vars.addObject()
+                .put("name", v.get("name"))
+                .put("value", v.get("resolvedValue")));
+        ObjectNode started = startPipelineExecution(start, region, account);
         CodePipelineExecution rollback = requireExecution(
                 account, region, target.getPipelineName(), started.path("pipelineExecutionId").asText());
         rollback.setExecutionType("ROLLBACK");
@@ -977,6 +1062,10 @@ public class CodePipelineService {
         Runnable work = () -> {
             try {
                 for (JsonNode stage : pipeline.getDeclaration().path("stages")) {
+                    if (execution.getRetryStageName() != null
+                            && !execution.getRetryStageName().equals(stage.path("name").asText())) {
+                        continue;
+                    }
                     waitForTransition(pipeline, execution, stage.path("name").asText());
                     if (finishIfStopped(execution)) {
                         return;
@@ -986,7 +1075,7 @@ public class CodePipelineService {
                     execution.getStageExecutionStatuses().put(stageName, "InProgress");
                     execution.setLastUpdateTime(now());
                     putExecution(execution);
-                    runStage(pipeline, execution, stage);
+                    runStage(pipeline, execution, stage, execution.getRetryActionNames());
                     if ("Failed".equals(execution.getStatus())) {
                         execution.getStageExecutionStatuses().put(stageName, "Failed");
                         return;
@@ -1012,7 +1101,6 @@ public class CodePipelineService {
                 execution.setCurrentStage(null);
                 execution.setLastUpdateTime(now());
                 putExecution(execution);
-                clearRuntimeArtifacts(execution);
             }
         };
         if ("QUEUED".equals(execution.getExecutionMode())) {
@@ -1022,9 +1110,14 @@ public class CodePipelineService {
         }
     }
 
-    private void runStage(CodePipelinePipeline pipeline, CodePipelineExecution execution, JsonNode stage) {
+    private void runStage(CodePipelinePipeline pipeline, CodePipelineExecution execution, JsonNode stage,
+                          List<String> retryActionNames) {
         Map<Integer, List<JsonNode>> groups = new LinkedHashMap<>();
         for (JsonNode action : stage.path("actions")) {
+            if (execution.getRetryStageName() != null
+                    && !retryActionNames.contains(action.path("name").asText())) {
+                continue;
+            }
             groups.computeIfAbsent(action.path("runOrder").asInt(1), ignored -> new ArrayList<>()).add(action);
         }
         groups.entrySet().stream().sorted(Map.Entry.comparingByKey()).forEach(entry -> {
@@ -1098,7 +1191,9 @@ public class CodePipelineService {
         switch (provider) {
             case "S3" -> executeS3(execution, action, state);
             case "CodeBuild" -> executeCodeBuild(execution, action, state);
-            case "CodeDeploy" -> executeCodeDeploy(execution, action, state);
+            case "CodeDeploy" -> executeCodeDeploy(pipeline, execution, action, state);
+            case "CodeDeployToECS" -> executeCodeDeployToEcs(execution, action, state);
+            case "CloudFormation" -> executeCloudFormation(pipeline, execution, action, state);
             case "Lambda" -> executeLambda(execution, action, state);
             case "CodePipeline" -> executeNestedPipeline(execution, action, state);
             default -> throw new AwsException("InvalidActionDeclarationException",
@@ -1113,7 +1208,7 @@ public class CodePipelineService {
             String key = config.path("S3ObjectKey").asText(config.path("ObjectKey").asText(null));
             S3Object object = s3Service.getObject(bucket, key);
             for (JsonNode artifact : action.path("outputArtifacts")) {
-                runtimeArtifacts.put(artifactKey(execution, artifact.path("name").asText()), object.getData());
+                execution.getArtifacts().put(artifact.path("name").asText(), object.getData());
             }
             Map<String, Object> revision = new LinkedHashMap<>();
             revision.put("name", state.getActionName());
@@ -1129,7 +1224,7 @@ public class CodePipelineService {
         String bucket = config.path("BucketName").asText(config.path("S3Bucket").asText(null));
         String objectKey = config.path("ObjectKey").asText(state.getActionName() + ".zip");
         JsonNode input = action.path("inputArtifacts").path(0);
-        byte[] data = runtimeArtifacts.get(artifactKey(execution, input.path("name").asText()));
+        byte[] data = execution.getArtifacts().get(input.path("name").asText());
         if (data == null) {
             throw new AwsException("InvalidJobStateException", "Input artifact is not available", 400);
         }
@@ -1139,9 +1234,14 @@ public class CodePipelineService {
 
     private void executeCodeBuild(CodePipelineExecution execution, JsonNode action,
                                   ActionExecution state) throws InterruptedException {
+        for (JsonNode artifact : action.path("outputArtifacts")) {
+            execution.getArtifacts().remove(artifact.path("name").asText());
+        }
         String projectName = action.path("configuration").path("ProjectName").asText(null);
+        ProjectArtifacts artifactsOverride = new ProjectArtifacts();
+        artifactsOverride.setType("CODEPIPELINE");
         Build build = codeBuildService.startBuild(execution.getRegion(), execution.getAccountId(), projectName,
-                null, null, null, null, null, null, null);
+                null, null, artifactsOverride, null, null, null, null);
         state.setExternalExecutionId(build.getId());
         while (!Boolean.TRUE.equals(build.getBuildComplete())) {
             if (abandonExternalActionIfRequested(execution, state)) {
@@ -1160,16 +1260,38 @@ public class CodePipelineService {
             }
             throw new AwsException("ActionExecutionFailed", message, 400);
         }
+        if (!action.path("outputArtifacts").isEmpty()) {
+            byte[] output = codeBuildService.getBuildOutputArtifact(
+                    execution.getRegion(), execution.getAccountId(), build.getId());
+            if (output == null) {
+                throw new AwsException("ActionExecutionFailed",
+                        "CodeBuild build " + build.getId() + " did not produce an output artifact", 400);
+            }
+            for (JsonNode artifact : action.path("outputArtifacts")) {
+                execution.getArtifacts().put(artifact.path("name").asText(), output);
+            }
+        }
     }
 
-    private void executeCodeDeploy(CodePipelineExecution execution, JsonNode action,
+    private void executeCodeDeploy(CodePipelinePipeline pipeline, CodePipelineExecution execution, JsonNode action,
                                    ActionExecution state) throws InterruptedException {
         JsonNode config = action.path("configuration");
         Map<String, Object> revision = null;
         JsonNode input = action.path("inputArtifacts").path(0);
         if (!input.isMissingNode()) {
-            revision = Map.of("revisionType", "S3",
-                    "s3Location", Map.of("bucket", artifactBucket(action), "key", input.path("name").asText()));
+            String artifactName = input.path("name").asText();
+            byte[] artifact = execution.getArtifacts().get(artifactName);
+            if (artifact == null) {
+                throw new AwsException("InvalidJobStateException", "Input artifact is not available", 400);
+            }
+            String bucket = pipeline.getDeclaration().path("artifactStore").path("location").asText(null);
+            if (bucket == null || bucket.isBlank()) {
+                throw new AwsException("InvalidActionDeclarationException", "Pipeline artifact store is required", 400);
+            }
+            String key = execution.getPipelineExecutionId() + "/" + state.getStageName() + "/"
+                    + state.getActionName() + "/" + artifactName + ".zip";
+            s3Service.putObject(bucket, key, artifact, "application/zip", Map.of());
+            revision = Map.of("revisionType", "S3", "s3Location", Map.of("bucket", bucket, "key", key));
         }
         String deploymentId = codeDeployService.createDeployment(
                 execution.getRegion(), config.path("ApplicationName").asText(),
@@ -1195,6 +1317,417 @@ public class CodePipelineService {
         }
     }
 
+    private void executeCodeDeployToEcs(CodePipelineExecution execution, JsonNode action,
+                                        ActionExecution state) throws InterruptedException {
+        if (ecsService == null) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    "CodeDeployToECS is not available", 400);
+        }
+        JsonNode config = action.path("configuration");
+        String applicationName = requiredCodeDeployToEcsConfiguration(config, "ApplicationName");
+        String deploymentGroupName = requiredCodeDeployToEcsConfiguration(config, "DeploymentGroupName");
+        String taskDefinitionTemplate = readCodeDeployToEcsTemplate(execution, action, config,
+                "TaskDefinitionTemplateArtifact", "TaskDefinitionTemplatePath");
+        String appSpecTemplate = readCodeDeployToEcsTemplate(execution, action, config,
+                "AppSpecTemplateArtifact", "AppSpecTemplatePath");
+
+        RegisterTaskDefinitionRequest taskDefinitionRequest;
+        try {
+            taskDefinitionRequest = mapper.readValue(taskDefinitionTemplate, RegisterTaskDefinitionRequest.class);
+        } catch (java.io.IOException exception) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    "TaskDefinitionTemplatePath must reference a valid ECS task definition JSON template", 400);
+        }
+        if (taskDefinitionRequest.getFamily() == null || taskDefinitionRequest.getFamily().isBlank()) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    "Task definition template must specify family", 400);
+        }
+        substituteCodeDeployToEcsImage(execution, action, config, taskDefinitionRequest);
+        TaskDefinition taskDefinition = ecsService.registerTaskDefinition(taskDefinitionRequest, execution.getRegion());
+        String appSpec = appSpecTemplate.replace("<TASK_DEFINITION>", taskDefinition.getTaskDefinitionArn());
+        Map<String, Object> revision = Map.of("revisionType", "AppSpecContent",
+                "appSpecContent", Map.of("content", appSpec));
+        String deploymentId = codeDeployService.createDeployment(execution.getRegion(), applicationName,
+                deploymentGroupName, null, revision, "CodePipeline execution");
+        state.setExternalExecutionId(deploymentId);
+        waitForCodeDeployDeployment(execution, state, deploymentId);
+    }
+
+    private String readCodeDeployToEcsTemplate(CodePipelineExecution execution, JsonNode action, JsonNode config,
+                                               String artifactField, String pathField) {
+        String templatePath = requiredCodeDeployToEcsConfiguration(config, pathField);
+        int separator = templatePath.indexOf("::");
+        if (separator >= 0) {
+            if (separator == 0 || separator == templatePath.length() - 2
+                    || templatePath.indexOf("::", separator + 2) >= 0) {
+                throw new AwsException("InvalidActionDeclarationException",
+                        "CodeDeployToECS template paths must use ArtifactName::TemplateFilePath", 400);
+            }
+            return readCodeDeployToEcsTemplate(execution, action, templatePath.substring(0, separator),
+                    templatePath.substring(separator + 2));
+        }
+        String artifactName = requiredCodeDeployToEcsConfiguration(config, artifactField);
+        return readCodeDeployToEcsTemplate(execution, action, artifactName, templatePath);
+    }
+
+    private String readCodeDeployToEcsTemplate(CodePipelineExecution execution, JsonNode action, String artifactName,
+                                               String templatePath) {
+        boolean declaredInput = false;
+        for (JsonNode input : action.path("inputArtifacts")) {
+            if (artifactName.equals(input.path("name").asText())) {
+                declaredInput = true;
+                break;
+            }
+        }
+        if (!declaredInput) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    "CodeDeployToECS template references an unavailable input artifact: " + artifactName, 400);
+        }
+        byte[] artifact = execution.getArtifacts().get(artifactName);
+        if (artifact == null) {
+            throw new AwsException("InvalidJobStateException", "Input artifact is not available: " + artifactName, 400);
+        }
+        return readTemplateFromArtifact(artifact, templatePath);
+    }
+
+    private static String requiredCodeDeployToEcsConfiguration(JsonNode config, String field) {
+        String value = config.path(field).asText(null);
+        if (value == null || value.isBlank()) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    "CodeDeployToECS " + field + " is required", 400);
+        }
+        return value;
+    }
+
+    private void substituteCodeDeployToEcsImage(CodePipelineExecution execution, JsonNode action, JsonNode config,
+                                                RegisterTaskDefinitionRequest taskDefinitionRequest) {
+        String imageArtifactName = requiredCodeDeployToEcsConfiguration(config, "Image1ArtifactName");
+        String containerName = requiredCodeDeployToEcsConfiguration(config, "Image1ContainerName");
+        String imageDetail = readCodeDeployToEcsTemplate(execution, action, imageArtifactName, "imageDetail.json");
+        JsonNode imageDetailJson;
+        try {
+            imageDetailJson = mapper.readTree(imageDetail);
+        } catch (java.io.IOException exception) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    "imageDetail.json must contain a valid image detail JSON object", 400);
+        }
+        String imageUri = imageDetailJson.path("ImageURI").asText(null);
+        if (imageUri == null || imageUri.isBlank()) {
+            throw new AwsException("InvalidActionDeclarationException", "imageDetail.json must specify ImageURI", 400);
+        }
+        if (taskDefinitionRequest.getContainerDefinitions() == null) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    "Task definition template must specify containerDefinitions", 400);
+        }
+        for (ContainerDefinition container : taskDefinitionRequest.getContainerDefinitions()) {
+            if (containerName.equals(container.getName())) {
+                if (container.getImage() == null) {
+                    throw new AwsException("InvalidActionDeclarationException",
+                            "Image1ContainerName must identify a container with an image", 400);
+                }
+                container.setImage(container.getImage().replace("<IMAGE1_NAME>", imageUri));
+                return;
+            }
+        }
+        throw new AwsException("InvalidActionDeclarationException",
+                "Image1ContainerName does not match a task definition container", 400);
+    }
+
+    private void waitForCodeDeployDeployment(CodePipelineExecution execution, ActionExecution state, String deploymentId)
+            throws InterruptedException {
+        Deployment deployment = codeDeployService.getDeployment(execution.getRegion(), deploymentId);
+        while (!List.of("Succeeded", "Failed", "Stopped").contains(deployment.getStatus())) {
+            if (abandonExternalActionIfRequested(execution, state)) {
+                return;
+            }
+            TimeUnit.MILLISECONDS.sleep(POLL_INTERVAL_MS);
+            deployment = codeDeployService.getDeployment(execution.getRegion(), deploymentId);
+        }
+        if (abandonExternalActionIfRequested(execution, state)) {
+            return;
+        }
+        if (!"Succeeded".equals(deployment.getStatus())) {
+            String message = "CodeDeploy deployment finished with " + deployment.getStatus();
+            if (recordExternalActionFailureWhileStopping(execution, state, message)) {
+                return;
+            }
+            throw new AwsException("ActionExecutionFailed", message, 400);
+        }
+    }
+
+    private void executeCloudFormation(CodePipelinePipeline pipeline, CodePipelineExecution execution,
+                                       JsonNode action, ActionExecution state) throws InterruptedException {
+        JsonNode config = action.path("configuration");
+        String stackName = requiredActionConfiguration(config, "StackName");
+        String actionMode = requiredActionConfiguration(config, "ActionMode");
+        if (!"CREATE_UPDATE".equals(actionMode)) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    "CloudFormation ActionMode must be CREATE_UPDATE", 400);
+        }
+        String templatePath = requiredActionConfiguration(config, "TemplatePath");
+        int separator = templatePath.indexOf("::");
+        if (separator <= 0 || separator == templatePath.length() - 2
+                || templatePath.indexOf("::", separator + 2) >= 0) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    "CloudFormation TemplatePath must use ArtifactName::TemplateFilePath", 400);
+        }
+        String artifactName = templatePath.substring(0, separator);
+        byte[] artifact = execution.getArtifacts().get(artifactName);
+        if (artifact == null) {
+            throw new AwsException("InvalidJobStateException", "Input artifact is not available: " + artifactName, 400);
+        }
+        String bucket = pipeline.getDeclaration().path("artifactStore").path("location").asText(null);
+        if (bucket == null || bucket.isBlank()) {
+            throw new AwsException("InvalidActionDeclarationException", "Pipeline artifact store is required", 400);
+        }
+        Map<String, ArtifactLocation> artifactLocations = materializeCloudFormationArtifacts(
+                execution, action, state, bucket);
+        String templateBody = readTemplateFromArtifact(artifact, templatePath.substring(separator + 2));
+
+        boolean exists;
+        try {
+            cloudFormationService.describeStacks(stackName, execution.getRegion(), execution.getAccountId());
+            exists = true;
+        } catch (AwsException exception) {
+            if (!"ValidationError".equals(exception.getErrorCode())) {
+                throw exception;
+            }
+            exists = false;
+        }
+        String changeSetName = "codepipeline-" + UUID.randomUUID().toString().substring(0, 8);
+        String changeSetType = exists ? "UPDATE" : "CREATE";
+        cloudFormationService.createChangeSet(stackName, changeSetName, changeSetType, templateBody, null,
+                resolveParameterOverrides(config, execution, action, artifactLocations), List.of(), Map.of(),
+                execution.getRegion(), execution.getAccountId());
+        Future<?> deployment = cloudFormationService.executeChangeSet(
+                stackName, changeSetName, execution.getRegion(), execution.getAccountId());
+        try {
+            deployment.get();
+        } catch (ExecutionException exception) {
+            Throwable cause = exception.getCause();
+            if (cause instanceof AwsException awsException) {
+                throw awsException;
+            }
+            throw new AwsException("ActionExecutionFailed", "CloudFormation deployment failed: "
+                    + Objects.toString(cause.getMessage(), cause.getClass().getSimpleName()), 400);
+        }
+        Stack stack = cloudFormationService.describeStacks(stackName, execution.getRegion(), execution.getAccountId()).get(0);
+        if (!List.of("CREATE_COMPLETE", "UPDATE_COMPLETE").contains(stack.getStatus())) {
+            throw new AwsException("ActionExecutionFailed", "CloudFormation stack " + stackName
+                    + " finished with " + stack.getStatus(), 400);
+        }
+        state.setExternalExecutionId(stack.getStackId());
+    }
+
+    private static String requiredActionConfiguration(JsonNode config, String field) {
+        String value = config.path(field).asText(null);
+        if (value == null || value.isBlank()) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    "CloudFormation " + field + " is required", 400);
+        }
+        return value;
+    }
+
+    private Map<String, ArtifactLocation> materializeCloudFormationArtifacts(CodePipelineExecution execution,
+                                                                               JsonNode action,
+                                                                               ActionExecution state,
+                                                                               String bucket) {
+        Map<String, ArtifactLocation> locations = new LinkedHashMap<>();
+        for (JsonNode input : action.path("inputArtifacts")) {
+            String artifactName = input.path("name").asText();
+            byte[] artifact = execution.getArtifacts().get(artifactName);
+            if (artifact == null) {
+                throw new AwsException("InvalidJobStateException",
+                        "Input artifact is not available: " + artifactName, 400);
+            }
+            String prefix = execution.getPipelineExecutionId() + "/" + state.getStageName() + "/"
+                    + state.getActionName() + "/" + artifactName;
+            String archiveKey = prefix + ".zip";
+            s3Service.putObject(bucket, archiveKey, artifact, "application/zip", Map.of());
+            List<ArtifactLocation> nestedArtifacts = extractArtifactEntries(bucket, prefix, artifact);
+            ArtifactLocation location = nestedArtifacts.size() == 1 && nestedArtifacts.getFirst().key().endsWith(".zip")
+                    ? nestedArtifacts.getFirst() : new ArtifactLocation(bucket, archiveKey);
+            locations.put(artifactName, location);
+        }
+        return locations;
+    }
+
+    private List<ArtifactLocation> extractArtifactEntries(String bucket, String prefix, byte[] artifact) {
+        List<ArtifactLocation> nestedArtifacts = new ArrayList<>();
+        int extractedSize = 0;
+        try (ZipInputStream zip = new ZipInputStream(new ByteArrayInputStream(artifact))) {
+            ZipEntry entry;
+            while ((entry = zip.getNextEntry()) != null) {
+                if (entry.isDirectory()) {
+                    continue;
+                }
+                String entryName = entry.getName();
+                validateArtifactEntryName(entryName);
+                byte[] data = zip.readNBytes(MAX_ARTIFACT_ENTRY_SIZE + 1);
+                if (data.length > MAX_ARTIFACT_ENTRY_SIZE) {
+                    throw new AwsException("InvalidActionDeclarationException",
+                            "Artifact entry exceeds 256 MB: " + entryName, 400);
+                }
+                if (data.length > MAX_EXTRACTED_ARTIFACT_SIZE - extractedSize) {
+                    throw new AwsException("InvalidActionDeclarationException",
+                            "CloudFormation input artifact expands beyond 256 MB", 400);
+                }
+                extractedSize += data.length;
+                String key = prefix + "/" + entryName;
+                s3Service.putObject(bucket, key, data, "application/octet-stream", Map.of());
+                nestedArtifacts.add(new ArtifactLocation(bucket, key));
+            }
+        } catch (java.io.IOException exception) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    "Could not read CloudFormation input artifact", 400);
+        }
+        return nestedArtifacts;
+    }
+
+    private static void validateArtifactEntryName(String entryName) {
+        if (entryName.startsWith("/") || entryName.startsWith("\\") || entryName.contains("\\")) {
+            throw new AwsException("InvalidActionDeclarationException", "Artifact entry path is not safe", 400);
+        }
+        for (String segment : entryName.split("/")) {
+            if (segment.isBlank() || ".".equals(segment) || "..".equals(segment)) {
+                throw new AwsException("InvalidActionDeclarationException", "Artifact entry path is not safe", 400);
+            }
+        }
+    }
+
+    private Map<String, String> resolveParameterOverrides(JsonNode config, CodePipelineExecution execution,
+                                                           JsonNode action,
+                                                           Map<String, ArtifactLocation> artifactLocations) {
+        String overrides = config.path("ParameterOverrides").asText(null);
+        if (overrides == null || overrides.isBlank()) {
+            return Map.of();
+        }
+        try {
+            JsonNode values = mapper.readTree(overrides);
+            if (!values.isObject()) {
+                throw new AwsException("InvalidActionDeclarationException",
+                        "CloudFormation ParameterOverrides must be a JSON object", 400);
+            }
+            Map<String, String> resolved = new LinkedHashMap<>();
+            values.fields().forEachRemaining(entry -> resolved.put(entry.getKey(),
+                    resolveParameterOverride(entry.getValue(), execution, action, artifactLocations)));
+            return resolved;
+        } catch (java.io.IOException exception) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    "CloudFormation ParameterOverrides must be valid JSON", 400);
+        }
+    }
+
+    private String resolveParameterOverride(JsonNode value, CodePipelineExecution execution, JsonNode action,
+                                            Map<String, ArtifactLocation> artifactLocations) {
+        if (value.isTextual() || value.isNumber() || value.isBoolean()) {
+            return value.asText();
+        }
+        if (!value.isObject()) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    "CloudFormation parameter override must be a scalar or supported function", 400);
+        }
+        JsonNode artifactAtt = value.path("Fn::GetArtifactAtt");
+        if (!artifactAtt.isMissingNode()) {
+            List<String> arguments = functionArguments(artifactAtt, 2, "Fn::GetArtifactAtt");
+            ArtifactLocation location = requireArtifactLocation(arguments.getFirst(), action, artifactLocations);
+            return switch (arguments.get(1)) {
+                case "BucketName" -> location.bucket();
+                case "ObjectKey" -> location.key();
+                case "URL" -> "https://s3." + execution.getRegion() + ".amazonaws.com/"
+                        + location.bucket() + "/" + location.key();
+                default -> throw new AwsException("InvalidActionDeclarationException",
+                        "Fn::GetArtifactAtt attribute is not supported: " + arguments.get(1), 400);
+            };
+        }
+        JsonNode getParam = value.path("Fn::GetParam");
+        if (!getParam.isMissingNode()) {
+            List<String> arguments = functionArguments(getParam, 3, "Fn::GetParam");
+            requireArtifactLocation(arguments.getFirst(), action, artifactLocations);
+            byte[] artifact = execution.getArtifacts().get(arguments.getFirst());
+            String contents = readTemplateFromArtifact(artifact, arguments.get(1));
+            try {
+                JsonNode parameters = mapper.readTree(contents);
+                JsonNode parameter = parameters.path(arguments.get(2));
+                if (!parameters.isObject() || parameter.isMissingNode() || !parameter.isValueNode()) {
+                    throw new AwsException("InvalidActionDeclarationException",
+                            "Fn::GetParam could not resolve " + arguments.get(2), 400);
+                }
+                return parameter.asText();
+            } catch (java.io.IOException exception) {
+                throw new AwsException("InvalidActionDeclarationException",
+                        "Fn::GetParam file must contain a JSON object", 400);
+            }
+        }
+        throw new AwsException("InvalidActionDeclarationException",
+                "CloudFormation parameter override uses an unsupported function", 400);
+    }
+
+    private static List<String> functionArguments(JsonNode arguments, int expectedCount, String functionName) {
+        if (!arguments.isArray() || arguments.size() != expectedCount) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    functionName + " requires " + expectedCount + " string arguments", 400);
+        }
+        List<String> values = new ArrayList<>();
+        for (JsonNode argument : arguments) {
+            if (!argument.isTextual() || argument.asText().isBlank()) {
+                throw new AwsException("InvalidActionDeclarationException",
+                        functionName + " requires " + expectedCount + " string arguments", 400);
+            }
+            values.add(argument.asText());
+        }
+        return values;
+    }
+
+    private static ArtifactLocation requireArtifactLocation(String artifactName, JsonNode action,
+                                                            Map<String, ArtifactLocation> artifactLocations) {
+        boolean isInputArtifact = false;
+        for (JsonNode input : action.path("inputArtifacts")) {
+            if (artifactName.equals(input.path("name").asText())) {
+                isInputArtifact = true;
+                break;
+            }
+        }
+        ArtifactLocation location = artifactLocations.get(artifactName);
+        if (!isInputArtifact || location == null) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    "Parameter override references an unavailable input artifact: " + artifactName, 400);
+        }
+        return location;
+    }
+
+    private static String readTemplateFromArtifact(byte[] artifact, String templatePath) {
+        if (templatePath.startsWith("/") || templatePath.startsWith("\\") || templatePath.contains("\\")) {
+            throw new AwsException("InvalidActionDeclarationException", "TemplatePath is not safe", 400);
+        }
+        for (String segment : templatePath.split("/")) {
+            if (segment.isBlank() || ".".equals(segment) || "..".equals(segment)) {
+                throw new AwsException("InvalidActionDeclarationException", "TemplatePath is not safe", 400);
+            }
+        }
+        try (ZipInputStream zip = new ZipInputStream(new ByteArrayInputStream(artifact))) {
+            ZipEntry entry;
+            while ((entry = zip.getNextEntry()) != null) {
+                if (!entry.isDirectory() && templatePath.equals(entry.getName())) {
+                    byte[] template = zip.readNBytes(51_201);
+                    if (template.length > 51_200) {
+                        throw new AwsException("InvalidActionDeclarationException",
+                                "CloudFormation template exceeds 51200 bytes", 400);
+                    }
+                    return new String(template, StandardCharsets.UTF_8);
+                }
+            }
+        } catch (java.io.IOException exception) {
+            throw new AwsException("InvalidActionDeclarationException",
+                    "Could not read CloudFormation template from input artifact", 400);
+        }
+        throw new AwsException("InvalidActionDeclarationException",
+                "TemplatePath does not exist in the input artifact", 400);
+    }
+
+    private record ArtifactLocation(String bucket, String key) {
+    }
+
     private boolean abandonExternalActionIfRequested(CodePipelineExecution execution, ActionExecution state) {
         if (!execution.isStopRequested() || !execution.isAbandon()) {
             return false;
@@ -1518,9 +2051,9 @@ public class CodePipelineService {
 
     private ObjectNode executionNode(CodePipelineExecution execution) {
         ObjectNode node = mapper.valueToTree(execution);
-        node.remove(List.of("accountId", "region", "startTime", "lastUpdateTime",
+        node.remove(List.of("accountId", "region", "startTime", "lastUpdateTime", "artifacts",
                 "sourceRevisions", "actionExecutions", "currentStage", "stopRequested", "abandon",
-                "rollbackTargetPipelineExecutionId"));
+                "rollbackTargetPipelineExecutionId", "retryStageName", "retryActionNames"));
         if (execution.getRollbackTargetPipelineExecutionId() != null) {
             node.putObject("rollbackMetadata").put(
                     "rollbackTargetPipelineExecutionId", execution.getRollbackTargetPipelineExecutionId());
@@ -1728,19 +2261,10 @@ public class CodePipelineService {
         return account + ":" + region + ":" + pipelineName;
     }
 
-    private static String artifactKey(CodePipelineExecution execution, String artifactName) {
-        return execution.getAccountId() + ":" + execution.getPipelineExecutionId() + ":" + artifactName;
-    }
-
     private static String artifactBucket(JsonNode action) {
         return action.path("configuration").path("BucketName").asText("codepipeline-artifacts");
     }
 
-    private void clearRuntimeArtifacts(CodePipelineExecution execution) {
-        String prefix = execution.getAccountId() + ":" + execution.getPipelineExecutionId() + ":";
-        runtimeArtifacts.keySet().removeIf(key -> key.startsWith(prefix));
-    }
-
     private static boolean isTerminal(String status) {
         return List.of("Succeeded", "Failed", "Stopped", "Superseded", "Cancelled").contains(status);
     }

src/main/java/io/github/hectorvent/floci/services/codepipeline/model/CodePipelineExecution.java

@@ -26,6 +26,7 @@ public class CodePipelineExecution {
     private Double startTime;
     private Double lastUpdateTime;
     private List<Map<String, Object>> artifactRevisions = new ArrayList<>();
+    private Map<String, byte[]> artifacts = new LinkedHashMap<>();
     private List<Map<String, Object>> sourceRevisions = new ArrayList<>();
     private List<Map<String, String>> variables = new ArrayList<>();
     private Map<String, String> trigger = new LinkedHashMap<>();
@@ -35,6 +36,8 @@ public class CodePipelineExecution {
     private volatile boolean stopRequested;
     private volatile boolean abandon;
     private String rollbackTargetPipelineExecutionId;
+    private String retryStageName;
+    private List<String> retryActionNames = new ArrayList<>();
 
     public String getAccountId() {
         return accountId;
@@ -132,6 +135,14 @@ public class CodePipelineExecution {
         this.artifactRevisions = artifactRevisions;
     }
 
+    public Map<String, byte[]> getArtifacts() {
+        return artifacts;
+    }
+
+    public void setArtifacts(Map<String, byte[]> artifacts) {
+        this.artifacts = artifacts == null ? new LinkedHashMap<>() : artifacts;
+    }
+
     public List<Map<String, Object>> getSourceRevisions() {
         return sourceRevisions;
     }
@@ -205,6 +216,22 @@ public class CodePipelineExecution {
         this.rollbackTargetPipelineExecutionId = rollbackTargetPipelineExecutionId;
     }
 
+    public String getRetryStageName() {
+        return retryStageName;
+    }
+
+    public void setRetryStageName(String retryStageName) {
+        this.retryStageName = retryStageName;
+    }
+
+    public List<String> getRetryActionNames() {
+        return retryActionNames;
+    }
+
+    public void setRetryActionNames(List<String> retryActionNames) {
+        this.retryActionNames = retryActionNames == null ? new ArrayList<>() : retryActionNames;
+    }
+
     @RegisterForReflection
     @JsonInclude(JsonInclude.Include.NON_NULL)
     public static class ActionExecution {

src/main/java/io/github/hectorvent/floci/services/cognito/CognitoAuthFlowHandler.java

@@ -1363,6 +1363,62 @@ final class CognitoAuthFlowHandler {
         return service.generateAuthResult(user, pool, client, override);
     }
 
+    /**
+     * Checks a password typed into the hosted login page. Same rules and triggers as
+     * USER_PASSWORD_AUTH, minus SECRET_HASH: the page is Cognito's own, not the app client.
+     * Throws {@code NewPasswordRequiredException} when the user still has a temporary password.
+     */
+    CognitoUser authenticateHostedLogin(UserPool pool, UserPoolClient client, String username, String password) {
+        CognitoUser user;
+        try {
+            user = service.adminGetUser(pool.getId(), username);
+        } catch (AwsException ae) {
+            if (!"UserNotFoundException".equals(ae.getErrorCode())) throw ae;
+            user = tryUserMigration(pool, client, username, password, null, Map.of(),
+                    "UserMigration_Authentication");
+            if (user == null) throw new AwsException("NotAuthorizedException", "Incorrect username or password", 400);
+        }
+
+        firePreAuthentication(pool, client, user, null, Map.of(), false);
+
+        if (!user.isEnabled()) throw new AwsException("NotAuthorizedException", "User is disabled", 400);
+        if ("RESET_REQUIRED".equals(user.getUserStatus())) {
+            throw new AwsException("PasswordResetRequiredException", "Password reset required", 400);
+        }
+        if (user.getPasswordHash() == null || !user.getPasswordHash().equals(service.hashPassword(password))) {
+            throw new AwsException("NotAuthorizedException", "Incorrect username or password", 400);
+        }
+        if ("UNCONFIRMED".equals(user.getUserStatus())) {
+            throw new AwsException("UserNotConfirmedException", "User is not confirmed", 400);
+        }
+        if (user.isTemporaryPassword() || "FORCE_CHANGE_PASSWORD".equals(user.getUserStatus())) {
+            throw new AwsException("NewPasswordRequiredException", "Password change required", 400);
+        }
+        firePostAuthentication(pool, client, user, Map.of(), false);
+        return user;
+    }
+
+    /** Tokens for an authorization code from the hosted login or a federated sign-in. */
+    Map<String, Object> issueHostedTokens(UserPool pool, UserPoolClient client, CognitoUser user, String nonce) {
+        CognitoService.ClaimsOverride override = withIdClaim(
+                firePreTokenGeneration(pool, client, user, Map.of(), "TokenGeneration_HostedAuth"), "nonce", nonce);
+        return service.generateAuthResult(user, pool, client, override);
+    }
+
+    private static CognitoService.ClaimsOverride withIdClaim(CognitoService.ClaimsOverride override,
+                                                             String name, String value) {
+        if (value == null || value.isBlank()) return override;
+        CognitoService.ClaimsOverride base = override != null ? override
+                : new CognitoService.ClaimsOverride(null, null, null, null, null, null, null, null, null);
+        Map<String, Object> idClaims = new HashMap<>();
+        if (base.idClaimsToAddOrOverride() != null) idClaims.putAll(base.idClaimsToAddOrOverride());
+        idClaims.put(name, value);
+        return new CognitoService.ClaimsOverride(idClaims, base.idClaimsToSuppress(),
+                base.accessClaimsToAddOrOverride(), base.accessClaimsToSuppress(),
+                base.scopesToAdd(), base.scopesToSuppress(),
+                base.groupsToOverride(), base.iamRolesToOverride(), base.preferredRole());
+    }
+
     CognitoService.ClaimsOverride preTokenGenerationForRefresh(UserPool pool, UserPoolClient client, CognitoUser user) {
         return firePreTokenGeneration(pool, client, user, Map.of(), "TokenGeneration_RefreshTokens");
     }

src/main/java/io/github/hectorvent/floci/services/cognito/CognitoCustomDomainFilter.java

@@ -14,12 +14,13 @@ import org.jboss.logging.Logger;
 
 import java.net.URI;
 import java.util.Optional;
+import java.util.Set;
 
 /**
  * Routes Cognito custom-domain requests by Host. On AWS a custom domain serves
- * {@code https://<domain>/oauth2/token}, {@code /oauth2/userInfo}, {@code /oauth2/authorize}, and
- * {@code /oauth2/idpresponse}; Floci maps those onto
- * the {@code /cognito-idp/oauth2/...} handlers and pins the pool and the account that own the
+ * {@code https://<domain>/oauth2/token}, {@code /oauth2/userInfo}, {@code /oauth2/authorize},
+ * {@code /oauth2/idpresponse} and the hosted {@code /login} and {@code /logout} pages; Floci maps
+ * those onto the {@code /cognito-idp/...} handlers and pins the pool and the account that own the
  * domain, since the request itself carries no AWS credential.
  */
 @Provider
@@ -37,6 +38,8 @@ public class CognitoCustomDomainFilter implements ContainerRequestFilter {
     private static final Logger LOG = Logger.getLogger(CognitoCustomDomainFilter.class);
     private static final String OAUTH_PREFIX = "/oauth2/";
     private static final String TARGET_PREFIX = "/cognito-idp/oauth2/";
+    private static final Set<String> HOSTED_PAGES = Set.of("/login", "/logout");
+    private static final String HOSTED_TARGET_PREFIX = "/cognito-idp/";
 
     private final CognitoService cognitoService;
 
@@ -49,7 +52,11 @@ public class CognitoCustomDomainFilter implements ContainerRequestFilter {
     public void filter(ContainerRequestContext requestContext) {
         URI originalUri = requestContext.getUriInfo().getRequestUri();
         String path = originalUri.getRawPath();
-        if (path == null || !path.startsWith(OAUTH_PREFIX)) {
+        if (path == null) {
+            return;
+        }
+        boolean hostedPage = HOSTED_PAGES.contains(path);
+        if (!path.startsWith(OAUTH_PREFIX) && !hostedPage) {
             return;
         }
         String host = RequestHost.of(requestContext);
@@ -62,7 +69,8 @@ public class CognitoCustomDomainFilter implements ContainerRequestFilter {
         }
 
         URI newUri = UriBuilder.fromUri(originalUri)
-                .replacePath(TARGET_PREFIX + path.substring(OAUTH_PREFIX.length()))
+                .replacePath(hostedPage ? HOSTED_TARGET_PREFIX + path.substring(1)
+                        : TARGET_PREFIX + path.substring(OAUTH_PREFIX.length()))
                 .build();
         LOG.debugv("Cognito custom domain routing: {0}{1} -> {2}", host, path, newUri.getPath());
         requestContext.setProperty(POOL_PROPERTY, domain.get().getUserPoolId());

src/main/java/io/github/hectorvent/floci/services/cognito/CognitoFederationService.java

@@ -47,6 +47,12 @@ public class CognitoFederationService {
 
     public String beginAuthorization(String userPoolId, String clientId, String redirectUri, List<String> scopes,
                                      String nonce, String providerName, String relyingPartyState) {
+        return beginAuthorization(userPoolId, clientId, redirectUri, scopes, nonce, providerName, relyingPartyState, null);
+    }
+
+    public String beginAuthorization(String userPoolId, String clientId, String redirectUri, List<String> scopes,
+                                     String nonce, String providerName, String relyingPartyState,
+                                     String codeChallenge) {
         IdentityProvider provider = cognitoService.describeIdentityProvider(userPoolId, providerName);
         requireOidcProvider(provider);
         String authorizeEndpoint = requiredProviderDetail(provider, "authorize_url", "authorize endpoint");
@@ -54,7 +60,8 @@ public class CognitoFederationService {
         validateAuthorizeEndpoint(authorizeEndpoint, provider.getProviderName());
         Instant expiresAt = clock.instant().plus(TRANSACTION_LIFETIME);
         CognitoAuthorizationTransaction transaction = new CognitoAuthorizationTransaction(
-                userPoolId, clientId, redirectUri, scopes, nonce, providerName, relyingPartyState, expiresAt);
+                userPoolId, clientId, redirectUri, scopes, nonce, providerName, relyingPartyState, expiresAt,
+                codeChallenge);
         String state = stateStore.putTransaction(transaction);
 
         Map<String, String> parameters = new LinkedHashMap<>();
@@ -89,7 +96,8 @@ public class CognitoFederationService {
                 subject, issuer, mapAttributes(provider, claims));
         CognitoAuthorizationCode authorizationCode = new CognitoAuthorizationCode(
                 transaction.userPoolId(), transaction.clientId(), user.getUsername(), transaction.redirectUri(),
-                transaction.scopes(), clock.instant().plus(AUTHORIZATION_CODE_LIFETIME));
+                transaction.scopes(), clock.instant().plus(AUTHORIZATION_CODE_LIFETIME), transaction.nonce(),
+                transaction.codeChallenge());
         return stateStore.putAuthorizationCode(authorizationCode);
     }
 

src/main/java/io/github/hectorvent/floci/services/cognito/CognitoFederationStateStore.java

@@ -2,6 +2,7 @@ package io.github.hectorvent.floci.services.cognito;
 
 import io.github.hectorvent.floci.services.cognito.model.CognitoAuthorizationCode;
 import io.github.hectorvent.floci.services.cognito.model.CognitoAuthorizationTransaction;
+import io.github.hectorvent.floci.services.cognito.model.CognitoHostedSession;
 import jakarta.enterprise.context.ApplicationScoped;
 
 import java.security.SecureRandom;
@@ -20,6 +21,7 @@ public class CognitoFederationStateStore {
 
     private final ConcurrentHashMap<String, CognitoAuthorizationTransaction> transactions = new ConcurrentHashMap<>();
     private final ConcurrentHashMap<String, CognitoAuthorizationCode> authorizationCodes = new ConcurrentHashMap<>();
+    private final ConcurrentHashMap<String, CognitoHostedSession> hostedSessions = new ConcurrentHashMap<>();
     private final Clock clock;
     private final SecureRandom secureRandom = new SecureRandom();
 
@@ -55,6 +57,31 @@ public class CognitoFederationStateStore {
         return Optional.of(authorizationCode);
     }
 
+    public String putHostedSession(CognitoHostedSession session) {
+        return put(hostedSessions, session);
+    }
+
+    public Optional<CognitoHostedSession> findHostedSession(String id) {
+        if (id == null) {
+            return Optional.empty();
+        }
+        CognitoHostedSession session = hostedSessions.get(id);
+        if (session == null) {
+            return Optional.empty();
+        }
+        if (isExpired(session.expiresAt())) {
+            hostedSessions.remove(id, session);
+            return Optional.empty();
+        }
+        return Optional.of(session);
+    }
+
+    public void removeHostedSession(String id) {
+        if (id != null) {
+            hostedSessions.remove(id);
+        }
+    }
+
     private <T> String put(ConcurrentHashMap<String, T> store, T value) {
         String key;
         do {

src/main/java/io/github/hectorvent/floci/services/cognito/CognitoHostedLoginController.java

@@ -0,0 +1,502 @@
+package io.github.hectorvent.floci.services.cognito;
+
+import io.github.hectorvent.floci.core.common.AwsException;
+import io.github.hectorvent.floci.services.cognito.model.CognitoAuthorizationCode;
+import io.github.hectorvent.floci.services.cognito.model.CognitoHostedSession;
+import io.github.hectorvent.floci.services.cognito.model.CognitoUser;
+import io.github.hectorvent.floci.services.cognito.model.UserPool;
+import io.github.hectorvent.floci.services.cognito.model.UserPoolClient;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.CookieParam;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.container.ContainerRequestContext;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.NewCookie;
+import jakarta.ws.rs.core.Response;
+
+import java.net.URI;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.SecureRandom;
+import java.time.Clock;
+import java.time.Duration;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+/**
+ * Cognito's hosted (managed) login pages: {@code /login} and {@code /logout}, reached from
+ * {@code /oauth2/authorize} when no external identity provider is named. A successful sign-in
+ * starts a browser session and redirects to the client's callback URL with an authorization
+ * code, which {@code /oauth2/token} redeems.
+ */
+@ApplicationScoped
+@Path("/")
+public class CognitoHostedLoginController {
+
+    static final String SESSION_COOKIE = "cognito";
+    static final String CSRF_COOKIE = "XSRF-TOKEN";
+    private static final Duration SESSION_LIFETIME = Duration.ofHours(1);
+    private static final Duration AUTHORIZATION_CODE_LIFETIME = Duration.ofMinutes(5);
+    private static final String COGNITO_PROVIDER = "COGNITO";
+    private static final String NO_PROVIDERS = "This app client has no identity providers to sign in with.";
+
+    private final CognitoService cognitoService;
+    private final CognitoFederationStateStore stateStore;
+    private final Clock clock;
+    private final SecureRandom secureRandom = new SecureRandom();
+
+    @Inject
+    public CognitoHostedLoginController(CognitoService cognitoService, CognitoFederationStateStore stateStore,
+                                        Clock clock) {
+        this.cognitoService = cognitoService;
+        this.stateStore = stateStore;
+        this.clock = clock;
+    }
+
+    /** The parameters of an authorize request, carried through the login form unchanged. */
+    record AuthorizeRequest(String clientId, String redirectUri, String scope, String state, String nonce,
+                            String codeChallenge, String codeChallengeMethod) {
+
+        Map<String, String> asQuery() {
+            Map<String, String> query = new LinkedHashMap<>();
+            query.put("client_id", clientId);
+            query.put("redirect_uri", redirectUri);
+            query.put("response_type", "code");
+            putIfPresent(query, "scope", scope);
+            putIfPresent(query, "state", state);
+            putIfPresent(query, "nonce", nonce);
+            putIfPresent(query, "code_challenge", codeChallenge);
+            putIfPresent(query, "code_challenge_method", codeChallengeMethod);
+            return query;
+        }
+    }
+
+    /**
+     * Continues an authorize request that names no external provider: an existing session gets a
+     * code straight away, anyone else is sent to the login page, which offers the pool's own
+     * password form and a button for each of the client's other identity providers.
+     */
+    Response authorizeWithCognito(ContainerRequestContext requestContext, UserPoolClient client,
+                                  AuthorizeRequest request, String prompt, String sessionId) {
+        if (!offersCognito(client) && externalProviders(client).isEmpty()) {
+            return errorPage(NO_PROVIDERS);
+        }
+        if (offersCognito(client) && !"login".equals(prompt)) {
+            Optional<CognitoUser> signedIn = sessionUser(client, sessionId);
+            if (signedIn.isPresent()) {
+                return redirectWithCode(client, request, signedIn.get(), null);
+            }
+        }
+        return Response.status(Response.Status.FOUND)
+                .location(URI.create(pagePath(requestContext, "login") + "?" + query(request.asQuery())))
+                .build();
+    }
+
+    @GET
+    @Path("/cognito-idp/login")
+    public Response loginPage(@Context ContainerRequestContext requestContext,
+                              @QueryParam("client_id") String clientId,
+                              @QueryParam("redirect_uri") String redirectUri,
+                              @QueryParam("response_type") String responseType,
+                              @QueryParam("scope") String scope,
+                              @QueryParam("state") String state,
+                              @QueryParam("nonce") String nonce,
+                              @QueryParam("code_challenge") String codeChallenge,
+                              @QueryParam("code_challenge_method") String codeChallengeMethod) {
+        AuthorizeRequest request = new AuthorizeRequest(trimToNull(clientId), trimToNull(redirectUri),
+                trimToNull(scope), state, trimToNull(nonce), trimToNull(codeChallenge), trimToNull(codeChallengeMethod));
+        Object validated = validate(requestContext, request, responseType);
+        if (validated instanceof Response error) {
+            return error;
+        }
+        String csrf = randomToken();
+        return loginForm(requestContext, (UserPoolClient) validated, request, csrf, null, null, 200)
+                .cookie(cookie(requestContext, CSRF_COOKIE, csrf, -1))
+                .build();
+    }
+
+    @POST
+    @Path("/cognito-idp/login")
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public Response submitLogin(@Context ContainerRequestContext requestContext,
+                                @CookieParam(CSRF_COOKIE) String csrfCookie,
+                                MultivaluedMap<String, String> form) {
+        AuthorizeRequest request = new AuthorizeRequest(trimToNull(form.getFirst("client_id")),
+                trimToNull(form.getFirst("redirect_uri")), trimToNull(form.getFirst("scope")),
+                form.getFirst("state"), trimToNull(form.getFirst("nonce")),
+                trimToNull(form.getFirst("code_challenge")), trimToNull(form.getFirst("code_challenge_method")));
+        Object validated = validate(requestContext, request, form.getFirst("response_type"));
+        if (validated instanceof Response error) {
+            return error;
+        }
+        UserPoolClient client = (UserPoolClient) validated;
+        if (!offersCognito(client)) {
+            return errorPage("This app client does not offer sign-in with a user name and password "
+                    + "(COGNITO is not one of its identity providers).");
+        }
+        String csrf = form.getFirst("_csrf");
+        if (csrf == null || csrfCookie == null || !constantTimeEquals(csrf, csrfCookie)) {
+            return errorPage("Your sign-in form expired. Go back to the app and sign in again.");
+        }
+
+        String username = trimToNull(form.getFirst("username"));
+        String password = form.getFirst("password");
+        if (username == null || password == null || password.isEmpty()) {
+            return loginForm(requestContext, client, request, csrf, username, "Enter your user name and password.", 400).build();
+        }
+
+        CognitoUser user;
+        try {
+            user = cognitoService.authenticateHostedLogin(client, username, password);
+        } catch (AwsException e) {
+            return loginForm(requestContext, client, request, csrf, username, describe(e), 400).build();
+        }
+
+        String sessionId = stateStore.putHostedSession(new CognitoHostedSession(
+                client.getUserPoolId(), user.getUsername(), clock.instant().plus(SESSION_LIFETIME)));
+        return redirectWithCode(client, request, user,
+                cookie(requestContext, SESSION_COOKIE, sessionId, (int) SESSION_LIFETIME.toSeconds()));
+    }
+
+    @GET
+    @Path("/cognito-idp/logout")
+    public Response logout(@Context ContainerRequestContext requestContext,
+                           @CookieParam(SESSION_COOKIE) String sessionId,
+                           @QueryParam("client_id") String clientId,
+                           @QueryParam("logout_uri") String logoutUri,
+                           @QueryParam("redirect_uri") String redirectUri,
+                           @QueryParam("response_type") String responseType,
+                           @QueryParam("scope") String scope,
+                           @QueryParam("state") String state) {
+        UserPoolClient client = findClient(requestContext, trimToNull(clientId));
+        if (client == null) {
+            return errorPage("The app client was not found.");
+        }
+
+        String location;
+        if (trimToNull(logoutUri) != null) {
+            if (!client.getLogoutURLs().contains(logoutUri.trim())) {
+                return errorPage("This sign-out URL is not registered for the app client.");
+            }
+            location = logoutUri.trim();
+        } else {
+            AuthorizeRequest request = new AuthorizeRequest(client.getClientId(), trimToNull(redirectUri),
+                    trimToNull(scope), state, null, null, null);
+            Object validated = validate(requestContext, request, responseType);
+            if (validated instanceof Response error) {
+                return error;
+            }
+            location = pagePath(requestContext, "login") + "?" + query(request.asQuery());
+        }
+
+        stateStore.removeHostedSession(sessionId);
+        return Response.status(Response.Status.FOUND)
+                .location(URI.create(location))
+                .cookie(cookie(requestContext, SESSION_COOKIE, "", 0))
+                .build();
+    }
+
+    private Optional<CognitoUser> sessionUser(UserPoolClient client, String sessionId) {
+        Optional<CognitoHostedSession> session = stateStore.findHostedSession(sessionId)
+                .filter(s -> s.userPoolId().equals(client.getUserPoolId()));
+        if (session.isEmpty()) {
+            return Optional.empty();
+        }
+        try {
+            CognitoUser user = cognitoService.adminGetUser(client.getUserPoolId(), session.get().username());
+            return user.isEnabled() ? Optional.of(user) : Optional.empty();
+        } catch (AwsException e) {
+            return Optional.empty();
+        }
+    }
+
+    private Response redirectWithCode(UserPoolClient client, AuthorizeRequest request, CognitoUser user,
+                                      NewCookie sessionCookie) {
+        String code = stateStore.putAuthorizationCode(new CognitoAuthorizationCode(
+                client.getUserPoolId(), client.getClientId(), user.getUsername(), request.redirectUri(),
+                splitScopes(request.scope()), clock.instant().plus(AUTHORIZATION_CODE_LIFETIME),
+                request.nonce(), request.codeChallenge()));
+        Map<String, String> parameters = new LinkedHashMap<>();
+        parameters.put("code", code);
+        putIfPresent(parameters, "state", request.state());
+        String redirectUri = request.redirectUri();
+        Response.ResponseBuilder response = Response.status(Response.Status.FOUND)
+                .location(URI.create(redirectUri + (redirectUri.contains("?") ? "&" : "?") + query(parameters)));
+        if (sessionCookie != null) {
+            response.cookie(sessionCookie);
+        }
+        return response.build();
+    }
+
+    /** Returns the client when the request is one Cognito would accept, otherwise an error page. */
+    private Object validate(ContainerRequestContext requestContext, AuthorizeRequest request, String responseType) {
+        if (!"code".equals(trimToNull(responseType))) {
+            return errorPage("Only response_type=code is supported.");
+        }
+        if (request.clientId() == null || request.redirectUri() == null) {
+            return errorPage("client_id and redirect_uri are required.");
+        }
+        UserPoolClient client = findClient(requestContext, request.clientId());
+        if (client == null) {
+            return errorPage("The app client was not found.");
+        }
+        if (!client.isAllowedOAuthFlowsUserPoolClient() || !client.getAllowedOAuthFlows().contains("code")) {
+            return errorPage("This app client is not allowed to use the authorization code flow.");
+        }
+        if (!client.getCallbackURLs().contains(request.redirectUri())) {
+            return errorPage("redirect_uri is not registered for this app client.");
+        }
+        if (!offersCognito(client) && externalProviders(client).isEmpty()) {
+            return errorPage(NO_PROVIDERS);
+        }
+        String pkceError = pkceError(request.codeChallenge(), request.codeChallengeMethod());
+        if (pkceError != null) {
+            return errorPage(pkceError);
+        }
+        return client;
+    }
+
+    private static boolean offersCognito(UserPoolClient client) {
+        return client.getSupportedIdentityProviders().contains(COGNITO_PROVIDER);
+    }
+
+    private static List<String> externalProviders(UserPoolClient client) {
+        return client.getSupportedIdentityProviders().stream()
+                .filter(provider -> !COGNITO_PROVIDER.equals(provider))
+                .toList();
+    }
+
+    static String pkceError(String codeChallenge, String codeChallengeMethod) {
+        if (codeChallenge == null) {
+            return codeChallengeMethod == null ? null : "code_challenge_method was sent without code_challenge.";
+        }
+        if (!"S256".equals(codeChallengeMethod)) {
+            return "code_challenge_method must be S256.";
+        }
+        return null;
+    }
+
+    private UserPoolClient findClient(ContainerRequestContext requestContext, String clientId) {
+        if (clientId == null) {
+            return null;
+        }
+        try {
+            UserPoolClient client = cognitoService.findClientById(clientId);
+            String domainPoolId = (String) requestContext.getProperty(CognitoCustomDomainFilter.POOL_PROPERTY);
+            return domainPoolId == null || domainPoolId.equals(client.getUserPoolId()) ? client : null;
+        } catch (AwsException e) {
+            return null;
+        }
+    }
+
+    private static String describe(AwsException e) {
+        return switch (e.getErrorCode()) {
+            case "NotAuthorizedException" -> "User is disabled".equals(e.getMessage())
+                    ? "This account is disabled." : "Incorrect user name or password.";
+            case "UserNotConfirmedException" -> "This account is not confirmed yet. Confirm it from the app first.";
+            case "PasswordResetRequiredException" -> "This account needs a password reset before it can sign in.";
+            case "NewPasswordRequiredException" -> "This account still has a temporary password. "
+                    + "Set a permanent one before signing in here.";
+            case "UserLambdaValidationException" -> e.getMessage();
+            default -> "Sign-in failed: " + e.getMessage();
+        };
+    }
+
+    private Response.ResponseBuilder loginForm(ContainerRequestContext requestContext, UserPoolClient client,
+                                               AuthorizeRequest request, String csrf, String username,
+                                               String error, int status) {
+        UserPool pool = cognitoService.describeUserPool(client.getUserPoolId());
+        boolean email = pool.getUsernameAttributes() != null && pool.getUsernameAttributes().contains("email");
+        StringBuilder hidden = new StringBuilder();
+        for (Map.Entry<String, String> field : request.asQuery().entrySet()) {
+            hidden.append("<input type=\"hidden\" name=\"").append(escape(field.getKey()))
+                    .append("\" value=\"").append(escape(field.getValue())).append("\">");
+        }
+        hidden.append("<input type=\"hidden\" name=\"_csrf\" value=\"").append(escape(csrf)).append("\">");
+        String appName = client.getClientName() == null || client.getClientName().isBlank()
+                ? pool.getName() : client.getClientName();
+        // Each external provider starts the federated flow with the same authorize parameters.
+        StringBuilder providers = new StringBuilder();
+        for (String provider : externalProviders(client)) {
+            Map<String, String> query = new LinkedHashMap<>(request.asQuery());
+            query.put("identity_provider", provider);
+            providers.append("<a class=\"provider\" href=\"").append(escape(authorizePath(requestContext) + "?" + query(query)))
+                    .append("\">Continue with ").append(escape(provider)).append("</a>");
+        }
+        String passwordForm = !offersCognito(client) ? "" : """
+                <form method="post" action="">
+                  %s
+                  <label>%s<input name="username" type="%s" autocomplete="username" value="%s" required autofocus></label>
+                  <label>Password<input name="password" type="password" autocomplete="current-password" required></label>
+                  <button type="submit">Sign in</button>
+                </form>
+                """.formatted(hidden, email ? "Email" : "User name", email ? "email" : "text",
+                escape(username == null ? "" : username));
+        String divider = providers.isEmpty() || passwordForm.isEmpty() ? "" : "<p class=\"divider\"><span>or</span></p>";
+        String body = """
+                <h1>Sign in</h1>
+                <p class="muted">to continue to <strong>%s</strong></p>
+                %s
+                %s%s<div class="providers">%s</div>
+                """.formatted(escape(appName),
+                error == null ? "" : "<p class=\"error\" role=\"alert\">" + escape(error) + "</p>",
+                passwordForm, divider, providers);
+        return Response.status(status).type(MediaType.TEXT_HTML_TYPE.withCharset("UTF-8"))
+                .entity(page("Sign in", body))
+                .header("Cache-Control", "no-store")
+                .header("X-Frame-Options", "DENY")
+                .header("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; form-action 'self' "
+                        + cspSource(request.redirectUri()) + "; frame-ancestors 'none'");
+    }
+
+    private static String cspSource(String redirectUri) {
+        URI uri = URI.create(redirectUri);
+        return uri.getScheme() + "://" + uri.getRawAuthority();
+    }
+
+    private Response errorPage(String message) {
+        return Response.status(400).type(MediaType.TEXT_HTML_TYPE.withCharset("UTF-8"))
+                .entity(page("Sign-in error", "<h1>Something went wrong</h1><p class=\"error\" role=\"alert\">"
+                        + escape(message) + "</p>"))
+                .header("Cache-Control", "no-store")
+                .header("X-Frame-Options", "DENY")
+                .header("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'")
+                .build();
+    }
+
+    private static String page(String title, String body) {
+        return """
+                <!doctype html>
+                <html lang="en">
+                <head>
+                <meta charset="utf-8">
+                <meta name="viewport" content="width=device-width, initial-scale=1">
+                <title>%s</title>
+                <style>
+                  :root { --bg:#f4f5f7; --card:#fff; --text:#17191c; --muted:#5d6470; --border:#d9dde3; --accent:#2f5fd0; --on-accent:#fff; --error:#b42318; --error-bg:#fdeceb; }
+                  @media (prefers-color-scheme: dark) { :root { --bg:#101215; --card:#181b20; --text:#e8eaed; --muted:#9aa1ac; --border:#2c3139; --accent:#7c9ef0; --on-accent:#0b1020; --error:#f08b82; --error-bg:#3a1714; } }
+                  * { box-sizing: border-box; }
+                  body { margin:0; min-height:100vh; display:grid; place-items:center; padding:24px 16px; background:var(--bg); color:var(--text); font:15px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; }
+                  main { width:100%%; max-width:380px; background:var(--card); border:1px solid var(--border); border-radius:10px; padding:28px; }
+                  h1 { margin:0 0 4px; font-size:22px; }
+                  .muted { color:var(--muted); margin:0 0 20px; overflow-wrap:anywhere; }
+                  form { display:grid; gap:14px; }
+                  label { display:grid; gap:6px; font-weight:600; font-size:14px; }
+                  input { font:inherit; padding:10px 12px; border:1px solid var(--border); border-radius:6px; background:var(--bg); color:var(--text); }
+                  input:focus { outline:2px solid var(--accent); outline-offset:1px; }
+                  button { font:inherit; font-weight:600; padding:10px 12px; border:0; border-radius:6px; background:var(--accent); color:var(--on-accent); cursor:pointer; }
+                  .providers { display:grid; gap:10px; }
+                  .provider { display:block; padding:10px 12px; border:1px solid var(--border); border-radius:6px; color:var(--text); font-weight:600; text-align:center; text-decoration:none; overflow-wrap:anywhere; }
+                  .provider:hover { border-color:var(--accent); color:var(--accent); }
+                  .divider { display:flex; align-items:center; gap:10px; margin:16px 0; color:var(--muted); font-size:13px; }
+                  .divider::before, .divider::after { content:""; flex:1; border-top:1px solid var(--border); }
+                  .error { margin:0 0 16px; padding:10px 12px; border-radius:6px; background:var(--error-bg); color:var(--error); overflow-wrap:anywhere; }
+                  footer { margin-top:20px; color:var(--muted); font-size:12px; text-align:center; }
+                </style>
+                </head>
+                <body><main>%s<footer>Cognito-compatible sign-in · local emulator</footer></main></body>
+                </html>
+                """.formatted(escape(title), body);
+    }
+
+    private NewCookie cookie(ContainerRequestContext requestContext, String name, String value, int maxAge) {
+        return new NewCookie.Builder(name).value(value).path("/").maxAge(maxAge)
+                .httpOnly(true).secure(isHttps(requestContext)).sameSite(NewCookie.SameSite.LAX).build();
+    }
+
+    private static boolean isHttps(ContainerRequestContext requestContext) {
+        String forwarded = requestContext.getHeaderString("X-Forwarded-Proto");
+        if (forwarded != null) {
+            return "https".equalsIgnoreCase(forwarded.split(",")[0].trim());
+        }
+        return "https".equalsIgnoreCase(requestContext.getUriInfo().getRequestUri().getScheme());
+    }
+
+    private static String authorizePath(ContainerRequestContext requestContext) {
+        boolean customDomain = requestContext.getProperty(CognitoCustomDomainFilter.POOL_PROPERTY) != null;
+        return customDomain ? "/oauth2/authorize" : "/cognito-idp/oauth2/authorize";
+    }
+
+    /** Custom domains serve the pages at /login and /logout; everything else under /cognito-idp/. */
+    private static String pagePath(ContainerRequestContext requestContext, String page) {
+        boolean customDomain = requestContext.getProperty(CognitoCustomDomainFilter.POOL_PROPERTY) != null;
+        return (customDomain ? "/" : "/cognito-idp/") + page;
+    }
+
+    private String randomToken() {
+        byte[] bytes = new byte[32];
+        secureRandom.nextBytes(bytes);
+        return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
+    }
+
+    private static boolean constantTimeEquals(String a, String b) {
+        return MessageDigest.isEqual(a.getBytes(StandardCharsets.UTF_8), b.getBytes(StandardCharsets.UTF_8));
+    }
+
+    static String escape(String value) {
+        StringBuilder escaped = new StringBuilder(value.length());
+        for (char c : value.toCharArray()) {
+            switch (c) {
+                case '&' -> escaped.append("&amp;");
+                case '<' -> escaped.append("&lt;");
+                case '>' -> escaped.append("&gt;");
+                case '"' -> escaped.append("&quot;");
+                case '\'' -> escaped.append("&#39;");
+                default -> escaped.append(c);
+            }
+        }
+        return escaped.toString();
+    }
+
+    private static String query(Map<String, String> parameters) {
+        List<String> pairs = new ArrayList<>();
+        for (Map.Entry<String, String> parameter : parameters.entrySet()) {
+            pairs.add(encode(parameter.getKey()) + "=" + encode(parameter.getValue()));
+        }
+        return String.join("&", pairs);
+    }
+
+    /** Query-string encoding with spaces as %20, which every URL parser reads back as a space. */
+    private static String encode(String value) {
+        return URLEncoder.encode(value, StandardCharsets.UTF_8).replace("+", "%20");
+    }
+
+    private static void putIfPresent(Map<String, String> map, String key, String value) {
+        if (value != null) {
+            map.put(key, value);
+        }
+    }
+
+    private static List<String> splitScopes(String scope) {
+        if (scope == null) {
+            return List.of();
+        }
+        List<String> scopes = new ArrayList<>();
+        for (String value : scope.trim().split("\\s+")) {
+            if (!value.isBlank()) {
+                scopes.add(value);
+            }
+        }
+        return scopes;
+    }
+
+    private static String trimToNull(String value) {
+        if (value == null) {
+            return null;
+        }
+        String trimmed = value.trim();
+        return trimmed.isEmpty() ? null : trimmed;
+    }
+}

src/main/java/io/github/hectorvent/floci/services/cognito/CognitoOAuthController.java

@@ -6,11 +6,11 @@ import io.github.hectorvent.floci.core.common.AwsException;
 import io.github.hectorvent.floci.services.cognito.model.CognitoAuthorizationCode;
 import io.github.hectorvent.floci.services.cognito.model.CognitoAuthorizationTransaction;
 import io.github.hectorvent.floci.services.cognito.model.CognitoUser;
-import io.github.hectorvent.floci.services.cognito.model.UserPool;
 import io.github.hectorvent.floci.services.cognito.model.UserPoolClient;
 import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
 import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.CookieParam;
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.HeaderParam;
 import jakarta.ws.rs.POST;
@@ -46,17 +46,37 @@ public class CognitoOAuthController {
     private final ObjectMapper objectMapper;
     private final CognitoFederationService federationService;
     private final CognitoFederationStateStore stateStore;
+    private final CognitoHostedLoginController hostedLogin;
 
     @Inject
     public CognitoOAuthController(CognitoService cognitoService, ObjectMapper objectMapper,
                                   CognitoFederationService federationService,
-                                  CognitoFederationStateStore stateStore) {
+                                  CognitoFederationStateStore stateStore,
+                                  CognitoHostedLoginController hostedLogin) {
         this.cognitoService = cognitoService;
         this.objectMapper = objectMapper;
         this.federationService = federationService;
         this.stateStore = stateStore;
+        this.hostedLogin = hostedLogin;
     }
 
+    public CognitoOAuthController(CognitoService cognitoService, ObjectMapper objectMapper,
+                                  CognitoFederationService federationService,
+                                  CognitoFederationStateStore stateStore) {
+        this(cognitoService, objectMapper, federationService, stateStore, null);
+    }
+
+    public Response authorize(ContainerRequestContext requestContext, String clientId, String redirectUri,
+                              String responseType, String scope, String nonce, String providerName,
+                              String relyingPartyState) {
+        return authorize(requestContext, clientId, redirectUri, responseType, scope, nonce, providerName,
+                relyingPartyState, null, null, null, null);
+    }
+
+    /**
+     * Without {@code identity_provider} (or with {@code COGNITO}) the pool's own users sign in on
+     * the hosted login page; any other provider name starts a federated sign-in.
+     */
     @GET
     @Path("/cognito-idp/oauth2/authorize")
     public Response authorize(@Context ContainerRequestContext requestContext,
@@ -66,13 +86,22 @@ public class CognitoOAuthController {
                               @QueryParam("scope") String scope,
                               @QueryParam("nonce") String nonce,
                               @QueryParam("identity_provider") String providerName,
-                              @QueryParam("state") String relyingPartyState) {
+                              @QueryParam("state") String relyingPartyState,
+                              @QueryParam("code_challenge") String codeChallenge,
+                              @QueryParam("code_challenge_method") String codeChallengeMethod,
+                              @QueryParam("prompt") String prompt,
+                              @CookieParam(CognitoHostedLoginController.SESSION_COOKIE) String sessionId) {
         if (!"code".equals(trimToNull(responseType))) {
             return oauthError("unsupported_response_type", "Only response_type=code is supported");
         }
-        if (trimToNull(clientId) == null || trimToNull(redirectUri) == null || trimToNull(providerName) == null) {
+        boolean hosted = trimToNull(providerName) == null || "COGNITO".equals(providerName.trim());
+        if (trimToNull(clientId) == null || trimToNull(redirectUri) == null || (hosted && hostedLogin == null)) {
             return oauthError("invalid_request", "client_id, redirect_uri, and identity_provider are required");
         }
+        String pkceError = CognitoHostedLoginController.pkceError(trimToNull(codeChallenge), trimToNull(codeChallengeMethod));
+        if (pkceError != null) {
+            return oauthError("invalid_request", pkceError);
+        }
 
         UserPoolClient client;
         try {
@@ -91,9 +120,20 @@ public class CognitoOAuthController {
             return oauthError("invalid_request", "redirect_uri is not registered for this client");
         }
 
+        if (hosted) {
+            return hostedLogin.authorizeWithCognito(requestContext, client,
+                    new CognitoHostedLoginController.AuthorizeRequest(clientId.trim(), redirectUri, trimToNull(scope),
+                            relyingPartyState, trimToNull(nonce), trimToNull(codeChallenge),
+                            trimToNull(codeChallengeMethod)),
+                    trimToNull(prompt), sessionId);
+        }
+
         try {
-            String location = federationService.beginAuthorization(client.getUserPoolId(), clientId, redirectUri,
-                    splitScopes(scope), trimToNull(nonce), providerName, relyingPartyState);
+            String location = trimToNull(codeChallenge) == null
+                    ? federationService.beginAuthorization(client.getUserPoolId(), clientId, redirectUri,
+                    splitScopes(scope), trimToNull(nonce), providerName, relyingPartyState)
+                    : federationService.beginAuthorization(client.getUserPoolId(), clientId, redirectUri,
+                    splitScopes(scope), trimToNull(nonce), providerName, relyingPartyState, codeChallenge.trim());
             return Response.status(Response.Status.FOUND).location(URI.create(location)).build();
         } catch (AwsException e) {
             return oauthError("invalid_request", e.getMessage());
@@ -185,8 +225,12 @@ public class CognitoOAuthController {
         if ("authorization_code".equals(grantType)) {
             return redeemAuthorizationCode(clientId, clientSecret, formParams, domainPoolId);
         }
+        if ("refresh_token".equals(grantType)) {
+            return refreshTokens(clientId, clientSecret, formParams, domainPoolId);
+        }
         if (!"client_credentials".equals(grantType)) {
-            return oauthError("unsupported_grant_type", "Only client_credentials and authorization_code are supported");
+            return oauthError("unsupported_grant_type",
+                    "Only client_credentials, authorization_code and refresh_token are supported");
         }
         String scope = trimToNull(formParams.getFirst("scope"));
 
@@ -249,10 +293,12 @@ public class CognitoOAuthController {
             return oauthError("invalid_grant", "Authorization code is invalid or has expired");
         }
         CognitoAuthorizationCode consumedCode = consumed.get();
+        if (!pkceVerified(consumedCode.codeChallenge(), trimToNull(formParams.getFirst("code_verifier")))) {
+            return oauthError("invalid_grant", "code_verifier does not match the code_challenge");
+        }
         try {
-            UserPool pool = cognitoService.describeUserPool(consumedCode.userPoolId());
             CognitoUser user = cognitoService.adminGetUser(consumedCode.userPoolId(), consumedCode.userId());
-            Map<String, Object> authentication = cognitoService.generateAuthResult(user, pool, client, null);
+            Map<String, Object> authentication = cognitoService.issueHostedTokens(client, user, consumedCode.nonce());
             ObjectNode body = objectMapper.createObjectNode();
             body.put("access_token", (String) authentication.get("AccessToken"));
             body.put("id_token", (String) authentication.get("IdToken"));
@@ -267,6 +313,67 @@ public class CognitoOAuthController {
         }
     }
 
+    private Response refreshTokens(String clientId, String clientSecret, MultivaluedMap<String, String> formParams,
+                                   String domainPoolId) {
+        String refreshToken = trimToNull(formParams.getFirst("refresh_token"));
+        if (refreshToken == null) {
+            return oauthError("invalid_request", "refresh_token is required");
+        }
+        UserPoolClient client;
+        try {
+            client = cognitoService.findClientById(clientId);
+        } catch (AwsException e) {
+            return oauthError("invalid_client", "Client not found");
+        }
+        if (domainPoolId != null && !domainPoolId.equals(client.getUserPoolId())) {
+            return oauthError("invalid_client", "Client not found");
+        }
+        if (client.getClientSecret() != null && !client.getClientSecret().isBlank()
+                && !secretsEqual(client.getClientSecret(), clientSecret)) {
+            return oauthError("invalid_client", "Client secret is invalid");
+        }
+        try {
+            Map<String, Object> result = cognitoService.initiateAuth(clientId, "REFRESH_TOKEN_AUTH",
+                    Map.of("REFRESH_TOKEN", refreshToken));
+            @SuppressWarnings("unchecked")
+            Map<String, Object> authentication = (Map<String, Object>) result.get("AuthenticationResult");
+            ObjectNode body = objectMapper.createObjectNode();
+            body.put("access_token", (String) authentication.get("AccessToken"));
+            body.put("id_token", (String) authentication.get("IdToken"));
+            body.put("expires_in", ((Number) authentication.get("ExpiresIn")).longValue());
+            body.put("token_type", (String) authentication.get("TokenType"));
+            return Response.ok(body).type(MediaType.APPLICATION_JSON)
+                    .header("Cache-Control", "no-store").header("Pragma", "no-cache").build();
+        } catch (AwsException e) {
+            if ("NotAuthorizedException".equals(e.getErrorCode())) {
+                return oauthError("invalid_grant", e.getMessage());
+            }
+            if ("InvalidParameterException".equals(e.getErrorCode())) {
+                return oauthError("unauthorized_client", e.getMessage());
+            }
+            LOG.error("Failed to refresh Cognito tokens", e);
+            return oauthError("invalid_request", e.getMessage());
+        }
+    }
+
+    /** RFC 7636 S256: the challenge is BASE64URL(SHA-256(verifier)). No challenge, nothing to check. */
+    static boolean pkceVerified(String codeChallenge, String codeVerifier) {
+        if (codeChallenge == null) {
+            return true;
+        }
+        if (codeVerifier == null || codeVerifier.length() < 43 || codeVerifier.length() > 128) {
+            return false;
+        }
+        try {
+            byte[] digest = MessageDigest.getInstance("SHA-256").digest(codeVerifier.getBytes(StandardCharsets.US_ASCII));
+            String expected = Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
+            return MessageDigest.isEqual(expected.getBytes(StandardCharsets.US_ASCII),
+                    codeChallenge.getBytes(StandardCharsets.US_ASCII));
+        } catch (java.security.NoSuchAlgorithmException e) {
+            throw new IllegalStateException(e);
+        }
+    }
+
     private Response redirect(String redirectUri, Map<String, String> parameters) {
         StringBuilder location = new StringBuilder(redirectUri);
         location.append(redirectUri.contains("?") ? '&' : '?');

src/main/java/io/github/hectorvent/floci/services/cognito/CognitoService.java

@@ -2695,6 +2695,14 @@ public class CognitoService implements ResourceProvider {
 
     // ──────────────────────────── Auth ────────────────────────────
 
+    public CognitoUser authenticateHostedLogin(UserPoolClient client, String username, String password) {
+        return authFlowHandler.authenticateHostedLogin(describeUserPool(client.getUserPoolId()), client, username, password);
+    }
+
+    public Map<String, Object> issueHostedTokens(UserPoolClient client, CognitoUser user, String nonce) {
+        return authFlowHandler.issueHostedTokens(describeUserPool(client.getUserPoolId()), client, user, nonce);
+    }
+
     public Map<String, Object> initiateAuth(String clientId, String authFlow, Map<String, String> authParameters) {
         return authFlowHandler.initiateAuth(clientId, authFlow, authParameters, Map.of());
     }

src/main/java/io/github/hectorvent/floci/services/cognito/CognitoWellKnownController.java

@@ -66,7 +66,7 @@ public class CognitoWellKnownController {
         String authorizationEndpoint = tokenEndpoint.replace("/token", "/authorize");
 
         String body = """
-                {"issuer":"%s","jwks_uri":"%s","authorization_endpoint":"%s","token_endpoint":"%s","userinfo_endpoint":"%s","subject_types_supported":["public"],"response_types_supported":["code"],"grant_types_supported":["client_credentials","authorization_code"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post"],"id_token_signing_alg_values_supported":["RS256"]}
+                {"issuer":"%s","jwks_uri":"%s","authorization_endpoint":"%s","token_endpoint":"%s","userinfo_endpoint":"%s","subject_types_supported":["public"],"response_types_supported":["code"],"grant_types_supported":["client_credentials","authorization_code","refresh_token"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post"],"id_token_signing_alg_values_supported":["RS256"]}
                 """.formatted(issuer, jwksUri, authorizationEndpoint, tokenEndpoint, userInfoEndpoint).strip();
         return Response.ok(body).build();
     }

src/main/java/io/github/hectorvent/floci/services/cognito/model/CognitoAuthorizationCode.java

@@ -3,15 +3,27 @@ package io.github.hectorvent.floci.services.cognito.model;
 import java.time.Instant;
 import java.util.List;
 
+/**
+ * A one-time code handed to the client's redirect URI. {@code codeChallenge} is the PKCE S256
+ * challenge from the authorize request, and {@code nonce} is copied into the ID token; both are
+ * null when the client did not send them.
+ */
 public record CognitoAuthorizationCode(
         String userPoolId,
         String clientId,
         String userId,
         String redirectUri,
         List<String> scopes,
-        Instant expiresAt) {
+        Instant expiresAt,
+        String nonce,
+        String codeChallenge) {
 
     public CognitoAuthorizationCode {
         scopes = List.copyOf(scopes);
     }
+
+    public CognitoAuthorizationCode(String userPoolId, String clientId, String userId, String redirectUri,
+                                    List<String> scopes, Instant expiresAt) {
+        this(userPoolId, clientId, userId, redirectUri, scopes, expiresAt, null, null);
+    }
 }

src/main/java/io/github/hectorvent/floci/services/cognito/model/CognitoAuthorizationTransaction.java

@@ -11,9 +11,16 @@ public record CognitoAuthorizationTransaction(
         String nonce,
         String providerName,
         String relyingPartyState,
-        Instant expiresAt) {
+        Instant expiresAt,
+        String codeChallenge) {
 
     public CognitoAuthorizationTransaction {
         scopes = List.copyOf(scopes);
     }
+
+    public CognitoAuthorizationTransaction(String userPoolId, String clientId, String redirectUri, List<String> scopes,
+                                           String nonce, String providerName, String relyingPartyState,
+                                           Instant expiresAt) {
+        this(userPoolId, clientId, redirectUri, scopes, nonce, providerName, relyingPartyState, expiresAt, null);
+    }
 }

src/main/java/io/github/hectorvent/floci/services/cognito/model/CognitoHostedSession.java

@@ -0,0 +1,7 @@
+package io.github.hectorvent.floci.services.cognito.model;
+
+import java.time.Instant;
+
+/** A signed-in browser on the hosted login pages, so the next authorize request skips the form. */
+public record CognitoHostedSession(String userPoolId, String username, Instant expiresAt) {
+}

src/main/java/io/github/hectorvent/floci/services/cognito/model/RevokedTokenInfo.java

@@ -3,13 +3,19 @@ package io.github.hectorvent.floci.services.cognito.model;
 import io.quarkus.runtime.annotations.RegisterForReflection;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
 /**
  * Information about a revoked token for tracking and validation purposes.
  * Used to implement AWS Cognito AdminUserGlobalSignOut token revocation behavior.
+ *
+ * <p>{@code expired} is derived from {@code expiresAt}, so it is not stored. Files written before
+ * that still carry it, and are read with it ignored instead of being discarded as corrupt.
  */
 @RegisterForReflection
+@JsonIgnoreProperties(ignoreUnknown = true)
 public class RevokedTokenInfo {
     
     private final String jti;
@@ -62,6 +68,7 @@ public class RevokedTokenInfo {
     /**
      * Check if this revocation record has expired and can be cleaned up.
      */
+    @JsonIgnore
     public boolean isExpired() {
         return System.currentTimeMillis() / 1000L > expiresAt;
     }

src/main/java/io/github/hectorvent/floci/services/ec2/AmiImageResolver.java

@@ -53,11 +53,16 @@ public class AmiImageResolver {
         }
         return new ResolvedAmiImage(
                 image.dockerImage,
-                image.guestRuntime == null || image.guestRuntime.isBlank()
+                image.initType == null || image.initType.isBlank()
                         ? ResolvedAmiImage.DEFAULT_RUNTIME
-                        : image.guestRuntime,
+                        : image.initType,
                 Boolean.TRUE.equals(image.cloudInit),
-                dockerPlatform(image.architecture));
+                dockerPlatform(image.architecture),
+                image.fallbackDockerImage,
+                image.fallbackDockerImage == null ? "public" : "enhanced",
+                image.sshUser == null || image.sshUser.isBlank() ? "root" : image.sshUser,
+                Boolean.TRUE.equals(image.sshPreinstalled),
+                image.sshServiceName == null || image.sshServiceName.isBlank() ? "sshd" : image.sshServiceName);
     }
 
     private static String dockerPlatform(String architecture) {

src/main/java/io/github/hectorvent/floci/services/ec2/Ec2ContainerManager.java

@@ -12,6 +12,7 @@ import io.github.hectorvent.floci.core.common.docker.ContainerStorageHelper;
 import io.github.hectorvent.floci.core.common.docker.DockerHostResolver;
 import io.github.hectorvent.floci.core.common.docker.PortAllocator;
 import io.github.hectorvent.floci.services.ec2.model.Instance;
+import io.github.hectorvent.floci.services.ec2.model.InstanceLaunchEvent;
 import io.github.hectorvent.floci.services.ec2.model.InstanceNetworkInterface;
 import io.github.hectorvent.floci.services.ec2.model.InstanceState;
 import io.github.hectorvent.floci.services.ec2.model.GroupIdentifier;
@@ -38,8 +39,13 @@ import java.io.ByteArrayOutputStream;
 import java.io.Closeable;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+import java.net.InetSocketAddress;
+import java.net.Socket;
 import java.nio.charset.StandardCharsets;
 import java.time.Duration;
+import java.time.Instant;
 import java.util.ArrayList;
 import java.util.Base64;
 import java.util.HashSet;
@@ -60,6 +66,7 @@ import java.util.concurrent.Semaphore;
 import java.util.concurrent.ThreadPoolExecutor;
 import java.util.concurrent.TimeUnit;
 import java.util.function.BiPredicate;
+import java.util.function.Consumer;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -161,6 +168,8 @@ public class Ec2ContainerManager {
 
     static int containerBridgeIpAttempts = 30;
     static long containerBridgeIpPollMillis = 500;
+    static int sshBannerAttempts = 30;
+    static long sshBannerPollMillis = 1_000;
 
     private final ContainerBuilder containerBuilder;
     private final ContainerLifecycleManager lifecycleManager;
@@ -180,9 +189,14 @@ public class Ec2ContainerManager {
     private final ExecutorService executor;
     private final Duration userDataExecutionTimeout;
     private final Set<ResultCallback<Frame>> activeUserDataCallbacks = ConcurrentHashMap.newKeySet();
+    private volatile Consumer<Instance> instancePersister = ignored -> {};
 
     private volatile boolean dockerUnavailableLogged;
 
+    public void setInstancePersister(Consumer<Instance> instancePersister) {
+        this.instancePersister = instancePersister == null ? ignored -> {} : instancePersister;
+    }
+
     public void refreshSecurityGroups(String region, Map<String, SecurityGroup> groups,
                                       Map<String, List<String>> prefixLists) {
         if (firewallManager != null && firewallManager.enabled()) {
@@ -240,7 +254,7 @@ public class Ec2ContainerManager {
         InstanceNetworkInterface eni = instance.getNetworkInterfaces().getFirst();
         String logical = instance.getLogicalPrivateIpAddress() != null
                 ? instance.getLogicalPrivateIpAddress() : eni.getPrivateIpAddress();
-        firewallManager.register(new SecurityGroupNftCompiler.Endpoint(regionResolver.getAccountId(), region,
+        firewallManager.register(new SecurityGroupNftCompiler.Endpoint(accountId(instance), region,
                 instance.getVpcId(), eni.getNetworkInterfaceId(), logical, address,
                 instance.getSecurityGroups().stream().map(GroupIdentifier::getGroupId)
                         .collect(Collectors.toSet()), groups), helperId, prefixLists);
@@ -375,6 +389,9 @@ public class Ec2ContainerManager {
                        Set<Integer> appPorts, List<SecurityGroup> groups,
                        Map<String, List<String>> prefixLists) {
         instance.setState(InstanceState.pending());
+        instance.setLaunchStatus("in-progress");
+        instance.setSshStatus("initializing");
+        persist(instance);
 
         // An instance record is metadata: id, addresses, tags and lifecycle state are all
         // served without a container runtime. Only the guest itself (SSH, UserData, SSM
@@ -398,11 +415,13 @@ public class Ec2ContainerManager {
         try {
             executor.execute(() -> {
                 try {
+                    recordLaunchEvent(instance, "selecting-image", "started", "Selecting the launch image");
+                    ResolvedAmiImage launchImage = selectLaunchImage(instance, image);
                     String instanceId = instance.getInstanceId();
                 // IMDS endpoint that this container should use
                 String flociHost = dockerHostResolver.resolve();
                 int imdsPort = config.services().ec2().imdsPort();
-                StartedContainer started = createAndStartContainer(instance, image, region, flociHost, imdsPort,
+                StartedContainer started = createAndStartContainer(instance, launchImage, region, flociHost, imdsPort,
                         leasedPrivateIp, groups, prefixLists);
                 if (started == null) {
                     return;
@@ -485,6 +504,7 @@ public class Ec2ContainerManager {
                     failLaunch(instance, leasedPrivateIp);
                     return;
                 }
+                persist(instance);
 
                 // Set public-facing addresses only for instances whose subnet
                 // opts in via MapPublicIpOnLaunch (#1984). Private-subnet
@@ -508,14 +528,47 @@ public class Ec2ContainerManager {
 
                 // Inject SSH public key, if one was provided
                 if (publicKey != null && !publicKey.isBlank()) {
-                    injectSshKey(containerId, publicKey);
+                    recordLaunchEvent(instance, "injecting-key", "started", "Injecting the selected public key");
+                    OperationResult injection = injectSshKey(containerId, publicKey);
+                    instance.setKeyInjectionStatus(injection.success() ? "succeeded" : "failed");
+                    recordLaunchEvent(instance, "injecting-key", injection.success() ? "completed" : "failed",
+                            injection.message());
+                } else {
+                    instance.setKeyInjectionStatus("skipped");
+                    recordLaunchEvent(instance, "injecting-key", "skipped", "No key pair was selected");
                 }
-                // sshd runs on every instance regardless of whether a key pair was supplied,
-                // matching real AWS AMIs (which start it as part of normal boot, independent of
-                // key-pair association) - starting it only when a key was present meant
-                // run-instances without --key-name produced a "connection refused" instead of AWS's
-                // actual behavior: a running daemon with simply nothing to authenticate against.
-                startSshd(containerId, instanceId);
+                // Systemd-backed AMIs start their enabled SSH unit during boot. Starting a second
+                // daemon here races it for port 22; lightweight guests still need this bootstrap.
+                if (!launchImage.systemd()) {
+                    recordLaunchEvent(instance, "installing-ssh", "started", "Checking and installing SSH packages");
+                    SshSetupResult setup = startSshd(containerId, instanceId);
+                    String installationStatus = setup.installationAttempted()
+                            ? setup.installationSucceeded() ? "completed" : "failed"
+                            : "skipped";
+                    recordLaunchEvent(instance, "installing-ssh", installationStatus,
+                            setup.installationMessage());
+                    recordLaunchEvent(instance, "starting-ssh", setup.success() ? "completed" : "failed",
+                            setup.message());
+                } else {
+                    recordLaunchEvent(instance, "installing-ssh", "skipped",
+                            "SSH is preinstalled in the selected image");
+                    recordLaunchEvent(instance, "starting-ssh", "skipped",
+                            "SSH startup is managed by " + launchImage.sshServiceName());
+                }
+
+                recordLaunchEvent(instance, "ssh-ready", "started", "Waiting for an SSH protocol banner");
+                OperationResult readiness = waitForSshBanner(instance.getContainerBridgeIp(), 22);
+                String readinessMessage = setupFailureMessage(instance, readiness.message());
+                instance.setSshStatus(readiness.success() ? "ok" : "impaired");
+                instance.setSshStatusMessage(readinessMessage);
+                instance.setLaunchStatus(readiness.success() ? "ready" : "failed");
+                if (!readiness.success()) {
+                    instance.setStateReasonCode("Client.SSHUnavailable");
+                    instance.setStateReasonMessage(readinessMessage);
+                    instance.setStateTransitionReason(readinessMessage);
+                }
+                recordLaunchEvent(instance, "ssh-ready", readiness.success() ? "completed" : "failed",
+                        readinessMessage);
 
                 // Execute UserData
                 String userData = instance.getUserData();
@@ -525,14 +578,14 @@ public class Ec2ContainerManager {
 
                 } catch (InterruptedException e) {
                     Thread.currentThread().interrupt();
-                    failLaunch(instance, leasedPrivateIp);
+                    failLaunch(instance, leasedPrivateIp, "Launch interrupted");
                 } catch (Exception e) {
                     LOG.warnv("Failed to launch EC2 instance {0}: {1}", instance.getInstanceId(), e.getMessage());
                     // The daemon can disappear between the probe above and any of the calls in
                     // this block. Losing Docker is not the instance's fault, so degrade to a
                     // metadata-only instance; a genuine container failure still fails the launch.
                     if ((firewallManager != null && firewallManager.enabled()) || isDockerAvailable()) {
-                        failLaunch(instance, leasedPrivateIp);
+                        failLaunch(instance, leasedPrivateIp, errorMessage(e));
                     } else {
                         markContainerlessRunning(instance);
                     }
@@ -541,10 +594,51 @@ public class Ec2ContainerManager {
         } catch (RejectedExecutionException e) {
             LOG.warnv("Could not schedule EC2 instance {0} launch because the launch executor is saturated or stopping",
                     instance.getInstanceId());
-            failLaunch(instance, leasedPrivateIp);
+            failLaunch(instance, leasedPrivateIp,
+                    "Launch executor is saturated or stopping: " + errorMessage(e));
         }
     }
 
+    ResolvedAmiImage selectLaunchImage(ResolvedAmiImage image) {
+        return selectLaunchImage(null, image);
+    }
+
+    private ResolvedAmiImage selectLaunchImage(Instance instance, ResolvedAmiImage image) {
+        if (image.fallbackDockerImage() == null || image.fallbackDockerImage().isBlank()) {
+            recordSelectedImage(instance, image, "Selected " + image.imageType() + " image");
+            return image;
+        }
+        String preferred = containerBuilder.resolveImage(image.dockerImage());
+        try {
+            dockerClient.inspectImageCmd(preferred).exec();
+            recordSelectedImage(instance, image, "Enhanced AMI image is available locally");
+            return image;
+        } catch (NotFoundException expected) {
+            LOG.warnv("EC2 AMI image {0} is not present locally; using pullable fallback {1}",
+                    image.dockerImage(), image.fallbackDockerImage());
+            ResolvedAmiImage fallback = new ResolvedAmiImage(image.fallbackDockerImage(),
+                    ResolvedAmiImage.DEFAULT_RUNTIME, false, image.dockerPlatform(), null,
+                    "public-fallback", image.sshUser(), false, image.sshServiceName());
+            recordSelectedImage(instance, fallback,
+                    "Enhanced image " + image.dockerImage() + " was not present locally; selected public fallback");
+            return fallback;
+        }
+    }
+
+    private void recordSelectedImage(Instance instance, ResolvedAmiImage image, String reason) {
+        if (instance == null) {
+            return;
+        }
+        instance.setSelectedImageType(image.imageType());
+        instance.setSelectedImageReference(image.dockerImage());
+        instance.setSshUser(image.sshUser());
+        instance.setSshPreinstalled(image.sshPreinstalled());
+        instance.setInitType(image.initType());
+        instance.setSshServiceName(image.sshServiceName());
+        recordLaunchEvent(instance, "selecting-image", "completed",
+                reason + ": " + image.dockerImage());
+    }
+
     private StartedContainer createAndStartContainer(Instance instance, ResolvedAmiImage image, String region,
                                                      String flociHost, int imdsPort, String leasedPrivateIp,
                                                      List<SecurityGroup> groups,
@@ -558,9 +652,20 @@ public class Ec2ContainerManager {
             if (isLaunchCancelled(instance)) {
                 return null;
             }
-            int sshHostPort = portAllocator.allocate(
-                    config.services().ec2().sshPortRangeStart(),
-                    config.services().ec2().sshPortRangeEnd());
+            recordLaunchEvent(instance, "allocating-ssh-port", "started",
+                    "Allocating a host port for guest port 22");
+            List<Integer> occupiedPorts = new ArrayList<>();
+            int sshHostPort;
+            try {
+                sshHostPort = portAllocator.allocate(
+                        config.services().ec2().sshPortRangeStart(),
+                        config.services().ec2().sshPortRangeEnd(),
+                        occupiedPorts::add);
+            } catch (RuntimeException e) {
+                recordOccupiedPorts(instance, occupiedPorts);
+                throw e;
+            }
+            recordOccupiedPorts(instance, occupiedPorts);
             SecurityGroupFirewallManager.Namespace namespace = null;
             String eniId = null;
             String containerId = null;
@@ -574,8 +679,8 @@ public class Ec2ContainerManager {
                     eniId = eni.getNetworkInterfaceId();
                     instance.setLogicalPrivateIpAddress(eni.getPrivateIpAddress());
                     namespace = firewallManager.createNamespace("ec2", instanceId,
-                            regionResolver.getAccountId(), region, Optional.empty(), Map.of(22, sshHostPort));
-                    firewallManager.register(new SecurityGroupNftCompiler.Endpoint(regionResolver.getAccountId(),
+                            accountId(instance), region, Optional.empty(), Map.of(22, sshHostPort));
+                    firewallManager.register(new SecurityGroupNftCompiler.Endpoint(accountId(instance),
                             region, instance.getVpcId(), eniId, eni.getPrivateIpAddress(),
                             namespace.transportAddress(),
                             instance.getSecurityGroups().stream().map(g -> g.getGroupId())
@@ -583,10 +688,34 @@ public class Ec2ContainerManager {
                             namespace.helperId(), prefixLists);
                 }
                 ContainerSpec spec = buildContainerSpec(containerName, image, region, serviceEndpoint, imdsEndpoint,
-                        instanceId, sshHostPort, namespace, instance.getIamInstanceProfileArn() != null);
-                containerId = image.dockerPlatform() == null
-                        ? lifecycleManager.create(spec)
-                        : lifecycleManager.create(spec, image.dockerPlatform());
+                        instanceId, accountId(instance), sshHostPort, namespace,
+                        instance.getIamInstanceProfileArn() != null);
+                recordLaunchEvent(instance, "allocating-ssh-port", "completed",
+                        "Allocated SSH host port " + sshHostPort);
+                containerId = lifecycleManager.create(spec, image.dockerPlatform(),
+                        new ContainerLifecycleManager.ContainerCreationObserver() {
+                            @Override
+                            public void imagePullStarted(String imageUri) {
+                                recordLaunchEvent(instance, "pulling-image", "started", "Pulling " + imageUri);
+                            }
+
+                            @Override
+                            public void imagePullCompleted(String imageUri) {
+                                recordLaunchEvent(instance, "pulling-image", "completed", "Pulled " + imageUri);
+                            }
+
+                            @Override
+                            public void containerCreationStarted() {
+                                recordLaunchEvent(instance, "creating-container", "started",
+                                        "Creating the instance container");
+                            }
+
+                            @Override
+                            public void containerCreated(String createdContainerId) {
+                                recordLaunchEvent(instance, "creating-container", "completed",
+                                        "Created container " + createdContainerId);
+                            }
+                        });
                 if (!recordCreatedContainer(instance, containerId, sshHostPort)) {
                     lifecycleManager.removeIfExists(containerId);
                     if (namespace != null) {
@@ -596,15 +725,20 @@ public class Ec2ContainerManager {
                     portAllocator.release(sshHostPort);
                     return null;
                 }
+                persist(instance);
                 recorded = true;
                 // Join the VPC's Docker network at the address the subnet allocated, before the
                 // container starts, so the guest comes up already holding its private IP. The
                 // default bridge attachment stays: it is what carries the published SSH host
                 // port, which a network mode set at creation time would suppress.
+                recordLaunchEvent(instance, "configuring-network", "started",
+                        "Attaching the instance container to its VPC network");
                 String vpcAddress = namespace == null
                         ? vpcNetworkManager.attach(region, instance.getVpcId(), instance.getSubnetId(),
                                 containerId, leasedPrivateIp).map(network -> leasedPrivateIp).orElse(null)
                         : null;
+                recordLaunchEvent(instance, "configuring-network", "completed",
+                        vpcAddress == null ? "Using the container network namespace" : "Attached at " + vpcAddress);
                 lifecycleManager.startCreated(containerId, spec);
                 return new StartedContainer(containerId, sshHostPort, vpcAddress, namespace, eniId);
             } catch (Exception e) {
@@ -627,6 +761,8 @@ public class Ec2ContainerManager {
                     portAllocator.markReserved(sshHostPort);
                     LOG.warnv("EC2 instance {0} could not use SSH host port {1}; trying another port",
                             instanceId, String.valueOf(sshHostPort));
+                    recordLaunchEvent(instance, "allocating-ssh-port", "info",
+                            "SSH host port " + sshHostPort + " was occupied; selecting another port");
                     continue;
                 }
                 portAllocator.release(sshHostPort);
@@ -637,6 +773,7 @@ public class Ec2ContainerManager {
 
     private ContainerSpec buildContainerSpec(String containerName, ResolvedAmiImage image, String region,
                                              String serviceEndpoint, String imdsEndpoint, String instanceId,
+                                             String accountId,
                                              int sshHostPort, SecurityGroupFirewallManager.Namespace namespace,
                                              boolean hasInstanceProfile) {
         // Minimal images keep the historic tail command, while cloud-image AMI guests can boot their init.
@@ -650,7 +787,7 @@ public class Ec2ContainerManager {
                 .withHostDockerInternalOnLinux()
                 .withLogRotation()
                 .withLabels(ContainerStorageHelper.resourceIdentityLabels(
-                        "ec2", instanceId, regionResolver.getAccountId(), region))
+                        "ec2", instanceId, accountId, region))
                 // Which Floci owns this container, so the startup reconciler cannot reap a
                 // sibling emulator's live instances off a shared daemon. See LABEL_OWNER_PORT.
                 .withLabels(Map.of(LABEL_OWNER_PORT, ownerIdentity()))
@@ -675,7 +812,7 @@ public class Ec2ContainerManager {
     }
 
     private void failLaunch(Instance instance) {
-        failLaunch(instance, instance.getPrivateIpAddress());
+        failLaunch(instance, instance.getPrivateIpAddress(), "EC2 container launch failed");
     }
 
     /**
@@ -688,6 +825,10 @@ public class Ec2ContainerManager {
      * reserved while the endpoint stands, and would refuse the next launch handed the same one.
      */
     private void failLaunch(Instance instance, String leasedPrivateIp) {
+        failLaunch(instance, leasedPrivateIp, "EC2 container launch failed");
+    }
+
+    private void failLaunch(Instance instance, String leasedPrivateIp, String reason) {
         String containerId;
         int sshHostPort;
         String containerIp;
@@ -698,6 +839,13 @@ public class Ec2ContainerManager {
                     && instance.getSshHostPort() <= 0
                     && (instance.getContainerBridgeIp() == null || instance.getContainerBridgeIp().isBlank());
             instance.setState(InstanceState.terminated());
+            instance.setStateReasonCode("Server.InternalError");
+            instance.setStateReasonMessage(reason);
+            instance.setStateTransitionReason(reason);
+            instance.setTerminatedAt(System.currentTimeMillis());
+            instance.setLaunchStatus("failed");
+            instance.setSshStatus("impaired");
+            instance.setSshStatusMessage(reason);
             containerId = instance.getDockerContainerId();
             sshHostPort = instance.getSshHostPort();
             containerIp = instance.getContainerBridgeIp();
@@ -705,6 +853,7 @@ public class Ec2ContainerManager {
             instance.setSshHostPort(0);
             instance.setContainerBridgeIp(null);
         }
+        recordLaunchEvent(instance, currentLaunchStage(instance), "failed", reason);
         if (alreadyCleaned) {
             return;
         }
@@ -743,6 +892,7 @@ public class Ec2ContainerManager {
                 LOG.warnv("Error unregistering failed EC2 instance {0}: {1}", instance.getInstanceId(), e.getMessage());
             }
         }
+        persist(instance);
     }
 
     /**
@@ -857,7 +1007,27 @@ public class Ec2ContainerManager {
     private void markContainerlessRunning(Instance instance) {
         LOG.infov("EC2 instance {0} is running without a backing container (no Docker daemon reachable)",
                 instance.getInstanceId());
+        String reason = "Docker daemon is unavailable; the instance has no backing container";
         instance.setState(InstanceState.running());
+        instance.setLaunchStatus("failed");
+        instance.setSshStatus("impaired");
+        instance.setSshStatusMessage(reason);
+        instance.setStateReasonCode("Server.InternalError");
+        instance.setStateReasonMessage(reason);
+        instance.setStateTransitionReason(reason);
+        recordLaunchEvent(instance, "creating-container", "failed", reason);
+    }
+
+    private String accountId(Instance instance) {
+        return instance.getAccountId() == null || instance.getAccountId().isBlank()
+                ? regionResolver.getAccountId() : instance.getAccountId();
+    }
+
+    private void recordOccupiedPorts(Instance instance, List<Integer> occupiedPorts) {
+        for (Integer occupiedPort : occupiedPorts) {
+            recordLaunchEvent(instance, "allocating-ssh-port", "retrying",
+                    "SSH host port " + occupiedPort + " is occupied; trying the next port");
+        }
     }
 
     /**
@@ -1228,6 +1398,15 @@ public class Ec2ContainerManager {
      * Sets terminatedAt for TTL pruning.
      */
     public void terminate(Instance instance) {
+        terminate(instance, () -> {
+        });
+    }
+
+    /**
+     * Terminates an instance and invokes {@code onTerminated} after its final state is recorded.
+     * The caller persists the instance because this manager deliberately has no storage dependency.
+     */
+    public void terminate(Instance instance, Runnable onTerminated) {
         String containerId;
         String containerIp;
         String imdsSourceIp;
@@ -1273,6 +1452,7 @@ public class Ec2ContainerManager {
                     instance.getPrivateIpAddress());
             instance.setState(InstanceState.terminated());
             instance.setTerminatedAt(System.currentTimeMillis());
+            onTerminated.run();
         });
     }
 
@@ -1287,6 +1467,13 @@ public class Ec2ContainerManager {
         executor.submit(() -> {
             try {
                 dockerClient.restartContainerCmd(containerId).exec();
+                InspectContainerResponse container = dockerClient.inspectContainerCmd(containerId).exec();
+                if (isLegacyTailGuest(container.getConfig().getCmd())) {
+                    // Instances launched before systemd-backed AMIs used tail as PID 1. Their image
+                    // catalog entry now identifies a systemd runtime, but Docker restart retains
+                    // the original command and therefore does not start the SSH service.
+                    startSshd(containerId, instance.getInstanceId());
+                }
                 LOG.infov("Rebooted EC2 container {0}", containerId);
             } catch (Exception e) {
                 LOG.warnv("Error rebooting EC2 container {0}: {1}", containerId, e.getMessage());
@@ -1294,6 +1481,11 @@ public class Ec2ContainerManager {
         });
     }
 
+    static boolean isLegacyTailGuest(String[] command) {
+        return command != null && command.length == 3
+                && "tail".equals(command[0]) && "-f".equals(command[1]) && "/dev/null".equals(command[2]);
+    }
+
     public boolean isContainerRunning(Instance instance) {
         String containerId = instance.getDockerContainerId();
         return containerId != null && lifecycleManager.isContainerRunning(containerId);
@@ -1369,7 +1561,7 @@ public class Ec2ContainerManager {
         }
     }
 
-    private void injectSshKey(String containerId, String publicKey) {
+    private OperationResult injectSshKey(String containerId, String publicKey) {
         try {
             // Ensure .ssh directory exists with correct permissions
             execInContainer(containerId, new String[]{"sh", "-c",
@@ -1385,32 +1577,39 @@ public class Ec2ContainerManager {
 
             execInContainer(containerId, new String[]{"chmod", "600", "/root/.ssh/authorized_keys"}, 5);
             LOG.infov("Injected SSH public key into container {0}", containerId);
+            return new OperationResult(true, "Public key injected into /root/.ssh/authorized_keys");
         } catch (Exception e) {
             LOG.warnv("Could not inject SSH key into container {0}: {1}", containerId, e.getMessage());
+            return new OperationResult(false, errorMessage(e));
         }
     }
 
-    private void startSshd(String containerId, String instanceId) {
+    private SshSetupResult startSshd(String containerId, String instanceId) {
         try {
             // Exit 1 means sshd is absent and there is nothing to start; exit 2 means sshd is
             // there but the client package did not land. Only the first is fatal - see
             // sshdInstallProbeCommand() for why the probe distinguishes them.
             ContainerExecResult install = execInContainerForResult(containerId, sshdInstallProbeCommand(), 120);
+            boolean installationAttempted = install.output().contains("FLOCI_SSH_INSTALL=1");
             if (install.exitCode() == SSH_CLIENT_MISSING_EXIT_CODE) {
                 LOG.warnv("sshd is available on EC2 instance {0} but the OpenSSH client package is not:"
                         + " scp is missing, so provisioners that upload files over scp will fail: {1}",
                         instanceId, install.summary());
             } else if (install.exitCode() != 0) {
+                String message = "Could not install openssh-server: " + install.summary();
                 LOG.warnv("Could not install openssh-server for EC2 instance {0}: {1}",
                         instanceId, install.summary());
-                return;
+                return new SshSetupResult(false, installationAttempted, false,
+                        installationAttempted ? "SSH package installation failed" : "SSH package installation skipped",
+                        message);
             }
             // Generate host keys
             ContainerExecResult keygen = execInContainerForResult(containerId, new String[]{"ssh-keygen", "-A"}, 10);
             if (keygen.exitCode() != 0) {
                 LOG.warnv("Could not generate SSH host keys for EC2 instance {0}: {1}",
                         instanceId, keygen.summary());
-                return;
+                return new SshSetupResult(false, installationAttempted, true, "SSH packages are available",
+                        "Could not generate SSH host keys: " + keygen.summary());
             }
             // Modern OpenSSH refuses to start without its privilege-separation directory, and /run
             // is a fresh tmpfs in most container images, so /run/sshd genuinely isn't there yet.
@@ -1419,7 +1618,8 @@ public class Ec2ContainerManager {
             if (mkdir.exitCode() != 0) {
                 LOG.warnv("Could not create /run/sshd for EC2 instance {0}: {1}",
                         instanceId, mkdir.summary());
-                return;
+                return new SshSetupResult(false, installationAttempted, true, "SSH packages are available",
+                        "Could not create /run/sshd: " + mkdir.summary());
             }
             // Start sshd without -D so it daemonizes itself and survives this exec session. Since sshd
             // requires execution with an absolute path, several paths are tried until it starts
@@ -1430,13 +1630,108 @@ public class Ec2ContainerManager {
                     continue;
                 }
                 LOG.infov("Started sshd in EC2 instance {0}", instanceId);
-                return;
+                return new SshSetupResult(true, installationAttempted, true,
+                        installationAttempted ? "SSH packages installed" : "SSH was already installed",
+                        "Started sshd using " + sshdPath);
             }
+            return new SshSetupResult(false, installationAttempted, true, "SSH packages are available",
+                    "No supported sshd executable started successfully");
         } catch (Exception e) {
             LOG.warnv("Could not start sshd in EC2 instance {0}: {1}", instanceId, e.getMessage());
+            return new SshSetupResult(false, false, false, "SSH package state is unknown", errorMessage(e));
         }
     }
 
+    private OperationResult waitForSshBanner(String host, int port) throws InterruptedException {
+        if (host == null || host.isBlank()) {
+            return new OperationResult(false, "No container address is available for the SSH readiness check");
+        }
+        String lastError = "SSH did not return a protocol banner";
+        for (int attempt = 0; attempt < sshBannerAttempts; attempt++) {
+            OperationResult probe = probeSshBanner(host, port);
+            if (probe.success()) {
+                return probe;
+            }
+            lastError = probe.message();
+            if (attempt + 1 < sshBannerAttempts) {
+                Thread.sleep(sshBannerPollMillis);
+            }
+        }
+        return new OperationResult(false, lastError);
+    }
+
+    private OperationResult probeSshBanner(String host, int port) {
+        try (Socket socket = new Socket()) {
+            socket.connect(new InetSocketAddress(host, port), 1_000);
+            socket.setSoTimeout(1_000);
+            BufferedReader reader = new BufferedReader(
+                    new InputStreamReader(socket.getInputStream(), StandardCharsets.US_ASCII));
+            String banner = reader.readLine();
+            if (banner != null && banner.startsWith("SSH-")) {
+                return new OperationResult(true, "SSH banner received: " + banner);
+            }
+            return new OperationResult(false, banner == null
+                    ? "SSH connection closed without a protocol banner"
+                    : "Endpoint returned a non-SSH banner: " + banner);
+        } catch (IOException e) {
+            return new OperationResult(false, errorMessage(e));
+        }
+    }
+
+    public OperationResult checkSshReadiness(Instance instance) {
+        return probeSshBanner(instance.getContainerBridgeIp(), 22);
+    }
+
+    private void recordLaunchEvent(Instance instance, String stage, String status, String message) {
+        if (instance == null) {
+            return;
+        }
+        synchronized (instance) {
+            instance.getLaunchEvents().add(new InstanceLaunchEvent(stage, status, Instant.now(), message));
+        }
+        persist(instance);
+    }
+
+    private String setupFailureMessage(Instance instance, String readinessMessage) {
+        synchronized (instance) {
+            List<InstanceLaunchEvent> events = instance.getLaunchEvents();
+            for (int i = events.size() - 1; i >= 0; i--) {
+                InstanceLaunchEvent event = events.get(i);
+                if ("starting-ssh".equals(event.getStage()) && "failed".equals(event.getStatus())) {
+                    return event.getMessage() + "; readiness check: " + readinessMessage;
+                }
+            }
+        }
+        return readinessMessage;
+    }
+
+    private String currentLaunchStage(Instance instance) {
+        synchronized (instance) {
+            List<InstanceLaunchEvent> events = instance.getLaunchEvents();
+            if (!events.isEmpty()) {
+                return events.getLast().getStage();
+            }
+        }
+        return "launch";
+    }
+
+    private void persist(Instance instance) {
+        instancePersister.accept(instance);
+    }
+
+    private static String errorMessage(Throwable error) {
+        if (error == null) {
+            return "Unknown launch failure";
+        }
+        String message = error.getMessage();
+        return message == null || message.isBlank() ? error.getClass().getSimpleName() : message;
+    }
+
+    public record OperationResult(boolean success, String message) {}
+
+    private record SshSetupResult(boolean success, boolean installationAttempted, boolean installationSucceeded,
+                                  String installationMessage, String message) {}
+
     private void executeUserData(String containerId, String instanceId, String userData, String region) {
         try {
             String logGroup = "/aws/ec2/" + instanceId;
@@ -1741,7 +2036,43 @@ public class Ec2ContainerManager {
     }
 
     static String[] userDataExecutionCommand() {
-        return new String[]{USER_DATA_SCRIPT_PATH};
+        String command = """
+                policy=/usr/sbin/policy-rc.d
+                backup=/var/lib/floci-policy-rc.d
+                actions=/var/lib/floci-service-actions
+                rm -f "$actions"
+                if [ -f "$policy" ]; then mv "$policy" "$backup"; fi
+                printf '%s\n' '#!/bin/sh' \
+                  'while [ "$#" -gt 0 ]; do case "$1" in --*) shift ;; *) break ;; esac; done' \
+                  'service=$1' \
+                  'action=$2' \
+                  'action=${action#(}' \
+                  'action=${action%)}' \
+                  'case "$action" in start|restart|try-restart|reload|force-reload)' \
+                  'printf "%s %s\\n" "$service" "$action" >> /var/lib/floci-service-actions ;; esac' \
+                  'exit 101' > "$policy"
+                chmod 755 "$policy"
+                restore_policy_and_start_services() {
+                  status=$?
+                  rm -f "$policy"
+                  if [ -f "$backup" ]; then mv "$backup" "$policy"; fi
+                  if [ -f "$actions" ]; then
+                    while read -r service action; do
+                      if command -v service >/dev/null 2>&1; then
+                        service "$service" "$action" || true
+                      elif [ -x "/etc/init.d/$service" ]; then
+                        "/etc/init.d/$service" "$action" || true
+                      fi
+                    done < "$actions"
+                    rm -f "$actions"
+                  fi
+                  trap - EXIT
+                  exit "$status"
+                }
+                trap restore_policy_and_start_services EXIT
+                /var/lib/user-data.sh
+                """;
+        return new String[]{"sh", "-c", command};
     }
 
     /**
@@ -1773,7 +2104,9 @@ public class Ec2ContainerManager {
      */
     static String[] sshdInstallProbeCommand() {
         return new String[]{"sh", "-c",
-            "if ! command -v sshd >/dev/null 2>&1 || ! command -v scp >/dev/null 2>&1; then" +
+            "installed=0;" +
+                    "if ! command -v sshd >/dev/null 2>&1 || ! command -v scp >/dev/null 2>&1; then" +
+                    "  installed=1;" +
                     "  if command -v dnf >/dev/null 2>&1; then dnf install -y openssh-server openssh-clients >/dev/null 2>&1;" +
                     // yum is probed after dnf, and the order is load-bearing: Amazon Linux
                     // 2023 and modern Fedora/RHEL ship both, and there dnf is the supported
@@ -1783,9 +2116,11 @@ public class Ec2ContainerManager {
                     // and sshd is never installed.
                     "  elif command -v yum >/dev/null 2>&1; then yum install -y openssh-server openssh-clients >/dev/null 2>&1;" +
                     "  elif command -v apt-get >/dev/null 2>&1; then DEBIAN_FRONTEND=noninteractive apt-get install -y openssh-server openssh-client >/dev/null 2>&1;" +
+                    "  elif command -v zypper >/dev/null 2>&1; then zypper --non-interactive install -y openssh >/dev/null 2>&1;" +
                     "  elif command -v apk >/dev/null 2>&1; then apk add --no-cache openssh >/dev/null 2>&1;" +
                     "  fi;" +
                     "fi;" +
+                    "printf 'FLOCI_SSH_INSTALL=%s\\n' \"$installed\";" +
                     "command -v sshd >/dev/null 2>&1 || exit 1;" +
                     "command -v scp >/dev/null 2>&1 || exit 2"};
     }

src/main/java/io/github/hectorvent/floci/services/ec2/Ec2ImageCatalog.java

@@ -168,6 +168,7 @@ public class Ec2ImageCatalog {
         public List<String> aliases = List.of();
         public List<String> publicParameterNames = List.of();
         public String dockerImage;
+        public String fallbackDockerImage;
         public String name;
         public String description;
         public String state;
@@ -182,8 +183,11 @@ public class Ec2ImageCatalog {
         public String imageOwnerAlias;
         public String creationDate;
         public Boolean advertised;
-        public String guestRuntime;
+        public String initType;
         public Boolean cloudInit;
+        public String sshUser;
+        public Boolean sshPreinstalled;
+        public String sshServiceName;
         public String provenance;
 
         public boolean advertised() {

src/main/java/io/github/hectorvent/floci/services/ec2/Ec2MetadataProxy.java

@@ -11,30 +11,34 @@ import java.util.Optional;
  */
 public final class Ec2MetadataProxy {
 
+    private static final int IMDS_PROXY_PORT = 1338;
+
     private Ec2MetadataProxy() {}
 
     public static String[] installCommand() {
         return new String[]{"sh", "-c", String.join("\n",
                 "set -eu",
-                "if command -v ip >/dev/null 2>&1 && command -v socat >/dev/null 2>&1 && command -v curl >/dev/null 2>&1; then exit 0; fi",
+                "if command -v ip >/dev/null 2>&1 && command -v iptables >/dev/null 2>&1 && command -v socat >/dev/null 2>&1 && command -v curl >/dev/null 2>&1; then exit 0; fi",
                 "if command -v apt-get >/dev/null 2>&1; then",
                 "  apt-get update -qq >/dev/null",
-                "  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends iproute2 socat curl ca-certificates >/dev/null",
+                "  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends iproute2 iptables socat curl ca-certificates >/dev/null",
                 "elif command -v dnf >/dev/null 2>&1; then",
                 // --allowerasing lets dnf swap the curl-minimal that
                 // public.ecr.aws/amazonlinux/amazonlinux:2023 ships by default for the full
                 // curl package this proxy needs. Without it, dnf aborts the whole transaction
                 // on a curl/curl-minimal conflict and iproute+socat never install either, even
                 // though neither of them conflicts with anything.
-                "  dnf install -y --allowerasing iproute socat curl ca-certificates >/dev/null",
+                "  dnf install -y --allowerasing iproute iptables socat curl ca-certificates >/dev/null",
                 // Same gap as the sshd probe: Amazon Linux 2 has only yum, so on an instance
                 // launched from ami-amazonlinux2 this chain reached its else branch and exited 1
                 // with "No supported package manager found for IMDS proxy dependencies",
                 // leaving the instance without a link-local IMDS endpoint.
                 "elif command -v yum >/dev/null 2>&1; then",
-                "  yum install -y iproute socat curl ca-certificates >/dev/null",
+                "  yum install -y iproute iptables socat curl ca-certificates >/dev/null",
+                "elif command -v zypper >/dev/null 2>&1; then",
+                "  zypper --non-interactive install -y iproute2 iptables socat curl ca-certificates >/dev/null",
                 "elif command -v apk >/dev/null 2>&1; then",
-                "  apk add --no-cache iproute2 socat curl ca-certificates >/dev/null",
+                "  apk add --no-cache iproute2 iptables socat curl ca-certificates >/dev/null",
                 "else",
                 "  echo 'No supported package manager found for IMDS proxy dependencies' >&2",
                 "  exit 1",
@@ -42,8 +46,24 @@ public final class Ec2MetadataProxy {
     }
 
     public static String[] startCommand(String flociHost, int imdsPort) {
-        return startCommand("imds", "169.254.169.254", 80, flociHost, imdsPort,
-                "curl -fsS --max-time 1 http://169.254.169.254/latest/meta-data/instance-id >/dev/null && exit 0");
+        return new String[]{"sh", "-c", String.join("\n",
+                "set -eu",
+                "ip addr show dev lo | grep -q '169.254.169.254/32' || ip addr add 169.254.169.254/32 dev lo",
+                "iptables -t nat -C OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j DNAT --to-destination 127.0.0.1:"
+                        + IMDS_PROXY_PORT + " 2>/dev/null || iptables -t nat -A OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j DNAT --to-destination 127.0.0.1:"
+                        + IMDS_PROXY_PORT,
+                "if [ -f /tmp/floci-imds-proxy.pid ] && kill -0 \"$(cat /tmp/floci-imds-proxy.pid)\" 2>/dev/null; then",
+                "  exit 0",
+                "fi",
+                "nohup socat TCP-LISTEN:" + IMDS_PROXY_PORT + ",bind=127.0.0.1,fork,reuseaddr TCP:"
+                        + flociHost + ":" + imdsPort + " >/tmp/floci-imds-proxy.log 2>&1 &",
+                "echo $! > /tmp/floci-imds-proxy.pid",
+                "for i in 1 2 3 4 5 6 7 8 9 10 11 12; do",
+                "  curl -fsS --max-time 1 http://169.254.169.254/latest/meta-data/instance-id >/dev/null && exit 0",
+                "  sleep 1",
+                "done",
+                "cat /tmp/floci-imds-proxy.log >&2 || true",
+                "exit 1")};
     }
 
     public static String[] podIdentityStartCommand(String flociHost, int flociPort) {

src/main/java/io/github/hectorvent/floci/services/ec2/Ec2QueryHandler.java

@@ -702,6 +702,15 @@ public class Ec2QueryHandler {
         int networkInterfaceDeviceIndex = parseIntParam(p, "NetworkInterface.1.DeviceIndex", 0);
         String clientToken = p.getFirst("ClientToken");
         List<String> sgIds = getList(p, "SecurityGroupId");
+        if (sgIds.isEmpty()) {
+            sgIds = getList(p, "NetworkInterface.1.SecurityGroupId");
+        }
+        if (sgIds.isEmpty()) {
+            sgIds = getList(p, "NetworkInterface.1.Groups");
+        }
+        if (sgIds.isEmpty()) {
+            sgIds = getList(p, "NetworkInterface.1.GroupId");
+        }
 
         // UserData is base64-encoded in the wire format
         String userDataEncoded = p.getFirst("UserData");
@@ -1285,12 +1294,20 @@ public class Ec2QueryHandler {
 
     private Response handleDescribeInstanceStatus(MultivaluedMap<String, String> p, String region) {
         List<String> ids = getList(p, "InstanceId");
-        List<Instance> runningInstances = service.describeInstanceStatus(region, ids);
+        boolean includeAllInstances = Boolean.TRUE.equals(
+                parseOptionalBoolean(p.getFirst("IncludeAllInstances"), "IncludeAllInstances"));
+        List<Instance> instances = service.describeInstanceStatus(region, ids, includeAllInstances);
         XmlBuilder xml = new XmlBuilder()
                 .start("DescribeInstanceStatusResponse", AwsNamespaces.EC2)
                 .elem("requestId", UUID.randomUUID().toString())
                 .start("instanceStatusSet");
-        for (Instance inst : runningInstances) {
+        for (Instance inst : instances) {
+            String reachability = inst.getSshStatus() == null ? "initializing" : inst.getSshStatus();
+            String detail = switch (reachability) {
+                case "ok" -> "passed";
+                case "impaired" -> "failed";
+                default -> "initializing";
+            };
             xml.start("item")
                     .elem("instanceId", inst.getInstanceId())
                     .elem("availabilityZone", inst.getPlacement() != null ? inst.getPlacement().getAvailabilityZone() : "")
@@ -1305,9 +1322,9 @@ public class Ec2QueryHandler {
                     .end("item").end("details")
                     .end("systemStatus")
                     .start("instanceStatus")
-                    .elem("status", "ok")
+                    .elem("status", reachability)
                     .start("details").start("item")
-                    .elem("name", "reachability").elem("status", "passed")
+                    .elem("name", "reachability").elem("status", detail)
                     .end("item").end("details")
                     .end("instanceStatus")
                     .end("item");

src/main/java/io/github/hectorvent/floci/services/ec2/Ec2Service.java

@@ -21,6 +21,9 @@ import java.util.Random;
 import java.util.Set;
 import java.util.UUID;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.function.BiPredicate;
 import java.util.function.Function;
@@ -31,6 +34,8 @@ import java.util.stream.Stream;
 import org.jboss.logging.Logger;
 
 import com.fasterxml.jackson.core.type.TypeReference;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
 import io.github.hectorvent.floci.config.EmulatorConfig;
 import io.github.hectorvent.floci.core.common.RequestContext;
 import io.github.hectorvent.floci.core.common.AwsArnUtils;
@@ -56,6 +61,7 @@ import io.github.hectorvent.floci.services.ec2.model.Image;
 import io.github.hectorvent.floci.services.ec2.model.Instance;
 import io.github.hectorvent.floci.services.ec2.model.InstanceCreditSpecification;
 import io.github.hectorvent.floci.services.ec2.model.InstanceCreditSpecificationListResult;
+import io.github.hectorvent.floci.services.ec2.model.InstanceLaunchEvent;
 import io.github.hectorvent.floci.services.ec2.model.InstanceNetworkInterface;
 import io.github.hectorvent.floci.services.ec2.model.InstanceState;
 import io.github.hectorvent.floci.services.ec2.model.NetworkInterface;
@@ -216,6 +222,7 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
     private final Set<String> seededAccountRegions = ConcurrentHashMap.newKeySet();
     // subnetId → counter for IP assignment (runtime-only, not persisted)
     private final Map<String, AtomicInteger> subnetIpCounters = new ConcurrentHashMap<>();
+    private ScheduledExecutorService terminatedInstancePruner;
 
     /**
      * Null in the hermetic unit tests, which reach the constructors that do not take it; CDI always
@@ -501,22 +508,21 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
 
     @PostConstruct
     void restoreMetadataRegistrations() {
+        containerManager.setInstancePersister(this::persistInstance);
         if (portForwardManager != null) {
-            portForwardManager.setPersister(inst -> {
-                if (inst != null && inst.getRegion() != null && inst.getInstanceId() != null) {
-                    instances.put(key(inst.getRegion(), inst.getInstanceId()), inst);
-                }
-            });
+            portForwardManager.setPersister(this::persistInstance);
         }
+        clearPersistedPrivateKeyMaterial();
         if (config.services().ec2().mock()) {
             return;
         }
 
         restoreVpcNetworks();
+        recoverInterruptedTerminations();
 
         int restored = 0;
-        for (String key : instances.keys()) {
-            Instance instance = instances.get(key).orElse(null);
+        for (AccountAwareStorageBackend.AccountEntry<Instance> entry : allInstanceEntries()) {
+            Instance instance = entry.value();
             if (!needsMetadataRegistration(instance)) {
                 continue;
             }
@@ -526,11 +532,26 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
                 LOG.warnv("Could not restore EC2 firewall for {0}: {1}", instance.getInstanceId(), e.getMessage());
                 containerManager.stopForShutdown(instance);
                 instance.setState(InstanceState.stopped());
-                instances.put(key, instance);
+                persistOwnedInstance(entry, instance);
                 continue;
             }
             if (containerManager.restoreMetadataRegistration(instance)) {
-                instances.put(key, instance);
+                if ("pending".equals(instance.getState().getName())
+                        || "in-progress".equals(instance.getLaunchStatus())) {
+                    instance.setState(InstanceState.running());
+                    instance.setLaunchStatus("unknown");
+                    instance.getLaunchEvents().add(new InstanceLaunchEvent("startup-reconciliation", "unknown",
+                            Instant.now(), "Core restarted before launch completion was recorded"));
+                    Ec2ContainerManager.OperationResult readiness = containerManager.checkSshReadiness(instance);
+                    if (readiness == null) {
+                        instance.setSshStatus("unknown");
+                        instance.setSshStatusMessage("SSH readiness could not be reconstructed after restart");
+                    } else {
+                        instance.setSshStatus(readiness.success() ? "ok" : "impaired");
+                        instance.setSshStatusMessage(readiness.message());
+                    }
+                }
+                persistOwnedInstance(entry, instance);
                 restored++;
                 // Container is running: re-reserve host ports and recreate any missing socat sidecars.
                 if (portForwardManager != null) {
@@ -538,6 +559,7 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
                 }
             }
         }
+        failUnrecoverablePendingLaunches();
         if (restored > 0) {
             LOG.infov("Restored IMDS metadata registration for {0} EC2 container(s)", restored);
         }
@@ -547,6 +569,68 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
         containerManager.reconcileOrphanedContainers(this::instanceContainerStillWanted);
     }
 
+    private void failUnrecoverablePendingLaunches() {
+        for (AccountAwareStorageBackend.AccountEntry<Instance> entry : allInstanceEntries()) {
+            Instance instance = entry.value();
+            if (instance == null || instance.getState() == null
+                    || (!"pending".equals(instance.getState().getName())
+                    && !"in-progress".equals(instance.getLaunchStatus()))) {
+                continue;
+            }
+            String reason = "Launch state is unknown because core restarted before a backing container was recorded";
+            instance.setState(InstanceState.terminated());
+            instance.setLaunchStatus("failed");
+            instance.setSshStatus("impaired");
+            instance.setSshStatusMessage(reason);
+            instance.setStateReasonCode("Server.InternalError");
+            instance.setStateReasonMessage(reason);
+            instance.setStateTransitionReason(reason);
+            instance.setTerminatedAt(System.currentTimeMillis());
+            instance.getLaunchEvents().add(new InstanceLaunchEvent("startup-reconciliation", "failed",
+                    Instant.now(), reason));
+            persistOwnedInstance(entry, instance);
+        }
+    }
+
+    private List<AccountAwareStorageBackend.AccountEntry<Instance>> allInstanceEntries() {
+        if (instances instanceof AccountAwareStorageBackend<?> rawAccountAware) {
+            @SuppressWarnings("unchecked")
+            AccountAwareStorageBackend<Instance> accountAware =
+                    (AccountAwareStorageBackend<Instance>) rawAccountAware;
+            return accountAware.scanAllAccountEntries(key -> true);
+        }
+        return instances.keys().stream()
+                .map(storageKey -> instances.get(storageKey)
+                        .map(instance -> new AccountAwareStorageBackend.AccountEntry<Instance>(
+                                null, storageKey, instance)))
+                .flatMap(Optional::stream)
+                .toList();
+    }
+
+    private void persistOwnedInstance(AccountAwareStorageBackend.AccountEntry<Instance> entry, Instance instance) {
+        if (entry.accountId() != null && instances instanceof AccountAwareStorageBackend<?> rawAccountAware) {
+            @SuppressWarnings("unchecked")
+            AccountAwareStorageBackend<Instance> accountAware =
+                    (AccountAwareStorageBackend<Instance>) rawAccountAware;
+            accountAware.putForAccount(entry.accountId(), entry.key(), instance);
+            return;
+        }
+        instances.put(entry.key(), instance);
+    }
+
+    private void persistInstance(Instance instance) {
+        if (instance == null || instance.getRegion() == null || instance.getInstanceId() == null) {
+            return;
+        }
+        String storageKey = key(instance.getRegion(), instance.getInstanceId());
+        if (instances instanceof AccountAwareStorageBackend<Instance> accountAware
+                && instance.getAccountId() != null && !instance.getAccountId().isBlank()) {
+            accountAware.putForAccount(instance.getAccountId(), storageKey, instance);
+            return;
+        }
+        instances.put(storageKey, instance);
+    }
+
     /**
      * Whether a container labelled for (region, instanceId) still backs a live instance record.
      * False means the record is gone or already terminated, so the container is an orphan.
@@ -560,6 +644,17 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
         return !"terminated".equals(state) && !"shutting-down".equals(state);
     }
 
+    private void recoverInterruptedTerminations() {
+        for (AccountAwareStorageBackend.AccountEntry<Instance> entry : allInstanceEntries()) {
+            Instance instance = entry.value();
+            if (instance == null || instance.getState() == null
+                    || !"shutting-down".equals(instance.getState().getName())) {
+                continue;
+            }
+            containerManager.terminate(instance, () -> persistOwnedInstance(entry, instance));
+        }
+    }
+
     /**
      * Rebuilds the in-memory VPC address plan from persisted VPCs and subnets, after clearing
      * out any Docker networks a previous run of this same emulator left behind.
@@ -599,8 +694,8 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
     private void reserveRestoredPrivateIps() {
         int reserved = 0;
         int skipped = 0;
-        for (String storageKey : instances.keys()) {
-            Instance instance = instances.get(storageKey).orElse(null);
+        for (AccountAwareStorageBackend.AccountEntry<Instance> entry : allInstanceEntries()) {
+            Instance instance = entry.value();
             if (instance == null || instance.getSubnetId() == null
                     || instance.getPrivateIpAddress() == null
                     || instance.getState() == null
@@ -2627,6 +2722,10 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
         LaunchTemplateData.MetadataOptions launchMetadataOptions = LaunchTemplateData.MetadataOptions.merge(
                 LaunchTemplateData.MetadataOptions.launchDefaults(), metadataOptions);
         ensureDefaultResources(region);
+        if (keyName != null && findKeyPair(region, keyName) == null) {
+            throw new AwsException("InvalidKeyPair.NotFound",
+                    "The key pair '" + keyName + "' does not exist", 400);
+        }
 
         // floci-kt9: a caller-supplied primary ENI (override-default-eni) governs its own
         // subnet/VPC/security-groups and can only ever back a single instance.
@@ -2721,8 +2820,9 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
                 dockerImage = amiImageResolver.resolveImage(resolveLaunchableImageId(region, imageId));
                 String captured = capturedImageFor(region, imageId);
                 if (captured != null) {
-                    dockerImage = new ResolvedAmiImage(captured, dockerImage.guestRuntime(),
-                            dockerImage.cloudInit(), dockerImage.dockerPlatform());
+                    dockerImage = new ResolvedAmiImage(captured, dockerImage.initType(),
+                            dockerImage.cloudInit(), dockerImage.dockerPlatform(), null, "captured",
+                            dockerImage.sshUser(), dockerImage.sshPreinstalled(), dockerImage.sshServiceName());
                 }
             }
             if (dryRun) {
@@ -2757,6 +2857,11 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
                 inst.setAmiLaunchIndex(i);
                 inst.setClientToken(clientToken);
                 inst.setRegion(region);
+                inst.setAccountId(callerAccountId());
+                inst.setLaunchStatus(config.services().ec2().mock() ? "ready" : "in-progress");
+                inst.setSshStatus(config.services().ec2().mock() ? "ok" : "initializing");
+                inst.getLaunchEvents().add(new InstanceLaunchEvent("launch-requested", "completed",
+                        Instant.now(), "RunInstances accepted the launch"));
                 inst.setUserData(userData);
                 inst.setEncodedUserData(encodedUserData);
                 inst.setIamInstanceProfileArn(iamInstanceProfileArn);
@@ -2836,13 +2941,7 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
         // Outside the lock: the containers are what the lock protects a reference to, not part of
         // the registry, and a launch is slow.
         if (!config.services().ec2().mock()) {
-            String publicKey = null;
-            if (keyName != null) {
-                KeyPair kp = findKeyPair(region, keyName);
-                if (kp != null) {
-                    publicKey = kp.getPublicKey();
-                }
-            }
+            String publicKey = keyName == null ? null : findKeyPair(region, keyName).getPublicKey();
             for (Instance inst : launched) {
                 List<SecurityGroup> policyGroups = inst.getSecurityGroups().stream()
                         .map(group -> securityGroups.get(key(region, group.getGroupId()))
@@ -3082,6 +3181,7 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
     }
 
     public List<Reservation> describeInstances(String region, List<String> instanceIds, Map<String, List<String>> filters) {
+        pruneTerminatedInstances();
         ensureDefaultResources(region);
         if (!instanceIds.isEmpty()) {
             for (String id : instanceIds) {
@@ -3130,7 +3230,7 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
                 inst.setState(InstanceState.terminated());
                 inst.setTerminatedAt(System.currentTimeMillis());
             } else {
-                containerManager.terminate(inst);
+                containerManager.terminate(inst, () -> instances.put(key(region, id), inst));
             }
             // Delete root volume if deleteOnTermination (matches real AWS behavior)
             if (inst.getRootVolumeId() != null) {
@@ -3274,7 +3374,7 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
         }
     }
 
-    /** Removes terminated instances older than 1 hour. Called periodically by lifecycle. */
+    /** Removes terminated instances older than 1 hour. */
     public void pruneTerminatedInstances() {
         long cutoff = System.currentTimeMillis() - 3_600_000L;
         for (String storeKey : new ArrayList<>(instances.keys())) {
@@ -3288,7 +3388,35 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
         }
     }
 
-    public List<Instance> describeInstanceStatus(String region, List<String> instanceIds) {
+    @PostConstruct
+    void startTerminatedInstancePruner() {
+        terminatedInstancePruner = Executors.newSingleThreadScheduledExecutor(runnable -> {
+            Thread thread = new Thread(runnable, "ec2-terminated-instance-pruner");
+            thread.setDaemon(true);
+            return thread;
+        });
+        terminatedInstancePruner.scheduleAtFixedRate(this::pruneTerminatedInstancesSafely,
+                1, 1, TimeUnit.MINUTES);
+        LOG.infov("EC2 terminated-instance pruning scheduled (1-minute interval, 1-hour retention)");
+    }
+
+    @PreDestroy
+    void stopTerminatedInstancePruner() {
+        if (terminatedInstancePruner != null) {
+            terminatedInstancePruner.shutdownNow();
+        }
+    }
+
+    private void pruneTerminatedInstancesSafely() {
+        try {
+            pruneTerminatedInstances();
+        } catch (RuntimeException e) {
+            LOG.warnv("Could not prune expired terminated EC2 instances: {0}", e.getMessage());
+        }
+    }
+
+    public List<Instance> describeInstanceStatus(String region, List<String> instanceIds,
+                                                  boolean includeAllInstances) {
         ensureDefaultResources(region);
         if (config.services().ec2().mock()) {
             instances.scan(k -> true).stream()
@@ -3299,11 +3427,41 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
                         instances.put(key(i.getRegion(), i.getInstanceId()), i);
                     });
         }
-        return instances.scan(k -> true).stream()
+        List<Instance> matching = instances.scan(k -> true).stream()
                 .filter(i -> i.getRegion().equals(region))
                 .filter(i -> instanceIds.isEmpty() || instanceIds.contains(i.getInstanceId()))
-                .filter(i -> "running".equals(i.getState().getName()))
+                .filter(i -> includeAllInstances || "running".equals(i.getState().getName()))
                 .collect(Collectors.toList());
+        if (!config.services().ec2().mock()) {
+            for (Instance instance : matching) {
+                if (!"running".equals(instance.getState().getName())
+                        || "in-progress".equals(instance.getLaunchStatus())) {
+                    continue;
+                }
+                Ec2ContainerManager.OperationResult result = containerManager.checkSshReadiness(instance);
+                String status = result.success() ? "ok" : "impaired";
+                String message = !result.success()
+                        && "Client.SSHUnavailable".equals(instance.getStateReasonCode())
+                        && instance.getStateReasonMessage() != null
+                        ? instance.getStateReasonMessage() : result.message();
+                if (!Objects.equals(status, instance.getSshStatus())
+                        || !Objects.equals(message, instance.getSshStatusMessage())) {
+                    instance.setSshStatus(status);
+                    instance.setSshStatusMessage(message);
+                    if (result.success() && "failed".equals(instance.getLaunchStatus())
+                            && "Client.SSHUnavailable".equals(instance.getStateReasonCode())) {
+                        instance.setLaunchStatus("ready");
+                        instance.setStateReasonCode(null);
+                        instance.setStateReasonMessage(null);
+                        instance.setStateTransitionReason(null);
+                    }
+                    instance.getLaunchEvents().add(new InstanceLaunchEvent("ssh-status-check",
+                            result.success() ? "completed" : "failed", Instant.now(), message));
+                    persistInstance(instance);
+                }
+            }
+        }
+        return matching;
     }
 
     /**
@@ -4843,6 +5001,38 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
 
     // ─── Key Pairs ─────────────────────────────────────────────────────────────
 
+    private void clearPersistedPrivateKeyMaterial() {
+        int cleared = 0;
+        if (keyPairs instanceof AccountAwareStorageBackend<?> rawAccountAware) {
+            @SuppressWarnings("unchecked")
+            AccountAwareStorageBackend<KeyPair> accountAware =
+                    (AccountAwareStorageBackend<KeyPair>) rawAccountAware;
+            for (AccountAwareStorageBackend.AccountEntry<KeyPair> entry
+                    : accountAware.scanAllAccountEntries(key -> true)) {
+                KeyPair keyPair = entry.value();
+                if (keyPair.getKeyMaterial() == null) {
+                    continue;
+                }
+                keyPair.setKeyMaterial(null);
+                accountAware.putForAccount(entry.accountId(), entry.key(), keyPair);
+                cleared++;
+            }
+        } else {
+            for (String storageKey : keyPairs.keys()) {
+                KeyPair keyPair = keyPairs.get(storageKey).orElse(null);
+                if (keyPair == null || keyPair.getKeyMaterial() == null) {
+                    continue;
+                }
+                keyPair.setKeyMaterial(null);
+                keyPairs.put(storageKey, keyPair);
+                cleared++;
+            }
+        }
+        if (cleared > 0) {
+            LOG.infov("Cleared private material from {0} persisted EC2 key pair record(s)", cleared);
+        }
+    }
+
     public KeyPair createKeyPair(String region, String keyName) {
         ensureDefaultResources(region);
         requireKeyName(keyName);
@@ -4858,7 +5048,13 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
         // Without storing it, a key pair created here could never authenticate anything.
         kp.setPublicKey(generated.openSshPublicKey());
         kp.setRegion(region);
-        keyPairs.put(key(region, keyPairId), kp);
+        KeyPair stored = new KeyPair();
+        stored.setKeyPairId(keyPairId);
+        stored.setKeyName(keyName);
+        stored.setKeyFingerprint(generated.fingerprint());
+        stored.setPublicKey(generated.openSshPublicKey());
+        stored.setRegion(region);
+        keyPairs.put(key(region, keyPairId), stored);
         return kp;
     }
 
@@ -4959,6 +5155,38 @@ public class Ec2Service implements ContainerTeardown, ResourceProvider {
         return containerManager.isContainerRunning(instance.getDockerContainerId());
     }
 
+    public List<Map<String, Object>> diagnosticInstances() {
+        return instances.scan(key -> true).stream().map(instance -> {
+            boolean containerRunning = isInstanceContainerRunning(instance.getInstanceId());
+            String containerStatus = instance.getDockerContainerId() == null
+                    ? "unavailable" : containerRunning ? "running" : "stopped";
+            Map<String, Object> diagnostic = new LinkedHashMap<>();
+            diagnostic.put("instanceId", instance.getInstanceId());
+            diagnostic.put("sshHost", "localhost");
+            diagnostic.put("sshPort", instance.getSshHostPort());
+            diagnostic.put("containerId", instance.getDockerContainerId());
+            diagnostic.put("containerStatus", containerStatus);
+            diagnostic.put("state", instance.getState() == null ? null : instance.getState().getName());
+            diagnostic.put("launchStatus", instance.getLaunchStatus());
+            synchronized (instance) {
+                diagnostic.put("launchEvents", List.copyOf(instance.getLaunchEvents()));
+            }
+            diagnostic.put("selectedImageType", instance.getSelectedImageType());
+            diagnostic.put("selectedImageReference", instance.getSelectedImageReference());
+            diagnostic.put("sshUser", instance.getSshUser());
+            diagnostic.put("sshPreinstalled", instance.isSshPreinstalled());
+            diagnostic.put("initType", instance.getInitType());
+            diagnostic.put("sshServiceName", instance.getSshServiceName());
+            diagnostic.put("sshStatus", instance.getSshStatus());
+            diagnostic.put("sshStatusMessage", instance.getSshStatusMessage());
+            diagnostic.put("keyName", instance.getKeyName());
+            diagnostic.put("keyInjectionStatus", instance.getKeyInjectionStatus());
+            diagnostic.put("publishedPorts", instance.getPublishedPorts());
+            diagnostic.put("failure", instance.getStateReasonMessage());
+            return diagnostic;
+        }).toList();
+    }
+
     private static void requireKeyName(String keyName) {
         if (keyName == null || keyName.isBlank()) {
             throw new AwsException("MissingParameter", "The request must contain the parameter KeyName", 400);

src/main/java/io/github/hectorvent/floci/services/ec2/ResolvedAmiImage.java

@@ -1,15 +1,17 @@
 package io.github.hectorvent.floci.services.ec2;
 
-public record ResolvedAmiImage(String dockerImage, String guestRuntime, boolean cloudInit,
-                               String dockerPlatform) {
+public record ResolvedAmiImage(String dockerImage, String initType, boolean cloudInit,
+                               String dockerPlatform, String fallbackDockerImage, String imageType,
+                               String sshUser, boolean sshPreinstalled, String sshServiceName) {
     public static final String DEFAULT_RUNTIME = "minimal";
     public static final String SYSTEMD_RUNTIME = "systemd";
 
     public static ResolvedAmiImage minimal(String dockerImage) {
-        return new ResolvedAmiImage(dockerImage, DEFAULT_RUNTIME, false, null);
+        return new ResolvedAmiImage(dockerImage, DEFAULT_RUNTIME, false, null, null,
+                "public", "root", false, "sshd");
     }
 
     public boolean systemd() {
-        return SYSTEMD_RUNTIME.equals(guestRuntime);
+        return SYSTEMD_RUNTIME.equals(initType);
     }
 }

src/main/java/io/github/hectorvent/floci/services/ec2/model/Instance.java

@@ -48,8 +48,21 @@ public class Instance {
     private String stateReasonCode;
     private String stateReasonMessage;
     private String region;
+    private String accountId;
     private List<Tag> tags = new ArrayList<>();
 
+    private String launchStatus;
+    private List<InstanceLaunchEvent> launchEvents = new ArrayList<>();
+    private String selectedImageType;
+    private String selectedImageReference;
+    private String sshUser;
+    private boolean sshPreinstalled;
+    private String initType;
+    private String sshServiceName;
+    private String sshStatus;
+    private String sshStatusMessage;
+    private String keyInjectionStatus;
+
     private String rootVolumeId;
 
     // NOTE: disableApiStop and disableApiTermination are stored but ModifyInstanceAttribute
@@ -192,9 +205,50 @@ public class Instance {
     public String getRegion() { return region; }
     public void setRegion(String region) { this.region = region; }
 
+    public String getAccountId() { return accountId; }
+    public void setAccountId(String accountId) { this.accountId = accountId; }
+
     public List<Tag> getTags() { return tags; }
     public void setTags(List<Tag> tags) { this.tags = tags; }
 
+    public String getLaunchStatus() { return launchStatus; }
+    public void setLaunchStatus(String launchStatus) { this.launchStatus = launchStatus; }
+
+    public List<InstanceLaunchEvent> getLaunchEvents() {
+        if (launchEvents == null) {
+            launchEvents = new ArrayList<>();
+        }
+        return launchEvents;
+    }
+    public void setLaunchEvents(List<InstanceLaunchEvent> launchEvents) { this.launchEvents = launchEvents; }
+
+    public String getSelectedImageType() { return selectedImageType; }
+    public void setSelectedImageType(String selectedImageType) { this.selectedImageType = selectedImageType; }
+
+    public String getSelectedImageReference() { return selectedImageReference; }
+    public void setSelectedImageReference(String selectedImageReference) { this.selectedImageReference = selectedImageReference; }
+
+    public String getSshUser() { return sshUser; }
+    public void setSshUser(String sshUser) { this.sshUser = sshUser; }
+
+    public boolean isSshPreinstalled() { return sshPreinstalled; }
+    public void setSshPreinstalled(boolean sshPreinstalled) { this.sshPreinstalled = sshPreinstalled; }
+
+    public String getInitType() { return initType; }
+    public void setInitType(String initType) { this.initType = initType; }
+
+    public String getSshServiceName() { return sshServiceName; }
+    public void setSshServiceName(String sshServiceName) { this.sshServiceName = sshServiceName; }
+
+    public String getSshStatus() { return sshStatus; }
+    public void setSshStatus(String sshStatus) { this.sshStatus = sshStatus; }
+
+    public String getSshStatusMessage() { return sshStatusMessage; }
+    public void setSshStatusMessage(String sshStatusMessage) { this.sshStatusMessage = sshStatusMessage; }
+
+    public String getKeyInjectionStatus() { return keyInjectionStatus; }
+    public void setKeyInjectionStatus(String keyInjectionStatus) { this.keyInjectionStatus = keyInjectionStatus; }
+
     public String getDockerContainerId() { return dockerContainerId; }
     public void setDockerContainerId(String dockerContainerId) { this.dockerContainerId = dockerContainerId; }
 

src/main/java/io/github/hectorvent/floci/services/ec2/model/InstanceLaunchEvent.java

@@ -0,0 +1,37 @@
+package io.github.hectorvent.floci.services.ec2.model;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import io.quarkus.runtime.annotations.RegisterForReflection;
+
+import java.time.Instant;
+
+@RegisterForReflection
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class InstanceLaunchEvent {
+
+    private String stage;
+    private String status;
+    private Instant timestamp;
+    private String message;
+
+    public InstanceLaunchEvent() {}
+
+    public InstanceLaunchEvent(String stage, String status, Instant timestamp, String message) {
+        this.stage = stage;
+        this.status = status;
+        this.timestamp = timestamp;
+        this.message = message;
+    }
+
+    public String getStage() { return stage; }
+    public void setStage(String stage) { this.stage = stage; }
+
+    public String getStatus() { return status; }
+    public void setStatus(String status) { this.status = status; }
+
+    public Instant getTimestamp() { return timestamp; }
+    public void setTimestamp(Instant timestamp) { this.timestamp = timestamp; }
+
+    public String getMessage() { return message; }
+    public void setMessage(String message) { this.message = message; }
+}

src/main/java/io/github/hectorvent/floci/services/ecr/registry/EcrRegistryManager.java

@@ -174,6 +174,12 @@ public class EcrRegistryManager {
      * the container name plus the container-internal port (not the published host port).
      */
     public String internalEndpoint() {
+        if (containerId != null) {
+            String ipAddress = lifecycleManager.resolveContainerNetworkIp(containerId, null);
+            if (ipAddress != null && !ipAddress.isBlank()) {
+                return "http://" + ipAddress + ":" + CONTAINER_INTERNAL_PORT;
+            }
+        }
         return "http://" + registryContainerName() + ":" + CONTAINER_INTERNAL_PORT;
     }
 

src/main/java/io/github/hectorvent/floci/services/ecs/EcsLoadBalancerRegistrar.java

@@ -1,12 +1,16 @@
 package io.github.hectorvent.floci.services.ecs;
 
+import io.github.hectorvent.floci.core.common.AwsException;
 import io.github.hectorvent.floci.services.ecs.container.EcsContainerManager;
 import io.github.hectorvent.floci.services.ecs.model.Container;
 import io.github.hectorvent.floci.services.ecs.model.EcsLoadBalancer;
 import io.github.hectorvent.floci.services.ecs.model.EcsServiceModel;
 import io.github.hectorvent.floci.services.ecs.model.EcsTask;
 import io.github.hectorvent.floci.services.ecs.model.NetworkBinding;
+import io.github.hectorvent.floci.services.ecs.model.PortMapping;
+import io.github.hectorvent.floci.services.ecs.model.TaskDefinition;
 import io.github.hectorvent.floci.services.elbv2.ElbV2Service;
+import io.github.hectorvent.floci.services.elbv2.model.TargetGroup;
 import io.github.hectorvent.floci.services.elbv2.model.TargetDescription;
 import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
@@ -14,6 +18,7 @@ import org.jboss.logging.Logger;
 
 import java.util.List;
 import java.util.function.BiConsumer;
+import java.util.stream.Stream;
 
 /**
  * Bridges ECS services to ELBv2: when an ECS service declares a {@code loadBalancers}
@@ -37,9 +42,57 @@ public class EcsLoadBalancerRegistrar {
         this.containerManager = containerManager;
     }
 
+    /**
+     * Resolves service target groups and their task-definition bindings before the service can
+     * launch a task. A late failure here otherwise leaves a running task that can never receive
+     * traffic.
+     */
+    public void validateServiceLoadBalancers(List<EcsLoadBalancer> loadBalancers,
+                                             TaskDefinition taskDefinition, String region) {
+        if (loadBalancers == null || loadBalancers.isEmpty()) {
+            return;
+        }
+        for (EcsLoadBalancer loadBalancer : loadBalancers) {
+            if (loadBalancer.getTargetGroupArn() == null || loadBalancer.getTargetGroupArn().isBlank()) {
+                continue;
+            }
+            TargetGroup targetGroup = elbV2Service.getTargetGroup(region, loadBalancer.getTargetGroupArn());
+            if (targetGroup == null) {
+                throw new AwsException("TargetGroupNotFound",
+                        "Target group " + loadBalancer.getTargetGroupArn() + " was not found.", 400);
+            }
+            if (taskDefinition.isFargateCompatible() && !"ip".equals(targetGroup.getTargetType())) {
+                throw new AwsException("InvalidParameterException",
+                        "The target group " + loadBalancer.getTargetGroupArn()
+                                + " must have target type ip for a Fargate service.", 400);
+            }
+            boolean declared = taskDefinition.getContainerDefinitions().stream()
+                    .filter(container -> loadBalancer.getContainerName().equals(container.getName()))
+                    .flatMap(container -> container.getPortMappings() == null
+                            ? Stream.<PortMapping>empty()
+                            : container.getPortMappings().stream())
+                    .anyMatch(mapping -> mapping.containerPort() == loadBalancer.getContainerPort());
+            if (!declared) {
+                throw new AwsException("InvalidParameterException",
+                        "The container " + loadBalancer.getContainerName() + " does not expose port "
+                                + loadBalancer.getContainerPort() + " in task definition "
+                                + taskDefinition.getTaskDefinitionArn() + ".", 400);
+            }
+        }
+    }
+
     /** Registers the task's load-balanced containers as ELBv2 targets. */
     public void registerTask(EcsTask task, EcsServiceModel svc, String region) {
-        forEachTarget(task, svc, (tgArn, td) -> {
+        register(task, svc.getLoadBalancers(), region);
+    }
+
+    /** Registers a task-set task against the load balancers declared by that task set. */
+    public void registerTaskSetTask(EcsTask task, List<EcsLoadBalancer> loadBalancers, String region) {
+        register(task, loadBalancers, region);
+    }
+
+    private void register(EcsTask task, List<EcsLoadBalancer> loadBalancers, String region) {
+        forEachTarget(task, loadBalancers, (tgArn, td) -> {
             try {
                 elbV2Service.registerTargets(region, tgArn, List.of(td));
                 LOG.infov("Registered ECS task target {0}:{1} into target group {2}",
@@ -52,7 +105,16 @@ public class EcsLoadBalancerRegistrar {
 
     /** Deregisters the task's load-balanced containers from their ELBv2 target groups. */
     public void deregisterTask(EcsTask task, EcsServiceModel svc, String region) {
-        forEachTarget(task, svc, (tgArn, td) -> {
+        deregister(task, svc.getLoadBalancers(), region);
+    }
+
+    /** Deregisters a task-set task from the load balancers declared by that task set. */
+    public void deregisterTaskSetTask(EcsTask task, List<EcsLoadBalancer> loadBalancers, String region) {
+        deregister(task, loadBalancers, region);
+    }
+
+    private void deregister(EcsTask task, List<EcsLoadBalancer> loadBalancers, String region) {
+        forEachTarget(task, loadBalancers, (tgArn, td) -> {
             try {
                 elbV2Service.deregisterTargets(region, tgArn, List.of(td));
                 LOG.infov("Deregistered ECS task target {0}:{1} from target group {2}",
@@ -63,15 +125,15 @@ public class EcsLoadBalancerRegistrar {
         });
     }
 
-    private void forEachTarget(EcsTask task, EcsServiceModel svc,
-                               BiConsumer<String, TargetDescription> action) {
-        if (svc == null || svc.getLoadBalancers() == null || svc.getLoadBalancers().isEmpty()) {
+    private void forEachTarget(EcsTask task, List<EcsLoadBalancer> loadBalancers,
+                                BiConsumer<String, TargetDescription> action) {
+        if (loadBalancers == null || loadBalancers.isEmpty()) {
             return;
         }
         if (task.getContainers() == null || task.getContainers().isEmpty()) {
             return;
         }
-        for (EcsLoadBalancer lb : svc.getLoadBalancers()) {
+        for (EcsLoadBalancer lb : loadBalancers) {
             if (lb.getTargetGroupArn() == null || lb.getTargetGroupArn().isBlank()) {
                 continue;
             }

src/main/java/io/github/hectorvent/floci/services/ecs/EcsService.java

@@ -1166,7 +1166,8 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
         }
         EcsCluster cluster = resolveClusterOrDefault(request.getCluster(), region);
         TaskDefinition taskDef = resolveLaunchableTaskDefinition(request.getTaskDefinition(), region);
-        return launchTasks(cluster, taskDef, request, null, null, region);
+        validateRuntimeLaunch(cluster, taskDef, request);
+        return launchTasks(cluster, taskDef, request, null, null, null, region);
     }
 
     public List<EcsTask> startTask(String clusterRef, List<String> containerInstanceRefs,
@@ -1203,7 +1204,7 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
         for (String instanceRef : instanceRefs) {
             ContainerInstance instance = resolveContainerInstanceOrThrow(cluster.getClusterArn(), instanceRef);
             result.addAll(launchTasks(cluster, taskDef, request,
-                    instance.getContainerInstanceArn(), null, region));
+                    instance.getContainerInstanceArn(), null, null, region));
         }
         return result;
     }
@@ -1217,7 +1218,7 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
      */
     private List<EcsTask> launchTasks(EcsCluster cluster, TaskDefinition taskDef, RunTaskRequest request,
                                        String containerInstanceArn,
-                                       String owningServiceArn, String region) {
+                                       String owningServiceArn, String taskSetArn, String region) {
         // Fail loudly instead of silently launching zero containers and leaving
         // a task that looks RUNNING with nothing behind it.
         if (taskDef.getContainerDefinitions() == null || taskDef.getContainerDefinitions().isEmpty()) {
@@ -1247,6 +1248,7 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
             task.setGroup(request.getGroup() != null ? request.getGroup() : "family:" + taskDef.getFamily());
             task.setStartedBy(request.getStartedBy());
             task.setOwningServiceArn(owningServiceArn);
+            task.setTaskSetArn(taskSetArn);
             task.setLastStatus(TaskStatus.PENDING.name());
             task.setDesiredStatus(TaskStatus.RUNNING.name());
             task.setCpu(effectiveCpu(taskDef, request));
@@ -1398,7 +1400,7 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
             request.setPropagateTags(PROPAGATE_TAGS_TASK_DEFINITION);
         }
         EcsTask task = launchTasks(cluster, taskDef, request, containerInstanceArn,
-                svc.getServiceArn(), region).getFirst();
+                svc.getServiceArn(), null, region).getFirst();
         task.setDeploymentId(deploymentId(svc));
         return task;
     }
@@ -1425,7 +1427,7 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
             strategy = clusterDefaultStrategy(cluster);
         }
         if (strategy == null || strategy.isEmpty()) {
-            LaunchType launchType = request.getLaunchType() != null ? request.getLaunchType() : LaunchType.FARGATE;
+            LaunchType launchType = request.getLaunchType() != null ? request.getLaunchType() : LaunchType.EC2;
             return Collections.nCopies(count, new Placement(launchType, null));
         }
         return distribute(strategy, count);
@@ -1552,6 +1554,36 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
         return new Placement(launchType, capacityProvider);
     }
 
+    /**
+     * Keeps the established EC2 bridge restriction while allowing Docker-backed Fargate tasks to
+     * use their awsvpc task ENI. A capacity-provider strategy determines the effective launch
+     * type, so validate every placement rather than only the explicit launchType member.
+     */
+    private void validateRuntimeLaunch(EcsCluster cluster, TaskDefinition taskDef, RunTaskRequest request) {
+        List<Placement> placements = resolvePlacements(cluster, request, 1);
+        boolean fargate = placements.stream().anyMatch(placement -> placement.launchType() == LaunchType.FARGATE);
+        boolean ec2 = placements.stream().anyMatch(placement -> placement.launchType() == LaunchType.EC2);
+        if (fargate && ec2) {
+            throw new AwsException("ClientException",
+                    "A task definition cannot be placed on both EC2 and FARGATE capacity providers.", 400);
+        }
+        if (fargate) {
+            if (taskDef.getNetworkMode() != NetworkMode.awsvpc) {
+                throw new AwsException("ClientException",
+                        "Fargate tasks require the awsvpc network mode.", 400);
+            }
+            if (!taskDef.isFargateCompatible()) {
+                throw new AwsException("ClientException",
+                        "The task definition is not compatible with the FARGATE launch type.", 400);
+            }
+            return;
+        }
+        if (ec2 && taskDef.getNetworkMode() != NetworkMode.bridge) {
+            throw new AwsException("ClientException",
+                    "Only bridge network mode is supported for ECS EC2 tasks.", 400);
+        }
+    }
+
     /** Accepts the two built-in Fargate providers as well as anything CreateCapacityProvider made. */
     private void requireCapacityProvider(String name) {
         if (name == null || name.isBlank()) {
@@ -1707,6 +1739,13 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
 
     /** Registers a freshly-started task's containers as ELBv2 targets if its service is load-balanced. */
     private void registerTaskWithLoadBalancers(EcsTask task, EcsCluster cluster, String region) {
+        if (task.getTaskSetArn() != null) {
+            TaskSet taskSet = taskSets.get(task.getTaskSetArn());
+            if (taskSet != null) {
+                lbRegistrar.registerTaskSetTask(task, taskSet.getLoadBalancers(), region);
+            }
+            return;
+        }
         EcsServiceModel svc = owningService(task, cluster);
         if (svc != null && !svc.getLoadBalancers().isEmpty()) {
             lbRegistrar.registerTask(task, svc, region);
@@ -1741,7 +1780,12 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
             return;
         }
         EcsServiceModel svc = owningService(task, cluster);
-        if (svc != null && !svc.getLoadBalancers().isEmpty()) {
+        if (task.getTaskSetArn() != null) {
+            TaskSet taskSet = taskSets.get(task.getTaskSetArn());
+            if (taskSet != null) {
+                lbRegistrar.deregisterTaskSetTask(task, taskSet.getLoadBalancers(), region);
+            }
+        } else if (svc != null && !svc.getLoadBalancers().isEmpty()) {
             lbRegistrar.deregisterTask(task, svc, region);
         }
     }
@@ -2026,6 +2070,11 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
         // AWS resolves family / family:revision at create time and stores the ARN; the
         // reconciler compares it with each task's taskDefinitionArn, so pin it here.
         TaskDefinition taskDef = resolveLaunchableTaskDefinition(request.getTaskDefinition(), region);
+        RunTaskRequest launchValidation = new RunTaskRequest();
+        launchValidation.setLaunchType(request.getLaunchType());
+        launchValidation.setCapacityProviderStrategy(request.getCapacityProviderStrategy());
+        validateRuntimeLaunch(cluster, taskDef, launchValidation);
+        lbRegistrar.validateServiceLoadBalancers(request.getLoadBalancers(), taskDef, region);
         String taskDefinition = taskDef.getTaskDefinitionArn();
         String serviceName = request.getServiceName();
 
@@ -2104,6 +2153,9 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
         cluster.setActiveServicesCount(cluster.getActiveServicesCount() + 1);
         persistCluster(region, cluster);
         recordServiceDeployment(svc, taskDefinition, region);
+        if (svc.getLaunchType() == LaunchType.FARGATE && "CODE_DEPLOY".equals(svc.getDeploymentController())) {
+            createInitialCodeDeployTaskSet(cluster, svc, region);
+        }
         if (eventPublisher != null) {
             eventPublisher.emitDeploymentStateChange(svc, "SERVICE_DEPLOYMENT_STARTED",
                     "ECS deployment " + svc.getDeploymentId() + " started.", region);
@@ -2112,6 +2164,31 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
         return svc;
     }
 
+    /**
+     * A Fargate CodeDeploy service starts with its blue deployment already placed. EC2 services
+     * retain their existing controller-owned task-set lifecycle.
+     */
+    private void createInitialCodeDeployTaskSet(EcsCluster cluster, EcsServiceModel svc, String region) {
+        CreateTaskSetRequest request = new CreateTaskSetRequest();
+        request.setCluster(cluster.getClusterName());
+        request.setService(svc.getServiceName());
+        request.setTaskDefinition(svc.getTaskDefinition());
+        if (svc.getCapacityProviderStrategy() != null && !svc.getCapacityProviderStrategy().isEmpty()) {
+            request.setCapacityProviderStrategy(svc.getCapacityProviderStrategy());
+        } else {
+            request.setLaunchType(LaunchType.FARGATE);
+        }
+        request.setPlatformVersion(svc.getPlatformVersion());
+        request.setScaleValue(100.0);
+        request.setNetworkConfiguration(svc.getNetworkConfiguration());
+        request.setLoadBalancers(svc.getLoadBalancers());
+        request.setServiceRegistries(svc.getServiceRegistries());
+
+        TaskSet taskSet = createTaskSet(request, region);
+        taskSet.setStatus("PRIMARY");
+        taskSet.setUpdatedAt(Instant.now());
+    }
+
     public EcsServiceModel updateService(String clusterRef, String serviceName, String taskDefinition,
                                           Integer desiredCount, NetworkConfiguration networkConfiguration,
                                           String region) {
@@ -2335,7 +2412,7 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
             strategy = clusterDefaultStrategy(cluster);
         }
         if (strategy == null || strategy.isEmpty()) {
-            return LaunchType.FARGATE;
+            return LaunchType.EC2;
         }
         validateCapacityProviderStrategy(strategy);
         return placementFor(strategy.getFirst().capacityProvider()).launchType();
@@ -2408,6 +2485,20 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
                                 t.getTaskArn(), e.getMessage());
                     }
                 });
+        // Service ARNs are reused when a same-named service is recreated. Retaining its task
+        // sets would make the new service reconcile and relaunch the deleted deployment.
+        taskSets.entrySet().removeIf(entry -> svc.getServiceArn().equals(entry.getValue().getServiceArn()));
+        // Inactive services are not reconciled, so retain the final observed task state rather
+        // than leaving the count that was recorded before the service drain.
+        svc.setRunningCount((int) tasks.values().stream()
+                .filter(t -> ownedBy(t, svc, cluster))
+                .filter(t -> TaskStatus.RUNNING.name().equals(t.getLastStatus()))
+                .count());
+        svc.setPendingCount((int) tasks.values().stream()
+                .filter(t -> ownedBy(t, svc, cluster))
+                .filter(t -> TaskStatus.PENDING.name().equals(t.getLastStatus()))
+                .count());
+        services.put(key, svc);
         return svc;
     }
 
@@ -3257,7 +3348,7 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
     private static final Set<String> TASK_SET_CONTROLLERS = Set.of("EXTERNAL", "CODE_DEPLOY");
     /** The only unit {@code Scale} accepts, so the computed count is always a percentage. */
     private static final String SCALE_UNIT_PERCENT = "PERCENT";
-    /** The stability a task set reports while Floci places no tasks of its own for one. */
+    /** Task sets report steady state when their running task count reaches the computed desired count. */
     private static final String STABILITY_STATUS_STEADY_STATE = "STEADY_STATE";
 
     public TaskSet createTaskSet(String clusterRef, String serviceRef, String taskDefinitionRef,
@@ -3335,7 +3426,9 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
         ts.setUpdatedAt(Instant.now());
         applyTaskSetScale(ts, svc);
 
+        lbRegistrar.validateServiceLoadBalancers(ts.getLoadBalancers(), taskDef, region);
         taskSets.put(taskSetArn, ts);
+        reconcileTaskSet(cluster, svc, ts, region);
         return ts;
     }
 
@@ -3363,15 +3456,54 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
      * Stamps {@code computedDesiredCount}, which AWS derives from the service's desired count and
      * the task set's scale percentage, always rounding up: a computed 1.2 becomes 2 tasks.
      *
-     * <p>Floci places no tasks for a task set, so its running and pending counts stay at zero. A
-     * stability status derived from them would leave every set on a service with a desired count
-     * above zero in {@code STABILIZING} for ever, hanging anything that waits for the set to
-     * stabilise, so the set is reported {@code STEADY_STATE} until Floci tracks tasks for it.
      */
     private void applyTaskSetScale(TaskSet ts, EcsServiceModel svc) {
         ts.setComputedDesiredCount(
                 (int) Math.ceil(svc.getDesiredCount() * ts.getScaleValue() / 100.0));
-        ts.setStabilityStatus(STABILITY_STATUS_STEADY_STATE);
+    }
+
+    /** Places and drains task-set tasks with the same runtime launcher used by the service scheduler. */
+    private void reconcileTaskSet(EcsCluster cluster, EcsServiceModel svc, TaskSet ts, String region) {
+        List<EcsTask> running = tasks.values().stream()
+                .filter(task -> ts.getTaskSetArn().equals(task.getTaskSetArn()))
+                .filter(task -> TaskStatus.RUNNING.name().equals(task.getLastStatus()))
+                .toList();
+        int toStart = ts.getComputedDesiredCount() - running.size();
+        if (toStart > 0) {
+            TaskDefinition taskDef = resolveTaskDefinitionOrThrow(ts.getTaskDefinition(), region);
+            for (int i = 0; i < toStart; i++) {
+                RunTaskRequest request = new RunTaskRequest();
+                request.setCount(1);
+                request.setGroup("service:" + svc.getServiceName());
+                request.setStartedBy(ts.getStartedBy());
+                request.setNetworkConfiguration(ts.getNetworkConfiguration());
+                request.setCapacityProviderStrategy(ts.getCapacityProviderStrategy());
+                if (ts.getCapacityProviderStrategy() == null || ts.getCapacityProviderStrategy().isEmpty()) {
+                    request.setLaunchType(ts.getLaunchType());
+                }
+                validateRuntimeLaunch(cluster, taskDef, request);
+                launchTasks(cluster, taskDef, request, null, svc.getServiceArn(), ts.getTaskSetArn(), region);
+            }
+        } else if (toStart < 0) {
+            running.stream().limit(-toStart).forEach(task -> stopTask(cluster.getClusterName(), task.getTaskArn(),
+                    "Task set scale-in", STOP_CODE_SERVICE_SCHEDULER_INITIATED, region));
+        }
+        updateTaskSetRuntime(ts);
+    }
+
+    private void updateTaskSetRuntime(TaskSet ts) {
+        int running = (int) tasks.values().stream()
+                .filter(task -> ts.getTaskSetArn().equals(task.getTaskSetArn()))
+                .filter(task -> TaskStatus.RUNNING.name().equals(task.getLastStatus()))
+                .count();
+        int pending = (int) tasks.values().stream()
+                .filter(task -> ts.getTaskSetArn().equals(task.getTaskSetArn()))
+                .filter(task -> TaskStatus.PENDING.name().equals(task.getLastStatus()))
+                .count();
+        ts.setRunningCount(running);
+        ts.setPendingCount(pending);
+        ts.setStabilityStatus(running == ts.getComputedDesiredCount() && pending == 0
+                ? STABILITY_STATUS_STEADY_STATE : "STABILIZING");
         ts.setStabilityStatusAt(Instant.now());
     }
 
@@ -3388,6 +3520,7 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
         ts.setScaleUnit(SCALE_UNIT_PERCENT);
         ts.setUpdatedAt(Instant.now());
         applyTaskSetScale(ts, svc);
+        reconcileTaskSet(cluster, svc, ts, region);
         return ts;
     }
 
@@ -3408,6 +3541,11 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
         }
         ts.setStatus("DRAINING");
         ts.setUpdatedAt(Instant.now());
+        tasks.values().stream()
+                .filter(task -> ts.getTaskSetArn().equals(task.getTaskSetArn()))
+                .filter(task -> !TaskStatus.STOPPED.name().equals(task.getLastStatus()))
+                .forEach(task -> stopTask(cluster.getClusterName(), task.getTaskArn(),
+                        "Task set deleted", STOP_CODE_SERVICE_SCHEDULER_INITIATED, region));
         taskSets.remove(ts.getTaskSetArn());
         return ts;
     }
@@ -3842,6 +3980,9 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
         }
 
         // Close log streams and remove the stopped Docker containers without re-inspecting.
+        // Docker can be killed outside ECS. Remove its old target before the service reconciler
+        // creates a replacement, otherwise the target group retains a dead host port.
+        deregisterTaskFromLoadBalancers(task, taskRegion(task));
         containerManager.cleanupStoppedTask(claimed);
 
         if (task.getContainers() != null) {
@@ -4097,9 +4238,20 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
         if (!"ACTIVE".equals(svc.getStatus())) {
             return;
         }
-
+        String deploymentController = svc.getDeploymentController() != null
+                ? svc.getDeploymentController() : DEFAULT_DEPLOYMENT_CONTROLLER;
         String region = extractRegionFromServiceKey(key);
         String clusterName = extractClusterNameFromServiceKey(key);
+        if (!DEFAULT_DEPLOYMENT_CONTROLLER.equals(deploymentController)) {
+            EcsCluster cluster = resolveClusterOrDefault(clusterName, region);
+            for (TaskSet taskSet : taskSetsFor(svc)) {
+                reconcileTaskSet(cluster, svc, taskSet, region);
+            }
+            // Task sets are scheduled by their CodeDeploy or external controller, not by the
+            // normal service reconciler. Otherwise green tasks would be supplemented by a second
+            // desiredCount-worth of regular service tasks on every tick.
+            return;
+        }
 
         if (SCHEDULING_DAEMON.equals(svc.getSchedulingStrategy())) {
             reconcileDaemonService(key, svc, clusterName, region);
@@ -4109,6 +4261,9 @@ public class EcsService implements ContainerTeardown, ResourceProvider, Resettab
         EcsCluster cluster = resolveClusterOrDefault(clusterName, region);
         List<EcsTask> runningTasks = tasks.values().stream()
                 .filter(t -> ownedBy(t, svc, cluster))
+                // Task sets own their desired count. Including them here lets the rolling-service
+                // reconciler replace a CodeDeploy green task before traffic is switched.
+                .filter(t -> t.getTaskSetArn() == null)
                 .filter(t -> TaskStatus.RUNNING.name().equals(t.getLastStatus()))
                 .toList();
         long running = runningTasks.size();

src/main/java/io/github/hectorvent/floci/services/ecs/container/EcsContainerManager.java

@@ -226,6 +226,9 @@ public class EcsContainerManager {
                     metadataId));
             imagesByContainer.put(def, ecrRegistryManager.rewriteImageUri(def.getImage()));
         }
+        for (String image : new HashSet<>(imagesByContainer.values())) {
+            lifecycleManager.refreshImage(image);
+        }
 
         PreparedNetwork protectedNetwork = prepareNetwork(task, taskDef, region, taskId);
 

src/main/java/io/github/hectorvent/floci/services/ecs/model/EcsTask.java

@@ -21,6 +21,8 @@ public class EcsTask {
      * caller-supplied label and therefore cannot be trusted to establish ownership.
      */
     private String owningServiceArn;
+    /** Task set that launched this service-owned task, or null for a rolling-service task. */
+    private String taskSetArn;
     private LaunchType launchType;
     private String lastStatus;
     private String desiredStatus;
@@ -81,6 +83,7 @@ public class EcsTask {
         this.taskDefinitionArn = other.taskDefinitionArn;
         this.group = other.group;
         this.owningServiceArn = other.owningServiceArn;
+        this.taskSetArn = other.taskSetArn;
         this.launchType = other.launchType;
         this.lastStatus = other.lastStatus;
         this.desiredStatus = other.desiredStatus;
@@ -138,6 +141,9 @@ public class EcsTask {
     public String getOwningServiceArn() { return owningServiceArn; }
     public void setOwningServiceArn(String owningServiceArn) { this.owningServiceArn = owningServiceArn; }
 
+    public String getTaskSetArn() { return taskSetArn; }
+    public void setTaskSetArn(String taskSetArn) { this.taskSetArn = taskSetArn; }
+
     public LaunchType getLaunchType() { return launchType; }
     public void setLaunchType(LaunchType launchType) { this.launchType = launchType; }
 

src/main/java/io/github/hectorvent/floci/services/elbv2/ElbV2DataPlane.java

@@ -5,6 +5,9 @@ import com.fasterxml.jackson.databind.ObjectMapper;
 import io.github.hectorvent.floci.config.EmulatorConfig;
 import io.github.hectorvent.floci.config.TlsProxyServer;
 import io.github.hectorvent.floci.services.ec2.Ec2Service;
+import io.github.hectorvent.floci.services.ec2.ContainerNetworkReachability;
+import io.github.hectorvent.floci.services.ec2.SecurityGroupPolicy;
+import io.github.hectorvent.floci.services.ec2.model.SecurityGroup;
 import io.github.hectorvent.floci.services.elbv2.model.Action;
 import io.github.hectorvent.floci.services.elbv2.model.Listener;
 import io.github.hectorvent.floci.services.elbv2.model.LoadBalancer;
@@ -37,6 +40,7 @@ import java.util.Base64;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
@@ -76,6 +80,12 @@ public class ElbV2DataPlane {
     @Inject
     Ec2Service ec2Service;
 
+    @Inject
+    ContainerNetworkReachability containerNetworkReachability;
+
+    @Inject
+    ElbV2ListenerForwardManager listenerForwardManager;
+
     @Inject
     ObjectMapper objectMapper;
 
@@ -102,6 +112,9 @@ public class ElbV2DataPlane {
 
     @PreDestroy
     void shutdown() {
+        for (Map.Entry<String, ListenerBinding> entry : listenerBindings.entrySet()) {
+            listenerForwardManager.remove(entry.getValue().port());
+        }
         for (Map.Entry<Integer, HttpServer> e : servers.entrySet()) {
             e.getValue().close();
         }
@@ -127,6 +140,10 @@ public class ElbV2DataPlane {
                 .put(binding.host(), listenerArn);
         ensureReleaseHandlerRegistered();
         servers.computeIfAbsent(binding.port(), this::startPortServer);
+        if (!isReservedByFloci(binding.port())
+                && listenersByHostAndPort.get(binding.port()).size() == 1) {
+            listenerForwardManager.reconcile(binding.port());
+        }
     }
 
     public void restartListener(Listener listener, String region, List<Rule> rules) {
@@ -150,6 +167,9 @@ public class ElbV2DataPlane {
             Map<String, String> listenersByHost = listenersByHostAndPort.get(oldBinding.port());
             if (listenersByHost != null) {
                 listenersByHost.remove(oldBinding.host(), listenerArn);
+                if (listenersByHost.isEmpty()) {
+                    listenerForwardManager.remove(oldBinding.port());
+                }
                 closePortServerIfUnused(oldBinding.port(), listenersByHost);
             }
         }
@@ -162,6 +182,9 @@ public class ElbV2DataPlane {
             Map<String, String> listenersByHost = listenersByHostAndPort.get(binding.port());
             if (listenersByHost != null) {
                 listenersByHost.remove(binding.host(), listenerArn);
+                if (listenersByHost.isEmpty()) {
+                    listenerForwardManager.remove(binding.port());
+                }
                 closePortServerIfUnused(binding.port(), listenersByHost);
             }
         }
@@ -268,6 +291,7 @@ public class ElbV2DataPlane {
     }
 
     private void clearPortBindings(int port) {
+        listenerForwardManager.remove(port);
         Map<String, String> listenersByHost = listenersByHostAndPort.remove(port);
         if (listenersByHost == null) {
             return;
@@ -296,6 +320,11 @@ public class ElbV2DataPlane {
             req.response().setStatusCode(502).end("No listener region");
             return;
         }
+        if (!allowsIngress(listenerArn, region, req, port)) {
+            // Security groups are enforced at TCP ingress. Do not synthesize an HTTP response.
+            req.connection().close();
+            return;
+        }
         AtomicReference<List<CompiledRule>> ref = ruleChains.get(listenerArn);
         if (ref == null) {
             req.response().setStatusCode(502).end("No rule chain");
@@ -378,18 +407,19 @@ public class ElbV2DataPlane {
 
         List<TargetDescription> allTargets = tg.getTargets();
         List<TargetDescription> healthy = allTargets.stream()
-                .filter(t -> healthChecker.isHealthy(tgArn, t, ElbV2HealthChecker.effectivePort(t, tg)))
+                .filter(t -> healthChecker.isHealthy(tgArn, t, ElbV2HealthChecker.effectiveHealthCheckPort(t, tg)))
                 .collect(Collectors.toList());
-        List<TargetDescription> candidates = healthy.isEmpty() ? allTargets : healthy;
-        if (candidates.isEmpty()) {
+        if (healthy.isEmpty()) {
             req.response().setStatusCode(503).end("No targets available");
             return;
         }
         AtomicInteger counter = rrCounters.computeIfAbsent(tgArn, k -> new AtomicInteger(0));
-        int idx = Math.abs(counter.getAndIncrement() % candidates.size());
-        TargetDescription target = candidates.get(idx);
+        int idx = Math.floorMod(counter.getAndIncrement(), healthy.size());
+        TargetDescription target = healthy.get(idx);
         int targetPort = ElbV2HealthChecker.effectivePort(target, tg);
-        proxyRequest(req, ElbV2TargetResolver.resolveHost(ec2Service, tg, target), targetPort,
+        ElbV2TargetResolver.TargetEndpoint endpoint = ElbV2TargetResolver.resolveEndpoint(
+                ec2Service, containerNetworkReachability, tg, target, targetPort);
+        proxyRequest(req, endpoint.host(), endpoint.port(),
                 preserveHostHeader(listenerArn, region));
     }
 
@@ -404,6 +434,20 @@ public class ElbV2DataPlane {
                 && Boolean.parseBoolean(loadBalancer.getAttributes().get(PRESERVE_HOST_HEADER_ATTRIBUTE));
     }
 
+    private boolean allowsIngress(String listenerArn, String region, HttpServerRequest req, int port) {
+        ListenerBinding binding = listenerBindings.get(listenerArn);
+        LoadBalancer loadBalancer = binding != null
+                ? elbV2Service.getLoadBalancer(region, binding.loadBalancerArn()) : null;
+        if (loadBalancer == null || loadBalancer.getSecurityGroups() == null || loadBalancer.getSecurityGroups().isEmpty()) {
+            return true;
+        }
+        List<SecurityGroup> groups = ec2Service.describeSecurityGroups(region, loadBalancer.getSecurityGroups(), List.of(), Map.of());
+        String remoteAddress = req.remoteAddress() != null ? req.remoteAddress().host() : null;
+        SecurityGroupPolicy.Peer peer = new SecurityGroupPolicy.Peer(remoteAddress, null,
+                loadBalancer.getVpcId(), Set.of());
+        return SecurityGroupPolicy.allows(groups, false, "tcp", port, -1, peer, Map.of());
+    }
+
     private void invokeLambdaTarget(io.vertx.core.http.HttpServerRequest req, String functionArn, String region) {
         if (req.isEnded()) {
             invokeLambdaWithBody(req, functionArn, region, Buffer.buffer());

src/main/java/io/github/hectorvent/floci/services/elbv2/ElbV2HealthChecker.java

@@ -2,6 +2,7 @@ package io.github.hectorvent.floci.services.elbv2;
 
 import io.github.hectorvent.floci.config.EmulatorConfig;
 import io.github.hectorvent.floci.core.common.Resettable;
+import io.github.hectorvent.floci.services.ec2.ContainerNetworkReachability;
 import io.github.hectorvent.floci.services.ec2.Ec2Service;
 import io.github.hectorvent.floci.services.elbv2.model.TargetDescription;
 import io.github.hectorvent.floci.services.elbv2.model.TargetGroup;
@@ -27,6 +28,7 @@ public class ElbV2HealthChecker implements Resettable {
     private final Vertx vertx;
     private final EmulatorConfig config;
     private final Ec2Service ec2Service;
+    private final ContainerNetworkReachability containerNetworkReachability;
 
     // tgArn → (targetKey → TargetState)
     private final Map<String, Map<String, TargetState>> states = new ConcurrentHashMap<>();
@@ -34,10 +36,12 @@ public class ElbV2HealthChecker implements Resettable {
     private final Map<String, Long> timers = new ConcurrentHashMap<>();
 
     @Inject
-    public ElbV2HealthChecker(Vertx vertx, EmulatorConfig config, Ec2Service ec2Service) {
+    public ElbV2HealthChecker(Vertx vertx, EmulatorConfig config, Ec2Service ec2Service,
+                               ContainerNetworkReachability containerNetworkReachability) {
         this.vertx = vertx;
         this.config = config;
         this.ec2Service = ec2Service;
+        this.containerNetworkReachability = containerNetworkReachability;
     }
 
     public static int effectivePort(TargetDescription target, TargetGroup tg) {
@@ -50,6 +54,18 @@ public class ElbV2HealthChecker implements Resettable {
         return 80;
     }
 
+    public static int effectiveHealthCheckPort(TargetDescription target, TargetGroup tg) {
+        String healthCheckPort = tg.getHealthCheckPort();
+        if (healthCheckPort != null && !"traffic-port".equalsIgnoreCase(healthCheckPort)) {
+            try {
+                return Integer.parseInt(healthCheckPort);
+            } catch (NumberFormatException e) {
+                return effectivePort(target, tg);
+            }
+        }
+        return effectivePort(target, tg);
+    }
+
     public void startMonitoring(TargetGroup tg) {
         if (config.services().elbv2().mock()) {
             return;
@@ -60,6 +76,11 @@ public class ElbV2HealthChecker implements Resettable {
         String tgArn = tg.getTargetGroupArn();
         states.computeIfAbsent(tgArn, k -> new ConcurrentHashMap<>());
 
+        Long previousTimer = timers.remove(tgArn);
+        if (previousTimer != null) {
+            vertx.cancelTimer(previousTimer);
+        }
+
         long intervalMs = (tg.getHealthCheckIntervalSeconds() != null ? tg.getHealthCheckIntervalSeconds() : 30) * 1000L;
         long timerId = vertx.setPeriodic(intervalMs, id -> probeAll(tgArn, tg));
         timers.put(tgArn, timerId);
@@ -85,7 +106,7 @@ public class ElbV2HealthChecker implements Resettable {
         }
         Map<String, TargetState> tgStates = states.computeIfAbsent(tgArn, k -> new ConcurrentHashMap<>());
         for (TargetDescription t : targets) {
-            int port = effectivePort(t, tg);
+            int port = effectiveHealthCheckPort(t, tg);
             String key = stateKey(t.getId(), port);
             tgStates.putIfAbsent(key, new TargetState());
         }
@@ -100,7 +121,7 @@ public class ElbV2HealthChecker implements Resettable {
             return;
         }
         for (TargetDescription t : targets) {
-            int port = effectivePort(t, tg);
+            int port = effectiveHealthCheckPort(t, tg);
             tgStates.remove(stateKey(t.getId(), port));
         }
     }
@@ -123,7 +144,7 @@ public class ElbV2HealthChecker implements Resettable {
 
     public boolean isHealthy(String tgArn, TargetDescription target, int port) {
         String state = getState(tgArn, target.getId(), port);
-        return "healthy".equals(state) || "initial".equals(state);
+        return "healthy".equals(state);
     }
 
     private void probeAll(String tgArn, TargetGroup tg) {
@@ -145,7 +166,11 @@ public class ElbV2HealthChecker implements Resettable {
             } catch (NumberFormatException e) {
                 continue;
             }
-            String host = ElbV2TargetResolver.resolveHost(ec2Service, tg, targetId);
+            TargetDescription target = new TargetDescription();
+            target.setId(targetId);
+            target.setPort(port);
+            ElbV2TargetResolver.TargetEndpoint endpoint = ElbV2TargetResolver.resolveEndpoint(
+                    ec2Service, containerNetworkReachability, tg, target, port);
             String path = tg.getHealthCheckPath() != null ? tg.getHealthCheckPath() : "/";
             String matcher = tg.getMatcher() != null ? tg.getMatcher() : "200";
             int timeout = tg.getHealthCheckTimeoutSeconds() != null ? tg.getHealthCheckTimeoutSeconds() : 5;
@@ -153,7 +178,7 @@ public class ElbV2HealthChecker implements Resettable {
             int unhealthyThreshold = tg.getUnhealthyThresholdCount() != null ? tg.getUnhealthyThresholdCount() : 2;
 
             vertx.executeBlocking(() -> {
-                return probe(host, port, path, timeout);
+                return probe(endpoint.host(), endpoint.port(), path, timeout);
             }).onSuccess(statusCode -> {
                 boolean success = matchesStatusCode(statusCode, matcher);
                 if (success) {
@@ -189,7 +214,7 @@ public class ElbV2HealthChecker implements Resettable {
                         state.description = "Health checks failed";
                     }
                 }
-                LOG.debugv("Health check failed for {0}:{1} - {2}", host, port, err.getMessage());
+                LOG.debugv("Health check failed for {0}:{1} - {2}", endpoint.host(), endpoint.port(), err.getMessage());
             });
         }
     }

src/main/java/io/github/hectorvent/floci/services/elbv2/ElbV2ListenerForwardManager.java

@@ -0,0 +1,78 @@
+package io.github.hectorvent.floci.services.elbv2;
+
+import io.github.hectorvent.floci.config.EmulatorConfig;
+import io.github.hectorvent.floci.core.common.docker.ContainerBuilder;
+import io.github.hectorvent.floci.core.common.docker.ContainerDetector;
+import io.github.hectorvent.floci.core.common.docker.ContainerLifecycleManager;
+import io.github.hectorvent.floci.core.common.docker.ContainerSpec;
+import io.github.hectorvent.floci.core.common.docker.CurrentContainerNetworkResolver;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import org.jboss.logging.Logger;
+
+import java.util.List;
+import java.util.Optional;
+
+/** Publishes an in-container ALB listener through a sibling socat container when Floci runs in Docker. */
+@ApplicationScoped
+public class ElbV2ListenerForwardManager {
+
+    private static final Logger LOG = Logger.getLogger(ElbV2ListenerForwardManager.class);
+
+    private final ContainerBuilder containerBuilder;
+    private final ContainerDetector containerDetector;
+    private final ContainerLifecycleManager lifecycleManager;
+    private final CurrentContainerNetworkResolver networkResolver;
+    private final EmulatorConfig config;
+
+    @Inject
+    public ElbV2ListenerForwardManager(ContainerBuilder containerBuilder, ContainerDetector containerDetector,
+                                       ContainerLifecycleManager lifecycleManager,
+                                       CurrentContainerNetworkResolver networkResolver, EmulatorConfig config) {
+        this.containerBuilder = containerBuilder;
+        this.containerDetector = containerDetector;
+        this.lifecycleManager = lifecycleManager;
+        this.networkResolver = networkResolver;
+        this.config = config;
+    }
+
+    public void reconcile(int port) {
+        if (!containerDetector.isRunningInContainer()) {
+            return;
+        }
+        Optional<String> targetIp = networkResolver.resolveContainerIp();
+        if (targetIp.isEmpty()) {
+            LOG.warnv("Could not resolve Floci container IP; ALB listener port {0} is not host-published",
+                    String.valueOf(port));
+            return;
+        }
+        String name = forwardContainerName(port);
+        try {
+            lifecycleManager.removeIfExists(name);
+            ContainerBuilder.Builder builder = containerBuilder.newContainer(config.services().elbv2().listenerForwarderImage())
+                    .withName(name)
+                    .withEntrypoint(List.of("socat"))
+                    .withCmd(List.of("TCP-LISTEN:" + port + ",fork,reuseaddr", "TCP:" + targetIp.get() + ":" + port))
+                    .withPortBinding(port, port)
+                    .withLogRotation();
+            networkResolver.resolveNetworkName().ifPresent(builder::withNetworkMode);
+            ContainerSpec spec = builder.build();
+            lifecycleManager.createAndStart(spec);
+            LOG.infov("Published ALB listener port {0} on the host (socat -> {1}:{0})",
+                    String.valueOf(port), targetIp.get());
+        } catch (Exception e) {
+            LOG.warnv("Failed to publish ALB listener port {0} on the host: {1}",
+                    String.valueOf(port), e.getMessage());
+        }
+    }
+
+    public void remove(int port) {
+        if (containerDetector.isRunningInContainer()) {
+            lifecycleManager.removeIfExists(forwardContainerName(port));
+        }
+    }
+
+    static String forwardContainerName(int port) {
+        return "floci-elbv2-fwd-" + port;
+    }
+}