FlociClone/CHANGELOG.md

# Changelog

Entries in this file are generated by [semantic-release](https://github.com/semantic-release/semantic-release) from Conventional Commit messages — do not edit it by hand; your commit message is the changelog entry. Historic sections at the bottom were maintained by hand in the Keep a Changelog format.

# [2.1.0](https://github.com/floci-io/floci/compare/2.0.1...2.1.0) (2026-09-15)


### Bug Fixes

* **acm:** reflect the requested ValidationDomain in DescribeCertificate ([#3264](https://github.com/floci-io/floci/issues/3264)) ([922eb0b](https://github.com/floci-io/floci/commit/922eb0b9e501e1701985fe568e9d379ee3591818))
* **acm:** reject RequestCertificate key algorithms real ACM does not support ([#3044](https://github.com/floci-io/floci/issues/3044)) ([db6c419](https://github.com/floci-io/floci/commit/db6c41945939cbf39b657f707b1ecf7929729a7e)), closes [#3027](https://github.com/floci-io/floci/issues/3027)
* **acm:** report SUCCESS domain validation once a certificate is issued ([#3112](https://github.com/floci-io/floci/issues/3112)) ([9b28388](https://github.com/floci-io/floci/commit/9b28388d89ec0bdd1cdda11a588144d5cbb60a23))
* **acm:** stop hex-shaped names becoming bogus IP address SANs ([#3335](https://github.com/floci-io/floci/issues/3335)) ([7a7531a](https://github.com/floci-io/floci/commit/7a7531a6b9ea4e91b7edd1d98f638cd18a657055))
* **amazonmq:** add configuration for AMQP and console host port ranges ([#3315](https://github.com/floci-io/floci/issues/3315)) ([2d5a8f7](https://github.com/floci-io/floci/commit/2d5a8f705b75dd41c5daf6d8ae2e0d691b1e5b21))
* **apigateway:** add missing authorizer arg to two VtlContext test calls ([38056a0](https://github.com/floci-io/floci/commit/38056a00f6263c7c6cd8b4aad098923bec439e4b)), closes [#3560](https://github.com/floci-io/floci/issues/3560)
* **apigateway:** allow idempotent custom-id tags ([#3430](https://github.com/floci-io/floci/issues/3430)) ([eb62225](https://github.com/floci-io/floci/commit/eb622254bc843ae8e99ef226fdbec64cca9010e2))
* **apigateway:** answer an unmatched REST request with 403, not 404/405 ([#3547](https://github.com/floci-io/floci/issues/3547)) ([fb82fb2](https://github.com/floci-io/floci/commit/fb82fb29aed79e79850c1dd3616089310e3f002e))
* **apigateway:** decode the ~0 JSON Pointer escape in stage method-settings patch paths ([#3526](https://github.com/floci-io/floci/issues/3526)) ([bc44fc9](https://github.com/floci-io/floci/commit/bc44fc9106fb538c51226807ed29a5f0b04ac784))
* **apigateway:** enforce ApiKeyRequired on REST API methods ([#3537](https://github.com/floci-io/floci/issues/3537)) ([3b31c5a](https://github.com/floci-io/floci/commit/3b31c5a6637ef73655f4a6108ed5ce8b6f2be7e1)), closes [#3507](https://github.com/floci-io/floci/issues/3507) [#3507](https://github.com/floci-io/floci/issues/3507)
* **apigateway:** enforce AWS_IAM authorization on the execute-api data plane ([#2895](https://github.com/floci-io/floci/issues/2895)) ([06349c8](https://github.com/floci-io/floci/commit/06349c8d88ec6ae677b4c9f96e1aa3ec9f1e5b63)), closes [#2810](https://github.com/floci-io/floci/issues/2810)
* **apigateway:** expose VTL authorizer and parameter maps ([#3538](https://github.com/floci-io/floci/issues/3538)) ([2290247](https://github.com/floci-io/floci/commit/229024780230bd9a16e8c993766c3d29837eec50))
* **apigateway:** fall back to a parameterised sibling on method mismatch ([#3399](https://github.com/floci-io/floci/issues/3399)) ([f03a716](https://github.com/floci-io/floci/commit/f03a716e909231f981366791393fb5539852625b))
* **apigateway:** implement MOCK integration response selection based on status code ([#3327](https://github.com/floci-io/floci/issues/3327)) ([8d011cb](https://github.com/floci-io/floci/commit/8d011cb983b9b1073de10057d26023558fcdf5aa))
* **apigateway:** import x-amazon-apigateway-any-method on OpenAPI import ([#2876](https://github.com/floci-io/floci/issues/2876)) ([b85dd2b](https://github.com/floci-io/floci/commit/b85dd2b7f7fe5300ad8c830d9d2b998d67d06481))
* **apigateway:** include apiKeyId in the REQUEST authorizer identity context ([#3143](https://github.com/floci-io/floci/issues/3143)) ([dced3e7](https://github.com/floci-io/floci/commit/dced3e7bece71f1a9df2a008f0e3400b291a4fb5))
* **apigateway:** only emit the greedy path parameter for greedy resources ([#3397](https://github.com/floci-io/floci/issues/3397)) ([547090b](https://github.com/floci-io/floci/commit/547090bdfb4772db82734954e138cc105b651895))
* **apigateway:** prefer path parameters in VTL lookups ([#3560](https://github.com/floci-io/floci/issues/3560)) ([166b13a](https://github.com/floci-io/floci/commit/166b13a82f35d4a756f6a69c3b26b6b8d593fe01))
* **apigateway:** report rootResourceId and the API key defaults ([#3269](https://github.com/floci-io/floci/issues/3269)) ([c57b8ff](https://github.com/floci-io/floci/commit/c57b8ff5f650ea067e8a9d5ac657f3c74a402e12))
* **apigateway:** return the full integration configuration on read-back ([#3432](https://github.com/floci-io/floci/issues/3432)) ([a91d7be](https://github.com/floci-io/floci/commit/a91d7becd15629d97f77f7c1b4d330fdc4275b17))
* **apigateway:** take the last value of a repeated query string parameter ([#3548](https://github.com/floci-io/floci/issues/3548)) ([e8edc3d](https://github.com/floci-io/floci/commit/e8edc3d4b177e4c80e74fe89ff1c14beff16528f))
* **apigatewayv2:** provision integration, route and stage on quick create ([#2877](https://github.com/floci-io/floci/issues/2877)) ([2a637d3](https://github.com/floci-io/floci/commit/2a637d3e05d586313ab9777f6002465e29b084ea)), closes [#1902](https://github.com/floci-io/floci/issues/1902)
* **appconfigdata:** honor requested poll interval ([#3092](https://github.com/floci-io/floci/issues/3092)) ([8686651](https://github.com/floci-io/floci/commit/8686651de12aab05e6b7a52151cd3bc876fddfdb))
* **appconfigdata:** return empty payload on repeat polls ([#3295](https://github.com/floci-io/floci/issues/3295)) ([47d96f6](https://github.com/floci-io/floci/commit/47d96f619f3c06c3c99c3c2e1154d021b8d9d63c))
* **appsync:** verify JWT signatures and SigV4 requests for GraphQL auth ([#3541](https://github.com/floci-io/floci/issues/3541)) ([f38a384](https://github.com/floci-io/floci/commit/f38a384e5101976df95502dd9f9bc6b2bbb76f3c))
* **athena:** project the column names the Glue table declares ([#3414](https://github.com/floci-io/floci/issues/3414)) ([ebe9cf2](https://github.com/floci-io/floci/commit/ebe9cf2264c6c00b062a6b787f5a85da938eb71d))
* **athena:** read a projecting table's partition paths, not its whole location ([#3415](https://github.com/floci-io/floci/issues/3415)) ([6d6940b](https://github.com/floci-io/floci/commit/6d6940bb8fc35b550819957218e90954b97fc41c))
* **athena:** register every Glue database as a DuckDB schema so <db>.<table> resolves ([#2993](https://github.com/floci-io/floci/issues/2993)) ([0ab9979](https://github.com/floci-io/floci/commit/0ab9979edf305038543311eaffb1752fe6bb33ac))
* **autoscaling:** round-trip launch configuration InstanceMonitoring and BlockDeviceMappings ([#3174](https://github.com/floci-io/floci/issues/3174)) ([4cc850e](https://github.com/floci-io/floci/commit/4cc850e8df8b2635e405f1adc4e604634992c564))
* **autoscaling:** round-trip the dropped Auto Scaling group fields ([#3494](https://github.com/floci-io/floci/issues/3494)) ([cebb011](https://github.com/floci-io/floci/commit/cebb011a007e18594ba152a2a76a815850c16f90))
* **autoscaling:** validate monitoring booleans ([#3219](https://github.com/floci-io/floci/issues/3219)) ([84a7ce6](https://github.com/floci-io/floci/commit/84a7ce67e4c844a915209c48698d6c647c990e69))
* bound CloudTrail delivery retries ([#3298](https://github.com/floci-io/floci/issues/3298)) ([d44a3fe](https://github.com/floci-io/floci/commit/d44a3fef62c39ebb17e5f43927d889269d8bb80c))
* **build:** publish arm64 baseline release image ([#3461](https://github.com/floci-io/floci/issues/3461)) ([e0d4318](https://github.com/floci-io/floci/commit/e0d43189f77308d8c5150988f97643c66a735508))
* **cdk:** parse CDK endpoint URLs safely ([#3352](https://github.com/floci-io/floci/issues/3352)) ([c5e1a7f](https://github.com/floci-io/floci/commit/c5e1a7f7ac9d4ec5828d51c2ec017170d3ada557))
* **cloudcontrol:** reject ListResources for unsupported resource types instead of returning empty ([#3141](https://github.com/floci-io/floci/issues/3141)) ([5cf10ec](https://github.com/floci-io/floci/commit/5cf10ece189f30fca0664ccb01545b416b076852)), closes [#2043](https://github.com/floci-io/floci/issues/2043)
* **cloudcontrol:** scope resources by caller account ([#3244](https://github.com/floci-io/floci/issues/3244)) ([b6080ea](https://github.com/floci-io/floci/commit/b6080ea4ffb310829240425853b3a4757df05956))
* **cloudformation:** apply AWS::SQS::Queue tags from the template ([#3532](https://github.com/floci-io/floci/issues/3532)) ([a5045d3](https://github.com/floci-io/floci/commit/a5045d3aefd6bc30fb95d069282cf2468ff74a89)), closes [#2985](https://github.com/floci-io/floci/issues/2985)
* **cloudformation:** delete AWS::IAM::User on stack deletion ([#3076](https://github.com/floci-io/floci/issues/3076)) ([7b5c6e2](https://github.com/floci-io/floci/commit/7b5c6e272db97ec0497f0a5d9349e337fc8469b4)), closes [#2490](https://github.com/floci-io/floci/issues/2490)
* **cloudformation:** expand AWS::Serverless::StateMachine, and reject every unresolvable DefinitionUri on both StateMachine and HttpApi ([#2885](https://github.com/floci-io/floci/issues/2885)) ([f2b4c08](https://github.com/floci-io/floci/commit/f2b4c084816095772c9ca0612ebba8ddf5e16103))
* **cloudformation:** expose the RDS resource-id GetAtt attributes ([#3527](https://github.com/floci-io/floci/issues/3527)) ([b618fa9](https://github.com/floci-io/floci/commit/b618fa9033dd2e5426612871d22ab2b47da21926))
* **cloudformation:** identify unsupported SAM Cognito authorizers ([#3535](https://github.com/floci-io/floci/issues/3535)) ([809ce40](https://github.com/floci-io/floci/commit/809ce40f1e5b29debcfbb88cbd60d65071243a4c))
* **cloudformation:** keep a generated physical name across stack updates ([#2788](https://github.com/floci-io/floci/issues/2788)) ([1528c65](https://github.com/floci-io/floci/commit/1528c65df36c336426b474263ecb6132e588f2ac))
* **cloudformation:** keep generated names across updates for Scheduler, SQS and MicrovmImage ([#2985](https://github.com/floci-io/floci/issues/2985)) ([9162b99](https://github.com/floci-io/floci/commit/9162b990ec706c70b935d0170d195588ffa4ad71)), closes [#2788](https://github.com/floci-io/floci/issues/2788)
* **cloudformation:** keep unchanged VPCs and security groups on stack update ([#3033](https://github.com/floci-io/floci/issues/3033)) ([dde11ae](https://github.com/floci-io/floci/commit/dde11aeb6a5966ae823208a96cbaef6a7f45036a))
* **cloudformation:** merge Fn::Transform AWS::Include before provisioning, and honour GetTemplate TemplateStage ([#2886](https://github.com/floci-io/floci/issues/2886)) ([77b4881](https://github.com/floci-io/floci/commit/77b4881fe40eb1fc40ed10896d9628e1373a4d9b))
* **cloudformation:** persist FunctionResponseTypes on Lambda::EventSourceMapping ([#2964](https://github.com/floci-io/floci/issues/2964)) ([9e2c031](https://github.com/floci-io/floci/commit/9e2c03158d5604af4909b9552c0254e3cd7fce78)), closes [#2848](https://github.com/floci-io/floci/issues/2848)
* **cloudformation:** preserve list intrinsics and conditional tags ([#2986](https://github.com/floci-io/floci/issues/2986)) ([9f44254](https://github.com/floci-io/floci/commit/9f442543e3465230ded806377e8c0758a10e8a8f))
* **cloudformation:** preserve SAM implicit API auth ([#3501](https://github.com/floci-io/floci/issues/3501)) ([8963c66](https://github.com/floci-io/floci/commit/8963c665eb034d557286d5cbc6b1f5ba65238fc4))
* **cloudformation:** provision AWS::Scheduler::ScheduleGroup ([#2796](https://github.com/floci-io/floci/issues/2796)) ([961d82d](https://github.com/floci-io/floci/commit/961d82dda984be5576a1d6a19ecd60eddba4cddf))
* **cloudformation:** provision CloudFront policies and origin access controls ([#3228](https://github.com/floci-io/floci/issues/3228)) ([895adce](https://github.com/floci-io/floci/commit/895adce214b67765e6e46b7fe2ee4026eca91405)), closes [#2441](https://github.com/floci-io/floci/issues/2441)
* **cloudformation:** reconcile AWS::Pipes::Pipe on UpdateStack ([#2970](https://github.com/floci-io/floci/issues/2970)) ([a31a959](https://github.com/floci-io/floci/commit/a31a9599fd5ff1bbd8cf6a8771e96afed5044b93))
* **cloudformation:** refuse UpdateStack on a ROLLBACK_COMPLETE stack ([#3104](https://github.com/floci-io/floci/issues/3104)) ([d2d7eb4](https://github.com/floci-io/floci/commit/d2d7eb4131b69e6cb69561ef34f3a4997ce37f9d)), closes [#3097](https://github.com/floci-io/floci/issues/3097)
* **cloudformation:** replace AWS RDSDBCluster when EngineMode or StorageEncrypted changes ([#3555](https://github.com/floci-io/floci/issues/3555)) ([589b1ab](https://github.com/floci-io/floci/commit/589b1aba9cab7089e75caa371b1c8d5f73a44a94))
* **cloudformation:** resolve dynamic references for all template values ([#3301](https://github.com/floci-io/floci/issues/3301)) ([924e35c](https://github.com/floci-io/floci/commit/924e35cefe4257e721afa087118af5a499666f88)), closes [ProvisionContext#resolveOptional](https://github.com/ProvisionContext/issues/resolveOptional) [#2213](https://github.com/floci-io/floci/issues/2213)
* **cloudformation:** resolve FunctionResponseTypes through whole-property intrinsics ([#2996](https://github.com/floci-io/floci/issues/2996)) ([9eb4fc8](https://github.com/floci-io/floci/commit/9eb4fc82cd2a782f4de0e67ef87b250ea79787fe)), closes [#2964](https://github.com/floci-io/floci/issues/2964) [#2964](https://github.com/floci-io/floci/issues/2964) [#2796](https://github.com/floci-io/floci/issues/2796) [#2946](https://github.com/floci-io/floci/issues/2946)
* **cloudformation:** resolve list-valued intrinsics for DBSubnetGroup SubnetIds ([#2946](https://github.com/floci-io/floci/issues/2946)) ([f214050](https://github.com/floci-io/floci/commit/f2140508679488fa786bcb65a4bb496eae3c46d3)), closes [#2937](https://github.com/floci-io/floci/issues/2937) [#2937](https://github.com/floci-io/floci/issues/2937) [#2937](https://github.com/floci-io/floci/issues/2937) [#2937](https://github.com/floci-io/floci/issues/2937) [#2937](https://github.com/floci-io/floci/issues/2937) [#2937](https://github.com/floci-io/floci/issues/2937) [#2937](https://github.com/floci-io/floci/issues/2937)
* **cloudformation:** scope stack state by account ([#3185](https://github.com/floci-io/floci/issues/3185)) ([0cff315](https://github.com/floci-io/floci/commit/0cff3156eccf32b706f6f298f4e3ec8758817aa4))
* **cloudformation:** set Fn::GetAtt attributes the schemas declare ([#2761](https://github.com/floci-io/floci/issues/2761)) ([7095641](https://github.com/floci-io/floci/commit/7095641e25b82c6b8282bf5ee68daa38c5271349))
* **cloudformation:** skip re-invoking custom resource handlers when properties are unchanged ([#2785](https://github.com/floci-io/floci/issues/2785)) ([71c7836](https://github.com/floci-io/floci/commit/71c7836da1bb01f89ce78914e8f9b0c65cc505f8))
* **cloudformation:** validate WAFv2 WebACL and Config rule required properties ([#3576](https://github.com/floci-io/floci/issues/3576)) ([36c8396](https://github.com/floci-io/floci/commit/36c8396f259809307e4a84e66e367e2b9fe4cfd1)), closes [#2711](https://github.com/floci-io/floci/issues/2711)
* **cloudformation:** wire Route53 and Scheduler provisioners into the test fixture ([#2922](https://github.com/floci-io/floci/issues/2922)) ([cf10d25](https://github.com/floci-io/floci/commit/cf10d25ac2edb5cbfcf0178175bd52488f394773)), closes [#2722](https://github.com/floci-io/floci/issues/2722) [#2796](https://github.com/floci-io/floci/issues/2796)
* **cloudfront:** echo OriginSslProtocols and round-trip legacy cache behavior fields ([#3182](https://github.com/floci-io/floci/issues/3182)) ([006f3c7](https://github.com/floci-io/floci/commit/006f3c77c9548d81259f010eb2a434b04d088af0))
* **cloudfront:** echo TrustedSigners in cache behaviors so the AWS provider does not segfault ([#3015](https://github.com/floci-io/floci/issues/3015)) ([75e93e5](https://github.com/floci-io/floci/commit/75e93e5e77be426db7622582d14747a48941844d)), closes [#2767](https://github.com/floci-io/floci/issues/2767)
* **cloudfront:** emit origin timeout fields ([#3299](https://github.com/floci-io/floci/issues/3299)) ([3523378](https://github.com/floci-io/floci/commit/35233787a8202eea5c4c1990687cfa58f3ce7a39)), closes [#3221](https://github.com/floci-io/floci/issues/3221)
* **cloudfront:** persist and echo LambdaFunctionAssociations and FunctionAssociations ([#2915](https://github.com/floci-io/floci/issues/2915)) ([3d3ab00](https://github.com/floci-io/floci/commit/3d3ab0023f892a0609bb6725e4b1c3184b4eed3e)), closes [#2835](https://github.com/floci-io/floci/issues/2835)
* **cloudfront:** report Logging on distribution reads ([#3318](https://github.com/floci-io/floci/issues/3318)) ([d4e9dcb](https://github.com/floci-io/floci/commit/d4e9dcbe5559bf5244afb5723b54960c3db10f0b))
* **cloudfront:** stop duplicating CachedMethods into AllowedMethods.Items ([#3217](https://github.com/floci-io/floci/issues/3217)) ([9e9b0b6](https://github.com/floci-io/floci/commit/9e9b0b6e91d8d1d59ca8657092f99ac65fc9144d))
* **cloudhsmv2:** tighten backup and tag fidelity ([#3443](https://github.com/floci-io/floci/issues/3443)) ([daff15d](https://github.com/floci-io/floci/commit/daff15da9f992b718f43267aa6463088d937a025))
* **cloudtrail:** bound log flush memory ([#3293](https://github.com/floci-io/floci/issues/3293)) ([d3530d9](https://github.com/floci-io/floci/commit/d3530d90c9490d473f1e9920791a4a86376ad17d))
* **cloudtrail:** implement CreateTrail with tagging support and add integration tests ([#3206](https://github.com/floci-io/floci/issues/3206)) ([991470e](https://github.com/floci-io/floci/commit/991470e7c41d31fb467928eb0ee2ceb481a26b33))
* **cloudtrail:** serialize trail mutations to prevent lost updates ([#2911](https://github.com/floci-io/floci/issues/2911)) ([8c2619f](https://github.com/floci-io/floci/commit/8c2619f96549e2ce212fe16326e7fbdf294a7aa3)), closes [#2904](https://github.com/floci-io/floci/issues/2904)
* **cloudtrail:** stop CloudTrailLogWriterBoundedRetryIntegrationTest relying on S3 key order ([#3363](https://github.com/floci-io/floci/issues/3363)) ([34be181](https://github.com/floci-io/floci/commit/34be181c0cc69024da2d79e6caa7c804598346da)), closes [#3361](https://github.com/floci-io/floci/issues/3361)
* **cloudwatch:** fail Logs Insights queries with unsupported syntax instead of silently dropping it ([#3139](https://github.com/floci-io/floci/issues/3139)) ([121a929](https://github.com/floci-io/floci/commit/121a9292b7ba772658952601f5f7715cf880039f))
* **cloudwatchlogs:** bound stored events and enforce retention ([#3611](https://github.com/floci-io/floci/issues/3611)) ([6ce3fbb](https://github.com/floci-io/floci/commit/6ce3fbbd2e852a7dfda45e7e7747c62254f79403))
* **cloudwatch:** wrap TagResource and UntagResource in their declared Result element ([#3211](https://github.com/floci-io/floci/issues/3211)) ([65db87d](https://github.com/floci-io/floci/commit/65db87d627da6bea64891c1e2c898afbf33d58bf))
* **codebuild:** persist build numbers across restarts ([#3049](https://github.com/floci-io/floci/issues/3049)) ([51f5591](https://github.com/floci-io/floci/commit/51f5591f85022781b6404d0e2444902b4428822f))
* **codebuild:** resolve project ARNs in batch lookup ([#2999](https://github.com/floci-io/floci/issues/2999)) ([de92212](https://github.com/floci-io/floci/commit/de92212b1b4f204b8720ccd4f1ad541fe1bbdfbf))
* **codedeploy:** default server hook timeout to one hour ([#3606](https://github.com/floci-io/floci/issues/3606)) ([73ef15f](https://github.com/floci-io/floci/commit/73ef15f6e26628974dee4438ed7096d30cf07a12))
* **codedeploy:** fail closed on unreachable, erroring, or timed-out lifecycle hooks ([#3563](https://github.com/floci-io/floci/issues/3563)) ([d167cc5](https://github.com/floci-io/floci/commit/d167cc5bf378ba038cbd1d976ffaac5b2ce6d7b6))
* **codepipeline:** cap QUEUED and PARALLEL pipelines at 50 active executions ([#3503](https://github.com/floci-io/floci/issues/3503)) ([2104b33](https://github.com/floci-io/floci/commit/2104b33ea74d2646e96ef2010f9e0beac4d8e3af))
* **codepipeline:** poll S3 source changes ([#3525](https://github.com/floci-io/floci/issues/3525)) ([ffd2488](https://github.com/floci-io/floci/commit/ffd2488f02d90d58a354b352406c43186cc187a9))
* **codepipeline:** populate stage execution status ([#3478](https://github.com/floci-io/floci/issues/3478)) ([129ba0a](https://github.com/floci-io/floci/commit/129ba0a260d5a0e57c41094ff960ea9d686d4926))
* **cognito:** clear stale pending admin updates ([#2533](https://github.com/floci-io/floci/issues/2533)) ([a704f73](https://github.com/floci-io/floci/commit/a704f731aa150c2ddbc17a2f0eb1b142fe5ba9e5))
* **cognito:** delete a pool's users and resource servers on DeleteUserPool ([#3419](https://github.com/floci-io/floci/issues/3419)) ([c48e81d](https://github.com/floci-io/floci/commit/c48e81d9561b5d688b21525e75cca7e89ec90df7)), closes [#2858](https://github.com/floci-io/floci/issues/2858)
* **cognito:** delete a user pool's records with the pool ([#2949](https://github.com/floci-io/floci/issues/2949)) ([2a4ca61](https://github.com/floci-io/floci/commit/2a4ca61baf4cd6b3870fdd562170346145eaafb8)), closes [#3419](https://github.com/floci-io/floci/issues/3419) [#2864](https://github.com/floci-io/floci/issues/2864) [#2936](https://github.com/floci-io/floci/issues/2936) [#2864](https://github.com/floci-io/floci/issues/2864)
* **cognito:** fail listUsers/listUserPoolClients on an absent user pool ([#2962](https://github.com/floci-io/floci/issues/2962)) ([4bf17a1](https://github.com/floci-io/floci/commit/4bf17a1fe2872de9e803eb6d003ba9154c673f1a)), closes [#2952](https://github.com/floci-io/floci/issues/2952)
* **cognito:** invoke the CustomMessage Lambda trigger before delivering verification emails ([#3140](https://github.com/floci-io/floci/issues/3140)) ([148ec83](https://github.com/floci-io/floci/commit/148ec839bd6ad27da718520126074b5de2aeda6f))
* **cognito:** name missing user pools in errors ([#2936](https://github.com/floci-io/floci/issues/2936)) ([c30ca8f](https://github.com/floci-io/floci/commit/c30ca8fb5fc5ede366a1e27bf01c5f4cd80e4173))
* **cognito:** serialize attribute verification updates ([#2535](https://github.com/floci-io/floci/issues/2535)) ([530717e](https://github.com/floci-io/floci/commit/530717e8e0f31df27a883b043e994c7caa4db2dc))
* **cognito:** verify self-service access tokens ([#3184](https://github.com/floci-io/floci/issues/3184)) ([3c247eb](https://github.com/floci-io/floci/commit/3c247ebd51aaafa85933c33a4432fb817a4a9265))
* **compat:** avoid CloudWatch statistics time race ([#3320](https://github.com/floci-io/floci/issues/3320)) ([bf49390](https://github.com/floci-io/floci/commit/bf49390969ce7a3761b9540e76aebcfb4d29f386))
* **compat:** require Kinesis stream details ([#3321](https://github.com/floci-io/floci/issues/3321)) ([53a5164](https://github.com/floci-io/floci/commit/53a51640cfcb39db2fac641065c661697eac3149))
* **compat:** retry RedshiftTest's SDK calls past a brief connection-refused hiccup ([#3216](https://github.com/floci-io/floci/issues/3216)) ([974d357](https://github.com/floci-io/floci/commit/974d357f88abf55ad232fa53d8f857b97fa3dd6e))
* **config:** accept any Host header again after the Quarkus 3.39 upgrade ([#3222](https://github.com/floci-io/floci/issues/3222)) ([1f4d43c](https://github.com/floci-io/floci/commit/1f4d43c4ccb58dc417514515e0765abcd8fa334f)), closes [#3175](https://github.com/floci-io/floci/issues/3175)
* **core:** accept ARNs from every AWS partition ([#3376](https://github.com/floci-io/floci/issues/3376)) ([1726c6a](https://github.com/floci-io/floci/commit/1726c6a8a336440398d6388ece92c2c04004560d)), closes [#2485](https://github.com/floci-io/floci/issues/2485)
* **core:** accept only JSON objects as JSON protocol request bodies ([#3509](https://github.com/floci-io/floci/issues/3509)) ([9f9a828](https://github.com/floci-io/floci/commit/9f9a828439a0bb7e79781a09a0c4438393a8cdfe))
* **core:** prevent REST JSON requests falling through to S3 ([#3498](https://github.com/floci-io/floci/issues/3498)) ([e62e99f](https://github.com/floci-io/floci/commit/e62e99f060447256b953a6d186900fa8e7734ffd))
* **core:** quarantine unreadable hybrid storage ([#2250](https://github.com/floci-io/floci/issues/2250)) ([cc8b8e9](https://github.com/floci-io/floci/commit/cc8b8e9f14a8d382471366662b5807f3be62a3c0))
* **core:** read ARN resource segments by structure, not by position ([#3392](https://github.com/floci-io/floci/issues/3392)) ([7c08b35](https://github.com/floci-io/floci/commit/7c08b35f1d47e1984096f07a872ec642f2686766))
* **docdb:** accept an existing security group on CreateDBCluster and ModifyDBCluster ([#2991](https://github.com/floci-io/floci/issues/2991)) ([91d7ab8](https://github.com/floci-io/floci/commit/91d7ab8935a3e50ded759a1b279b98cb905ac6bd)), closes [#2990](https://github.com/floci-io/floci/issues/2990)
* **docker:** allow explicit root for restricted sockets ([#3558](https://github.com/floci-io/floci/issues/3558)) ([d8e7382](https://github.com/floci-io/floci/commit/d8e7382d5bef999aa7e145a11e4eb16daac4cb8b))
* **docker:** PortAllocator also checks ports other containers already publish on the host ([#2805](https://github.com/floci-io/floci/issues/2805)) ([afa5960](https://github.com/floci-io/floci/commit/afa5960709b98da42a44b65bbe33304e82c8bdc2))
* **docker:** produce a working native image from Dockerfile.native ([#3325](https://github.com/floci-io/floci/issues/3325)) ([a501eab](https://github.com/floci-io/floci/commit/a501eabbf9112208b461fd4e2175a5ac1dfae795))
* **docker:** translate misleading disk-quota error for keyring exhaustion ([#2797](https://github.com/floci-io/floci/issues/2797)) ([7828ab2](https://github.com/floci-io/floci/commit/7828ab2430ba635cd1b54841f709318b04451296)), closes [floci-io/floci#2243](https://github.com/floci-io/floci/issues/2243)
* **dynamodb:** add missing request validation ([#3287](https://github.com/floci-io/floci/issues/3287)) ([4d199b1](https://github.com/floci-io/floci/commit/4d199b144e40c5cfa216c37b76c1f17a6932aebf))
* **dynamodb:** append list values for out-of-range indexes ([#3088](https://github.com/floci-io/floci/issues/3088)) ([f8a1c31](https://github.com/floci-io/floci/commit/f8a1c3134ac5cc9f36c9514027d3506ffa9a4804))
* **dynamodb:** apply GSI throughput updates ([#3032](https://github.com/floci-io/floci/issues/3032)) ([2d26f93](https://github.com/floci-io/floci/commit/2d26f93e7dd483f296dbeacce83f05c7be6f7b8f)), closes [#3028](https://github.com/floci-io/floci/issues/3028)
* **dynamodb:** bind every PartiQL parameter type and reject unordered operands ([#3288](https://github.com/floci-io/floci/issues/3288)) ([66ca9dc](https://github.com/floci-io/floci/commit/66ca9dc4a6b9a95512c5450f4ad85ca569521fc8))
* **dynamodb:** calculate consumed capacity correctly ([#3071](https://github.com/floci-io/floci/issues/3071)) ([97915d3](https://github.com/floci-io/floci/commit/97915d366828d7ecec0d22632d912e504ea924bf))
* **dynamodb:** enforce primary key size limits ([#3354](https://github.com/floci-io/floci/issues/3354)) ([8624ccc](https://github.com/floci-io/floci/commit/8624ccce832100fab93986b9400f519384a15792))
* **dynamodb:** flush persistence once per affected table in batch and transact writes ([#2998](https://github.com/floci-io/floci/issues/2998)) ([80725e6](https://github.com/floci-io/floci/commit/80725e6f483a4066c195bc2b325f2ee5bfb42a7f)), closes [#2995](https://github.com/floci-io/floci/issues/2995) [#2995](https://github.com/floci-io/floci/issues/2995) [#2995](https://github.com/floci-io/floci/issues/2995)
* **dynamodb:** honor customer-supplied KMS key for table SSE ([#1923](https://github.com/floci-io/floci/issues/1923)) ([e313ab5](https://github.com/floci-io/floci/commit/e313ab5b1dbc12924fe826ec94b9555cf2a8f5ba)), closes [#1811](https://github.com/floci-io/floci/issues/1811)
* **dynamodb:** keep stream iterators stable after trimming ([#3313](https://github.com/floci-io/floci/issues/3313)) ([b377134](https://github.com/floci-io/floci/commit/b377134fcbe048fc06ff0a9da522e664bce4c16e))
* **dynamodb:** match AWS on UpdateItem results and request limits ([#3447](https://github.com/floci-io/floci/issues/3447)) ([6d43e16](https://github.com/floci-io/floci/commit/6d43e16d0efb70e4fac41080ee3b1830db59684b))
* **dynamodb:** match AWS wording and order for Select rejections ([#3410](https://github.com/floci-io/floci/issues/3410)) ([dffe34e](https://github.com/floci-io/floci/commit/dffe34e1333e67b3ce03db93b8876ebbd2c710d6))
* **dynamodb:** merge shared-prefix projection paths and compact list indices ([#3072](https://github.com/floci-io/floci/issues/3072)) ([5c8cff6](https://github.com/floci-io/floci/commit/5c8cff61b887e49a5b228f4dbba25c2781f0ac84))
* **dynamodb:** more request validations in Query and Scan ([#3360](https://github.com/floci-io/floci/issues/3360)) ([fbe92aa](https://github.com/floci-io/floci/commit/fbe92aa41102c0ef687a0f4b9c113ab3a2408550)), closes [#3287](https://github.com/floci-io/floci/issues/3287)
* **dynamodb:** name the table in the ResourceNotFoundException message ([#2929](https://github.com/floci-io/floci/issues/2929)) ([58b2e5f](https://github.com/floci-io/floci/commit/58b2e5ff9610943e02337f484ebc1067bd395e50))
* **dynamodb:** partition parallel scan by partition key hash ([#3225](https://github.com/floci-io/floci/issues/3225)) ([#3429](https://github.com/floci-io/floci/issues/3429)) ([9c9aa67](https://github.com/floci-io/floci/commit/9c9aa670e436d8c139426eaabd22fbeb352f0165))
* **dynamodb:** re-check TTL under item lock before sweeper deletes ([#3562](https://github.com/floci-io/floci/issues/3562)) ([f1bbe12](https://github.com/floci-io/floci/commit/f1bbe12d62f99f97413d5034654f538781abfcb3))
* **dynamodb:** read every attribute through an ALL-projection index in PartiQL ([#3309](https://github.com/floci-io/floci/issues/3309)) ([4cb9314](https://github.com/floci-io/floci/commit/4cb9314a2d246e14210e99354eb0e7eafa8474dc))
* **dynamodb:** reject a BETWEEN with reversed bounds at parse time ([#3183](https://github.com/floci-io/floci/issues/3183)) ([df0bf82](https://github.com/floci-io/floci/commit/df0bf82e1232632aff6c6b7c904e85302bffc821))
* **dynamodb:** reject ConsistentRead on GSI Scan ([#2931](https://github.com/floci-io/floci/issues/2931)) ([6dec214](https://github.com/floci-io/floci/commit/6dec21479beea719ac59bf80b3c5f58b912dd45a))
* **dynamodb:** reject out-of-bound query cursors ([#3389](https://github.com/floci-io/floci/issues/3389)) ([862e4a1](https://github.com/floci-io/floci/commit/862e4a1c776975c8c2dc63cd04483b9a5a3d2000))
* **dynamodb:** reject QueryFilter with KeyConditionExpression ([#2935](https://github.com/floci-io/floci/issues/2935)) ([7d693de](https://github.com/floci-io/floci/commit/7d693de663bfa58bd5d7dea1da159e1a41ed9297))
* **dynamodb:** reject unused ExpressionAttributeNames/Values on PutItem, DeleteItem, Scan, Query ([#2923](https://github.com/floci-io/floci/issues/2923)) ([262495d](https://github.com/floci-io/floci/commit/262495df67dcd13e9d8b537a244794365b1d2122)), closes [#2893](https://github.com/floci-io/floci/issues/2893) [#2893](https://github.com/floci-io/floci/issues/2893) [#st](https://github.com/floci-io/floci/issues/st) [#2893](https://github.com/floci-io/floci/issues/2893)
* **dynamodb:** route Kinesis CDC to the table owner's account and retry failed forwards ([#3063](https://github.com/floci-io/floci/issues/3063)) ([a9df872](https://github.com/floci-io/floci/commit/a9df872956056dfd111609fc796787d9a69a96b4))
* **dynamodb:** stage transact write mutations before commit ([#3189](https://github.com/floci-io/floci/issues/3189)) ([8343583](https://github.com/floci-io/floci/commit/83435838356dc828a7c399e70a25ff2bed0ef279))
* **dynamodb:** word BatchWriteItem key rejections the way AWS does ([#3227](https://github.com/floci-io/floci/issues/3227)) ([f4954de](https://github.com/floci-io/floci/commit/f4954dec020b4533e3e16c5a33a6b10fd47e1c4b))
* **ec2,ecr,eks,elasticache,msk,opensearch:** degrade gracefully with no Docker daemon ([#2975](https://github.com/floci-io/floci/issues/2975)) ([1aa981f](https://github.com/floci-io/floci/commit/1aa981fef27a0bec3f5428291d13607fae42b29f)), closes [#2386](https://github.com/floci-io/floci/issues/2386) [#3023](https://github.com/floci-io/floci/issues/3023)
* **ec2,ssm:** explain missing IMDS registration for SSM-only managed instances ([#3283](https://github.com/floci-io/floci/issues/3283)) ([f77cf4d](https://github.com/floci-io/floci/commit/f77cf4da77fd127be701360b22634da87ef06df6))
* **ec2:** add network capacity to instance type responses ([#3179](https://github.com/floci-io/floci/issues/3179)) ([f9686d5](https://github.com/floci-io/floci/commit/f9686d5eb2468dbd49ffa0362aa6e3d35ab102cd))
* **ec2:** align catalog image owner filtering ([#3463](https://github.com/floci-io/floci/issues/3463)) ([a6f1751](https://github.com/floci-io/floci/commit/a6f1751dfb8c9a7715771cb18a1ef1aa908f8259))
* **ec2:** answer DescribeTransitGatewayConnects with an empty list ([#3274](https://github.com/floci-io/floci/issues/3274)) ([f30ba77](https://github.com/floci-io/floci/commit/f30ba77ac074c2f973091c8f9a40b5428c9de28d))
* **ec2:** bound launches and close userdata streams ([#3135](https://github.com/floci-io/floci/issues/3135)) ([dd33308](https://github.com/floci-io/floci/commit/dd33308e7eca9f6e01e17f48aa0a99ca4cdf6970))
* **ec2:** bound user data output capture ([#3144](https://github.com/floci-io/floci/issues/3144)) ([653c139](https://github.com/floci-io/floci/commit/653c1397a2be3611598a6fe819cf01c709c4d67a))
* **ec2:** build the instance AWS_ENDPOINT_URL from the shared container endpoint ([#3579](https://github.com/floci-io/floci/issues/3579)) ([1ae779a](https://github.com/floci-io/floci/commit/1ae779a9d9cc432395c9a879cfc465178356511c)), closes [#3578](https://github.com/floci-io/floci/issues/3578)
* **ec2:** carry DeliverLogsPermissionArn through CreateFlowLogs and DescribeFlowLogs ([#3172](https://github.com/floci-io/floci/issues/3172)) ([acc0904](https://github.com/floci-io/floci/commit/acc0904be4f607fc7a8c7561d3484fe9e680bcd9))
* **ec2:** describe launchable unknown AMI ids in DescribeImages ([#3168](https://github.com/floci-io/floci/issues/3168)) ([de5dc0d](https://github.com/floci-io/floci/commit/de5dc0da35083b216483517237f8aa52680e6cc6))
* **ec2:** generate real key material in CreateKeyPair and fingerprint imported keys ([#3307](https://github.com/floci-io/floci/issues/3307)) ([2fbe2b7](https://github.com/floci-io/floci/commit/2fbe2b7c647c924be9586170a5fb5527850829f7)), closes [PKCS#1](https://github.com/PKCS/issues/1) [PKCS#8](https://github.com/PKCS/issues/8)
* **ec2:** guard null group entries in DescribeNetworkInterfaces group-id filter ([#2887](https://github.com/floci-io/floci/issues/2887)) ([5c71713](https://github.com/floci-io/floci/commit/5c71713cadfccc0cfa364fe4a13457de18126204))
* **ec2:** honor AMI architecture for containers ([#3096](https://github.com/floci-io/floci/issues/3096)) ([43cdbe2](https://github.com/floci-io/floci/commit/43cdbe234fcf15c80d7855f3b9743d917242a02c))
* **ec2:** include network metadata in instance type responses ([#2943](https://github.com/floci-io/floci/issues/2943)) ([c54b237](https://github.com/floci-io/floci/commit/c54b237cd8e1fe79ca224435d3f465727b1dda56))
* **ec2:** include supported usage classes in DescribeInstanceTypes ([#3347](https://github.com/floci-io/floci/issues/3347)) ([19f410d](https://github.com/floci-io/floci/commit/19f410d6b025316d08d86ba0d345deda926cc2a0))
* **ec2:** let dnf swap curl-minimal for curl when installing the IMDS proxy ([#3284](https://github.com/floci-io/floci/issues/3284)) ([5648be7](https://github.com/floci-io/floci/commit/5648be79c46b6f9fd79f3b1191cc7e045ade0cf6)), closes [floci-io/floci#3281](https://github.com/floci-io/floci/issues/3281)
* **ec2:** match cidr-block-association filters on DescribeVpcs ([#3257](https://github.com/floci-io/floci/issues/3257)) ([eb3a6b2](https://github.com/floci-io/floci/commit/eb3a6b23ef61c56d8db6522722a0c161be5a5390)), closes [#3256](https://github.com/floci-io/floci/issues/3256)
* **ec2:** nest cidrBlockState in AssociateVpcCidrBlock response ([#3243](https://github.com/floci-io/floci/issues/3243)) ([496b376](https://github.com/floci-io/floci/commit/496b376da1b685edf56726fbf4dcb83994583b98)), closes [#3241](https://github.com/floci-io/floci/issues/3241)
* **ec2:** place a subnet in the zone its request names, not always az1 ([#2890](https://github.com/floci-io/floci/issues/2890)) ([c32f8b5](https://github.com/floci-io/floci/commit/c32f8b5a24feaeab245dc358fea5d5bf603921f6))
* **ec2:** reclaim instance containers orphaned by a hard restart ([#3031](https://github.com/floci-io/floci/issues/3031)) ([94b9665](https://github.com/floci-io/floci/commit/94b9665c3224edb87815aa56e5287a6f057c8df8)), closes [#2029](https://github.com/floci-io/floci/issues/2029)
* **ec2:** register all guest network addresses with IMDS ([#3546](https://github.com/floci-io/floci/issues/3546)) ([3c6568b](https://github.com/floci-io/floci/commit/3c6568bac5489f78610df01f954e641204a70d65))
* **ec2:** reject a CreateSubnet whose CIDR overlaps an existing subnet ([#3171](https://github.com/floci-io/floci/issues/3171)) ([614166f](https://github.com/floci-io/floci/commit/614166fe1fbc0001891cdf757bbe30df166a7cf6))
* **ec2:** report a NAT gateway's addresses, not just its allocation id ([#2892](https://github.com/floci-io/floci/issues/2892)) ([bed2704](https://github.com/floci-io/floci/commit/bed27043ef66212f3653b6c5a24250735e1fb2f3))
* **ec2:** report NotFound for launch templates requested by name ([#3246](https://github.com/floci-io/floci/issues/3246)) ([8bc4891](https://github.com/floci-io/floci/commit/8bc4891a9a9f554abe8f80bd6416f0675efe373f)), closes [#3234](https://github.com/floci-io/floci/issues/3234)
* **ec2:** store and validate CreateVpcEndpoint SubnetConfiguration ([#3491](https://github.com/floci-io/floci/issues/3491)) ([5d0b0b4](https://github.com/floci-io/floci/commit/5d0b0b44b1ffe27de6f5ae5866a6cfcc82a21db6))
* **ec2:** store instance metadata options and add ModifyInstanceMetadataOptions ([#3215](https://github.com/floci-io/floci/issues/3215)) ([5eacd01](https://github.com/floci-io/floci/commit/5eacd016362eedbc25b080c170229c2b52e95713)), closes [lex00/floci#116](https://github.com/lex00/floci/issues/116)
* **ec2:** tolerate a null groupId in the network-interface group-id filter ([#2921](https://github.com/floci-io/floci/issues/2921)) ([e44df51](https://github.com/floci-io/floci/commit/e44df51a79b0ebcaf0755d0fd3fac73c6106932c))
* **ecr:** clean up registry storage ([#2982](https://github.com/floci-io/floci/issues/2982)) ([732e009](https://github.com/floci-io/floci/commit/732e009207f91a3e790fe3e75da2eeb0716963a9))
* **ecr:** enforce immutable image tags ([#3009](https://github.com/floci-io/floci/issues/3009)) ([9507996](https://github.com/floci-io/floci/commit/95079965a89bdd0a6f4209c08844b0b1f1ace858))
* **ecr:** join the ECR API with the backing registry ([#2466](https://github.com/floci-io/floci/issues/2466)) ([064f302](https://github.com/floci-io/floci/commit/064f302ab1d61d88acddaa672941b09822246b59))
* **ecr:** recover backing registry containers ([#3486](https://github.com/floci-io/floci/issues/3486)) ([8e3bd63](https://github.com/floci-io/floci/commit/8e3bd63c15ef3f93eeee26842dfc5b647b1613c7))
* **ecs:** enforce host-volume bind-mount safety fail-closed at register and run time ([#3543](https://github.com/floci-io/floci/issues/3543)) ([126af73](https://github.com/floci-io/floci/commit/126af731416856cfafc74dcc3080a6aee51604c3))
* **ecs:** reconcile services in every account, not just the default one ([#3297](https://github.com/floci-io/floci/issues/3297)) ([42bc0d9](https://github.com/floci-io/floci/commit/42bc0d934fc451ec90cc6e07abf0272985fb30b2))
* **efs:** implement UpdateFileSystemProtection and report protection on describe ([#2842](https://github.com/floci-io/floci/issues/2842)) ([db182b3](https://github.com/floci-io/floci/commit/db182b3048b8d61903eac9d2c0817a027e844e38))
* **eks:** validate IAM authentication tokens ([#2912](https://github.com/floci-io/floci/issues/2912)) ([309043b](https://github.com/floci-io/floci/commit/309043baf643408644c5235f7bf2d02bad177c69))
* **elasticache:** honor the requested Port on CreateReplicationGroup ([#3276](https://github.com/floci-io/floci/issues/3276)) ([67198c7](https://github.com/floci-io/floci/commit/67198c70642b3059df2b4b9652176dac6a4fad94))
* **elasticache:** implement parameter group reservation to prevent deletion during provisioning ([#3023](https://github.com/floci-io/floci/issues/3023)) ([d398376](https://github.com/floci-io/floci/commit/d3983766422898088e263b287943ea090c182c9b))
* **elasticache:** resolve order-dependent crossGroupAuthIsRejected test failure ([#1991](https://github.com/floci-io/floci/issues/1991)) ([#3074](https://github.com/floci-io/floci/issues/3074)) ([173ff45](https://github.com/floci-io/floci/commit/173ff45b1291cbdf0de1c67ecb2b116aac6a5a21))
* **elbv2:** bound Lambda and target body sizes ([#3149](https://github.com/floci-io/floci/issues/3149)) ([ec41b1e](https://github.com/floci-io/floci/commit/ec41b1eef7714b300af23f15ef8ff4a7b7a6f698))
* **elbv2:** do not let a listener bind a port Floci reserves for itself ([#3034](https://github.com/floci-io/floci/issues/3034)) ([bf517ac](https://github.com/floci-io/floci/commit/bf517ac95245d5b3ad422f51e958ceeb9d66dc97))
* **elbv2:** drop access logs from a Gateway Load Balancer's attributes ([9bf93b9](https://github.com/floci-io/floci/commit/9bf93b94c28e1ae75dc6a456fa32748c3643b59d))
* **elbv2:** report the attribute defaults, not only what was modified ([910e64e](https://github.com/floci-io/floci/commit/910e64e726d18a353d0e9a309cc9024a7e177bdc))
* **eventbridge,scheduler:** read cron day-of-week as AWS 1-7 SUN-SAT ([#3147](https://github.com/floci-io/floci/issues/3147)) ([60a8a9d](https://github.com/floci-io/floci/commit/60a8a9d25262ab9a35033ed5c9778600a89a1e94)), closes [2#1](https://github.com/2/issues/1)
* **eventbridge:** scope replay cancellation by ARN ([#3058](https://github.com/floci-io/floci/issues/3058)) ([2e303e2](https://github.com/floci-io/floci/commit/2e303e2a0bf1bd2e91bf1cb5a9bc36e796551ed2))
* **firehose:** isolate streams by account and region ([#3267](https://github.com/floci-io/floci/issues/3267)) ([141b159](https://github.com/floci-io/floci/commit/141b15939f94c8fc6e454a5ecfab599671c30417))
* **firehose:** keep buffered records when S3 delivery fails ([#3471](https://github.com/floci-io/floci/issues/3471)) ([6507f32](https://github.com/floci-io/floci/commit/6507f32aeaef226fa53e63cf15350f06d07fc566))
* **github-actions:** continue Docker compatibility tests after failures ([#3351](https://github.com/floci-io/floci/issues/3351)) ([051a2f0](https://github.com/floci-io/floci/commit/051a2f09db368907f8444ff152a8ce7e01db800b))
* **glue:** bound DeleteSchemaVersions ranges before expanding them ([#3508](https://github.com/floci-io/floci/issues/3508)) ([76c1907](https://github.com/floci-io/floci/commit/76c1907214db0e9cb968ac0ffbc8cafea06299a3))
* **glue:** populate CatalogId on GetDatabase and GetDatabases ([#2814](https://github.com/floci-io/floci/issues/2814)) ([342f58b](https://github.com/floci-io/floci/commit/342f58b2b79afad1b609e770009689d5a308db64)), closes [#2793](https://github.com/floci-io/floci/issues/2793)
* **guardduty:** scope organization state across accounts ([#3278](https://github.com/floci-io/floci/issues/3278)) ([ed116ae](https://github.com/floci-io/floci/commit/ed116ae815c150be601fa4bd192f56cd5486a80b))
* honor Kinesis ExplicitHashKey routing ([#3069](https://github.com/floci-io/floci/issues/3069)) ([a006b27](https://github.com/floci-io/floci/commit/a006b2769448d8e1cb946e40707f8c3868a4f90d))
* **iam:** distinguish cross-account resource grants ([#3590](https://github.com/floci-io/floci/issues/3590)) ([2f76640](https://github.com/floci-io/floci/commit/2f76640aa8619ff94b611596bbee118840097ff0))
* **iam:** enforce temporary credential lifecycle ([#3487](https://github.com/floci-io/floci/issues/3487)) ([ad1061c](https://github.com/floci-io/floci/commit/ad1061c36996556533f68a866f52d71a94d9d866))
* **iam:** report the real default version of AWS-managed policies ([#3275](https://github.com/floci-io/floci/issues/3275)) ([abfa8e9](https://github.com/floci-io/floci/commit/abfa8e949e8711dacce9bc5dd5400d7d99631349))
* **iam:** resolve DynamoDB table ARN from request body for IAM enforcement ([#2928](https://github.com/floci-io/floci/issues/2928)) ([3db883d](https://github.com/floci-io/floci/commit/3db883d0038e3606cc88eff45755084e66cea14e)), closes [#2925](https://github.com/floci-io/floci/issues/2925)
* **iam:** use AWS-managed policy documents ([#3237](https://github.com/floci-io/floci/issues/3237)) ([379910b](https://github.com/floci-io/floci/commit/379910b0088584ce9d1feada5af702e31249257f))
* **identitystore:** self-heal the bootstrap identity store on hasIdentityStore ([#3387](https://github.com/floci-io/floci/issues/3387)) ([b87ee5b](https://github.com/floci-io/floci/commit/b87ee5bd4a5c4a5ce7ed772dd1cf84f723df8c98)), closes [#3386](https://github.com/floci-io/floci/issues/3386)
* **init-hooks:** terminate hook process trees on timeout ([#3372](https://github.com/floci-io/floci/issues/3372)) ([d99f162](https://github.com/floci-io/floci/commit/d99f162eb6e27df8b4c95217d55893f5bf08aab5))
* **iot:** isolate topic rule actions and run the error action ([#3012](https://github.com/floci-io/floci/issues/3012)) ([7ec4c89](https://github.com/floci-io/floci/commit/7ec4c89d0f84e438235c105ca0bc785afaf4d372))
* **kinesis:** handle minimum partition key hash ([#2950](https://github.com/floci-io/floci/issues/2950)) ([30b8f88](https://github.com/floci-io/floci/commit/30b8f88467ee89fcd5de62d072bbe6437be0d992))
* **kinesis:** reject non-string tag members instead of coercing them ([#3099](https://github.com/floci-io/floci/issues/3099)) ([fcb5bd0](https://github.com/floci-io/floci/commit/fcb5bd02c02e74f9b4229cfef92dfc0136e520d9)), closes [#2512](https://github.com/floci-io/floci/issues/2512)
* **kinesis:** stop dropping shard records under concurrent producers and resharding ([#3000](https://github.com/floci-io/floci/issues/3000)) ([73deb13](https://github.com/floci-io/floci/commit/73deb13c01dbde2c17ff9b3a3045ab8856d6465d))
* **kms:** apply real RSAES-OAEP for RSA keys in Encrypt and Decrypt ([#3038](https://github.com/floci-io/floci/issues/3038)) ([e5afe35](https://github.com/floci-io/floci/commit/e5afe3518be824d77e19fd9a7c52a404f39c8ccb)), closes [#3024](https://github.com/floci-io/floci/issues/3024)
* **kms:** give ECC_NIST_EDWARDS25519 an actual Ed25519 key ([#2930](https://github.com/floci-io/floci/issues/2930)) ([146753b](https://github.com/floci-io/floci/commit/146753b094b1eed5d71067f4b396f15e53e6c822)), closes [#2924](https://github.com/floci-io/floci/issues/2924)
* **kms:** protect ciphertext blobs with an AES-GCM envelope ([#3544](https://github.com/floci-io/floci/issues/3544)) ([494bab4](https://github.com/floci-io/floci/commit/494bab4b309dd422ff141174c59ca3369a523130))
* **kms:** support ML-DSA keys ([#3047](https://github.com/floci-io/floci/issues/3047)) ([b713c4b](https://github.com/floci-io/floci/commit/b713c4b0d9189711091d263e91a88341e13b22cd))
* **kms:** support SM2 signing in China regions ([#3046](https://github.com/floci-io/floci/issues/3046)) ([5198cf2](https://github.com/floci-io/floci/commit/5198cf29ec4dff64c73cd408209e49d7cb72d1ce))
* **kms:** validate KeyUsage against KeySpec on CreateKey ([#2787](https://github.com/floci-io/floci/issues/2787)) ([#3004](https://github.com/floci-io/floci/issues/3004)) ([69e8bf1](https://github.com/floci-io/floci/commit/69e8bf1ac37d41581e37320d8bd914d87594a3ef))
* **lambda:** apply Architectures on UpdateFunctionCode ([#2907](https://github.com/floci-io/floci/issues/2907)) ([9b582b3](https://github.com/floci-io/floci/commit/9b582b309a9baa00b6eb1af04509c8d6f9d8e387))
* **lambda:** bound ZIP extraction resources ([#3127](https://github.com/floci-io/floci/issues/3127)) ([0fce2d2](https://github.com/floci-io/floci/commit/0fce2d2407d89d35de3623bd618c2326e0494249))
* **lambda:** correct Function URL body encoding, cookies, and error status ([#3196](https://github.com/floci-io/floci/issues/3196)) ([d049875](https://github.com/floci-io/floci/commit/d049875aafcc9881299aed1be99af733decc3337)), closes [#3153](https://github.com/floci-io/floci/issues/3153)
* **lambda:** defer handler validation to invocation ([#3332](https://github.com/floci-io/floci/issues/3332)) ([8b25e50](https://github.com/floci-io/floci/commit/8b25e5003d89d7b67cde3da40220a081d5ca65b0)), closes [#3311](https://github.com/floci-io/floci/issues/3311)
* **lambda:** deliver extension INVOKE when the runtime receives the invocation ([#3070](https://github.com/floci-io/floci/issues/3070)) ([43e2a48](https://github.com/floci-io/floci/commit/43e2a482636bbcddd159a06172f08003fc501864)), closes [#2573](https://github.com/floci-io/floci/issues/2573)
* **lambda:** do not publish a version when nothing has changed ([#2941](https://github.com/floci-io/floci/issues/2941)) ([c48b6b0](https://github.com/floci-io/floci/commit/c48b6b0b0a38f558454ff1d28474d81210808011)), closes [#2822](https://github.com/floci-io/floci/issues/2822)
* **lambda:** enforce handler deadline at dispatch ([#3177](https://github.com/floci-io/floci/issues/3177)) ([438ae61](https://github.com/floci-io/floci/commit/438ae619fd1c007839276396f1ebcc404027a337)), closes [#3154](https://github.com/floci-io/floci/issues/3154)
* **lambda:** fail the whole SQS batch on malformed batchItemFailures ([#3169](https://github.com/floci-io/floci/issues/3169)) ([bcd422a](https://github.com/floci-io/floci/commit/bcd422ad83dbc9b54d10963db3b1fd8abcc13b7f)), closes [#3152](https://github.com/floci-io/floci/issues/3152)
* **lambda:** give each published version its own copy of the code ([#3041](https://github.com/floci-io/floci/issues/3041)) ([4ee5a52](https://github.com/floci-io/floci/commit/4ee5a528f36758d79581b2e4b83618d0752311b7)), closes [#2958](https://github.com/floci-io/floci/issues/2958)
* **lambda:** honor configured function architecture ([#2994](https://github.com/floci-io/floci/issues/2994)) ([7fdd145](https://github.com/floci-io/floci/commit/7fdd145c0c7dd7756afc3d53114504ec060be6fd))
* **lambda:** honor DynamoDB stream partial batch failures ([#3466](https://github.com/floci-io/floci/issues/3466)) ([c6316d1](https://github.com/floci-io/floci/commit/c6316d10cffa054c357b57e0c580e42b668e6526))
* **lambda:** honor MaximumBatchingWindowInSeconds on SQS event source mappings ([#3203](https://github.com/floci-io/floci/issues/3203)) ([ec2d678](https://github.com/floci-io/floci/commit/ec2d678e6d905bc0a25ab2bae24d058b9d205f53)), closes [#3155](https://github.com/floci-io/floci/issues/3155)
* **lambda:** honor MaximumRetryAttempts and DestinationConfig.OnFailure for DynamoDB Streams ESM ([#3263](https://github.com/floci-io/floci/issues/3263)) ([#3428](https://github.com/floci-io/floci/issues/3428)) ([1af3b56](https://github.com/floci-io/floci/commit/1af3b56683e66820d89eb974402d44e94ec7650c))
* **lambda:** honour Qualifier on GetFunction and GetFunctionConfiguration ([#2932](https://github.com/floci-io/floci/issues/2932)) ([cf628ba](https://github.com/floci-io/floci/commit/cf628ba2b9147bf9667f6dac45bca965c1c9bb7f)), closes [#1988](https://github.com/floci-io/floci/issues/1988) [#2821](https://github.com/floci-io/floci/issues/2821)
* **lambda:** honour the CodeSha256 precondition on PublishVersion ([#2939](https://github.com/floci-io/floci/issues/2939)) ([3d2b882](https://github.com/floci-io/floci/commit/3d2b8828adceaaa8625171ce85804381d13d2295)), closes [#2822](https://github.com/floci-io/floci/issues/2822)
* **lambda:** omit Environment when no variables are set ([#2838](https://github.com/floci-io/floci/issues/2838)) ([2bf9b57](https://github.com/floci-io/floci/commit/2bf9b57bd9210198c9e0396bf1c3f96f33943733))
* **lambda:** persist, validate and enforce event source mapping FilterCriteria ([#3060](https://github.com/floci-io/floci/issues/3060)) ([5512db0](https://github.com/floci-io/floci/commit/5512db0e050c43e1fb8e110395d872b3b522027b))
* **lambda:** recover a DynamoDB Streams ESM from a trimmed checkpoint ([#3412](https://github.com/floci-io/floci/issues/3412)) ([62abde8](https://github.com/floci-io/floci/commit/62abde805a07c747cae10e39bc4d99bb0da690f8))
* **lambda:** reject dotted and over-length function names ([#3300](https://github.com/floci-io/floci/issues/3300)) ([49903ab](https://github.com/floci-io/floci/commit/49903ab9fefe10d4e317554f77462e1aa409061b)), closes [#3238](https://github.com/floci-io/floci/issues/3238)
* **lambda:** reject scalar structure members ([#3051](https://github.com/floci-io/floci/issues/3051)) ([ec034a5](https://github.com/floci-io/floci/commit/ec034a503a377bbe300f6adb44f7a8ada030f732))
* **lambda:** replace the fabric8 kubernetes client with a plain REST client ([#2919](https://github.com/floci-io/floci/issues/2919)) ([97ce09f](https://github.com/floci-io/floci/commit/97ce09f22a8dd00398d960aa32203bbfadab32e1)), closes [#2914](https://github.com/floci-io/floci/issues/2914) [PKCS#8](https://github.com/PKCS/issues/8)
* **lambda:** report real runtime errors instead of Function.TimedOut ([#3505](https://github.com/floci-io/floci/issues/3505)) ([34062f6](https://github.com/floci-io/floci/commit/34062f63838f5b1423fe5b1f3286db55628058b9)), closes [#3314](https://github.com/floci-io/floci/issues/3314)
* **lambda:** resolve layer version ARNs by account ([#2948](https://github.com/floci-io/floci/issues/2948)) ([24a8c84](https://github.com/floci-io/floci/commit/24a8c8440bcbc1d866cc1eb8b2205fd67ee20f81)), closes [#2813](https://github.com/floci-io/floci/issues/2813) [#2813](https://github.com/floci-io/floci/issues/2813) [#2809](https://github.com/floci-io/floci/issues/2809)
* **lambda:** scope extracted function code by region ([#3265](https://github.com/floci-io/floci/issues/3265)) ([290559c](https://github.com/floci-io/floci/commit/290559cff0125a00406e37fe5bf3063be405c984))
* **lambda:** serialise the version snapshot against function updates ([#3010](https://github.com/floci-io/floci/issues/3010)) ([ebd849a](https://github.com/floci-io/floci/commit/ebd849a956147bcc9c5e2e3fa945f716ac2cb671)), closes [#2939](https://github.com/floci-io/floci/issues/2939) [#3041](https://github.com/floci-io/floci/issues/3041) [#3051](https://github.com/floci-io/floci/issues/3051) [#2939](https://github.com/floci-io/floci/issues/2939) [#3007](https://github.com/floci-io/floci/issues/3007)
* **lambda:** stop rejecting a foreign-platform image the daemon cannot describe ([#3357](https://github.com/floci-io/floci/issues/3357)) ([570f975](https://github.com/floci-io/floci/commit/570f975829ab30f2cf2447985fa425e7a9df3b7b))
* **lambda:** warn before runtime api port exhaustion ([#3496](https://github.com/floci-io/floci/issues/3496)) ([bea8f85](https://github.com/floci-io/floci/commit/bea8f85f62d321af3354a9c380fb8877e4b3cfaa))
* **lifecycle:** clear storage before services clear on state reset ([#3388](https://github.com/floci-io/floci/issues/3388)) ([22bae1f](https://github.com/floci-io/floci/commit/22bae1fcd29a11654d02c2a3fd00424bbb2b624a))
* **lifecycle:** run every shutdown step even when one of them fails ([#3472](https://github.com/floci-io/floci/issues/3472)) ([3bdb019](https://github.com/floci-io/floci/commit/3bdb019e9666c37867574b2be1f0b6197300e034))
* **memorydb:** scope resources by account and region ([#3261](https://github.com/floci-io/floci/issues/3261)) ([e02accf](https://github.com/floci-io/floci/commit/e02accff4a38ece03b64a27f62d4fd05ddd13852))
* **mq:** match CreateBroker EngineType and DeploymentMode without regard to case ([#3268](https://github.com/floci-io/floci/issues/3268)) ([c1e5cc2](https://github.com/floci-io/floci/commit/c1e5cc239f2800a3327ce9dcc8bb58b4008e5138))
* **msk:** isolate MSK resources by account and region ([#3353](https://github.com/floci-io/floci/issues/3353)) ([970cd30](https://github.com/floci-io/floci/commit/970cd301d14088de1db9ecca4ad2e1ba3f4e3cde))
* **mwaa:** also detect a crashed sibling Postgres container, not just Airflow ([#3454](https://github.com/floci-io/floci/issues/3454)) ([fe07621](https://github.com/floci-io/floci/commit/fe076212c2e29bd79a4cbf4a6860b0958ee4f1c0))
* **mwaa:** apply AirflowConfigurationOptions to the Airflow container ([#3457](https://github.com/floci-io/floci/issues/3457)) ([d429d10](https://github.com/floci-io/floci/commit/d429d107ff842bb1d6f5322612282036df030697)), closes [#3436](https://github.com/floci-io/floci/issues/3436)
* **mwaa:** isolate environments by account and region ([#3400](https://github.com/floci-io/floci/issues/3400)) ([c6e64a0](https://github.com/floci-io/floci/commit/c6e64a0977262226d9f2d2fa6919a676520392c1))
* **mwaa:** mark CREATE_FAILED when the Airflow container exits before becoming ready ([#3446](https://github.com/floci-io/floci/issues/3446)) ([2a682a6](https://github.com/floci-io/floci/commit/2a682a68756fb10bf0d0c189503c714ce0cf9f60)), closes [#3437](https://github.com/floci-io/floci/issues/3437)
* **mwaa:** match real MWAA's Airflow/Python pairing for the emulated image tag ([#3445](https://github.com/floci-io/floci/issues/3445)) ([473a26a](https://github.com/floci-io/floci/commit/473a26aad92a168191214404327bf5ccbbd3d18e)), closes [#3438](https://github.com/floci-io/floci/issues/3438)
* **mwaa:** probe the metadata database over TCP before starting Airflow ([#3406](https://github.com/floci-io/floci/issues/3406)) ([be578ac](https://github.com/floci-io/floci/commit/be578ac13f2b6c24f9c0ae64bc6ab95b6548a394))
* **mwaa:** reject a malformed configured AirflowVersion as ValidationException ([#3453](https://github.com/floci-io/floci/issues/3453)) ([a7902b9](https://github.com/floci-io/floci/commit/a7902b97f36e50b1c89be6ced54283c2deb06472))
* **neptune:** isolate resources by account and region ([#3401](https://github.com/floci-io/floci/issues/3401)) ([70176d6](https://github.com/floci-io/floci/commit/70176d62879552ab7e8750376e11a1a1b959e6d4))
* **networkfirewall:** model CreateFirewall* collisions and enforce UpdateToken ([#3198](https://github.com/floci-io/floci/issues/3198)) ([215a802](https://github.com/floci-io/floci/commit/215a80208c758d3dd58baf59adebde9aec417969)), closes [#2600](https://github.com/floci-io/floci/issues/2600)
* **opensearch:** include CognitoOptions in domain status ([#2860](https://github.com/floci-io/floci/issues/2860)) ([047db09](https://github.com/floci-io/floci/commit/047db09d54068b774e163471f8afddc03c917b5f)), closes [#2801](https://github.com/floci-io/floci/issues/2801)
* **opensearch:** keep publishing the domain's host port when floci runs in a container ([#2798](https://github.com/floci-io/floci/issues/2798)) ([96c55ec](https://github.com/floci-io/floci/commit/96c55ec2e2fa5cfbcaaec0959255a0d3d3c50664))
* **opensearch:** keep readiness polling after errors ([#3373](https://github.com/floci-io/floci/issues/3373)) ([713a166](https://github.com/floci-io/floci/commit/713a166a7c4f77e69f88da8c4bedc65cdbcb449f))
* **organizations:** return account state ([#3053](https://github.com/floci-io/floci/issues/3053)) ([587d0b5](https://github.com/floci-io/floci/commit/587d0b57581b5336e8bde16d6ab55cb78b7c2be8))
* parse S3 EventBridge notification XML ([#3350](https://github.com/floci-io/floci/issues/3350)) ([ad9a88c](https://github.com/floci-io/floci/commit/ad9a88cf7e56956de9311038814ceb856887d5f8))
* **pipes:** replace kafka-clients with a Kafka REST Proxy client ([#3160](https://github.com/floci-io/floci/issues/3160)) ([cd2847d](https://github.com/floci-io/floci/commit/cd2847dba0af77c434f838a5fda39bbab8eec1a2))
* **pipes:** restore a CloudFormation snapshot without re-validating it ([#3218](https://github.com/floci-io/floci/issues/3218)) ([d95ed9f](https://github.com/floci-io/floci/commit/d95ed9f8fe96e20a5a31dc3cdab697aab6fcf861)), closes [#3192](https://github.com/floci-io/floci/issues/3192) [#3209](https://github.com/floci-io/floci/issues/3209)
* **ram:** emulate organization sharing side effects ([#3279](https://github.com/floci-io/floci/issues/3279)) ([d322d48](https://github.com/floci-io/floci/commit/d322d48bd57e56ad257d4c0181584142601e4c59))
* **ram:** enforce resource share principal visibility ([#3266](https://github.com/floci-io/floci/issues/3266)) ([8e10fd1](https://github.com/floci-io/floci/commit/8e10fd1ea630181c0cc4d5c8f589d4af79f4a4d4))
* **rds:** bound PostgreSQL handshake packet lengths ([#3102](https://github.com/floci-io/floci/issues/3102)) ([148ea6f](https://github.com/floci-io/floci/commit/148ea6f3dbff40152a4a3a3cf049882197570089))
* **rds:** bound RDS/Redshift auth proxy connections and handshakes ([#3545](https://github.com/floci-io/floci/issues/3545)) ([1987bf0](https://github.com/floci-io/floci/commit/1987bf0c96fcd09adf296f47c6c40998da46bac0))
* **rds:** enhance DB cluster handling by recording createOnly properties and updating rollback logic ([#3636](https://github.com/floci-io/floci/issues/3636)) ([b2b43df](https://github.com/floci-io/floci/commit/b2b43dfb3cb379a2f440035fd950dcb999753b14))
* **rds:** format unexpected query errors as XML error envelope ([#3121](https://github.com/floci-io/floci/issues/3121)) ([daeea78](https://github.com/floci-io/floci/commit/daeea78ee613b4c0a48919a98567567afd2898fe)), closes [#3110](https://github.com/floci-io/floci/issues/3110)
* **rds:** keep the control plane working with no Docker daemon ([#3170](https://github.com/floci-io/floci/issues/3170)) ([49dfd1b](https://github.com/floci-io/floci/commit/49dfd1b18abb65bc68e3e1d179bca684f7a49791)), closes [lex00/floci#38](https://github.com/lex00/floci/issues/38)
* **rds:** map Aurora MySQL engine versions to the MySQL image tag ([#3382](https://github.com/floci-io/floci/issues/3382)) ([d9cc2a0](https://github.com/floci-io/floci/commit/d9cc2a09d02782362ce1f62e0f741ffee4ffb782))
* **rds:** persist PubliclyAccessible on Create/ModifyDBInstance and echo it on Describe ([#2484](https://github.com/floci-io/floci/issues/2484)) ([d45a437](https://github.com/floci-io/floci/commit/d45a4371224f94bc3fe84ab232c1e038cc062206)), closes [#2420](https://github.com/floci-io/floci/issues/2420)
* **rds:** populate MasterUserSecret for Aurora clusters with ManageMasterUserPassword ([#3148](https://github.com/floci-io/floci/issues/3148)) ([6345c37](https://github.com/floci-io/floci/commit/6345c37bad868463d6262e2ae3b9f7edc22604f8)), closes [#3061](https://github.com/floci-io/floci/issues/3061)
* **rds:** preserve aurora engine identity in parameter group names and managed secrets ([#1920](https://github.com/floci-io/floci/issues/1920)) ([5719e65](https://github.com/floci-io/floci/commit/5719e65c3cef13401f5fd8585ceca1437ef50947)), closes [#1829](https://github.com/floci-io/floci/issues/1829)
* **rds:** register instances before starting auth proxy ([#3467](https://github.com/floci-io/floci/issues/3467)) ([34efd89](https://github.com/floci-io/floci/commit/34efd8957aafc15e52c51775169556dd847ff648))
* **rds:** report backing container failures ([#3455](https://github.com/floci-io/floci/issues/3455)) ([68c783b](https://github.com/floci-io/floci/commit/68c783b576cc35dbe341b0bc21dbd5925e220f74))
* **rds:** run IAM PostgreSQL sessions as the role named in the token ([#3106](https://github.com/floci-io/floci/issues/3106)) ([c22ded9](https://github.com/floci-io/floci/commit/c22ded931a9288c60c90af5461ea3029c06374fa)), closes [#3087](https://github.com/floci-io/floci/issues/3087)
* **rds:** scope event reconciliation and prune history ([#3533](https://github.com/floci-io/floci/issues/3533)) ([04f0c3b](https://github.com/floci-io/floci/commit/04f0c3b7fd369d39512f457d9c26f13780cfcac0))
* **rds:** support tagging DB proxy target groups ([#3145](https://github.com/floci-io/floci/issues/3145)) ([e0bf589](https://github.com/floci-io/floci/commit/e0bf589972872576480d3881c9749e935a82c651))
* **rds:** use MySQL 8.4 auth options ([#3001](https://github.com/floci-io/floci/issues/3001)) ([e26e9a6](https://github.com/floci-io/floci/commit/e26e9a68fdc5753f62a61f8ad7b54661f573a864))
* **rds:** wait for the final PostgreSQL server before reporting the instance ready ([#3405](https://github.com/floci-io/floci/issues/3405)) ([14b0875](https://github.com/floci-io/floci/commit/14b0875a27cb8f61a7aa39b80ca406bb28176da7)), closes [#3384](https://github.com/floci-io/floci/issues/3384)
* **redshift:** emit ClusterAvailabilityStatus and AvailabilityZoneRelocationStatus ([#3109](https://github.com/floci-io/floci/issues/3109)) ([025ac71](https://github.com/floci-io/floci/commit/025ac714f6bac59707cf28db88b695eaa138655a)), closes [#3098](https://github.com/floci-io/floci/issues/3098)
* **resourceexplorer2:** reject invalid pagination tokens ([#3444](https://github.com/floci-io/floci/issues/3444)) ([f482a2d](https://github.com/floci-io/floci/commit/f482a2d15e4290359b0b3edcc582bf694160d276))
* **route53:** require exact match for ChangeResourceRecordSets DELETE ([#3565](https://github.com/floci-io/floci/issues/3565)) ([9da5895](https://github.com/floci-io/floci/commit/9da589568d5f0bc2cd1022220ba650bcd4af32e0))
* **s3:** authorize read on copyobject/uploadpartcopy source ([#3450](https://github.com/floci-io/floci/issues/3450)) ([bb58176](https://github.com/floci-io/floci/commit/bb58176974b8bf44555c66224503304c8df04610)), closes [#2333](https://github.com/floci-io/floci/issues/2333)
* **s3:** decode unsigned streaming checksum payloads ([#3476](https://github.com/floci-io/floci/issues/3476)) ([d11fff3](https://github.com/floci-io/floci/commit/d11fff3d6d2910d50e569d8e08627e9735ca9993))
* **s3:** enforce auth on bucket-level config writes when enforce-auth is enabled ([#3536](https://github.com/floci-io/floci/issues/3536)) ([28105c0](https://github.com/floci-io/floci/commit/28105c08ec335e3614ed6e82702f857206ab40f2)), closes [#2326](https://github.com/floci-io/floci/issues/2326) [#2335](https://github.com/floci-io/floci/issues/2335)
* **s3:** enforce source resource policies on object copies ([#3539](https://github.com/floci-io/floci/issues/3539)) ([19917ed](https://github.com/floci-io/floci/commit/19917ed9edb19ce03b664247639d84f6c0fd4b71))
* **s3:** evaluate IAM policy on presigned URL and presigned POST requests ([#3504](https://github.com/floci-io/floci/issues/3504)) ([8a45211](https://github.com/floci-io/floci/commit/8a452116bf43eb54a41736733ba7c21e5ff8e7aa)), closes [#3195](https://github.com/floci-io/floci/issues/3195)
* **s3:** honor max-keys=0 and reject invalid max-keys values ([#3510](https://github.com/floci-io/floci/issues/3510)) ([b994d58](https://github.com/floci-io/floci/commit/b994d58e142a93bb224312046fd8e617b1163c42))
* **s3:** honor per-object VersionId in batch DeleteObjects ([#3232](https://github.com/floci-io/floci/issues/3232)) ([d9cddc5](https://github.com/floci-io/floci/commit/d9cddc56cb406ea0f7fe645908fdabf9bca90e4e)), closes [#1045](https://github.com/floci-io/floci/issues/1045)
* **s3:** honor x-amz-bypass-governance-retention in batch DeleteObjects ([#3366](https://github.com/floci-io/floci/issues/3366)) ([7d96799](https://github.com/floci-io/floci/commit/7d96799c5a9ad59764d372647acf9076e2482a52))
* **s3:** honor x-amz-tagging query parameter on presigned PutObject and CreateMultipartUpload ([#3615](https://github.com/floci-io/floci/issues/3615)) ([52bafb7](https://github.com/floci-io/floci/commit/52bafb7e5c1249068ba26d5138f2d60f1d30c21d)), closes [#3608](https://github.com/floci-io/floci/issues/3608)
* **s3:** make GetObject atomic against concurrent same-key overwrites ([#2874](https://github.com/floci-io/floci/issues/2874)) ([b4aab99](https://github.com/floci-io/floci/commit/b4aab999f75b951e28939bfc42eeae1048ae059e))
* **s3:** preserve SSE-KMS key ID metadata ([#2145](https://github.com/floci-io/floci/issues/2145)) ([d466ffe](https://github.com/floci-io/floci/commit/d466ffe0998ba28594c23c38419abadfd795104b))
* **s3:** return composite multipart checksums and match S3 on UploadPart, GetObjectAttributes and CopyObject responses ([#3093](https://github.com/floci-io/floci/issues/3093)) ([724be0a](https://github.com/floci-io/floci/commit/724be0a6a7cfae81227b0075e5f1491b9e0741dc)), closes [#877](https://github.com/floci-io/floci/issues/877)
* **s3:** route signed multipart requests by virtual host ([#3464](https://github.com/floci-io/floci/issues/3464)) ([01ec7af](https://github.com/floci-io/floci/commit/01ec7af8d5c94bb8cc0755d42964b184d8ca0681))
* **s3:** shrink getObject's lock to a cheap seqlock check, not the I/O ([#2901](https://github.com/floci-io/floci/issues/2901)) ([3a212d8](https://github.com/floci-io/floci/commit/3a212d83605a7b87e1f30ee628c9680dbd3ff019))
* **s3:** validate multipart completion parts ([#3312](https://github.com/floci-io/floci/issues/3312)) ([31f8860](https://github.com/floci-io/floci/commit/31f8860c11663a55e31b940e977a39ce039fb2d3))
* **s3:** verify SigV4 signature on presigned POST uploads ([#3081](https://github.com/floci-io/floci/issues/3081)) ([ffab3dc](https://github.com/floci-io/floci/commit/ffab3dc1e90a9d5b46fd5fe267dcdbfed6969d04))
* **s3:** verify the SigV4 header signature when enforce-auth is enabled ([#3573](https://github.com/floci-io/floci/issues/3573)) ([bfe2b71](https://github.com/floci-io/floci/commit/bfe2b715870cec279afc068a7f821889edd431c8)), closes [#1842](https://github.com/floci-io/floci/issues/1842) [#3081](https://github.com/floci-io/floci/issues/3081) [#2332](https://github.com/floci-io/floci/issues/2332)
* **s3:** verify virtual-hosted presigned URLs ([#3048](https://github.com/floci-io/floci/issues/3048)) ([3dee17e](https://github.com/floci-io/floci/commit/3dee17e51dd382c30e065bb755aab58e74673e56))
* **scheduler:** forward MessageAttributes in universal sqs target ([#3435](https://github.com/floci-io/floci/issues/3435)) ([ffdd5b8](https://github.com/floci-io/floci/commit/ffdd5b87890b979f64254903e981b1a2ce3d45ad))
* **secretsmanager:** serialize secret version updates with the rotation lock ([#3247](https://github.com/floci-io/floci/issues/3247)) ([172765a](https://github.com/floci-io/floci/commit/172765a8088caaca0f60b20d6f2b073d33fb3e40))
* **security:** map EXTRA_CORS_* env variables to enable global CORS preflight ([#1890](https://github.com/floci-io/floci/issues/1890)) ([18044d9](https://github.com/floci-io/floci/commit/18044d966f79325e60bd053e93a86cf0bd709d3f))
* serialize GetRecords ApproximateArrivalTimestamp as a plain decimal ([#2359](https://github.com/floci-io/floci/issues/2359)) ([5b4d1af](https://github.com/floci-io/floci/commit/5b4d1aff600d7cd25ec6b8450fbad0f5a6164bff)), closes [#2099](https://github.com/floci-io/floci/issues/2099) [#2358](https://github.com/floci-io/floci/issues/2358)
* **ses:** align v1 Query boolean parsing with probed xsd 1.1 behavior ([#3075](https://github.com/floci-io/floci/issues/3075)) ([f677eda](https://github.com/floci-io/floci/commit/f677edad43863e9a154c9aaf13a06688bdd642f7))
* **ses:** create email identities atomically so failures leave nothing behind ([#3146](https://github.com/floci-io/floci/issues/3146)) ([618ca58](https://github.com/floci-io/floci/commit/618ca584247581b4fd3ae8821746092cf3600f36))
* **sfn:** apply state input and output paths ([#3289](https://github.com/floci-io/floci/issues/3289)) ([9fa36e9](https://github.com/floci-io/floci/commit/9fa36e9741f86cd3fd508733fdaefb84868f487c)), closes [#3258](https://github.com/floci-io/floci/issues/3258)
* **sfn:** enforce the alias and published version quotas per state machine ([#3580](https://github.com/floci-io/floci/issues/3580)) ([4707d4d](https://github.com/floci-io/floci/commit/4707d4d3a870ad795b20e5866e229424f0cc924d)), closes [#3575](https://github.com/floci-io/floci/issues/3575) [#3614](https://github.com/floci-io/floci/issues/3614)
* **sfn:** fail States.Runtime on an unresolvable JSONPath in a payload template ([#3199](https://github.com/floci-io/floci/issues/3199)) ([618f52e](https://github.com/floci-io/floci/commit/618f52e7584bb3da3d282cf04c04fc58a67a01cd)), closes [#2521](https://github.com/floci-io/floci/issues/2521)
* **sfn:** merge ResultPath at a bracket-index reference path ([#3483](https://github.com/floci-io/floci/issues/3483)) ([99c19d0](https://github.com/floci-io/floci/commit/99c19d03d2eb14fc07c32e1d586fe97d58354fb1)), closes [#3479](https://github.com/floci-io/floci/issues/3479)
* **sfn:** preserve Lambda function errors ([#3456](https://github.com/floci-io/floci/issues/3456)) ([ae58097](https://github.com/floci-io/floci/commit/ae580974ccea6765f3d651233626521ee5970a57))
* **sfn:** preserve mocked response indexes ([#3391](https://github.com/floci-io/floci/issues/3391)) ([78cf107](https://github.com/floci-io/floci/commit/78cf107fcbc461b8ea38bbcb80c4da6c3b3b5cde))
* **sfn:** resolve context reference paths ([#3390](https://github.com/floci-io/floci/issues/3390)) ([ce07393](https://github.com/floci-io/floci/commit/ce073930b9c2423b24a479b1a67aef56bcd1054c))
* **sfn:** return empty objects for null state paths ([#3371](https://github.com/floci-io/floci/issues/3371)) ([3090e33](https://github.com/floci-io/floci/commit/3090e333d4b64a9b2e32c7a9b317fd4234b0a339))
* **sfn:** support advanced JSONPath expressions ([#3398](https://github.com/floci-io/floci/issues/3398)) ([5bf8075](https://github.com/floci-io/floci/commit/5bf8075d52840b20ae4f0fa2d4efe4c46c2cc2fa))
* **sfn:** treat null as falsy in JSONPath negation ([#3497](https://github.com/floci-io/floci/issues/3497)) ([c18c80e](https://github.com/floci-io/floci/commit/c18c80e557886b669b215a923db666ffce52dd4f))
* **sns:** honor FifoThroughputScope=MessageGroup on FIFO topics ([#3181](https://github.com/floci-io/floci/issues/3181)) ([a1d0597](https://github.com/floci-io/floci/commit/a1d0597ffe8781dd74911d5827115c809040b5d8))
* **sqs:** bound message move task history ([#3292](https://github.com/floci-io/floci/issues/3292)) ([520568e](https://github.com/floci-io/floci/commit/520568ef9365a7e4ff8ba0a9dd5f253567ff8ecc))
* **sqs:** honour ReceiveMessageWaitTimeSeconds when ReceiveMessage omits WaitTimeSeconds ([#2989](https://github.com/floci-io/floci/issues/2989)) ([ad0f4a1](https://github.com/floci-io/floci/commit/ad0f4a1613a35d884a4d29fa7aff0389872d2d2d))
* **sqs:** keep DLQ messages when a move task cannot deliver them ([#3470](https://github.com/floci-io/floci/issues/3470)) ([a9feb3c](https://github.com/floci-io/floci/commit/a9feb3ccaf76897548bc55f30d2ea7385f7161f7))
* **sqs:** match AWS queue attribute defaults and MaximumMessageSize range ([#3626](https://github.com/floci-io/floci/issues/3626)) ([1482d45](https://github.com/floci-io/floci/commit/1482d45b6ed88dbed06911b18ba153e91179ba98))
* **ssm:** apply every DescribeParameters filter and page the results ([#3646](https://github.com/floci-io/floci/issues/3646)) ([ea88947](https://github.com/floci-io/floci/commit/ea88947865cd7e978c04cbceeab713d8028c395f)), closes [#3642](https://github.com/floci-io/floci/issues/3642)
* **ssm:** set the Arn attribute on AWS::SSM::Parameter ([#3019](https://github.com/floci-io/floci/issues/3019)) ([3600038](https://github.com/floci-io/floci/commit/3600038a3fb107bbcce71ccc20685b86a05c7d0f))
* **stepfunctions:** abort executions abandoned by a restart ([#2969](https://github.com/floci-io/floci/issues/2969)) ([504203f](https://github.com/floci-io/floci/commit/504203f8e82b54ec159c457483d63f9b9a009ce9))
* **stepfunctions:** fail an intrinsic argument that matches nothing ([#2872](https://github.com/floci-io/floci/issues/2872)) ([fad54f3](https://github.com/floci-io/floci/commit/fad54f3c7a1fd0a97bdc1592eb2dfcf5ac89e6f8)), closes [#2870](https://github.com/floci-io/floci/issues/2870) [#2927](https://github.com/floci-io/floci/issues/2927)
* **stepfunctions:** let Express executions reuse names and type the nested StartExecution refusal ([#3059](https://github.com/floci-io/floci/issues/3059)) ([8a2161a](https://github.com/floci-io/floci/commit/8a2161ab5e85d68c21a1a79e4ee5697c9540fe73))
* **stepfunctions:** persist execution history across restarts ([#3291](https://github.com/floci-io/floci/issues/3291)) ([35159c5](https://github.com/floci-io/floci/commit/35159c5aaabef6969e910e3e41604673b5691881))
* **stepfunctions:** reject the QueryLanguage definitions AWS rejects ([#2972](https://github.com/floci-io/floci/issues/2972)) ([e3230a7](https://github.com/floci-io/floci/commit/e3230a74abae2295c0d62e8978a3163df05b9904))
* **stepfunctions:** resolve state machine alias ARNs ([#3607](https://github.com/floci-io/floci/issues/3607)) ([e828363](https://github.com/floci-io/floci/commit/e82836348b17b7c3d23219feb68cc23bd7da937a))
* **stepfunctions:** resolve the States.Format template argument like every other argument ([#2963](https://github.com/floci-io/floci/issues/2963)) ([fa265a4](https://github.com/floci-io/floci/commit/fa265a4a33ce32a3b2a6e9470db6f6e35fb84cd9)), closes [#2927](https://github.com/floci-io/floci/issues/2927)
* **storage:** load each backend once and close WAL writers on shutdown ([#3469](https://github.com/floci-io/floci/issues/3469)) ([1b83ef3](https://github.com/floci-io/floci/commit/1b83ef323ee58d9ffa1a471d5f9bca6a1e789a9d))
* **storage:** log effective storage mode at boot ([#3495](https://github.com/floci-io/floci/issues/3495)) ([15eff7e](https://github.com/floci-io/floci/commit/15eff7e4cd36e7067a943215162ad82aae99ed46)), closes [#2225](https://github.com/floci-io/floci/issues/2225)
* **storage:** migrate legacy entries by exact key ([#3408](https://github.com/floci-io/floci/issues/3408)) ([d92211d](https://github.com/floci-io/floci/commit/d92211d1c11dd25dc2b536e79259f408c4a611c3))
* **sts:** reject unverified web identity tokens ([#3151](https://github.com/floci-io/floci/issues/3151)) ([1de6b80](https://github.com/floci-io/floci/commit/1de6b8003506167e1203aaf89fee5dc6c3dc207d))
* **sts:** return ExpiredTokenException for an expired web identity token ([#3210](https://github.com/floci-io/floci/issues/3210)) ([90fa707](https://github.com/floci-io/floci/commit/90fa707145d34f8380a2d9a2768df8ac64585eb7)), closes [#3205](https://github.com/floci-io/floci/issues/3205)
* **sts:** validate SAML assertions before assuming roles ([#3204](https://github.com/floci-io/floci/issues/3204)) ([1b12525](https://github.com/floci-io/floci/commit/1b1252505b41be283c9249e27f78b2c8ff158514))
* support SSM PutParameter tags and ECS container healthCheck ([#2567](https://github.com/floci-io/floci/issues/2567)) ([#3550](https://github.com/floci-io/floci/issues/3550)) ([7d6e958](https://github.com/floci-io/floci/commit/7d6e9588cd386cfbbdc629460f5c2b301a57c0b3))
* **swf:** improve polling mechanism with timeout and backoff strategy ([#3207](https://github.com/floci-io/floci/issues/3207)) ([f765195](https://github.com/floci-io/floci/commit/f765195991ea75bc362eb16756215b625839e8e0))
* **test:** disable the GuardDuty organization admin GuardDutyMembersIntegrationTest enables ([#3348](https://github.com/floci-io/floci/issues/3348)) ([3669c8e](https://github.com/floci-io/floci/commit/3669c8e84ce2cadbbf039e2e6ebff96101905aa3))
* **test:** isolate MQTT WebSocket concurrency from TLS ([#3431](https://github.com/floci-io/floci/issues/3431)) ([9f36a87](https://github.com/floci-io/floci/commit/9f36a8729fe12fe59a4f72ab5d83e9c908774e62))
* **test:** relax S3 concurrent write stress timeout ([#3396](https://github.com/floci-io/floci/issues/3396)) ([901b83c](https://github.com/floci-io/floci/commit/901b83cb8e64ab38c6c3a1232f12b330ddb63f37))
* **test:** sign the CopyObject source-permission requests for real ([#3588](https://github.com/floci-io/floci/issues/3588)) ([62407e2](https://github.com/floci-io/floci/commit/62407e24790127d91e2cd27360b327a659688cf2)), closes [#3539](https://github.com/floci-io/floci/issues/3539) [#3539](https://github.com/floci-io/floci/issues/3539) [#3573](https://github.com/floci-io/floci/issues/3573) [#3573](https://github.com/floci-io/floci/issues/3573)
* **test:** stop XmlParserTest matching a localized parser message ([#3458](https://github.com/floci-io/floci/issues/3458)) ([c127794](https://github.com/floci-io/floci/commit/c12779416d2eb62a491e343be365418a4eec6fd1))
* **test:** tear down the organization DetectiveIntegrationTest creates ([#3229](https://github.com/floci-io/floci/issues/3229)) ([1a804ae](https://github.com/floci-io/floci/commit/1a804ae5472cdaa4d9bf1dcb016ac456a9a007b5)), closes [#3226](https://github.com/floci-io/floci/issues/3226)
* **test:** tear down the organizations the service-managed StackSets test creates ([#3158](https://github.com/floci-io/floci/issues/3158)) ([6914530](https://github.com/floci-io/floci/commit/691453086a35db844e007647d0b64f9008afd7e9)), closes [#3055](https://github.com/floci-io/floci/issues/3055)
* **test:** wait for DeleteStack to actually complete in CloudFront policies test ([#3473](https://github.com/floci-io/floci/issues/3473)) ([ec2ab07](https://github.com/floci-io/floci/commit/ec2ab07689a81ed6433c8bfb136164136e94eced))
* **tls:** fail startup when public listener cannot bind ([#3362](https://github.com/floci-io/floci/issues/3362)) ([2fd55b5](https://github.com/floci-io/floci/commit/2fd55b53df18ff05fe37362691d98762b3f65a94))
* **transcribe:** isolate jobs and vocabularies by account and region ([#3402](https://github.com/floci-io/floci/issues/3402)) ([c4ff42b](https://github.com/floci-io/floci/commit/c4ff42b80065d72d4596350a6146975b8741bfda))
* **transfer:** allow DeleteServer regardless of server state ([#2897](https://github.com/floci-io/floci/issues/2897)) ([e7256f5](https://github.com/floci-io/floci/commit/e7256f5556708db46241d97001873f295ce976c2)), closes [#2802](https://github.com/floci-io/floci/issues/2802) [#1834](https://github.com/floci-io/floci/issues/1834) [#2802](https://github.com/floci-io/floci/issues/2802)
* **transfer:** isolate servers and users by account and region ([#3403](https://github.com/floci-io/floci/issues/3403)) ([43eace4](https://github.com/floci-io/floci/commit/43eace4e026ba088a6583baccc68a161663b0170))
* **ui:** verify Floci connectivity in readiness probe ([#2753](https://github.com/floci-io/floci/issues/2753)) ([c0b5461](https://github.com/floci-io/floci/commit/c0b5461f10623574836621d528b574e4fb646d55))
* **wafv2:** reject non-CIDR IPSet addresses ([#3511](https://github.com/floci-io/floci/issues/3511)) ([a40409f](https://github.com/floci-io/floci/commit/a40409f5912139bb6f07f13eaa0f4799e66f69fc)), closes [#3328](https://github.com/floci-io/floci/issues/3328)
* **wafv2:** validate resource names on operations ([#3066](https://github.com/floci-io/floci/issues/3066)) ([0a57f0a](https://github.com/floci-io/floci/commit/0a57f0ac08037b542d15d4f0c29c64d330d29c32))


### Features

* **accessanalyzer:** add analyzer lifecycle ([#3117](https://github.com/floci-io/floci/issues/3117)) ([aebed6e](https://github.com/floci-io/floci/commit/aebed6e15c2f65eb180c52d441293a036b3ad9a3))
* **account:** add alternate contact operations ([#3118](https://github.com/floci-io/floci/issues/3118)) ([d80734e](https://github.com/floci-io/floci/commit/d80734e6de0c07ac139097666d50ebbc1172b353))
* **acm:** enhance email validation to report approval mailboxes and omit DNS records ([#3290](https://github.com/floci-io/floci/issues/3290)) ([8180d4b](https://github.com/floci-io/floci/commit/8180d4b3b83987109565b4ffb2dbe4b0098db27c))
* **acm:** map CertificateExport and CertificateTransparencyLoggingPreference onto the certificate options ([#3111](https://github.com/floci-io/floci/issues/3111)) ([6150569](https://github.com/floci-io/floci/commit/615056999e3cd824fd0cc011f78260b8eed59764))
* **acm:** provision AWS::CertificateManager::Certificate ([#3003](https://github.com/floci-io/floci/issues/3003)) ([38176b9](https://github.com/floci-io/floci/commit/38176b9e054b10c49133155a2e857ab8bb62ce90))
* **agentcore:** expand Bedrock AgentCore control-plane coverage ([#3317](https://github.com/floci-io/floci/issues/3317)) ([483dfb4](https://github.com/floci-io/floci/commit/483dfb4e1c84094aeaeaeea5c92e1624058f692b))
* **apigateway:** provision AWS::ApiGateway::DomainName and BasePathMapping ([#3040](https://github.com/floci-io/floci/issues/3040)) ([c3d977a](https://github.com/floci-io/floci/commit/c3d977a3e33a80c52745f579e2347e6981bed6d7))
* **apigateway:** support HTTP and HTTP_PROXY integrations on REST APIs ([#3433](https://github.com/floci-io/floci/issues/3433)) ([96707f6](https://github.com/floci-io/floci/commit/96707f6d5a1dbf5b72b04859186bcc93e5ee392d))
* **appintegrations:** add data and event integrations ([#3379](https://github.com/floci-io/floci/issues/3379)) ([137a39a](https://github.com/floci-io/floci/commit/137a39add3db2345783965347a8d480caecb1511))
* **aps:** implement AMP rule groups namespaces ([#3330](https://github.com/floci-io/floci/issues/3330)) ([6eca854](https://github.com/floci-io/floci/commit/6eca8540a8ae58215685a1bd1321146ff5a2879c)), closes [#3329](https://github.com/floci-io/floci/issues/3329)
* **asl:** add support for States.ArrayPartition, States.ArrayRange, States.ArrayUnique, and States.MathRandom intrinsics with comprehensive tests ([#3224](https://github.com/floci-io/floci/issues/3224)) ([cf8466b](https://github.com/floci-io/floci/commit/cf8466b58c5f43e1672bf373eda43cb07e056bdf))
* **athena:** add UpdateWorkGroup support ([#3468](https://github.com/floci-io/floci/issues/3468)) ([ea5925f](https://github.com/floci-io/floci/commit/ea5925f6305cb6c9938bfbdc8eb7740d20505990))
* **athena:** create, update and delete data catalogs ([#3381](https://github.com/floci-io/floci/issues/3381)) ([cb6b4d8](https://github.com/floci-io/floci/commit/cb6b4d8a887684a340800dead61c9e5cdf50e0a2))
* **athena:** support ListTagsForResource for workgroups ([#3242](https://github.com/floci-io/floci/issues/3242)) ([b988dc5](https://github.com/floci-io/floci/commit/b988dc5d1ae523ac2d76abdcf71a1f8a48177ff9))
* **autoscaling:** warm pools, scheduled actions, traffic sources, and process suspension ([#2973](https://github.com/floci-io/floci/issues/2973)) ([0980114](https://github.com/floci-io/floci/commit/09801146b13a18a1673cd4d6f90f2bfccdf6ef93))
* **batch:** add UpdateComputeEnvironment and DeleteComputeEnvironment ([#2857](https://github.com/floci-io/floci/issues/2857)) ([3b7ba5c](https://github.com/floci-io/floci/commit/3b7ba5c6871ce0cd7b0b625ad83a0267bcf96830)), closes [#2293](https://github.com/floci-io/floci/issues/2293)
* **batch:** support array and multi-node parallel jobs ([#3595](https://github.com/floci-io/floci/issues/3595)) ([74d4782](https://github.com/floci-io/floci/commit/74d4782b51be59a30e92c4b4287ca641847a64b0))
* **bcm-pricing-calculator:** emulate workload estimates ([#3441](https://github.com/floci-io/floci/issues/3441)) ([a985773](https://github.com/floci-io/floci/commit/a985773611e905464e8377715d816edee9edf19c))
* **bedrock-agentcore:** implement AgentCore Memory events ([#3556](https://github.com/floci-io/floci/issues/3556)) ([3003f05](https://github.com/floci-io/floci/commit/3003f059531e96a5d1d402ac6b0bcbb82e7b1104))
* **bedrock-runtime:** implement ConverseStream for stub and proxy backends ([#2889](https://github.com/floci-io/floci/issues/2889)) ([4465575](https://github.com/floci-io/floci/commit/44655751c674e1a70da51fe17040a234da8b5db7))
* **bedrock-runtime:** stream ConverseStream incrementally ([#3043](https://github.com/floci-io/floci/issues/3043)) ([0471d6f](https://github.com/floci-io/floci/commit/0471d6f488f43d9349013cf60cd984b2da789183))
* **bedrock:** add guardrail lifecycle and versions ([#3380](https://github.com/floci-io/floci/issues/3380)) ([cae8f9a](https://github.com/floci-io/floci/commit/cae8f9a013e8244189ef142e707c797a1812bb61))
* **budgets:** add full service emulation ([#3165](https://github.com/floci-io/floci/issues/3165)) ([7a5ae96](https://github.com/floci-io/floci/commit/7a5ae965e52d33734ed8d5a647b601792408fde9))
* **cloudformation:** pass EngineMode and StorageEncrypted to RDS clusters ([#3482](https://github.com/floci-io/floci/issues/3482)) ([4471e92](https://github.com/floci-io/floci/commit/4471e92a0f56cfbffa128294af51f27224e6ffe4))
* **cloudformation:** provision AWS::ApiGateway::ApiKey ([#3122](https://github.com/floci-io/floci/issues/3122)) ([cbde58f](https://github.com/floci-io/floci/commit/cbde58f238a70e5e58ae36bc16fdb9bcc475b75a))
* **cloudformation:** provision AWS::ApiGateway::UsagePlan and UsagePlanKey ([#3123](https://github.com/floci-io/floci/issues/3123)) ([3a4982c](https://github.com/floci-io/floci/commit/3a4982c2943974a4f431637e778fddc79a367972))
* **cloudformation:** provision AWS::AutoScaling::ScalingPolicy ([#3124](https://github.com/floci-io/floci/issues/3124)) ([17af959](https://github.com/floci-io/floci/commit/17af9590c79643ee07872dbd9caf9a5ad8272635))
* **cloudformation:** provision AWS::Backup::BackupVault ([#3125](https://github.com/floci-io/floci/issues/3125)) ([631df1d](https://github.com/floci-io/floci/commit/631df1dc016e59addbc1b3448dd13b330c29fa46))
* **cloudformation:** provision AWS::Lambda::Url ([#3423](https://github.com/floci-io/floci/issues/3423)) ([10becc5](https://github.com/floci-io/floci/commit/10becc593faee79629a367696b2e5051da0888c1))
* **cloudformation:** provision AWS::SNS::TopicPolicy ([#3126](https://github.com/floci-io/floci/issues/3126)) ([ba3dd65](https://github.com/floci-io/floci/commit/ba3dd657b68a691e50ef20fea1714cbdbaac0f6b))
* **cloudformation:** provision Route 53 hosted zones ([#2722](https://github.com/floci-io/floci/issues/2722)) ([ab26a42](https://github.com/floci-io/floci/commit/ab26a42096b09ad1c8be54d7d18ddb76fc88ee02))
* **cloudformation:** provision the AppSync resource types ([#3424](https://github.com/floci-io/floci/issues/3424)) ([55ada9b](https://github.com/floci-io/floci/commit/55ada9b8a39eef685163b1c9a9b3e77ad8c880c0))
* **cloudformation:** report a stubbed unsupported resource type instead of hiding it ([#2971](https://github.com/floci-io/floci/issues/2971)) ([5dc0808](https://github.com/floci-io/floci/commit/5dc0808bdae78c3b7199167b6c117eab59590878)), closes [#2967](https://github.com/floci-io/floci/issues/2967)
* **cloudformation:** support service-managed stacksets ([#3055](https://github.com/floci-io/floci/issues/3055)) ([41022d0](https://github.com/floci-io/floci/commit/41022d09fb7a7571a2f6d07caa6d1a8aa54aaf44))
* **cloudtrail:** implement AddTags, RemoveTags and ListTags ([#2934](https://github.com/floci-io/floci/issues/2934)) ([671628b](https://github.com/floci-io/floci/commit/671628b52589e0b204b8aabbc5bc90cd9e46fd1f)), closes [floci-io/floci#2297](https://github.com/floci-io/floci/issues/2297)
* **cloudtrail:** support AdvancedEventSelectors and CloudFormation Trail provisioning ([#2720](https://github.com/floci-io/floci/issues/2720)) ([fd3c4d9](https://github.com/floci-io/floci/commit/fd3c4d9ab6b827b1db41cfb369aa4147ac89fd95)), closes [#1192](https://github.com/floci-io/floci/issues/1192) [#1194](https://github.com/floci-io/floci/issues/1194)
* **cloudwatch:** implement the dashboard operations on both protocols ([#2888](https://github.com/floci-io/floci/issues/2888)) ([e8eb4f2](https://github.com/floci-io/floci/commit/e8eb4f2ff003995f18a00bf874d014dfbf474e49))
* **cloudwatchlogs:** add cross-account policy operations ([#3089](https://github.com/floci-io/floci/issues/3089)) ([6a728f1](https://github.com/floci-io/floci/commit/6a728f1b9fe5d1279e90eef73510d132f1461ea0))
* **cloudwatch:** provision AWS::CloudWatch::Dashboard ([#3231](https://github.com/floci-io/floci/issues/3231)) ([460aa07](https://github.com/floci-io/floci/commit/460aa0718ee5eae9e2e1d253713177fc72afc49f))
* **cloudwatch:** store and serve metric stream definitions ([#3214](https://github.com/floci-io/floci/issues/3214)) ([5b7c2c4](https://github.com/floci-io/floci/commit/5b7c2c4a620182878eaaa25a3d27a95331c8f9ae))
* **cognito:** check the custom domain certificate in ACM and mark it in use ([#3035](https://github.com/floci-io/floci/issues/3035)) ([d771783](https://github.com/floci-io/floci/commit/d771783afb47eed6c980f2792f16d738f2219dbe))
* **cognitoidentity:** identity pool management plane (CRUD, roles, principal-tag maps, tags) ([#2977](https://github.com/floci-io/floci/issues/2977)) ([dd9cdc1](https://github.com/floci-io/floci/commit/dd9cdc12073eef64dbcb863034dad5949ebed872))
* **cognito:** implement identity provider configuration CRUD ([#2858](https://github.com/floci-io/floci/issues/2858)) ([0a3bc03](https://github.com/floci-io/floci/commit/0a3bc030f651c454ea916466157117754dc35111))
* **cognito:** implement log delivery configuration ([#2867](https://github.com/floci-io/floci/issues/2867)) ([b8f1e22](https://github.com/floci-io/floci/commit/b8f1e22c742ad0d88b3ac23f8ef38d9b87750aaf)), closes [#2855](https://github.com/floci-io/floci/issues/2855)
* **cognito:** implement managed login branding ([#2869](https://github.com/floci-io/floci/issues/2869)) ([1e4e8b9](https://github.com/floci-io/floci/commit/1e4e8b9ee80d1a7670d993f62bf18eb8ecd7e26a)), closes [#2856](https://github.com/floci-io/floci/issues/2856)
* **cognito:** implement SetUserPoolMfaConfig ([#2831](https://github.com/floci-io/floci/issues/2831)) ([906717a](https://github.com/floci-io/floci/commit/906717a510c72056a5d96c5e179600d35ea88bb2))
* **cognito:** implement user MFA preferences ([#2896](https://github.com/floci-io/floci/issues/2896)) ([82ee360](https://github.com/floci-io/floci/commit/82ee3605c87e84a0ac0da20aa13a98e31820e03e))
* **cognito:** implement VerifyUserAttribute ([#2018](https://github.com/floci-io/floci/issues/2018)) ([36c3ee4](https://github.com/floci-io/floci/commit/36c3ee4e22fe0752d9e3c730d468e11221ebc473))
* **cognito:** provision AWS::Cognito::UserPoolDomain ([#3005](https://github.com/floci-io/floci/issues/3005)) ([f3c251e](https://github.com/floci-io/floci/commit/f3c251ef2085adcb94cd6df180f2e418a8abe7e7))
* **cognito:** route custom domains by Host ([#3095](https://github.com/floci-io/floci/issues/3095)) ([b4d80a5](https://github.com/floci-io/floci/commit/b4d80a55963b72a002db1d1de457414106ded7a5))
* **cognito:** support pending user attribute verification ([#2531](https://github.com/floci-io/floci/issues/2531)) ([a03c4d6](https://github.com/floci-io/floci/commit/a03c4d6160f7b9e5302b7e79cbb5485268f755e0))
* **controlcatalog:** add control lookup operations ([#3130](https://github.com/floci-io/floci/issues/3130)) ([d99675a](https://github.com/floci-io/floci/commit/d99675a512d61fc434fa6deed49baf2a6d9c935a))
* **controltower:** add enabled control operations ([#3056](https://github.com/floci-io/floci/issues/3056)) ([b199894](https://github.com/floci-io/floci/commit/b199894e19113915666bb409c3aaceb89aa36925))
* **core:** derive ARN partition from the region ([#3334](https://github.com/floci-io/floci/issues/3334)) ([dc61c1a](https://github.com/floci-io/floci/commit/dc61c1a8a59bc36fa3b46b96afc81daa36683e67))
* **datasync:** add the DataSync management plane ([#3377](https://github.com/floci-io/floci/issues/3377)) ([128d3ef](https://github.com/floci-io/floci/commit/128d3ef18134463cb002cb77504d714829b67b39))
* **detective:** add organization member operations ([#3190](https://github.com/floci-io/floci/issues/3190)) ([5864b01](https://github.com/floci-io/floci/commit/5864b013d2c8ca54eff4b740700df723bd6763da))
* **docker:** containers Floci launches trust the Floci CA ([#3091](https://github.com/floci-io/floci/issues/3091)) ([024bfa0](https://github.com/floci-io/floci/commit/024bfa0a5c5de78459e302b630194452f402bc81)), closes [#3079](https://github.com/floci-io/floci/issues/3079) [#3086](https://github.com/floci-io/floci/issues/3086) [#3086](https://github.com/floci-io/floci/issues/3086)
* **dynamodb:** import tables from S3 and report new exports as IN_PROGRESS ([#3138](https://github.com/floci-io/floci/issues/3138)) ([cbec02d](https://github.com/floci-io/floci/commit/cbec02df040605dac476a8cef256912d7af1c4ee))
* **dynamodb:** index-qualified PartiQL SELECT with ConsistentRead validation ([#2953](https://github.com/floci-io/floci/issues/2953)) ([84ec8ae](https://github.com/floci-io/floci/commit/84ec8ae8e71ab4d87dfa546081db5d8e45f1b4b0))
* **dynamodb:** resource policies and GSI-level OnDemandThroughput ([#2976](https://github.com/floci-io/floci/issues/2976)) ([17e02ed](https://github.com/floci-io/floci/commit/17e02edad9a5d2052cea8a7cb75667fdf521a154))
* **ec2:** answer MonitorInstances and UnmonitorInstances ([#3319](https://github.com/floci-io/floci/issues/3319)) ([8921ca1](https://github.com/floci-io/floci/commit/8921ca11182ffd1fb8ac4ddb13cb855a24a008a7))
* **ec2:** back each VPC with a real Docker network in RFC 1918 space ([#3272](https://github.com/floci-io/floci/issues/3272)) ([cf1aabc](https://github.com/floci-io/floci/commit/cf1aabce39a6cef4d40978747d678c7b0b7520a2))
* **ec2:** Capacity Reservation CRUD ([#2974](https://github.com/floci-io/floci/issues/2974)) ([0c33ef2](https://github.com/floci-io/floci/commit/0c33ef234bdee1ff8cefdfefaa3a6565a70bf459))
* **ec2:** capture the instance file system in CreateImage, and implement Deregister/CopyImage ([#3306](https://github.com/floci-io/floci/issues/3306)) ([a228507](https://github.com/floci-io/floci/commit/a2285072c98726502bacecf757a1c39f9b643dd6))
* **ec2:** carry the remaining launch template data fields ([#3493](https://github.com/floci-io/floci/issues/3493)) ([0431677](https://github.com/floci-io/floci/commit/043167793b73182c47f778507e6025dd55b6814a))
* **ec2:** honour AmazonProvidedIpv6CidrBlock on a VPC ([#2891](https://github.com/floci-io/floci/issues/2891)) ([0cf3144](https://github.com/floci-io/floci/commit/0cf3144f5e3cadee28295b0309b7f5d0330119ea))
* **ec2:** implement DescribeSpotPriceHistory ([#3359](https://github.com/floci-io/floci/issues/3359)) ([ee23e26](https://github.com/floci-io/floci/commit/ee23e26bc377727a6cd8527ea586fbc431c7c5e9))
* **ec2:** implement instant CreateFleet ([#2956](https://github.com/floci-io/floci/issues/2956)) ([1f87f7c](https://github.com/floci-io/floci/commit/1f87f7c48238a5adbaa278a575eb215bab25769d))
* **ec2:** report instance credit specifications ([#3492](https://github.com/floci-io/floci/issues/3492)) ([325bdfb](https://github.com/floci-io/floci/commit/325bdfb30e83b556f3d3d86ea86dddfc37463b6b))
* **ec2:** support snapshot block public access ([#3490](https://github.com/floci-io/floci/issues/3490)) ([fe40e06](https://github.com/floci-io/floci/commit/fe40e069389ffcfb09c26308480caa114221c970))
* **ec2:** support standalone network interface create/attach/detach ([#2843](https://github.com/floci-io/floci/issues/2843)) ([906af8c](https://github.com/floci-io/floci/commit/906af8c632a886a93f37fa6c96aea880e6f84e27))
* **ec2:** support VPC peering connections ([#2654](https://github.com/floci-io/floci/issues/2654)) ([14f99a5](https://github.com/floci-io/floci/commit/14f99a512304160849e2c1922791bb36850f8708))
* **ecr:** prefer locally present images over the loopback registry rewrite ([#3022](https://github.com/floci-io/floci/issues/3022)) ([23728e0](https://github.com/floci-io/floci/commit/23728e0b7596dabaf4aec1a9a0ca04c3a5d6e1c4))
* **ecs:** honor UpdateService forceNewDeployment and emit EventBridge lifecycle events ([#2938](https://github.com/floci-io/floci/issues/2938)) ([14ca62d](https://github.com/floci-io/floci/commit/14ca62d9f7adb62151559d6334b3e3cc8002aff3)), closes [#2557](https://github.com/floci-io/floci/issues/2557) [#2557](https://github.com/floci-io/floci/issues/2557) [#2557](https://github.com/floci-io/floci/issues/2557) [#2557](https://github.com/floci-io/floci/issues/2557) [#2557](https://github.com/floci-io/floci/issues/2557) [#2557](https://github.com/floci-io/floci/issues/2557)
* **ecs:** scope EFS volume mounts to rootDirectory and accessPointId ([#3449](https://github.com/floci-io/floci/issues/3449)) ([543bde7](https://github.com/floci-io/floci/commit/543bde7d5d0676e7d7010b48140e227a5d2f36de)), closes [#2563](https://github.com/floci-io/floci/issues/2563)
* **elasticache:** add validation for cache parameter group existence in replication group operations ([#2957](https://github.com/floci-io/floci/issues/2957)) ([6c9cc95](https://github.com/floci-io/floci/commit/6c9cc95d540492bedbcb54ed7cfe6fac382df0a4))
* **eventbridge:** run ECS tasks from classic rule targets ([#3484](https://github.com/floci-io/floci/issues/3484)) ([cfe9f84](https://github.com/floci-io/floci/commit/cfe9f84ffe9ff830463e12119780a34f7320b7dc)), closes [#2558](https://github.com/floci-io/floci/issues/2558)
* **firehose:** apply the Lambda transform to buffered records ([#3393](https://github.com/floci-io/floci/issues/3393)) ([d96516d](https://github.com/floci-io/floci/commit/d96516dc70ebee7ee60863e0b1ac3f9a9d2fb1c0))
* **firehose:** convert array, struct and map columns to Parquet ([#3521](https://github.com/floci-io/floci/issues/3521)) ([6790024](https://github.com/floci-io/floci/commit/6790024abc5e922b92eac65bd3514594096620fe))
* **firehose:** convert JSON records to Parquet via the floci-duck sidecar ([#3333](https://github.com/floci-io/floci/issues/3333)) ([9a2a893](https://github.com/floci-io/floci/commit/9a2a89399aaad6efd08d9442b27d6d745cb6a317))
* **firehose:** validate and persist DataFormatConversionConfiguration ([#3236](https://github.com/floci-io/floci/issues/3236)) ([8a122d2](https://github.com/floci-io/floci/commit/8a122d2b8cf9a6a6f63c4e249544f97f2c5d8083))
* **firehose:** validate and persist ProcessingConfiguration ([#3375](https://github.com/floci-io/floci/issues/3375)) ([debf9fb](https://github.com/floci-io/floci/commit/debf9fb0dc728581c4c6db6d1a65bd511b282e8f))
* **floci-core:** resolve active Docker context when DOCKER_HOST is unset ([#3197](https://github.com/floci-io/floci/issues/3197)) ([e31590b](https://github.com/floci-io/floci/commit/e31590bba5bef84a47390d0f845417d5b99ab222)), closes [#1990](https://github.com/floci-io/floci/issues/1990)
* **globalaccelerator:** add the Global Accelerator management plane ([#3378](https://github.com/floci-io/floci/issues/3378)) ([2e79f5c](https://github.com/floci-io/floci/commit/2e79f5c766347264924d001bee3e567789d1a1e3))
* **glue:** jobs and crawlers ([#2591](https://github.com/floci-io/floci/issues/2591)) ([de6bf8f](https://github.com/floci-io/floci/commit/de6bf8f599d6085ca2d6f4c04b32ec8c53e0270f))
* **glue:** support GetPartitionIndexes ([#3416](https://github.com/floci-io/floci/issues/3416)) ([606e7b9](https://github.com/floci-io/floci/commit/606e7b966f1160ca0f30292e68b4ff2c662a8e4c))
* **guardduty:** add member account operations ([#3052](https://github.com/floci-io/floci/issues/3052)) ([b6489ac](https://github.com/floci-io/floci/commit/b6489ac933791cee05da263da038bbb358a1fb75))
* **iam:** resolve resource and request tag condition keys for EC2 and S3 ([#3212](https://github.com/floci-io/floci/issues/3212)) ([64538f7](https://github.com/floci-io/floci/commit/64538f7d324ae9a95816b795130b4ab2cf4df01e))
* **iam:** support DynamoDB fine-grained access control ([#2926](https://github.com/floci-io/floci/issues/2926)) ([#3011](https://github.com/floci-io/floci/issues/3011)) ([6653b9a](https://github.com/floci-io/floci/commit/6653b9a4e4beee419a1378f911e40ea2b8ef1282)), closes [#aliases](https://github.com/floci-io/floci/issues/aliases)
* **identity-center:** complete IAM Identity Center emulation ([#3331](https://github.com/floci-io/floci/issues/3331)) ([cbfa034](https://github.com/floci-io/floci/commit/cbfa034470826e02fc36fda44041fe3368f846f6))
* **identitystore:** add full service emulation ([#3159](https://github.com/floci-io/floci/issues/3159)) ([6264b09](https://github.com/floci-io/floci/commit/6264b09a28ba4e96dbc5b65588a5ac71779c494d))
* **inspector2:** add organization configuration operations ([#3162](https://github.com/floci-io/floci/issues/3162)) ([4944764](https://github.com/floci-io/floci/commit/4944764fa381b34a4118d89640f84eb7ea5e5f66))
* **iot:** configurable DescribeEndpoint address for published AWS IoT ports ([#3202](https://github.com/floci-io/floci/issues/3202)) ([53a84c8](https://github.com/floci-io/floci/commit/53a84c889045f06a88cd2c26ce31aad3450c9894))
* **iot:** domain configurations ([#3008](https://github.com/floci-io/floci/issues/3008)) ([9220c05](https://github.com/floci-io/floci/commit/9220c057b77fc2a66a254d1e5d68f57ae629f8e6))
* **iot:** evaluate the SQL subset of topic rules ([#3021](https://github.com/floci-io/floci/issues/3021)) ([d45c645](https://github.com/floci-io/floci/commit/d45c64545d444d749b0f311d943c506295750e97))
* **iot:** firehose and cloudwatchLogs rule actions ([#3013](https://github.com/floci-io/floci/issues/3013)) ([ebdf092](https://github.com/floci-io/floci/commit/ebdf092ccebbfda7daaebe42b58fd001f47e5556))
* **iot:** MQTT over TLS listener on 8883 ([#3142](https://github.com/floci-io/floci/issues/3142)) ([ee2f55b](https://github.com/floci-io/floci/commit/ee2f55b784229667a5e06ec61c3754030ab913aa))
* **iot:** MQTT over WebSocket at /mqtt ([#3150](https://github.com/floci-io/floci/issues/3150)) ([c4027bb](https://github.com/floci-io/floci/commit/c4027bbf549e3f863ce932e0f186f29fcc0ffc18)), closes [#3142](https://github.com/floci-io/floci/issues/3142)
* **iot:** provision AWS::IoT::Thing, Policy and TopicRule ([#3014](https://github.com/floci-io/floci/issues/3014)) ([dec348d](https://github.com/floci-io/floci/commit/dec348d38259eb79783863adc21e42ad226b08f8))
* **iot:** real device certificates issued by the local CA ([#3079](https://github.com/floci-io/floci/issues/3079)) ([c67e598](https://github.com/floci-io/floci/commit/c67e5985944ddb807bad544fe308ef1bb55e948b)), closes [PKCS#10](https://github.com/PKCS/issues/10) [PKCS#10](https://github.com/PKCS/issues/10)
* **iot:** rule SQL message functions, isNull, isUndefined, IN and array literals ([#3036](https://github.com/floci-io/floci/issues/3036)) ([b88034c](https://github.com/floci-io/floci/commit/b88034cd1df64622419252bb6a58ae1178f509eb))
* **iot:** verify device certificates on the MQTT TLS listener ([#3180](https://github.com/floci-io/floci/issues/3180)) ([19a8536](https://github.com/floci-io/floci/commit/19a85360e1ee1b12ef06f0ea897221093e71a439))
* **kinesis:** implement UpdateShardCount API ([#3200](https://github.com/floci-io/floci/issues/3200)) ([e3766ea](https://github.com/floci-io/floci/commit/e3766eac6fb0702c140a1333fabcb7103c34332b)), closes [#3064](https://github.com/floci-io/floci/issues/3064)
* **kms:** support ImportKeyMaterial for Origin=EXTERNAL keys ([#3068](https://github.com/floci-io/floci/issues/3068)) ([37faaa8](https://github.com/floci-io/floci/commit/37faaa8abe0d1b3768c3b8004460e4f9ff258133)), closes [#1916](https://github.com/floci-io/floci/issues/1916)
* **lakeformation:** add UpdateResource action ([#2944](https://github.com/floci-io/floci/issues/2944)) ([ee24c77](https://github.com/floci-io/floci/commit/ee24c77d024795e95b7c1f52c9bc4ea3327591f1))
* **lambda:** mint EKS bearer tokens natively for the kubernetes executor ([#2981](https://github.com/floci-io/floci/issues/2981)) ([252bfe8](https://github.com/floci-io/floci/commit/252bfe85a2d5d5027e9ff46a59df7aaa7e6818ff)), closes [#2919](https://github.com/floci-io/floci/issues/2919)
* **lambda:** provision AWS::Lambda::EventInvokeConfig ([#3230](https://github.com/floci-io/floci/issues/3230)) ([af42564](https://github.com/floci-io/floci/commit/af42564cb306fd628652dffe59a488451b6d3891))
* **lambda:** support self-managed Apache Kafka event source mappings ([#3062](https://github.com/floci-io/floci/issues/3062)) ([#3082](https://github.com/floci-io/floci/issues/3082)) ([ee5c87d](https://github.com/floci-io/floci/commit/ee5c87d6d6966c640a8e4c2ef256916c5a153791))
* **macie2:** add organization administration operations ([#3105](https://github.com/floci-io/floci/issues/3105)) ([3927c66](https://github.com/floci-io/floci/commit/3927c660403172fc8f31cc114bfb75178a6a03f4))
* **marketplace-agreement:** emulate AWS Marketplace Agreement API ([#3339](https://github.com/floci-io/floci/issues/3339)) ([c99ecea](https://github.com/floci-io/floci/commit/c99ecea0da10b380d61737ccb554cbfafa5bf7a8))
* **marketplace-catalog:** emulate AWS Marketplace Catalog API ([#3338](https://github.com/floci-io/floci/issues/3338)) ([50fa334](https://github.com/floci-io/floci/commit/50fa334dc526b1e46f6ff44a16023057f7d62a76))
* **marketplace-deployment:** emulate AWS Marketplace Deployment API ([#3341](https://github.com/floci-io/floci/issues/3341)) ([48d2928](https://github.com/floci-io/floci/commit/48d29280610685471ea955b06e7c2b76d9d82920))
* **marketplace-discovery:** emulate AWS Marketplace Discovery API ([#3342](https://github.com/floci-io/floci/issues/3342)) ([07d6cab](https://github.com/floci-io/floci/commit/07d6cabd8a41ffd7be81b0d31c10ba9bb2f0b328))
* **marketplace-entitlement:** emulate AWS Marketplace Entitlement API ([#3340](https://github.com/floci-io/floci/issues/3340)) ([87f2c2d](https://github.com/floci-io/floci/commit/87f2c2d1a85cd73167df96e6e1516a9de14b8fd1))
* **marketplace-metering:** emulate AWS Marketplace Metering API ([#3344](https://github.com/floci-io/floci/issues/3344)) ([efcbc4d](https://github.com/floci-io/floci/commit/efcbc4d993119d9b6d403ef471ef275d5365d710))
* **marketplace-reporting:** emulate AWS Marketplace Reporting API ([#3343](https://github.com/floci-io/floci/issues/3343)) ([3c080e1](https://github.com/floci-io/floci/commit/3c080e1ea60e0640360643d8467c8f8e99e35d2c))
* **neptune:** support the Terraform aws_neptune_cluster read-back contract ([#3017](https://github.com/floci-io/floci/issues/3017)) ([a7be2dd](https://github.com/floci-io/floci/commit/a7be2dd299e07313ca3853b670e2cba5b97ac835))
* **oam:** emulate observability access manager ([#3440](https://github.com/floci-io/floci/issues/3440)) ([a0fd815](https://github.com/floci-io/floci/commit/a0fd815366ab72c089ea96f0c8af79d0bcceae93))
* **pipes:** validate ParallelizationFactor on Kinesis and DynamoDB sources ([#3192](https://github.com/floci-io/floci/issues/3192)) ([5fd89e2](https://github.com/floci-io/floci/commit/5fd89e27bc8bcefc26b02843b3446567295d169c))
* **ram:** support resource-share invitation accept/reject ([#3120](https://github.com/floci-io/floci/issues/3120)) ([81b8127](https://github.com/floci-io/floci/commit/81b8127de07ba0a2812cb965995cb50c263ce587))
* **rds:** accept AWS IAM DB auth users on MySQL ([#3395](https://github.com/floci-io/floci/issues/3395)) ([485b7c5](https://github.com/floci-io/floci/commit/485b7c50477358de1b2e49531e816431f44f8867))
* **rds:** implement CreateDBSnapshot and RestoreDBInstanceFromDBSnap… ([#1894](https://github.com/floci-io/floci/issues/1894)) ([2869502](https://github.com/floci-io/floci/commit/2869502e7cf5cd6345dd8333436fdab772746692)), closes [#1817](https://github.com/floci-io/floci/issues/1817)
* **rds:** persist EngineMode and StorageEncrypted on DB clusters ([#3448](https://github.com/floci-io/floci/issues/3448)) ([828b53c](https://github.com/floci-io/floci/commit/828b53c5afeb7195d1a281aba4d75f9da4906524)), closes [#2559](https://github.com/floci-io/floci/issues/2559)
* **redshift-data:** emulate the Amazon Redshift Data API ([#3186](https://github.com/floci-io/floci/issues/3186)) ([b9039fe](https://github.com/floci-io/floci/commit/b9039fef1d446dfdbfc69ff0a5371aad8d550a48))
* **redshift:** emulate GetClusterCredentials and GetClusterCredentialsWithIAM ([#3273](https://github.com/floci-io/floci/issues/3273)) ([6b17ef2](https://github.com/floci-io/floci/commit/6b17ef2b1c13e66ce2101a732efd5fc2f47d316d))
* **redshift:** emulate Redshift COPY FROM s3 over Simple Query protocol ([#3100](https://github.com/floci-io/floci/issues/3100)) ([85180a4](https://github.com/floci-io/floci/commit/85180a4d88aeaf027b188cf8192869612cd04e20))
* **redshift:** emulate Redshift UNLOAD TO s3 over Simple Query protocol ([#3129](https://github.com/floci-io/floci/issues/3129)) ([4570bf6](https://github.com/floci-io/floci/commit/4570bf62c5f8c13fca598efcd20be29421185f82))
* **redshift:** intercept Extended Query protocol ([#3474](https://github.com/floci-io/floci/issues/3474)) ([e9454af](https://github.com/floci-io/floci/commit/e9454af8550568bcbb9ca120a09aa121e125e90e))
* **redshift:** provision AWS::Redshift::Cluster through CloudFormation ([#3427](https://github.com/floci-io/floci/issues/3427)) ([e5bd8be](https://github.com/floci-io/floci/commit/e5bd8be405dbbf31f612c2cb068731617521c2d5))
* **redshift:** rewrite Redshift table DDL keywords for a PostgreSQL backend ([#2947](https://github.com/floci-io/floci/issues/2947)) ([17ea9a9](https://github.com/floci-io/floci/commit/17ea9a9aac9b025b26e5bf720655e56711ebbf46))
* **redshift:** wire the Simple Query DDL interceptor into the proxy ([#3029](https://github.com/floci-io/floci/issues/3029)) ([4daba7e](https://github.com/floci-io/floci/commit/4daba7ed6a3bde4e93bdbb5d757b1315962e053e))
* **route53:** support cross-account VPC associations ([#3116](https://github.com/floci-io/floci/issues/3116)) ([162211d](https://github.com/floci-io/floci/commit/162211de0c6bc404a9974e8400e8bd219d528fff))
* **route53:** update supported operations and add VPC association actions ([#2959](https://github.com/floci-io/floci/issues/2959)) ([df0e7bc](https://github.com/floci-io/floci/commit/df0e7bc79c1256a7efbe54dbbf218e98639ec173))
* **s3:** add Intelligent-Tiering configuration CRUD ([#2997](https://github.com/floci-io/floci/issues/2997)) ([96d16de](https://github.com/floci-io/floci/commit/96d16de99885678ab6bb68bbc2f20d0cc63899af))
* **s3:** add object annotations support ([#3324](https://github.com/floci-io/floci/issues/3324)) ([f9f90cf](https://github.com/floci-io/floci/commit/f9f90cfc988ac8365fdcf8b2d5934e1694781011))
* **s3:** support bucket analytics and inventory configurations ([#3213](https://github.com/floci-io/floci/issues/3213)) ([703744c](https://github.com/floci-io/floci/commit/703744c9fb5b01af29f9943b16bfb8f90d408a6b))
* **securityhub:** add organization configuration operations ([#3161](https://github.com/floci-io/floci/issues/3161)) ([9d4e71f](https://github.com/floci-io/floci/commit/9d4e71f8a2f15035070f19f5f381dafa56c36940))
* serve custom domains over TLS as soon as they are created ([#3086](https://github.com/floci-io/floci/issues/3086)) ([67bbd2c](https://github.com/floci-io/floci/commit/67bbd2cf1322f8a36c3d4ad0424edab8979a9d70)), closes [PKCS#8](https://github.com/PKCS/issues/8) [PKCS#8](https://github.com/PKCS/issues/8) [PKCS#1](https://github.com/PKCS/issues/1) [#3035](https://github.com/floci-io/floci/issues/3035) [#3035](https://github.com/floci-io/floci/issues/3035) [#3095](https://github.com/floci-io/floci/issues/3095) [#3095](https://github.com/floci-io/floci/issues/3095)
* **servicequotas:** add quota request history lookup ([#3054](https://github.com/floci-io/floci/issues/3054)) ([532e279](https://github.com/floci-io/floci/commit/532e27986eca31baac593b9167f77e10fca850ba))
* **ses:** implement v1 receipt filters (CreateReceiptFilter, ListReceiptFilters, DeleteReceiptFilter) ([#3163](https://github.com/floci-io/floci/issues/3163)) ([2c6a92c](https://github.com/floci-io/floci/commit/2c6a92c07dca3723638c51e1539c9c51c46126f0))
* **ses:** implement v1 receipt rules with locally validated action targets ([#3119](https://github.com/floci-io/floci/issues/3119)) ([fd665a0](https://github.com/floci-io/floci/commit/fd665a08cc3188dd7d25cc31cffa2b5358d69c34))
* **ses:** implement v1 ReorderReceiptRuleSet and CloneReceiptRuleSet ([#3176](https://github.com/floci-io/floci/issues/3176)) ([f485122](https://github.com/floci-io/floci/commit/f485122ffcbfe5615dd0dd9f9caef197266ad29f))
* **ses:** preserve raw message fidelity and envelope sender in the SMTP relay ([#3522](https://github.com/floci-io/floci/issues/3522)) ([505b5d2](https://github.com/floci-io/floci/commit/505b5d286ef72d7d4fd8711a45eb4477d90a22c5))
* **ses:** support tag operations on tenant ARNs ([#2832](https://github.com/floci-io/floci/issues/2832)) ([812911f](https://github.com/floci-io/floci/commit/812911fd03f0e3215d420b49c8c582a0a60748dd))
* **ses:** support v2 dedicated IP (IP-level) and scaling/warmup APIs ([#3420](https://github.com/floci-io/floci/issues/3420)) ([e219ea4](https://github.com/floci-io/floci/commit/e219ea409ff9d77a920b02af4e182f9791a35b1e))
* **sfn:**  publish history events for Parallel branches and Map iterations ([#3167](https://github.com/floci-io/floci/issues/3167)) ([fd21ac9](https://github.com/floci-io/floci/commit/fd21ac9a6d749e7adbeb01004d1fb2df0c95a615))
* **ssm:** answer the public Amazon Linux AMI parameters ([#3173](https://github.com/floci-io/floci/issues/3173)) ([8142457](https://github.com/floci-io/floci/commit/8142457f9b680019313e86d911b8c27032665b38))
* **ssm:** model documents and associations with full lifecycle operations ([#3057](https://github.com/floci-io/floci/issues/3057)) ([f00fb4c](https://github.com/floci-io/floci/commit/f00fb4c289ad20e5b21940691362c6eb88c5d5e8))
* **ssoadmin:** add permission sets and assignments ([#3103](https://github.com/floci-io/floci/issues/3103)) ([1bf7494](https://github.com/floci-io/floci/commit/1bf7494e990f6c0a1f00427c17fac4939dfbd728))
* **stepfunctions:** add SNS Publish service integration ([#3316](https://github.com/floci-io/floci/issues/3316)) ([283890d](https://github.com/floci-io/floci/commit/283890dce926256562b8032e9e18b55ce25f42fc))
* **stepfunctions:** close ASL gaps in intrinsics, Choice, StartExecution and ResultPath ([#3002](https://github.com/floci-io/floci/issues/3002)) ([352d89f](https://github.com/floci-io/floci/commit/352d89ff2d2aa34b85e9ca9b03857de44f61fbd0))
* **stepfunctions:** resolve Fail state ErrorPath and CausePath dynamically ([#3302](https://github.com/floci-io/floci/issues/3302)) ([650914f](https://github.com/floci-io/floci/commit/650914f5f11b9d0fe4e636979076bbdc00d07abd)), closes [#3255](https://github.com/floci-io/floci/issues/3255)
* **tls:** a local root CA that signs Floci's server certificate ([#3078](https://github.com/floci-io/floci/issues/3078)) ([3c6c005](https://github.com/floci-io/floci/commit/3c6c005ff1a0d68d8149742ab1a9abbc313111e5))
* **translate:** add Amazon Translate mock service ([#2879](https://github.com/floci-io/floci/issues/2879)) ([10192f0](https://github.com/floci-io/floci/commit/10192f05d5faca693418b692d750d48df63e81ab))
* **ui:** publish a console contract so any web console can be the sidecar ([#3641](https://github.com/floci-io/floci/issues/3641)) ([a5ebda0](https://github.com/floci-io/floci/commit/a5ebda01fba82bd702a0b36adc0c585406280eb9))
* **verifiedpermissions:** add full service emulation ([#3128](https://github.com/floci-io/floci/issues/3128)) ([2d51259](https://github.com/floci-io/floci/commit/2d512591208d8445bfa3a1def5e085ffc59fc565))


### Performance Improvements

* **apigateway:** avoid repeated root resource scans ([#3404](https://github.com/floci-io/floci/issues/3404)) ([0a45d2e](https://github.com/floci-io/floci/commit/0a45d2e1313029fc211968921e18e8194b994965))
* **build:** drop KotlinPoet and ICU4J from the protobuf schema path ([#2992](https://github.com/floci-io/floci/issues/2992)) ([21f165b](https://github.com/floci-io/floci/commit/21f165b2e972a27db82cad5077a9c89a52e99068))
* **build:** keep only the snappy JNI libraries the image will use ([#2940](https://github.com/floci-io/floci/issues/2940)) ([4ce53b5](https://github.com/floci-io/floci/commit/4ce53b51d65cc53e099ec3fec93cf7274842f88e))
* **build:** keep the managed policy catalog files out of the native image ([#3489](https://github.com/floci-io/floci/issues/3489)) ([24e13f3](https://github.com/floci-io/floci/commit/24e13f3831e13ce06db2232839f2596bf4feb63d))
* **build:** replace BouncyCastle with JDK crypto API as much as possible ([#2988](https://github.com/floci-io/floci/issues/2988)) ([ffe8a92](https://github.com/floci-io/floci/commit/ffe8a92635ce7018414bfc5f0d246bbc67d2c534))
* **build:** replace quarkus-jdbc extensions with plain JDBC drivers  ([#3465](https://github.com/floci-io/floci/issues/3465)) ([569f9f5](https://github.com/floci-io/floci/commit/569f9f55e4ea6811563ec60f54b1dd7150e81c9b))
* **docker:** drop the gosu layer and two no-op native-image inputs ([#3037](https://github.com/floci-io/floci/issues/3037)) ([b0a8dff](https://github.com/floci-io/floci/commit/b0a8dff20641b216dc3424295115758d4e6f44f2))
* **docker:** shrink image by 28% using ubi9-micro (109 MB to 78 MB compressed) ([#3085](https://github.com/floci-io/floci/issues/3085)) ([64f06e0](https://github.com/floci-io/floci/commit/64f06e090f595c7a69c3df2e65ffd1ab6e1d6333)), closes [#3037](https://github.com/floci-io/floci/issues/3037)
* **docker:** trim the compat image's CLI extras and Python build leftovers ([#3108](https://github.com/floci-io/floci/issues/3108)) ([a6bd055](https://github.com/floci-io/floci/commit/a6bd0554a7f89c9e1c2c4b0f5fbc3226c595856c))
* **s3:** drop unused hashes on S3Object creation ([#3589](https://github.com/floci-io/floci/issues/3589)) ([a5ab167](https://github.com/floci-io/floci/commit/a5ab1672f9305299e3b7a32d67ce12b1d89f1199))

## [2.0.1](https://github.com/floci-io/floci/compare/2.0.0...2.0.1) (2026-09-01)


### Bug Fixes

* **rds-data:** fixing empty array response from statement ([#2880](https://github.com/floci-io/floci/issues/2880)) ([46283f3](https://github.com/floci-io/floci/commit/46283f3209275dde55ede37ce6d889b5d296d3c5))

# [2.0.0](https://github.com/floci-io/floci/compare/1.7.0...2.0.0) (2026-09-01)


* fix(stepfunctions)!: reject JSONata top-level references at definition time ([#2699](https://github.com/floci-io/floci/issues/2699)) ([5534460](https://github.com/floci-io/floci/commit/553446049294499455a70f411d2db3c0050c17ae))


### Bug Fixes

* **acm:** correct wildcard validation record names ([#2575](https://github.com/floci-io/floci/issues/2575)) ([88bf0a2](https://github.com/floci-io/floci/commit/88bf0a293155947487ce72b89cca2514daf7547a))
* **apigateway:** match measured JWT claim wire format and enforce route authorizationScopes ([#2011](https://github.com/floci-io/floci/issues/2011)) ([4980210](https://github.com/floci-io/floci/commit/498021087f23b316d609814c264a280b17a719c5))
* **apigateway:** pass RequestContext to ApiGatewayExecuteController in trailing-slash tests ([#2394](https://github.com/floci-io/floci/issues/2394)) ([41953d8](https://github.com/floci-io/floci/commit/41953d88200017da7b4eb15d0f6ce149aca83c5b)), closes [#2377](https://github.com/floci-io/floci/issues/2377)
* **apigateway:** project HTTP API v2 cookies ([#2391](https://github.com/floci-io/floci/issues/2391)) ([48880aa](https://github.com/floci-io/floci/commit/48880aa79ae9940f4135da25641b70decc7faade))
* **apigateway:** report RestApi as available ([#2816](https://github.com/floci-io/floci/issues/2816)) ([62dbd9d](https://github.com/floci-io/floci/commit/62dbd9ddf953ddbb567818f85c0a49a077f0837b))
* **apigateway:** route CORS preflight (OPTIONS) to deployed API integ… ([#1955](https://github.com/floci-io/floci/issues/1955)) ([0e3391c](https://github.com/floci-io/floci/commit/0e3391cac2de0823f4b30b3b89127b2cbb7d89ba)), closes [#1928](https://github.com/floci-io/floci/issues/1928)
* **apigateway:** support AWS type Lambda integration and fix duplicate Content-Type header ([#2049](https://github.com/floci-io/floci/issues/2049)) ([72dfa63](https://github.com/floci-io/floci/commit/72dfa634f75a849a096804c72c5c4c8ba4fa5442))
* **apigateway:** support underscores in v2 path parameters ([#2721](https://github.com/floci-io/floci/issues/2721)) ([c18af5b](https://github.com/floci-io/floci/commit/c18af5b68adada89c1c81055523e1159208a0568))
* **apigatewayv2:** CloudFormation AuthorizationScopes pass-through and scope-ingestion hardening (follow-up to [#2011](https://github.com/floci-io/floci/issues/2011)) ([#2431](https://github.com/floci-io/floci/issues/2431)) ([d0a96d8](https://github.com/floci-io/floci/commit/d0a96d87b1a9f17d87112b470126c256bfe958df))
* **apigatewayv2:** preserve trailing slash in HTTP API event path ([#2367](https://github.com/floci-io/floci/issues/2367)) ([6469637](https://github.com/floci-io/floci/commit/64696375082a028941488c9cf82d72e18d77c9aa)), closes [#1863](https://github.com/floci-io/floci/issues/1863) [#2136](https://github.com/floci-io/floci/issues/2136)
* **apigatewayv2:** propagate Lambda REQUEST authorizer context to HTTP API backends ([#2715](https://github.com/floci-io/floci/issues/2715)) ([908d70d](https://github.com/floci-io/floci/commit/908d70db3d13c41fa696fe57cd55f3e2976a032f)), closes [#1011](https://github.com/floci-io/floci/issues/1011) [#812](https://github.com/floci-io/floci/issues/812) [#581](https://github.com/floci-io/floci/issues/581)
* **apigatewayv2:** return stage tags across protocols ([#2413](https://github.com/floci-io/floci/issues/2413)) ([5744082](https://github.com/floci-io/floci/commit/5744082c5eb3b99e1a0c52db644b64a67afada77))
* **apigatewayv2:** route requests to API-owning account ([#2377](https://github.com/floci-io/floci/issues/2377)) ([ba9ce84](https://github.com/floci-io/floci/commit/ba9ce8424223f5652ba34f53cbca291372084e53))
* apply S3 Vectors metadata filters ([#2417](https://github.com/floci-io/floci/issues/2417)) ([bd8d99b](https://github.com/floci-io/floci/commit/bd8d99b7575bd70b50fc4fe51f5ec33309c8a14a)), closes [#2160](https://github.com/floci-io/floci/issues/2160)
* **appsync:** honor configured base URL in API URIs ([#2457](https://github.com/floci-io/floci/issues/2457)) ([86e1c01](https://github.com/floci-io/floci/commit/86e1c016cd0bb093be9232f2a4444647a85a97b1))
* **appsync:** use ApiKey.id as the API key value ([#2645](https://github.com/floci-io/floci/issues/2645)) ([2932500](https://github.com/floci-io/floci/commit/29325006bb7fd17714227653a4abcf76e2039a28))
* **appsync:** wait for schema creation in SDK test ([#2456](https://github.com/floci-io/floci/issues/2456)) ([43e5e90](https://github.com/floci-io/floci/commit/43e5e903d16941724b66fee943315dc4143da91b))
* **athena:** route database DDL to Glue ([#2757](https://github.com/floci-io/floci/issues/2757)) ([2480daa](https://github.com/floci-io/floci/commit/2480daaa099bb50d670bcf65b8f22c2cee8dba43))
* **bedrock-agentcore:** allow maxResults up to 1000 ([#2487](https://github.com/floci-io/floci/issues/2487)) ([9792198](https://github.com/floci-io/floci/commit/97921982d70b67725087016bd33e40bf7ffbea0a))
* **bedrock-agentcore:** support memory tagging and dropped fields ([#2501](https://github.com/floci-io/floci/issues/2501)) ([feb669d](https://github.com/floci-io/floci/commit/feb669d58b806965a1a403ba5656f02eeb82e994)), closes [#2316](https://github.com/floci-io/floci/issues/2316)
* **build:** resolve the JSON schema library from Maven Central ([#2811](https://github.com/floci-io/floci/issues/2811)) ([66d910c](https://github.com/floci-io/floci/commit/66d910c61348ed01f9e38563086e18ff864948ee))
* **ci:** replace setup-java's broken maven cache with actions/cache ([#2503](https://github.com/floci-io/floci/issues/2503)) ([a68bfc4](https://github.com/floci-io/floci/commit/a68bfc4e68d265ebf34011b67ae83e0b65e489d5))
* **cloudformation:** adopt managed policy on stack update ([#2717](https://github.com/floci-io/floci/issues/2717)) ([51edcca](https://github.com/floci-io/floci/commit/51edccacbf7ab22977ca765cfb481227d449a1c8))
* **cloudformation:** fail the stack when Lambda S3 code cannot be read ([#2650](https://github.com/floci-io/floci/issues/2650)) ([231c097](https://github.com/floci-io/floci/commit/231c0972b0ec9e663388bf85ec2a15f3ee1ddf38)), closes [#2648](https://github.com/floci-io/floci/issues/2648)
* **cloudformation:** keep a rolled-back stack's diagnostics until the next redeploy ([#2365](https://github.com/floci-io/floci/issues/2365)) ([c54f8dd](https://github.com/floci-io/floci/commit/c54f8ddf023007d975b3dc300873281727e74c66)), closes [#2207](https://github.com/floci-io/floci/issues/2207) [Stack#changeSets](https://github.com/Stack/issues/changeSets) [#2419](https://github.com/floci-io/floci/issues/2419)
* **cloudformation:** no-op stack update for unchanged fixed-name resources ([#2385](https://github.com/floci-io/floci/issues/2385)) ([5864ff6](https://github.com/floci-io/floci/commit/5864ff6aa88e0047b5a3540ac4722c8cfc424e4d)), closes [lex00/floci#16](https://github.com/lex00/floci/issues/16)
* **cloudformation:** reconcile DynamoDB streams declared by StreamSpecification ([#2411](https://github.com/floci-io/floci/issues/2411)) ([c4597f2](https://github.com/floci-io/floci/commit/c4597f2e53ce2c116559353721f516aac1bf3ba1))
* **cloudformation:** resolve IAM assume role policy intrinsics ([#2630](https://github.com/floci-io/floci/issues/2630)) ([6a1d86e](https://github.com/floci-io/floci/commit/6a1d86e43fb0939c833f92a864e9cf44bb6b70cf))
* **cloudformation:** tolerate missing stack resources during deletion ([#2039](https://github.com/floci-io/floci/issues/2039)) ([12b8ddd](https://github.com/floci-io/floci/commit/12b8ddd6291b901a086bc106d346ea87ffb8b09b))
* **cloudfront:** include terraform-required distribution fields ([#1940](https://github.com/floci-io/floci/issues/1940)) ([8ac23de](https://github.com/floci-io/floci/commit/8ac23deb064b243884563db73745943926459f31)), closes [#1930](https://github.com/floci-io/floci/issues/1930)
* **cloudfront:** separate DEVELOPMENT and LIVE function stages ([#2622](https://github.com/floci-io/floci/issues/2622)) ([0dfec3c](https://github.com/floci-io/floci/commit/0dfec3cf3cd4db7d212007472dd7f9393caf4661))
* **cloudwatch:** decompress gzipped cbor bodies. ([#2379](https://github.com/floci-io/floci/issues/2379)) ([f952fff](https://github.com/floci-io/floci/commit/f952fffe77e9c44e05bbeadeeba8fb9d73a6f341))
* **cloudwatch:** evaluate alarms over CloudWatch's wider evaluation range ([#2771](https://github.com/floci-io/floci/issues/2771)) ([cfe8566](https://github.com/floci-io/floci/commit/cfe8566511cf0ac720174f95e72a07b41ff517be)), closes [#2700](https://github.com/floci-io/floci/issues/2700)
* **cognito:** AWS-accurate `UsernameAttributes` pools — UUID username, alias sign-in, and token/revocation parity ([#1849](https://github.com/floci-io/floci/issues/1849)) ([1ca19c7](https://github.com/floci-io/floci/commit/1ca19c722ac8ed3dd20b1a4e396ebb11f58aaec5))
* **cognito:** enforce user pool password policies ([#2070](https://github.com/floci-io/floci/issues/2070)) ([3aaf745](https://github.com/floci-io/floci/commit/3aaf74520eadd2c0a71ec84b2ab06a1b406f2f80)), closes [#2066](https://github.com/floci-io/floci/issues/2066) [#2066](https://github.com/floci-io/floci/issues/2066)
* **cognito:** reject self-managed verification status ([#2532](https://github.com/floci-io/floci/issues/2532)) ([f8597bd](https://github.com/floci-io/floci/commit/f8597bdef91e5538988afb1ac7bec5ab2c90eaa6))
* **docdb:** give a record without an ARN the one it should have had ([#2425](https://github.com/floci-io/floci/issues/2425)) ([7602002](https://github.com/floci-io/floci/commit/760200223a557b8a824d10e856e8d910e051e3d9))
* **docdb:** refuse an engine version a live account does not list ([#2682](https://github.com/floci-io/floci/issues/2682)) ([46d2f4e](https://github.com/floci-io/floci/commit/46d2f4e70f765d4f24842b5530d79d3d078290aa)), closes [#2681](https://github.com/floci-io/floci/issues/2681)
* **docdb:** scope cluster and instance identifiers per region ([#2440](https://github.com/floci-io/floci/issues/2440)) ([3887a6c](https://github.com/floci-io/floci/commit/3887a6ca65479e41fcf7ccc17ee231688c3bba75)), closes [#2408](https://github.com/floci-io/floci/issues/2408)
* **docdb:** store and return cluster and instance settings ([#2651](https://github.com/floci-io/floci/issues/2651)) ([f019573](https://github.com/floci-io/floci/commit/f019573bf164245e8a0555d9d7a3587e5feb7cb9)), closes [#2614](https://github.com/floci-io/floci/issues/2614)
* **dynamodb:** cap GSI multi-attribute key parts at 4 attributes ([#2475](https://github.com/floci-io/floci/issues/2475)) ([13f6867](https://github.com/floci-io/floci/commit/13f68670d770b35bb5341320cd510078866d6a8c)), closes [#2460](https://github.com/floci-io/floci/issues/2460)
* **dynamodb:** enforce composite query order ([#2471](https://github.com/floci-io/floci/issues/2471)) ([e4356de](https://github.com/floci-io/floci/commit/e4356def24503cf6fac01c6e48a2228087c4c37d)), closes [#2462](https://github.com/floci-io/floci/issues/2462)
* **dynamodb:** hybrid persistence ([#2677](https://github.com/floci-io/floci/issues/2677)) ([e531683](https://github.com/floci-io/floci/commit/e5316839caa93c3ca6e856df85723f7be7f6a8be))
* **dynamodb:** recognize every HASH attribute of a composite GSI partition key ([#2474](https://github.com/floci-io/floci/issues/2474)) ([768e96a](https://github.com/floci-io/floci/commit/768e96a33fb3c7de9421b9249f3f3850c2a8a562)), closes [#2461](https://github.com/floci-io/floci/issues/2461)
* **dynamodb:** reject key attribute values whose type does not match the key schema ([#2625](https://github.com/floci-io/floci/issues/2625)) ([bf6c7b0](https://github.com/floci-io/floci/commit/bf6c7b001cbe0c9ec642f34e3a54b8e231d94175)), closes [#2624](https://github.com/floci-io/floci/issues/2624)
* **dynamodb:** reject LSI KeySchema with other than one sort key ([#2476](https://github.com/floci-io/floci/issues/2476)) ([0397826](https://github.com/floci-io/floci/commit/0397826b9087604207464b9dfbcb663475837ba0)), closes [#2459](https://github.com/floci-io/floci/issues/2459)
* **dynamodb:** return LastEvaluatedKey when Limit stops exactly at the last item ([#2389](https://github.com/floci-io/floci/issues/2389)) ([41ff13e](https://github.com/floci-io/floci/commit/41ff13e66d0fde2b3619648bdf80161e478bde2b)), closes [#2383](https://github.com/floci-io/floci/issues/2383)
* **dynamodb:** stop getSortKeyNames() from corrupting persisted tables ([#2463](https://github.com/floci-io/floci/issues/2463)) ([726c9c7](https://github.com/floci-io/floci/commit/726c9c7446b8b2755586d4c2465f2b981d2b45b9)), closes [#2415](https://github.com/floci-io/floci/issues/2415)
* **dynamodb:** tolerate whitespace before a function's own parenthesis ([#2510](https://github.com/floci-io/floci/issues/2510)) ([e4b101d](https://github.com/floci-io/floci/commit/e4b101d5dab2de9f48755f8a80705db9f15c9f70)), closes [#2509](https://github.com/floci-io/floci/issues/2509)
* **dynamodb:** validate cursor key types ([#2470](https://github.com/floci-io/floci/issues/2470)) ([e3df59a](https://github.com/floci-io/floci/commit/e3df59ae1f7e5ffe0a1fe8da6d8669b2e996e735)), closes [#2468](https://github.com/floci-io/floci/issues/2468)
* **dynamodb:** validate index access paths ([#2278](https://github.com/floci-io/floci/issues/2278)) ([30f965d](https://github.com/floci-io/floci/commit/30f965d0563daac32d27e43caab2804089e5d1a3))
* **dynamodb:** validate query key types ([#2469](https://github.com/floci-io/floci/issues/2469)) ([a57c6c8](https://github.com/floci-io/floci/commit/a57c6c8112cd2547eeedcd95dd111fa7bbaca5e2)), closes [#2467](https://github.com/floci-io/floci/issues/2467)
* **ec2:** apply availability-zone filter in DescribeInstances ([#2543](https://github.com/floci-io/floci/issues/2543)) ([3bdcd5b](https://github.com/floci-io/floci/commit/3bdcd5b84fb2d517b4a440cccc907b7ffe2f9556)), closes [#2542](https://github.com/floci-io/floci/issues/2542)
* **ec2:** canonicalize IPv4 route destinations at the API boundary ([#2620](https://github.com/floci-io/floci/issues/2620)) ([8f76e13](https://github.com/floci-io/floci/commit/8f76e13dd69ae8189cdc2227042e1e0629d01c40)), closes [Ec2ServicePersistenceTest#legacyNonCanonicalRouteDestinationCanonicalizesOnRestart](https://github.com/Ec2ServicePersistenceTest/issues/legacyNonCanonicalRouteDestinationCanonicalizesOnRestart)
* **ec2:** create /run/sshd before starting sshd ([#1855](https://github.com/floci-io/floci/issues/1855)) ([3daab4a](https://github.com/floci-io/floci/commit/3daab4a1aec6a518f8b3837131212136926b961c))
* **ec2:** derive default vpc/subnet/sg ids per region ([#2384](https://github.com/floci-io/floci/issues/2384)) ([337dead](https://github.com/floci-io/floci/commit/337dead734f292e3fb9b2f898ab69a926f4693fc)), closes [Ec2ServiceTest#defaultVpcSubnetAndSecurityGroupIdsAreRegionScoped](https://github.com/Ec2ServiceTest/issues/defaultVpcSubnetAndSecurityGroupIdsAreRegionScoped) [lex00/floci#21](https://github.com/lex00/floci/issues/21) [pre-#21](https://github.com/pre-/issues/21) [pre-#21](https://github.com/pre-/issues/21) [#21](https://github.com/floci-io/floci/issues/21) [#21](https://github.com/floci-io/floci/issues/21) [floci-io/floci#21](https://github.com/floci-io/floci/issues/21)
* **ec2:** honour documented Describe* filters and stop ENIs inheriting instance tags ([#2747](https://github.com/floci-io/floci/issues/2747)) ([26ae4ef](https://github.com/floci-io/floci/commit/26ae4ef78acdf990d7123efbf7cc0c6341b3ecb6))
* **ec2:** install packages with yum on Amazon Linux 2 guests ([#2448](https://github.com/floci-io/floci/issues/2448)) ([c9f456e](https://github.com/floci-io/floci/commit/c9f456ea7a0f0fa4ba0ec5e667a9ba5aad0e8fa9)), closes [#2449](https://github.com/floci-io/floci/issues/2449)
* **ec2:** install the SSH client package in guests, not just the server ([#2449](https://github.com/floci-io/floci/issues/2449)) ([f3029ee](https://github.com/floci-io/floci/commit/f3029ee2511d9992381203dc89ed7dc0a364c9ce))
* **ec2:** reject a duplicate route destination with RouteAlreadyExists ([#2546](https://github.com/floci-io/floci/issues/2546)) ([1be97c9](https://github.com/floci-io/floci/commit/1be97c93332de48072dc43ab01f61ea79c4cbe3a))
* **ec2:** report a reachable EIP address, and run gzipped user-data ([#2621](https://github.com/floci-io/floci/issues/2621)) ([41b5148](https://github.com/floci-io/floci/commit/41b5148824e4c481f5949506a08c8e1b68d215b4))
* **ec2:** retry Docker port collisions ([#2029](https://github.com/floci-io/floci/issues/2029)) ([b27b32f](https://github.com/floci-io/floci/commit/b27b32f044da00fa6da20f01e2d39bce2c45c6a6))
* **ec2:** round-trip launch template data instead of discarding it ([#2595](https://github.com/floci-io/floci/issues/2595)) ([f1ad306](https://github.com/floci-io/floci/commit/f1ad306599a3efb643ff60ae0ca8df0d96a26888)), closes [Ec2ServicePersistenceTest#legacyIamProfileAndInstanceTagsSurviveRestart](https://github.com/Ec2ServicePersistenceTest/issues/legacyIamProfileAndInstanceTagsSurviveRestart)
* **ec2:** store and report a route's IPv6 destination, and stop DeleteRoute NPEing ([#2492](https://github.com/floci-io/floci/issues/2492)) ([e18a262](https://github.com/floci-io/floci/commit/e18a262261fc2fb5cb8cfd91c0198999b610886d))
* **ecs:** apply cluster settings given on CreateCluster ([#2845](https://github.com/floci-io/floci/issues/2845)) ([19013b8](https://github.com/floci-io/floci/commit/19013b8b63aa8b60ee31f78ea4875c2af7d66a36)), closes [#2806](https://github.com/floci-io/floci/issues/2806)
* **ecs:** report schedulingStrategy, deploymentController and availabilityZoneRebalancing on services ([#2482](https://github.com/floci-io/floci/issues/2482)) ([13664e7](https://github.com/floci-io/floci/commit/13664e76935b14a881d60611a000d363e419d37d))
* **ecs:** roll service tasks onto a changed task definition ([#2483](https://github.com/floci-io/floci/issues/2483)) ([f3b22e7](https://github.com/floci-io/floci/commit/f3b22e7964c342517fd279e479fa493a6d80f38c))
* **ecs:** round-trip command and entryPoint on container definitions ([#2446](https://github.com/floci-io/floci/issues/2446)) ([5c45c14](https://github.com/floci-io/floci/commit/5c45c146c7fe51a4ed9472dfd90be5be57d53cd4)), closes [#2445](https://github.com/floci-io/floci/issues/2445)
* **ecs:** round-trip runtimePlatform and logConfiguration on task definitions ([#2443](https://github.com/floci-io/floci/issues/2443)) ([a2389e7](https://github.com/floci-io/floci/commit/a2389e7733249102c9736cfb3698cf409f41bc4b))
* **ecs:** scope service tasks by owning service, not by caller-supplied group ([#2731](https://github.com/floci-io/floci/issues/2731)) ([c6b9e4c](https://github.com/floci-io/floci/commit/c6b9e4c34e2ac003254511ce59baf8533e8921b0)), closes [#2716](https://github.com/floci-io/floci/issues/2716)
* **eks:** implement cluster restoration after restart to maintain state ([#2780](https://github.com/floci-io/floci/issues/2780)) ([eaecb36](https://github.com/floci-io/floci/commit/eaecb36425983dbd7fc61ec73ad7e023bbd0958d))
* **elasticache:** keep a replication group's encryption, snapshot settings, tags and ARN ([#2632](https://github.com/floci-io/floci/issues/2632)) ([75f8f42](https://github.com/floci-io/floci/commit/75f8f42d5fbdb5e075e48eea9f18b8cffd2675ac)), closes [#2615](https://github.com/floci-io/floci/issues/2615)
* **elasticache:** report transit encryption, not the auth-token flag ([#2844](https://github.com/floci-io/floci/issues/2844)) ([90d1a19](https://github.com/floci-io/floci/commit/90d1a19310221d674d15f4f87b6a3c7cc81dc25e))
* **elasticache:** return the modeled capacity fault on proxy-port exhaustion ([#2423](https://github.com/floci-io/floci/issues/2423)) ([f40d2e3](https://github.com/floci-io/floci/commit/f40d2e34f3e6fc80bce6878916d4d58a47dd5eb1))
* **elb:** route Classic (v1) requests to a dedicated handler instead of ELBv2 ([#2619](https://github.com/floci-io/floci/issues/2619)) ([afe26c6](https://github.com/floci-io/floci/commit/afe26c6ad17953fecc3452e30f0978c06bc134c1))
* **eventbridge:** AWS-conformant InputTransformer from CloudFormation and PutTargets ([#1885](https://github.com/floci-io/floci/issues/1885)) ([9b3aee6](https://github.com/floci-io/floci/commit/9b3aee6a030575bf688d5ba55686994314c9c5a6))
* **eventbridge:** return 400 for missing resources ([#2553](https://github.com/floci-io/floci/issues/2553)) ([4083d06](https://github.com/floci-io/floci/commit/4083d0667d883426a3d220cf5d822b3637181041))
* **firehose:** use request region in delivery stream ARN ([#2719](https://github.com/floci-io/floci/issues/2719)) ([47e0647](https://github.com/floci-io/floci/commit/47e064786f0c227591fcc4f3b7344320cd6f5f1a))
* **iam:** correct GetAccountSummary provider and access-key counts ([#2426](https://github.com/floci-io/floci/issues/2426)) ([17e77ba](https://github.com/floci-io/floci/commit/17e77ba9d31e6a3e05a27b9cf7441aa60aef86e7))
* **iam:** implement UpdateAccountPasswordPolicy, Get and Delete ([#2616](https://github.com/floci-io/floci/issues/2616)) ([f411a31](https://github.com/floci-io/floci/commit/f411a316a2e8dc6ae6f5555b07c9a46f1c1fe75a))
* inject AWS SDK environment into Flink sidecars ([#2486](https://github.com/floci-io/floci/issues/2486)) ([127e51e](https://github.com/floci-io/floci/commit/127e51e71b0a429de94166e856fc91d78673747d)), closes [#2404](https://github.com/floci-io/floci/issues/2404)
* **kinesis-cbor:** timestamps mis-scaled 1000x on the CBOR path ([#2432](https://github.com/floci-io/floci/issues/2432)) ([39ed771](https://github.com/floci-io/floci/commit/39ed7712a7194322b6cfa38fc5aba3dbe91f4520)), closes [#2368](https://github.com/floci-io/floci/issues/2368)
* **kinesis:** apply CreateStream's Tags instead of dropping them ([#2494](https://github.com/floci-io/floci/issues/2494)) ([564dbf2](https://github.com/floci-io/floci/commit/564dbf204f36ad25e59add7588ebb7df6708e8e8))
* **kinesis:** reject non-blob Data instead of coercing it with asText ([#2551](https://github.com/floci-io/floci/issues/2551)) ([df5581e](https://github.com/floci-io/floci/commit/df5581e5bd7fb592e062b3511dd30f0bb5fb866f)), closes [#2516](https://github.com/floci-io/floci/issues/2516)
* **kms:** grant fidelity ([#2639](https://github.com/floci-io/floci/issues/2639)) ([5400204](https://github.com/floci-io/floci/commit/54002045635852b3cc5fbdcafcc9ff8d1ca71361))
* **lambda:** delete only the named version when DeleteFunction has a Qualifier ([#2824](https://github.com/floci-io/floci/issues/2824)) ([ca4c84c](https://github.com/floci-io/floci/commit/ca4c84c9e0f04a951410c872e73d5265853965b7)), closes [#2819](https://github.com/floci-io/floci/issues/2819)
* **lambda:** honour ListLayers and ListLayerVersions query parameters ([#2817](https://github.com/floci-io/floci/issues/2817)) ([4462963](https://github.com/floci-io/floci/commit/44629631ca1e38836aa6d3405d4cc30a8f45c1fc)), closes [#2808](https://github.com/floci-io/floci/issues/2808)
* **lambda:** honour Publish on CreateFunction and UpdateFunctionCode ([#2825](https://github.com/floci-io/floci/issues/2825)) ([a7b2b79](https://github.com/floci-io/floci/commit/a7b2b794929f9f79a8f31fa374b3bafe06d89097)), closes [#2820](https://github.com/floci-io/floci/issues/2820)
* **lambda:** implement GetLayerVersionByArn ([#2812](https://github.com/floci-io/floci/issues/2812)) ([5b363ff](https://github.com/floci-io/floci/commit/5b363ffa2dd25beadd1cea3b24bea1ce9ddf1128))
* **lambda:** make the code-volume populate concurrency configurable ([#2830](https://github.com/floci-io/floci/issues/2830)) ([968ff78](https://github.com/floci-io/floci/commit/968ff78e252945f651b7ca105dfdb840bedd3159)), closes [#2050](https://github.com/floci-io/floci/issues/2050)
* **lambda:** read deployment packages via the zip central directory ([#2649](https://github.com/floci-io/floci/issues/2649)) ([cd3f367](https://github.com/floci-io/floci/commit/cd3f3677f8e82ba8664368d162ad671da646c1fc)), closes [#2593](https://github.com/floci-io/floci/issues/2593) [#1215](https://github.com/floci-io/floci/issues/1215)
* **lambda:** replace the extracted package instead of merging into it ([#2672](https://github.com/floci-io/floci/issues/2672)) ([e4c6903](https://github.com/floci-io/floci/commit/e4c690351f724223ef9c86192039a712c8bddaac)), closes [#2647](https://github.com/floci-io/floci/issues/2647)
* **lambda:** resolve ARN and function URL invocations in owning account ([#2414](https://github.com/floci-io/floci/issues/2414)) ([c22652d](https://github.com/floci-io/floci/commit/c22652dd15604e5332dba8c462b1394b101cc81f))
* **lambda:** resolve launched-container placeholder creds to the owning account ([#2657](https://github.com/floci-io/floci/issues/2657)) ([be89286](https://github.com/floci-io/floci/commit/be892864db40af1ec7b6c09a21e84ea8434999ab))
* **lambda:** return VpcConfig, SnapStart and LoggingConfig from every read path ([#2527](https://github.com/floci-io/floci/issues/2527)) ([94795dd](https://github.com/floci-io/floci/commit/94795dd67b695b0e06377299d31b5559466f2a5e)), closes [-_/#A-Za-z0-9](https://github.com/floci-io/floci/issues/A-Za-z0-9)
* **lambda:** round-trip StartingPosition on event source mappings ([#2370](https://github.com/floci-io/floci/issues/2370)) ([151e3fc](https://github.com/floci-io/floci/commit/151e3fcc7a4a5cfd6ee663ecb928c48e720f4ceb))
* **lambda:** serialize resource policy mutations ([#2430](https://github.com/floci-io/floci/issues/2430)) ([2314c85](https://github.com/floci-io/floci/commit/2314c85b620b23a5850b633d41a68c7a4fcf0b6e))
* **lifecycle:** run start/ready hooks when FLOCI_PORT is non-default ([#2439](https://github.com/floci-io/floci/issues/2439)) ([ba97c08](https://github.com/floci-io/floci/commit/ba97c084eb51c7149fadbfcca5f7b9439583a77a)), closes [#2437](https://github.com/floci-io/floci/issues/2437)
* **memorydb,neptune,docdb:** degrade gracefully with no Docker daemon ([#2386](https://github.com/floci-io/floci/issues/2386)) ([65b22ff](https://github.com/floci-io/floci/commit/65b22ff01e3fcb24d4024c18ed3557e086a567b5)), closes [lex00/floci#44](https://github.com/lex00/floci/issues/44)
* **msk:** accept an empty serverProperties on Create/UpdateConfiguration ([#2491](https://github.com/floci-io/floci/issues/2491)) ([fcd662f](https://github.com/floci-io/floci/commit/fcd662fb623531a6e98b15f5aa44b7eb0768cf05))
* **msk:** persist CreateCluster broker node groups, encryption, client auth, logging, configuration and tags ([#2366](https://github.com/floci-io/floci/issues/2366)) ([0205e4e](https://github.com/floci-io/floci/commit/0205e4ed7efe267ade3a95c0af8be9f23fbe93b5)), closes [#2571](https://github.com/floci-io/floci/issues/2571)
* **msk:** reject numberOfBrokerNodes values that only look whole after double rounding ([#2571](https://github.com/floci-io/floci/issues/2571)) ([bd436ee](https://github.com/floci-io/floci/commit/bd436eeea1d6e75a6caec0aa684408f757b66901)), closes [MskService#validateCreateRequest](https://github.com/MskService/issues/validateCreateRequest)
* **msk:** return BadRequestException when a configuration ARN does not exist ([#2572](https://github.com/floci-io/floci/issues/2572)) ([247bd59](https://github.com/floci-io/floci/commit/247bd590bcb9bbf3c91366423d69527071818140)), closes [MskService#describeConfiguration](https://github.com/MskService/issues/describeConfiguration)
* **opensearch:** address spawned domain containers by IP, not name ([#2746](https://github.com/floci-io/floci/issues/2746)) ([fcc6067](https://github.com/floci-io/floci/commit/fcc606799c06802302b64ba3d871250886c0bb44))
* preserve Firehose compression format in CloudFormation ([#2406](https://github.com/floci-io/floci/issues/2406)) ([ebd4a07](https://github.com/floci-io/floci/commit/ebd4a078d39198d8a2bdc06420ad73ab21aca100))
* preserve Route 53 private hosted-zone VPC associations ([#2342](https://github.com/floci-io/floci/issues/2342)) ([967ea84](https://github.com/floci-io/floci/commit/967ea843a0b3706143c27e6dfc142d0b21a3d7cc)), closes [#2294](https://github.com/floci-io/floci/issues/2294)
* **rds,docdb:** list DocumentDB clusters and instances in the RDS-family list form ([#2623](https://github.com/floci-io/floci/issues/2623)) ([3b0e31b](https://github.com/floci-io/floci/commit/3b0e31b8880fb1439f5b475280621da8ecc4ee89)), closes [#2613](https://github.com/floci-io/floci/issues/2613) [#1829](https://github.com/floci-io/floci/issues/1829)
* **rds,firehose,cognito:** match AWS's real defaults so a second terraform plan reports no changes ([#2420](https://github.com/floci-io/floci/issues/2420)) ([5ed3a8c](https://github.com/floci-io/floci/commit/5ed3a8cad97fd1ffe1046f6a73c91b4826689697)), closes [FirehoseService#mergeDestination](https://github.com/FirehoseService/issues/mergeDestination)
* **rds:** clear CLIENT_SSL before forwarding the TLS-terminated handshake response to the backend ([#2698](https://github.com/floci-io/floci/issues/2698)) ([0090739](https://github.com/floci-io/floci/commit/009073961725a3881646331ef026903151e03f32))
* **rds:** grant the MySQL/MariaDB master user RDS-master-equivalent privileges ([#2679](https://github.com/floci-io/floci/issues/2679)) ([6c96f47](https://github.com/floci-io/floci/commit/6c96f47f7350cf86bdb5bc47db693de9f93bef27))
* **rds:** keep the tags given to CreateDBSubnetGroup ([#2627](https://github.com/floci-io/floci/issues/2627)) ([20ecb89](https://github.com/floci-io/floci/commit/20ecb89155674e34168b76c811c0deb00da3933d)), closes [#2612](https://github.com/floci-io/floci/issues/2612)
* **rds:** propagate ModifyDBCluster master-password rotations to the backend and every proxy ([#2727](https://github.com/floci-io/floci/issues/2727)) ([895b59f](https://github.com/floci-io/floci/commit/895b59f1eeaf1824de77578469b6520f6a72a2b2)), closes [#2709](https://github.com/floci-io/floci/issues/2709)
* **rds:** propagate ModifyDBInstance master-password rotations to the backend and proxy ([#2709](https://github.com/floci-io/floci/issues/2709)) ([09a05c2](https://github.com/floci-io/floci/commit/09a05c2d77f87a8b04454ae11eda23ea6705f76e))
* **rds:** reject a duplicate create while provisioning is in flight ([#2525](https://github.com/floci-io/floci/issues/2525)) ([7ef698c](https://github.com/floci-io/floci/commit/7ef698c1f408cb0b449c493ab1951eb984d15068)), closes [#2051](https://github.com/floci-io/floci/issues/2051)
* **rds:** store and return the encryption and backup settings given on create ([#2617](https://github.com/floci-io/floci/issues/2617)) ([5033ace](https://github.com/floci-io/floci/commit/5033ace77233db320733228b544b1fd48acce93f)), closes [#2611](https://github.com/floci-io/floci/issues/2611)
* repair main CI (AslExecutor test compilation, Redshift compat test endpoint) ([#2726](https://github.com/floci-io/floci/issues/2726)) ([477e8ae](https://github.com/floci-io/floci/commit/477e8ae7b9106329213b3ee4a1c2109d44b91fa9)), closes [#2703](https://github.com/floci-io/floci/issues/2703) [#2688](https://github.com/floci-io/floci/issues/2688)
* **s3:** accept the log-delivery-write canned ACL ([#2653](https://github.com/floci-io/floci/issues/2653)) ([2a014d2](https://github.com/floci-io/floci/commit/2a014d2add67fb7b243bbf7d1d8021f09b53d1ab))
* **s3:** emit post events for browser uploads ([#2577](https://github.com/floci-io/floci/issues/2577)) ([d8ef1c8](https://github.com/floci-io/floci/commit/d8ef1c8d7b91c7cda9629834f1315eac6de7d90f))
* **s3:** prevent compliance retention downgrade ([#2755](https://github.com/floci-io/floci/issues/2755)) ([2e5935d](https://github.com/floci-io/floci/commit/2e5935d7641a9f0920e8ae7f46db8eab46d6679e))
* **s3:** resolve virtual-hosted buckets whose names contain dots ([#2493](https://github.com/floci-io/floci/issues/2493)) ([ea2b62f](https://github.com/floci-io/floci/commit/ea2b62fb955e7eef3b9b8c46f0b604d4da9703b7))
* **s3:** return x-amz-version-id from presigned POST ([#2608](https://github.com/floci-io/floci/issues/2608)) ([066e6c9](https://github.com/floci-io/floci/commit/066e6c904b4c623b56f14ee01f5a8e44e7fe684f)), closes [#2607](https://github.com/floci-io/floci/issues/2607)
* **s3:** route the replication subresource instead of falling through ([#2519](https://github.com/floci-io/floci/issues/2519)) ([ce4f6d1](https://github.com/floci-io/floci/commit/ce4f6d1c48ed87f72a7906f7ca5d70b52dc8a31a)), closes [#2296](https://github.com/floci-io/floci/issues/2296)
* **secretsmanager,rds:** rotate secrets that an AWS service manages ([#2378](https://github.com/floci-io/floci/issues/2378)) ([23015a7](https://github.com/floci-io/floci/commit/23015a747568e4bffcc7d595573371d9254bbfe1))
* **secretsmanager:** raise InvalidRequestException, not ResourceNotFoundException, for pending-deletion secrets ([#2514](https://github.com/floci-io/floci/issues/2514)) ([fd78ae4](https://github.com/floci-io/floci/commit/fd78ae4f4b474028f4056a5ab69b445051c74480)), closes [#2513](https://github.com/floci-io/floci/issues/2513)
* **secretsmanager:** stop CreateSecret overwriting a secret inside its recovery window ([#2555](https://github.com/floci-io/floci/issues/2555)) ([1e443ac](https://github.com/floci-io/floci/commit/1e443acd0614d57c6cc409a143bc27e60de2f142)), closes [#2549](https://github.com/floci-io/floci/issues/2549)
* **security:** reject unregistered SigV4 access keys and unbound usernames ([#2680](https://github.com/floci-io/floci/issues/2680)) ([f9d28c9](https://github.com/floci-io/floci/commit/f9d28c9649753e527b53512b72a19256c78176ec)), closes [#2657](https://github.com/floci-io/floci/issues/2657)
* serialize Kinesis stream creation timestamps as plain decimals ([#2173](https://github.com/floci-io/floci/issues/2173)) ([c335086](https://github.com/floci-io/floci/commit/c33508651ea14f54002393eefa887b4f173b0df9)), closes [#2099](https://github.com/floci-io/floci/issues/2099)
* **ses:** enforce full AWS tag validation across all SES resources ([#2504](https://github.com/floci-io/floci/issues/2504)) ([29f6e7a](https://github.com/floci-io/floci/commit/29f6e7ac6b56d45cec36042b4864be8a79ec99e2))
* **ses:** reject non-string tag members with SerializationException ([#2512](https://github.com/floci-io/floci/issues/2512)) ([60dd795](https://github.com/floci-io/floci/commit/60dd7957036ea2345acbff9ac8d8d0951c88f122))
* **ses:** report the sending account in send-event payloads ([#2499](https://github.com/floci-io/floci/issues/2499)) ([bd36b02](https://github.com/floci-io/floci/commit/bd36b02728aa8e4c00cb64cad582f425bde20256))
* **ses:** return DeliveryOptions from v1 DescribeConfigurationSet ([#2841](https://github.com/floci-io/floci/issues/2841)) ([7473c57](https://github.com/floci-io/floci/commit/7473c57720840d76668866f08dd4db757d6a8eb2))
* **signin:** preserve AWS token error modes ([#2554](https://github.com/floci-io/floci/issues/2554)) ([399bf20](https://github.com/floci-io/floci/commit/399bf203872d0c59a7bb904cf0df5acadde229be))
* **ssm:** stop re-reading shared mutable state in the command status rollup ([#2477](https://github.com/floci-io/floci/issues/2477)) ([6f1ce9b](https://github.com/floci-io/floci/commit/6f1ce9b23f68cbdca791d394035603dee7672f17)), closes [#2264](https://github.com/floci-io/floci/issues/2264) [#2264](https://github.com/floci-io/floci/issues/2264)
* **ssm:** validate SettingValue and require an account list on ModifyDocumentPermission ([#2635](https://github.com/floci-io/floci/issues/2635)) ([149ac63](https://github.com/floci-io/floci/commit/149ac635f22ea9b3de343d9e13fb8bb213c4642e))
* **stepfunctions:** bound $range allocation at the AWS memory limit ([#2790](https://github.com/floci-io/floci/issues/2790)) ([f7f16cd](https://github.com/floci-io/floci/commit/f7f16cd2a3e72882fc8fcc2c4e80cf2b9f1c827a)), closes [#2738](https://github.com/floci-io/floci/issues/2738) [#2737](https://github.com/floci-io/floci/issues/2737)
* **stepfunctions:** bound a running execution the four ways AWS does ([#2782](https://github.com/floci-io/floci/issues/2782)) ([9288769](https://github.com/floci-io/floci/commit/92887696074b7e709c4f103cf86bb0b4561c742e)), closes [#2733](https://github.com/floci-io/floci/issues/2733)
* **stepfunctions:** bound JSONata evaluation by time and depth ([#2697](https://github.com/floci-io/floci/issues/2697)) ([3954018](https://github.com/floci-io/floci/commit/395401807b4a6a10586fe963c9ba79be49ba365a)), closes [Frame#setRuntimeBounds](https://github.com/Frame/issues/setRuntimeBounds) [#2667](https://github.com/floci-io/floci/issues/2667)
* **stepfunctions:** end the execution when a state throws an Error ([#2693](https://github.com/floci-io/floci/issues/2693)) ([acf8879](https://github.com/floci-io/floci/commit/acf88794ca4e08a5ce26080e33a4e18d081bf99e)), closes [#2666](https://github.com/floci-io/floci/issues/2666)
* **stepfunctions:** fail the state when a JSONata expression returns nothing ([#2689](https://github.com/floci-io/floci/issues/2689)) ([ea11e67](https://github.com/floci-io/floci/commit/ea11e6771948d2d21520feb2393d9356d95ba8b6)), closes [#2665](https://github.com/floci-io/floci/issues/2665)
* **stepfunctions:** keep a JSONata expression's explicit null in the output ([#2684](https://github.com/floci-io/floci/issues/2684)) ([48e0ecd](https://github.com/floci-io/floci/commit/48e0ecd809026b79f7b296e365268368dd31e48a)), closes [#2664](https://github.com/floci-io/floci/issues/2664) [#2665](https://github.com/floci-io/floci/issues/2665)
* **stepfunctions:** let a mocked response with no attempts start the execution ([#2823](https://github.com/floci-io/floci/issues/2823)) ([63a2a60](https://github.com/floci-io/floci/commit/63a2a60a3001bec613b297c39771b1f8479cb789)), closes [#2523](https://github.com/floci-io/floci/issues/2523)
* **stepfunctions:** refuse the definitions AWS refuses, at both validation entry points ([#2786](https://github.com/floci-io/floci/issues/2786)) ([ead70ea](https://github.com/floci-io/floci/commit/ead70eae4dae927668332964b674a96f01be4418))
* **stepfunctions:** resolve the substitutions in a JSONata error cause ([#2687](https://github.com/floci-io/floci/issues/2687)) ([09d813d](https://github.com/floci-io/floci/commit/09d813d13fc7b1f0bc087c0de57222b61607dc03)), closes [#2668](https://github.com/floci-io/floci/issues/2668)
* **stepfunctions:** write a large whole number in full in $string ([#2683](https://github.com/floci-io/floci/issues/2683)) ([2a7ee7a](https://github.com/floci-io/floci/commit/2a7ee7a605800dca7e81ee9f9c144cf6db62446f)), closes [#2669](https://github.com/floci-io/floci/issues/2669)
* **ui:** reconnect the UI sidecar without restarting Floci ([#2718](https://github.com/floci-io/floci/issues/2718)) ([02f9754](https://github.com/floci-io/floci/commit/02f9754ac774963dfd3ce1945f9be00dcf9805e7)), closes [HI#severity](https://github.com/HI/issues/severity)
* update .gitignore to include .mission/ for shared tooling visibility ([#2750](https://github.com/floci-io/floci/issues/2750)) ([2bc3736](https://github.com/floci-io/floci/commit/2bc37365dc01b09b7eb3bf3540718023b375f710))


### Features

* **acm:** certificate validation records and revocation ([#2655](https://github.com/floci-io/floci/issues/2655)) ([3bd9bcc](https://github.com/floci-io/floci/commit/3bd9bcc62b4f1bd9a1c183863ab60360cdd0104b))
* **apigateway:** API key import/usage-plan fidelity and update-operation fixes ([#2631](https://github.com/floci-io/floci/issues/2631)) ([9b9e7f5](https://github.com/floci-io/floci/commit/9b9e7f56a2896bc00fd97f7a8ebd8c49561874b5))
* **apigatewayv2:** OpenAPI import and Terraform-visible API/stage attributes ([#2714](https://github.com/floci-io/floci/issues/2714)) ([881695e](https://github.com/floci-io/floci/commit/881695ea3b1c35e19ad621099f0e041e6d0bee0b))
* **apigatewayv2:** support custom domain names and API mappings ([#2390](https://github.com/floci-io/floci/issues/2390)) ([74da157](https://github.com/floci-io/floci/commit/74da157681dc98af183d3d3704f3f5c3853071f1))
* **applicationautoscaling:** evaluate target-tracking and step-scaling policies against ECS ([#2692](https://github.com/floci-io/floci/issues/2692)) ([2a7c94b](https://github.com/floci-io/floci/commit/2a7c94b04d1f797335c2bd87fcb9ab3730df21ff)), closes [#2565](https://github.com/floci-io/floci/issues/2565)
* **appsync:** Phase 7 — GraphQL execute authentication ([#2380](https://github.com/floci-io/floci/issues/2380)) ([3f12428](https://github.com/floci-io/floci/commit/3f12428d9737584b875ce380874ca2fd49a216f0))
* **aps:** add Amazon Managed Service for Prometheus workspaces ([#2604](https://github.com/floci-io/floci/issues/2604)) ([277809f](https://github.com/floci-io/floci/commit/277809fb416d00dbda8b295bb5b5ffbe5dd86f1e))
* **autoscaling:** P0 operations and lifecycle-hook delete-by-name ([#2673](https://github.com/floci-io/floci/issues/2673)) ([e9a379b](https://github.com/floci-io/floci/commit/e9a379b37a3627cb8e0a3dc752687562e6b00a73))
* **batch:** add update and delete job queue endpoints with corresponding service logic ([#2807](https://github.com/floci-io/floci/issues/2807)) ([6f123e8](https://github.com/floci-io/floci/commit/6f123e83b8cb2aba087fe8c0a3e8c6cfc7f74c66))
* **cloudformation:** apply security-group rules — inline properties and standalone resources ([#1993](https://github.com/floci-io/floci/issues/1993)) ([1461a10](https://github.com/floci-io/floci/commit/1461a10de7b23e03ce6514ba8567c31964a94ee6)), closes [#1992](https://github.com/floci-io/floci/issues/1992)
* **cloudformation:** CDK Provider-framework custom resources and changeset/SSM param fidelity ([#2688](https://github.com/floci-io/floci/issues/2688)) ([08e532a](https://github.com/floci-io/floci/commit/08e532ab1af8ada89ac3c663a55d3069bbcef662)), closes [#2455](https://github.com/floci-io/floci/issues/2455) [#2455](https://github.com/floci-io/floci/issues/2455) [#2666](https://github.com/floci-io/floci/issues/2666)
* **cloudformation:** CodeBuild/CodePipeline CFN provisioning ([#2685](https://github.com/floci-io/floci/issues/2685)) ([ac94232](https://github.com/floci-io/floci/commit/ac94232910e4ac6aeca5e3652cd510823785bd87))
* **cloudformation:** expand SAM AWS::Serverless::HttpApi to ApiGatew… ([#1956](https://github.com/floci-io/floci/issues/1956)) ([6fa53ab](https://github.com/floci-io/floci/commit/6fa53abd7cd9db183addee8d0bd2a80c38449e20))
* **cloudformation:** provision WAFv2 web ACLs and AWS Config rules ([#2701](https://github.com/floci-io/floci/issues/2701)) ([8a705d0](https://github.com/floci-io/floci/commit/8a705d0aae7a64d831ec57bdaa89802c5e441c76)), closes [CloudFormationTemplateEngine#resolveNode](https://github.com/CloudFormationTemplateEngine/issues/resolveNode)
* **cloudfront:** apply response-headers policies when serving ([#1833](https://github.com/floci-io/floci/issues/1833)) ([520c0f4](https://github.com/floci-io/floci/commit/520c0f4da29313978302852f44a11e94f171e740)), closes [#1820](https://github.com/floci-io/floci/issues/1820) [#1823](https://github.com/floci-io/floci/issues/1823)
* **cloudfront:** forward origin custom headers ([#1832](https://github.com/floci-io/floci/issues/1832)) ([f2ad05c](https://github.com/floci-io/floci/commit/f2ad05ce22e34e413177aa5884400cb83adcc925)), closes [#1820](https://github.com/floci-io/floci/issues/1820) [#1823](https://github.com/floci-io/floci/issues/1823)
* **cloudwatch-logs:** add resource policy actions ([#2574](https://github.com/floci-io/floci/issues/2574)) ([859db2f](https://github.com/floci-io/floci/commit/859db2f35223a1d4082dac30a757a2e0d3a77ee7))
* **cloudwatch:** Adds support for orderBy, pagination, limit in DescribeLogStreams response ([#2362](https://github.com/floci-io/floci/issues/2362)) ([846e78d](https://github.com/floci-io/floci/commit/846e78db12a2dae80489bdad86e65297a94da183))
* **codegurureviewer:** repository association lifecycle with tagging ([#2741](https://github.com/floci-io/floci/issues/2741)) ([0b46d80](https://github.com/floci-io/floci/commit/0b46d804c04b01f0d72303f8bcd7ae7907e9b98a))
* **codepipeline:** validate ListPipelineExecutions filters and PutApprovalResult inputs ([#2696](https://github.com/floci-io/floci/issues/2696)) ([a155e66](https://github.com/floci-io/floci/commit/a155e66b153193fc7d7a40d21311ee54cd7fc9d8))
* **cognito:** user pool domain operations (Create/Describe/DeleteUserPoolDomain) ([#2742](https://github.com/floci-io/floci/issues/2742)) ([ed16713](https://github.com/floci-io/floci/commit/ed167135ff63773a88bd1ac8b6bd8b23514941f7))
* **comprehend:** add Amazon Comprehend sync text-analysis actions ([#2674](https://github.com/floci-io/floci/issues/2674)) ([5c1b69c](https://github.com/floci-io/floci/commit/5c1b69c45f7b1dfa727f483ac31aa0eef695cc72)), closes [#2660](https://github.com/floci-io/floci/issues/2660)
* **config:** compliance evaluation loop, retention, pagination ([#2642](https://github.com/floci-io/floci/issues/2642)) ([1b3417a](https://github.com/floci-io/floci/commit/1b3417a7a3c2e90b2fa8e13a552cdfdb134d8cc0))
* **connect:** instance management (CreateInstance family, attributes, storage configs, tags) ([#2740](https://github.com/floci-io/floci/issues/2740)) ([7b6266e](https://github.com/floci-io/floci/commit/7b6266e902a938ba0cb4bbc0d49657392a2819a9))
* **controltower:** add AWS Control Tower with landing-zone and baseline lifecycle ([#2578](https://github.com/floci-io/floci/issues/2578)) ([4524099](https://github.com/floci-io/floci/commit/45240998ac0fb62a466dadf9278f6f9ef63072e2))
* **core:** add configurable mock responses for stub AI services ([#2765](https://github.com/floci-io/floci/issues/2765)) ([e2e69f6](https://github.com/floci-io/floci/commit/e2e69f65f55be1fc81f891c797008931a788a4f9)), closes [#2764](https://github.com/floci-io/floci/issues/2764)
* **core:** label emulated resource containers with io.floci.* identity ([#2497](https://github.com/floci-io/floci/issues/2497)) ([8247014](https://github.com/floci-io/floci/commit/824701481cfcd7a3c9a4056134898712f0228816)), closes [#1818](https://github.com/floci-io/floci/issues/1818) [#1818](https://github.com/floci-io/floci/issues/1818)
* **docs:** guard the service matrix against undocumented services ([#2465](https://github.com/floci-io/floci/issues/2465)) ([700acc6](https://github.com/floci-io/floci/commit/700acc65c78035da2d4988d07bf74a9b6f490d0a)), closes [#2436](https://github.com/floci-io/floci/issues/2436)
* **ec2:** IPAM with real CIDR allocation, EBS encryption defaults, and transit gateway route export ([#2596](https://github.com/floci-io/floci/issues/2596)) ([9563b7e](https://github.com/floci-io/floci/commit/9563b7ef08e9a8cc45da70190221659cc7ea8781)), closes [#2526](https://github.com/floci-io/floci/issues/2526) [floci-io/floci#2605](https://github.com/floci-io/floci/issues/2605)
* **ec2:** support ModifyVpcEndpoint and persist the endpoint policy ([#2526](https://github.com/floci-io/floci/issues/2526)) ([2e8cbc1](https://github.com/floci-io/floci/commit/2e8cbc13d7293fad19c737a034dc17b839822375)), closes [#2317](https://github.com/floci-io/floci/issues/2317)
* **ec2:** support transit gateway route tables, associations and routes ([#2348](https://github.com/floci-io/floci/issues/2348)) ([bc0f88c](https://github.com/floci-io/floci/commit/bc0f88c9b1df3084cd50e2acbe148f963dfcc803)), closes [#2308](https://github.com/floci-io/floci/issues/2308) [#2329](https://github.com/floci-io/floci/issues/2329)
* **ec2:** support transit gateway VPC attachments ([#2347](https://github.com/floci-io/floci/issues/2347)) ([74e43a4](https://github.com/floci-io/floci/commit/74e43a46320c3b3bff8f328d6a9206a80927b9de)), closes [#2308](https://github.com/floci-io/floci/issues/2308)
* **ecs:** rewrite ECR image URIs on RunTask like Lambda already does ([#2641](https://github.com/floci-io/floci/issues/2641)) ([c405093](https://github.com/floci-io/floci/commit/c4050936a84d29c0874d39519a9d21e17c438a19)), closes [#2568](https://github.com/floci-io/floci/issues/2568)
* **efs:** add Elastic File System (file systems, mount targets, access points) ([#2371](https://github.com/floci-io/floci/issues/2371)) ([943b4c1](https://github.com/floci-io/floci/commit/943b4c1b456c9fb43332ff67f5ed321d778a00f4))
* **elasticache:** support cache parameter groups ([#2392](https://github.com/floci-io/floci/issues/2392)) ([6b62817](https://github.com/floci-io/floci/commit/6b628179f3f39b853cf30369ac2b166bb474cef1))
* **elasticache:** support cache subnet groups ([#2401](https://github.com/floci-io/floci/issues/2401)) ([06d58aa](https://github.com/floci-io/floci/commit/06d58aad36ce35cfe5bac7438bf53003d5a5f63e))
* **elasticache:** support cluster-mode replication groups ([#2633](https://github.com/floci-io/floci/issues/2633)) ([97ff0bc](https://github.com/floci-io/floci/commit/97ff0bc3e9ff0aea77faf188550c0587ee0b451b))
* **emrserverless:** support EMR Serverless applications ([#2403](https://github.com/floci-io/floci/issues/2403)) ([8a673fc](https://github.com/floci-io/floci/commit/8a673fc580f2ef57ec11f4153fe013f584327004))
* **eventbridge:** add Connection API actions ([#1897](https://github.com/floci-io/floci/issues/1897)) ([36a55f5](https://github.com/floci-io/floci/commit/36a55f5060e8eb25e878aa1539d371f9aff03c65))
* **firehose:** add StartDeliveryStreamEncryption and StopDeliveryStreamEncryption ([#2583](https://github.com/floci-io/floci/issues/2583)) ([4affa05](https://github.com/floci-io/floci/commit/4affa05ceab19c02a950801a3c41f3eabcb2ca42))
* **firehose:** deliver records from a Kinesis stream source ([#2528](https://github.com/floci-io/floci/issues/2528)) ([009ac0b](https://github.com/floci-io/floci/commit/009ac0b4a62e2e1fbf799c19800bd02e7c05d36b))
* **firehose:** honor CompressionFormat and FileExtension on S3 delivery ([#2410](https://github.com/floci-io/floci/issues/2410)) ([bba5ffb](https://github.com/floci-io/floci/commit/bba5ffb644c02b3ac5a93502b1c85ab436f8cca8)), closes [#2328](https://github.com/floci-io/floci/issues/2328)
* **fis:** add AWS FIS support ([#2435](https://github.com/floci-io/floci/issues/2435)) ([04d120f](https://github.com/floci-io/floci/commit/04d120fdd5f0927bb14ae83682f4e72a1c7396a7))
* **iam:** enforce SCPs and populate aws:PrincipalArn during policy evaluation ([#2637](https://github.com/floci-io/floci/issues/2637)) ([7188b3e](https://github.com/floci-io/floci/commit/7188b3ec9d1ca52defad1246af525116e9da1c0c)), closes [iam.md#service-control-policies-scps](https://github.com/iam.md/issues/service-control-policies-scps) [iam.md#bypass-rules](https://github.com/iam.md/issues/bypass-rules) [hi#water](https://github.com/hi/issues/water)
* **kinesis:** add PutRecords request caps and a per-stream max record size ([#2438](https://github.com/floci-io/floci/issues/2438)) ([353d9c8](https://github.com/floci-io/floci/commit/353d9c842fa81a0c807466253ce3cb748bd210d6))
* **kinesisanalytics:** emit MSF-style JSON CloudWatch logs from Flink ([#2656](https://github.com/floci-io/floci/issues/2656)) ([aaae992](https://github.com/floci-io/floci/commit/aaae99282f8ee737f587b08da98930a345108f52))
* **lakeformation:** lake formation ([#2427](https://github.com/floci-io/floci/issues/2427)) ([ac6cb06](https://github.com/floci-io/floci/commit/ac6cb06af4f529cfaab7449ceddb6863a652cbb2))
* **lambda:** add the ability to name and label lambda containers, code volumes ([#2409](https://github.com/floci-io/floci/issues/2409)) ([f8b07a7](https://github.com/floci-io/floci/commit/f8b07a78ff2aecbbd5fb71dd8efe71626648b160))
* **lambda:** code-signing endpoints and account settings ([#2646](https://github.com/floci-io/floci/issues/2646)) ([c90c5ad](https://github.com/floci-io/floci/commit/c90c5adfcbc2da8309e02e2d96418a03001ebc01)), closes [#2225](https://github.com/floci-io/floci/issues/2225) [#2206](https://github.com/floci-io/floci/issues/2206) [#1987](https://github.com/floci-io/floci/issues/1987)
* **lambda:** support kubernetes as the lambda runner ([#1941](https://github.com/floci-io/floci/issues/1941)) ([bc13801](https://github.com/floci-io/floci/commit/bc1380112168f3600938695c74cfa3d7e87eff7c))
* **logs:** add AssociateKmsKey and DisassociateKmsKey for log groups ([#2584](https://github.com/floci-io/floci/issues/2584)) ([4435c62](https://github.com/floci-io/floci/commit/4435c6284859ad96d72df327c4d15072499e01e0))
* **msk:** add configuration revision actions ([#2344](https://github.com/floci-io/floci/issues/2344)) ([7505110](https://github.com/floci-io/floci/commit/7505110ed96ba65b663101d08d9bf0764a073e0e)), closes [#2339](https://github.com/floci-io/floci/issues/2339) [#2340](https://github.com/floci-io/floci/issues/2340) [#2299](https://github.com/floci-io/floci/issues/2299) [2336/#2343](https://github.com/floci-io/floci/issues/2343) [#2343](https://github.com/floci-io/floci/issues/2343) [MskService#updateConfiguration](https://github.com/MskService/issues/updateConfiguration) [MskConfiguration#addRevision](https://github.com/MskConfiguration/issues/addRevision)
* **networkfirewall:** emulate AWS Network Firewall ([#2580](https://github.com/floci-io/floci/issues/2580)) ([715bab6](https://github.com/floci-io/floci/commit/715bab68e7d0665012883083cd0837b8327aea1d)), closes [#2579](https://github.com/floci-io/floci/issues/2579)
* **organizations:** add AWS Organizations service ([#2489](https://github.com/floci-io/floci/issues/2489)) ([87e8044](https://github.com/floci-io/floci/commit/87e804492aaa0d87b0bbec94110cfcad84c61f3e))
* **organizations:** add CloudFormation resource types ([#2495](https://github.com/floci-io/floci/issues/2495)) ([054508d](https://github.com/floci-io/floci/commit/054508df87a29fbeb40cd4c6be61f3c5286cda3d))
* **organizations:** add ListAccountsWithInvalidEffectivePolicy ([#2628](https://github.com/floci-io/floci/issues/2628)) ([18521ed](https://github.com/floci-io/floci/commit/18521edf287f8006da3c3dc43e075c03e7e9d7fd))
* **organizations:** add management account email configuration and tests ([#2749](https://github.com/floci-io/floci/issues/2749)) ([89fd37a](https://github.com/floci-io/floci/commit/89fd37a5c43fdbeb173199496823bd8040119369))
* **rds-data:** adding data-api support for lable/name and batch ([#2518](https://github.com/floci-io/floci/issues/2518)) ([a3044e0](https://github.com/floci-io/floci/commit/a3044e065e26e0cdf7b3de2e8ee823923323034e))
* **rds,docdb:** answer DescribeGlobalClusters ([#2402](https://github.com/floci-io/floci/issues/2402)) ([29b0d60](https://github.com/floci-io/floci/commit/29b0d600c6a1398ed44dabdb20620174531fcde5))
* **rds,docdb:** tag DocumentDB clusters and parameter groups ([#2408](https://github.com/floci-io/floci/issues/2408)) ([7b83bd5](https://github.com/floci-io/floci/commit/7b83bd5283f7df7650f94ce591c009061c07c301))
* **rds:** add option group CRUD ([#2352](https://github.com/floci-io/floci/issues/2352)) ([3374bfe](https://github.com/floci-io/floci/commit/3374bfeb0492ac353d001c6fd23465617fe2d42a)), closes [#2304](https://github.com/floci-io/floci/issues/2304)
* **rds:** match proxy TLS cert SAN to the advertised endpoint ([#2603](https://github.com/floci-io/floci/issues/2603)) ([b1d7286](https://github.com/floci-io/floci/commit/b1d7286444e5ad54c51c5d2e83ffe6d9f9a66b60))
* **rds:** model Aurora Serverless v2 scaling configuration on DB clusters ([#1829](https://github.com/floci-io/floci/issues/1829)) ([d778a6e](https://github.com/floci-io/floci/commit/d778a6e393ab455b6ec45e11f1ae001adf837ff0))
* **redshift:** implement Redshift emulation with snapshot and parameter group support ([#2472](https://github.com/floci-io/floci/issues/2472)) ([a1383fd](https://github.com/floci-io/floci/commit/a1383fdd3d1df080cf40fe304905e53eca6b57cb))
* **rekognition:** add Amazon Rekognition sync image-analysis actions ([#2706](https://github.com/floci-io/floci/issues/2706)) ([cf6fede](https://github.com/floci-io/floci/commit/cf6fede45357dd9ae619ea7b062463fe836f61ae)), closes [#2705](https://github.com/floci-io/floci/issues/2705)
* **resourceexplorer2:** add AWS Resource Explorer 2 with cross-service resource discovery ([#2485](https://github.com/floci-io/floci/issues/2485)) ([d3871e1](https://github.com/floci-io/floci/commit/d3871e1f258dd2c85cf5ab97f140a20b51774e1c)), closes [#1583](https://github.com/floci-io/floci/issues/1583) [#1797](https://github.com/floci-io/floci/issues/1797)
* **route53resolver:** add Route 53 Resolver with DNS Firewall domain lists ([#2582](https://github.com/floci-io/floci/issues/2582)) ([d60bd6e](https://github.com/floci-io/floci/commit/d60bd6ead21c5f2e3e51c9ddc2a9435285c356c8)), closes [#2579](https://github.com/floci-io/floci/issues/2579)
* **route53:** VPC association lifecycle actions ([#2638](https://github.com/floci-io/floci/issues/2638)) ([e471946](https://github.com/floci-io/floci/commit/e471946f44318b406c3a470b31c725f9a93ac303))
* **s3:** apply VersioningConfiguration in CloudFormation S3 bucket provisioning ([#2626](https://github.com/floci-io/floci/issues/2626)) ([64c38c7](https://github.com/floci-io/floci/commit/64c38c77b9ee0e7439da069abc8b5d6596518fb7))
* **s3:** opt-in global bucket namespace and replication config ([#2640](https://github.com/floci-io/floci/issues/2640)) ([c96dc98](https://github.com/floci-io/floci/commit/c96dc980653e1fd6df8941622d68ff61e34ffb81)), closes [#2519](https://github.com/floci-io/floci/issues/2519)
* **s3:** support bucket metrics configurations ([#2382](https://github.com/floci-io/floci/issues/2382)) ([8d33c65](https://github.com/floci-io/floci/commit/8d33c6512951b7391ea48a456da8c17743d188af))
* **secretsmanager:** persist and return secret resource policies ([#2587](https://github.com/floci-io/floci/issues/2587)) ([8b23ed8](https://github.com/floci-io/floci/commit/8b23ed8f4aa6733538379847e330b0dd7530857a))
* **servicecatalog:** emulate AWS Service Catalog with Control Tower Account Factory ([#2585](https://github.com/floci-io/floci/issues/2585)) ([2e843e9](https://github.com/floci-io/floci/commit/2e843e9f2353092f015d5ee55937085b524bd705))
* **servicequotas,ram:** add Service Quotas and AWS RAM resource sharing ([#2579](https://github.com/floci-io/floci/issues/2579)) ([f912c3b](https://github.com/floci-io/floci/commit/f912c3b717ac19ed7b0d7d2bd36d6ed0384593f2))
* **ses:** extend tag endpoints to contact lists, custom verification email templates, and dedicated IP pools ([#2589](https://github.com/floci-io/floci/issues/2589)) ([c7cd78e](https://github.com/floci-io/floci/commit/c7cd78e3b366a8f00a657a7045bb4957c0264a5a))
* **ses:** support +label subaddressing on mailbox simulator addresses ([#2464](https://github.com/floci-io/floci/issues/2464)) ([c969ffc](https://github.com/floci-io/floci/commit/c969ffc31d1023272d40f137b026548a03909b8e))
* **ses:** support v2 PutAccountDetails and GetAccount Details ([#2498](https://github.com/floci-io/floci/issues/2498)) ([622ba0a](https://github.com/floci-io/floci/commit/622ba0adbd640a1d5270e3cc2c3973ff0605a697))
* **ses:** support v2 tenant CRUD (CreateTenant/GetTenant/ListTenants/DeleteTenant) ([#2644](https://github.com/floci-io/floci/issues/2644)) ([2963601](https://github.com/floci-io/floci/commit/2963601f698a70b98a441886241da21b9c3496dd))
* **ses:** support v2 tenant resource associations ([#2710](https://github.com/floci-io/floci/issues/2710)) ([67f75c7](https://github.com/floci-io/floci/commit/67f75c7e1d9fc1f6f8801aed71198832cd99c6d4))
* **ses:** support v2 tenant suppression attributes and tenant-scoped suppression list ([#2743](https://github.com/floci-io/floci/issues/2743)) ([fc3c283](https://github.com/floci-io/floci/commit/fc3c28323ac907bb88b79b293b2cb2b59722ce79))
* **ses:** support v2 tenant-scoped sending with association gate ([#2815](https://github.com/floci-io/floci/issues/2815)) ([b0fe831](https://github.com/floci-io/floci/commit/b0fe8311a01a609f73cc0508de512c075d4daaaf))
* **sfn:** support mocked service integrations (SFN_MOCK_CONFIG) ([#2452](https://github.com/floci-io/floci/issues/2452)) ([b6418db](https://github.com/floci-io/floci/commit/b6418dbfeea43b7b2906a3256d581bb88becc274)), closes [#2283](https://github.com/floci-io/floci/issues/2283)
* **sfn:** support Retry policies in Task, Parallel, and Map states ([#2455](https://github.com/floci-io/floci/issues/2455)) ([56e74d6](https://github.com/floci-io/floci/commit/56e74d64c6a5452ec9c23451f42bd472bc57b720)), closes [#2283](https://github.com/floci-io/floci/issues/2283)
* **signin:** add secure branded consent flow ([#2429](https://github.com/floci-io/floci/issues/2429)) ([09d7502](https://github.com/floci-io/floci/commit/09d7502b284b5d61a9334b809a5331c52c7814dd))
* **signin:** support AWS login credentials provider ([#2428](https://github.com/floci-io/floci/issues/2428)) ([470ec77](https://github.com/floci-io/floci/commit/470ec777114081f0888460421dd3934b21731096))
* **sns:** deliver topic broadcasts to application-protocol platform endpoints ([#1856](https://github.com/floci-io/floci/issues/1856)) ([f45d64a](https://github.com/floci-io/floci/commit/f45d64a00e70466ccb0e135ac9cc8568cba0d93c))
* **ssm:** document lifecycle, share permissions, and account-scoped service settings ([#2629](https://github.com/floci-io/floci/issues/2629)) ([7f6b875](https://github.com/floci-io/floci/commit/7f6b87513685731b045b0f53e7326eef14513cc5))
* **ssoadmin:** serve Identity Center ListInstances ([#2581](https://github.com/floci-io/floci/issues/2581)) ([a2bd22d](https://github.com/floci-io/floci/commit/a2bd22d5f887b409a35b9d72d63c35bace40fb09)), closes [#2579](https://github.com/floci-io/floci/issues/2579)
* **stepfunctions:** add the JSONata functions of the Step Functions dialect ([#2676](https://github.com/floci-io/floci/issues/2676)) ([eb5134d](https://github.com/floci-io/floci/commit/eb5134da2d7620c75fe276d747fa8ae3d1f40065))
* **stepfunctions:** describe a distributed Map run after it finishes ([#2694](https://github.com/floci-io/floci/issues/2694)) ([ff61c2b](https://github.com/floci-io/floci/commit/ff61c2b2a5b844f5eea153c20f43232adbac776a)), closes [#2671](https://github.com/floci-io/floci/issues/2671)
* **stepfunctions:** dispatch the seven Task service integrations of [#2663](https://github.com/floci-io/floci/issues/2663) ([#2686](https://github.com/floci-io/floci/issues/2686)) ([14112b8](https://github.com/floci-io/floci/commit/14112b8ace5a0272715d17a60d268e67b94ab925))
* **stepfunctions:** emit task history events and chain previousEventId ([#2703](https://github.com/floci-io/floci/issues/2703)) ([5600d21](https://github.com/floci-io/floci/commit/5600d21f32b00ff464243af96252070f52521f91)), closes [#2520](https://github.com/floci-io/floci/issues/2520)


### Performance Improvements

* **cloudformation:** probe Lambda S3 code with headObject, not getObject ([#2728](https://github.com/floci-io/floci/issues/2728)) ([ff36141](https://github.com/floci-io/floci/commit/ff36141c199bfc8bb387db053056526332fbeb4d)), closes [#2648](https://github.com/floci-io/floci/issues/2648) [#2675](https://github.com/floci-io/floci/issues/2675)


### BREAKING CHANGES

* state machines whose JSONata expressions reference a bare
top-level name are now rejected at creation, as on AWS. Anchor the reference
with $states.input.<name> for input or $<name> for an Assign variable.

* fix(stepfunctions): parse a JSONata payload key named after an ASL field

The deny list of fields AWS does not parse as JSONata was applied to every
key at every depth, so a payload key named Next, Comment, Resource, Retry,
Default, ErrorEquals, Credentials, Branches, ItemProcessor or Iterator hid
its expression. AWS parses a payload whole: `Assign: {"Next": "{% phone %}"}`
and `Arguments: {"Payload": {"Comment": "{% phone %}"}}` are both refused
with `Reference to 'phone' at the top level is not supported.` The deny list
now stops applying once the walk enters Output, Assign, Arguments,
ItemSelector or BatchInput.

The same walk refused `ItemReader.ReaderConfig.CSVHeaders`, which holds
literal column names: `validate-state-machine-definition` returns OK for it
and `create-state-machine` stores the machine, so CSVHeaders joins the list.

# [1.7.0](https://github.com/floci-io/floci/compare/1.6.0...1.7.0) (2026-08-18)


### Bug Fixes

* **apigateway:** apply MOCK integration response headers ([#1822](https://github.com/floci-io/floci/issues/1822)) ([a49c3e5](https://github.com/floci-io/floci/commit/a49c3e57f6cef8f515fd546cdcdcd47b57f1871c)), closes [#1955](https://github.com/floci-io/floci/issues/1955) [#1955](https://github.com/floci-io/floci/issues/1955)
* **apigateway:** create the stage when CreateDeployment carries a stageName ([#2130](https://github.com/floci-io/floci/issues/2130)) ([f34e0b5](https://github.com/floci-io/floci/commit/f34e0b56550ccd70ca998f7a9ad0d71dbe3c3a69))
* **apigateway:** fall back to REST API region scan for non-SigV4 Authorization headers ([#2149](https://github.com/floci-io/floci/issues/2149)) ([5156095](https://github.com/floci-io/floci/commit/5156095f018d4c13f49c31ad6fe4332706f7dd98)), closes [ApiGatewayV2Service#resolveHttpApiRegion](https://github.com/ApiGatewayV2Service/issues/resolveHttpApiRegion) [ApiGatewayService#resolveRestApiRegion](https://github.com/ApiGatewayService/issues/resolveRestApiRegion) [#2169](https://github.com/floci-io/floci/issues/2169) [#2169](https://github.com/floci-io/floci/issues/2169) [#2054](https://github.com/floci-io/floci/issues/2054) [#2054](https://github.com/floci-io/floci/issues/2054)
* **apigateway:** honor configured execute-api hostname ([#2286](https://github.com/floci-io/floci/issues/2286)) ([3cfa983](https://github.com/floci-io/floci/commit/3cfa983479cbd9f7b8aa3d8bfb4b151992396be6))
* **apigateway:** match Content-Type case-insensitively in Lambda proxy responses ([#2150](https://github.com/floci-io/floci/issues/2150)) ([10048ad](https://github.com/floci-io/floci/commit/10048adced14502f5bee8b439b6019373f92f827))
* **apigateway:** preserve trailing slash in proxy event path ([#1863](https://github.com/floci-io/floci/issues/1863)) ([4236388](https://github.com/floci-io/floci/commit/42363886d527f9b36da302b50ba5865c775ac111)), closes [#1557](https://github.com/floci-io/floci/issues/1557)
* **apigatewayv2:** encode binary Lambda request bodies ([#2203](https://github.com/floci-io/floci/issues/2203)) ([28e9f6e](https://github.com/floci-io/floci/commit/28e9f6ed63e5bdd1af4f96bcb7ab2517cc98044f))
* **apigateway:** verify and propagate HTTP API v2 JWT authorizer claims ([#2353](https://github.com/floci-io/floci/issues/2353)) ([0444753](https://github.com/floci-io/floci/commit/0444753eb85fc5355a835bfd6206b01c1b14f275))
* **appconfig:** accept top-level resource ARNs in TagResource/ListTagsForResource ([#2279](https://github.com/floci-io/floci/issues/2279)) ([0818e5e](https://github.com/floci-io/floci/commit/0818e5e2d64215b01d68b11c5b9c4319c1bde549)), closes [AppConfigTagHandler#parseArn](https://github.com/AppConfigTagHandler/issues/parseArn)
* **appconfig:** add DeleteConfigurationProfile/DeleteHostedConfigurationVersion/ListDeploymentStrategies/DeleteDeploymentStrategy ([#2280](https://github.com/floci-io/floci/issues/2280)) ([be62502](https://github.com/floci-io/floci/commit/be625023eb700b571d5e89456651fcb6862c0bfe))
* **cloudformation:** apply AssumeRolePolicyDocument when adopting an existing IAM role on update ([#2143](https://github.com/floci-io/floci/issues/2143)) ([4a5fae4](https://github.com/floci-io/floci/commit/4a5fae4dcd574fa4dc3a603c56f20d1fcf96c232))
* **cloudformation:** create AWS::IAM::Role inline Policies instead of silently dropping them ([#1969](https://github.com/floci-io/floci/issues/1969)) ([8d2a5bd](https://github.com/floci-io/floci/commit/8d2a5bdd46ea8c372798b3a58a39938167b75c8e)), closes [#1952](https://github.com/floci-io/floci/issues/1952) [#1825](https://github.com/floci-io/floci/issues/1825) [#1952](https://github.com/floci-io/floci/issues/1952)
* **cloudformation:** don't double-encode string-form SNS RedrivePolicy and FilterPolicy ([#2325](https://github.com/floci-io/floci/issues/2325)) ([c12f3fa](https://github.com/floci-io/floci/commit/c12f3fae7d1993b924bf81178e1a6a62a6a051a4)), closes [CloudFormationTemplateEngine#resolveJsonAttribute](https://github.com/CloudFormationTemplateEngine/issues/resolveJsonAttribute)
* **cloudformation:** expand AWS::Serverless::HttpApi via SAM transform ([#2146](https://github.com/floci-io/floci/issues/2146)) ([5812910](https://github.com/floci-io/floci/commit/58129108bf4f5a63388409d460c3dc26ab2c5a04)), closes [#1758](https://github.com/floci-io/floci/issues/1758) [#1758](https://github.com/floci-io/floci/issues/1758)
* **cloudformation:** expand SAM AutoPublishAlias into Version + Alias ([#1961](https://github.com/floci-io/floci/issues/1961)) ([7d66bf0](https://github.com/floci-io/floci/commit/7d66bf087aa585012ccdd397305eb4353813a4e8)), closes [#1987](https://github.com/floci-io/floci/issues/1987) [#1988](https://github.com/floci-io/floci/issues/1988) [#1987](https://github.com/floci-io/floci/issues/1987) [#1987](https://github.com/floci-io/floci/issues/1987) [#1988](https://github.com/floci-io/floci/issues/1988) [#1987](https://github.com/floci-io/floci/issues/1987) [#1987](https://github.com/floci-io/floci/issues/1987)
* **cloudformation:** honor resource-level conditions ([#2255](https://github.com/floci-io/floci/issues/2255)) ([8ef71d6](https://github.com/floci-io/floci/commit/8ef71d69302933b4300d0713fb92487dc7b3495a))
* **cloudformation:** honor stack status filters ([#2244](https://github.com/floci-io/floci/issues/2244)) ([34c9c6c](https://github.com/floci-io/floci/commit/34c9c6c0f573cd5224e51e64774756e1e22305b2))
* **cloudformation:** infer Lambda FunctionName mode for pre-fix persisted stacks ([#2177](https://github.com/floci-io/floci/issues/2177)) ([0cbfba8](https://github.com/floci-io/floci/commit/0cbfba82dd12ebe9ec982728745e8300e69a4170)), closes [#2163](https://github.com/floci-io/floci/issues/2163) [#1831](https://github.com/floci-io/floci/issues/1831) [#1831](https://github.com/floci-io/floci/issues/1831) [#2261](https://github.com/floci-io/floci/issues/2261)
* **cloudformation:** map FIFO and redrive attributes for AWS::SQS::Queue ([#1939](https://github.com/floci-io/floci/issues/1939)) ([58112b1](https://github.com/floci-io/floci/commit/58112b1f3bd111fbfbe61fcb7e128fb9cd106704))
* **cloudformation:** pass the CloudFront service argument in the provisioner tests ([#2261](https://github.com/floci-io/floci/issues/2261)) ([6ca7d44](https://github.com/floci-io/floci/commit/6ca7d44af0e4c676249c113f56bd4dc063281517)), closes [#1820](https://github.com/floci-io/floci/issues/1820) [#1807](https://github.com/floci-io/floci/issues/1807)
* **cloudformation:** physically delete nested stacks and removed resources on update ([#2345](https://github.com/floci-io/floci/issues/2345)) ([291a974](https://github.com/floci-io/floci/commit/291a97473eee98bad04e22dacf002164b17b3194))
* **cloudformation:** reconcile AWS::Logs::LogGroup in place on UpdateStack ([#2152](https://github.com/floci-io/floci/issues/2152)) ([76b264f](https://github.com/floci-io/floci/commit/76b264f66727807a63b9861e0453eee2a040924d)), closes [#1965](https://github.com/floci-io/floci/issues/1965)
* **cloudformation:** resolve ASG launch templates by id and MixedInstancesPolicy ([#2005](https://github.com/floci-io/floci/issues/2005)) ([#2019](https://github.com/floci-io/floci/issues/2019)) ([0971cf6](https://github.com/floci-io/floci/commit/0971cf6f649bfbe9b7d4c6d849e2d62e436c9117))
* **cloudwatch:** keep GetLogEvents paging inside the list bounds ([#2355](https://github.com/floci-io/floci/issues/2355)) ([c163a86](https://github.com/floci-io/floci/commit/c163a8678ccaca8c18e42ed87b19a0ced571e797))
* **cloudwatch:** page FilterLogEvents forward with a usable nextToken ([#2354](https://github.com/floci-io/floci/issues/2354)) ([112602f](https://github.com/floci-io/floci/commit/112602fc6e7b194c89d6a3b069be92a4fcef9961))
* **cloudwatch:** reject invalid log event tokens ([#2249](https://github.com/floci-io/floci/issues/2249)) ([12cf6e2](https://github.com/floci-io/floci/commit/12cf6e2fd8797dba50099506d8bfa86f081f17cf))
* **cloudwatch:** return logStreamName on FilterLogEvents results ([#2259](https://github.com/floci-io/floci/issues/2259)) ([a0adea9](https://github.com/floci-io/floci/commit/a0adea90733c8e462257e81adff6108a6bb89ed6)), closes [#2210](https://github.com/floci-io/floci/issues/2210)
* **cloudwatch:** warn on unsupported Logs Insights filter operators ([#2170](https://github.com/floci-io/floci/issues/2170)) ([f1c8197](https://github.com/floci-io/floci/commit/f1c81977ec395c8cb2db4d26f05c57ce482741ac)), closes [#2042](https://github.com/floci-io/floci/issues/2042)
* **cognito:** expire refresh tokens and scope them to their own pool in REFRESH_TOKEN_AUTH ([#2135](https://github.com/floci-io/floci/issues/2135)) ([7d8aced](https://github.com/floci-io/floci/commit/7d8acede18a4f4a869083c6d6d3792a2235e2fa2)), closes [#2132](https://github.com/floci-io/floci/issues/2132) [#2139](https://github.com/floci-io/floci/issues/2139) [#2132](https://github.com/floci-io/floci/issues/2132)
* **cognito:** HMAC-sign refresh tokens to prevent forgery ([#2139](https://github.com/floci-io/floci/issues/2139)) ([c4f4181](https://github.com/floci-io/floci/commit/c4f4181c3d75d24a926ab9d94fd0fffc4090e350))
* **cognito:** mark verified contact attribute on ConfirmSignUp ([#1881](https://github.com/floci-io/floci/issues/1881)) ([d891425](https://github.com/floci-io/floci/commit/d8914259439659a319bdcaef6c678126c30fc397))
* **cognito:** reject invalid refresh tokens in InitiateAuth REFRESH_TOKEN_AUTH ([#2132](https://github.com/floci-io/floci/issues/2132)) ([3ce5041](https://github.com/floci-io/floci/commit/3ce5041c717ce15868463770a83c0ae2bb23f98e)), closes [#2113](https://github.com/floci-io/floci/issues/2113)
* **cognito:** restore the SecureRandom import ([#2337](https://github.com/floci-io/floci/issues/2337)) ([7a2dc53](https://github.com/floci-io/floci/commit/7a2dc53b96124f121c936b7d5e84f07c6c0582b2)), closes [#2139](https://github.com/floci-io/floci/issues/2139) [#1881](https://github.com/floci-io/floci/issues/1881) [#1881](https://github.com/floci-io/floci/issues/1881)
* **compat:** install AWS CLI v2 in the compat image so AWS_ENDPOINT_URL is honored ([#2315](https://github.com/floci-io/floci/issues/2315)) ([9fda5f5](https://github.com/floci-io/floci/commit/9fda5f5919c8b6f2ab96dc9f0e4d1b603fa11a60))
* **core:** extract shared pagination helper, reject maxResults=0 ([#2343](https://github.com/floci-io/floci/issues/2343)) ([25b46e2](https://github.com/floci-io/floci/commit/25b46e28ad3d76cdb302d57e703ffc58d3ba0c6f)), closes [#2339](https://github.com/floci-io/floci/issues/2339) [#2340](https://github.com/floci-io/floci/issues/2340)
* **core:** stop leaked executor threads from pinning test classloaders ([#2363](https://github.com/floci-io/floci/issues/2363)) ([6962e91](https://github.com/floci-io/floci/commit/6962e9102053b1f27771104eef6e7547c3335c2b))
* **docker:** fall back to Windows named pipe when docker-host is at its unix-socket default ([#2030](https://github.com/floci-io/floci/issues/2030)) ([c48c062](https://github.com/floci-io/floci/commit/c48c062117c2ebce01961d7324092ed749a900b6))
* **docker:** label containers and volumes per emulator ([#2341](https://github.com/floci-io/floci/issues/2341)) ([d819c00](https://github.com/floci-io/floci/commit/d819c00dbfcf05f99b936c965414c80f8ac79d8d))
* **dynamodb:** compare Value when legacy Expected supplies Exists ([#2125](https://github.com/floci-io/floci/issues/2125)) ([a2b20cc](https://github.com/floci-io/floci/commit/a2b20cc08537651aefc93dedf11567704fa9e2a6))
* **dynamodb:** isolate item storage and locks between accounts ([#2240](https://github.com/floci-io/floci/issues/2240)) ([a803626](https://github.com/floci-io/floci/commit/a803626c176ae65c2090eaf35b00d0a373a23c63))
* **dynamodb:** order Query by full composite sort key ([#2114](https://github.com/floci-io/floci/issues/2114)) ([cd3c6b5](https://github.com/floci-io/floci/commit/cd3c6b54b270dbc60e55134a716062233580fd3f)), closes [#1675](https://github.com/floci-io/floci/issues/1675)
* **ec2:** assign a public IP only when the subnet opts in via MapPublicIpOnLaunch ([#2023](https://github.com/floci-io/floci/issues/2023)) ([2ab795c](https://github.com/floci-io/floci/commit/2ab795c6dcc38471a2bb74324fef2937ad59c572)), closes [#1984](https://github.com/floci-io/floci/issues/1984)
* **ec2:** delete key pairs by name through the storage backend ([#2187](https://github.com/floci-io/floci/issues/2187)) ([fc74987](https://github.com/floci-io/floci/commit/fc74987bd3a24d94ab5d185229657376c5ae55ef)), closes [#2185](https://github.com/floci-io/floci/issues/2185)
* **ec2:** keep the source on security group rules ([#2266](https://github.com/floci-io/floci/issues/2266)) ([a6f5f12](https://github.com/floci-io/floci/commit/a6f5f12295809a179ce5972968280629576d389d)), closes [#2190](https://github.com/floci-io/floci/issues/2190)
* **ec2:** reject prefix list names AWS reserves for its own lists ([#2274](https://github.com/floci-io/floci/issues/2274)) ([2d003b5](https://github.com/floci-io/floci/commit/2d003b52f230bd84432807085383205b0485739a)), closes [#2273](https://github.com/floci-io/floci/issues/2273)
* **ec2:** sshd can only be started from an absolute path since OpenSSH v3.9 ([#2351](https://github.com/floci-io/floci/issues/2351)) ([c194bff](https://github.com/floci-io/floci/commit/c194bffe30d99713bb1239686e7de2ca4da8d3bf))
* **ec2:** start sshd even when run-instances omits a key pair ([#2245](https://github.com/floci-io/floci/issues/2245)) ([da5ff91](https://github.com/floci-io/floci/commit/da5ff910b4cc12c1f1bcfc33246505cd4892e0ec))
* **ec2:** type a security group rule's tags as security-group-rule ([#2272](https://github.com/floci-io/floci/issues/2272)) ([4058dfa](https://github.com/floci-io/floci/commit/4058dfae00b280185588703e70a15a8026f4269a)), closes [#2270](https://github.com/floci-io/floci/issues/2270)
* **ecs:** report service deployments and MISSING failures on DescribeServices ([#2176](https://github.com/floci-io/floci/issues/2176)) ([8b8f837](https://github.com/floci-io/floci/commit/8b8f837728dbb82afe5dc8affa53aa3c19515f3d)), closes [#2174](https://github.com/floci-io/floci/issues/2174)
* **eks:** validate subnet IDs exist before creating a cluster ([#1943](https://github.com/floci-io/floci/issues/1943)) ([66fd109](https://github.com/floci-io/floci/commit/66fd109ad6340774685ce312f74021848fe3dd72)), closes [#1942](https://github.com/floci-io/floci/issues/1942)
* **elasticache:** clean up container by id on readiness-timeout rollback ([#2090](https://github.com/floci-io/floci/issues/2090)) ([91b6a40](https://github.com/floci-io/floci/commit/91b6a40bc77cefd8d24c52da70f47268b6cf18d4))
* **elasticache:** store the user Engine instead of hardcoding redis ([#2331](https://github.com/floci-io/floci/issues/2331)) ([7a4fc45](https://github.com/floci-io/floci/commit/7a4fc45fdf70b6b2fc8232f1f229622debdfddd4)), closes [#2290](https://github.com/floci-io/floci/issues/2290)
* **eventbridge:** boolean/numeric pattern values are matched correctly ([#1889](https://github.com/floci-io/floci/issues/1889)) ([517094a](https://github.com/floci-io/floci/commit/517094adc13d6e7f392dad1e34c3e67fc8628137))
* **firehose:** build S3 object keys with AWS prefix expressions and name suffix ([#1858](https://github.com/floci-io/floci/issues/1858)) ([a79e04e](https://github.com/floci-io/floci/commit/a79e04e4ecd9282943248407259864590ee03469)), closes [floci-io/floci#1857](https://github.com/floci-io/floci/issues/1857)
* **firehose:** return Kinesis source in stream description ([#2025](https://github.com/floci-io/floci/issues/2025)) ([988696b](https://github.com/floci-io/floci/commit/988696b057e586fa3df423dc3cd46a43b006533e))
* **iam,lambda:** return resource tags in Get and Create responses ([#2262](https://github.com/floci-io/floci/issues/2262)) ([b71bfc4](https://github.com/floci-io/floci/commit/b71bfc46b67ac5e639997eba2ee2407aa7f82fbc)), closes [#2155](https://github.com/floci-io/floci/issues/2155) [#2199](https://github.com/floci-io/floci/issues/2199)
* **iam:** include policy description in GetPolicy/ListPolicies/CreatePolicy responses ([#2155](https://github.com/floci-io/floci/issues/2155)) ([1150cfc](https://github.com/floci-io/floci/commit/1150cfc657d56be216908c1c1ac758c1bbeb2cc4)), closes [#2154](https://github.com/floci-io/floci/issues/2154)
* **iam:** route long-term access keys to owning accounts ([#2319](https://github.com/floci-io/floci/issues/2319)) ([02898cf](https://github.com/floci-io/floci/commit/02898cf5e2d3e7f6c6810f6d1b2b4fbfd8930117))
* **iam:** seed AmazonAPIGatewayPushToCloudWatchLogs managed policy ([#2147](https://github.com/floci-io/floci/issues/2147)) ([b1f953e](https://github.com/floci-io/floci/commit/b1f953efb1972b86f1a0faf092ee0205b5b5f523)), closes [#2121](https://github.com/floci-io/floci/issues/2121)
* **iam:** seed the full AWS managed policy catalog ([#2194](https://github.com/floci-io/floci/issues/2194)) ([527615b](https://github.com/floci-io/floci/commit/527615bdf0624e53b00e9708e9c4902e6109f50a)), closes [ClassLoader#getResourceAsStream](https://github.com/ClassLoader/issues/getResourceAsStream)
* **iot:** match topic rules outside the default region ([#2169](https://github.com/floci-io/floci/issues/2169)) ([9b451cc](https://github.com/floci-io/floci/commit/9b451ccc825b31dd099bc75413a49ec419cc9d54)), closes [#2065](https://github.com/floci-io/floci/issues/2065)
* **kinesis:** reject records over the 1 MiB size limit ([#1896](https://github.com/floci-io/floci/issues/1896)) ([5afb60d](https://github.com/floci-io/floci/commit/5afb60d0f55e00aeb555a08ecc7d9ce8305bc545)), closes [#1755](https://github.com/floci-io/floci/issues/1755)
* **kinesis:** resolve LATEST shard iterator position at GetShardIterator time ([#1901](https://github.com/floci-io/floci/issues/1901)) ([3b760bd](https://github.com/floci-io/floci/commit/3b760bd8e51bdfd7b6314538badfe9a53d7c3075)), closes [#1900](https://github.com/floci-io/floci/issues/1900)
* **kms:** reject mismatched keys in decryption requests ([#1893](https://github.com/floci-io/floci/issues/1893)) ([0cfffbe](https://github.com/floci-io/floci/commit/0cfffbea000a9c56dc926d4c9bff75c942bf12b1))
* **lambda,iam:** assume execution role for in-function SDK calls ([#1909](https://github.com/floci-io/floci/issues/1909)) ([573d4bd](https://github.com/floci-io/floci/commit/573d4bdaffc9403295621d9cd8f94086c25760d9)), closes [#2040](https://github.com/floci-io/floci/issues/2040)
* **lambda:** disable HTTP/2 cleartext on the runtime API server ([#2181](https://github.com/floci-io/floci/issues/2181)) ([cb06a73](https://github.com/floci-io/floci/commit/cb06a73b782c2252dd462125781c146fb1e8b8ec))
* **lambda:** drain parked extensions before closing the runtime API server ([#2156](https://github.com/floci-io/floci/issues/2156)) ([c0f36ea](https://github.com/floci-io/floci/commit/c0f36ea60467b9df5898f8cd71229b4c4b3314c7))
* **lambda:** give published versions their code location ([#2012](https://github.com/floci-io/floci/issues/2012)) ([42022fe](https://github.com/floci-io/floci/commit/42022fe9375d240df4da452cc4279e4543e67b62)), closes [#1988](https://github.com/floci-io/floci/issues/1988) [#1987](https://github.com/floci-io/floci/issues/1987) [#1987](https://github.com/floci-io/floci/issues/1987)
* **lambda:** propagate image inspection failures ([#2268](https://github.com/floci-io/floci/issues/2268)) ([9ebf9fe](https://github.com/floci-io/floci/commit/9ebf9feb54bc0bd1cc78c774ee1a67cb4935c09c))
* **lambda:** reassemble container log lines split across Docker frames ([#1953](https://github.com/floci-io/floci/issues/1953)) ([6344852](https://github.com/floci-io/floci/commit/6344852540cec1b69a9b8fb76795abc08dedb46c))
* **lambda:** reconcile code volumes against real Docker state and clean up superseded ones ([#2208](https://github.com/floci-io/floci/issues/2208)) ([a5daab6](https://github.com/floci-io/floci/commit/a5daab6fb7daf2a657392941ac3ef8ce6b2c7c25)), closes [#2164](https://github.com/floci-io/floci/issues/2164)
* **lambda:** scope resource-policy statements to the request Qualifier ([#2129](https://github.com/floci-io/floci/issues/2129)) ([ea74b97](https://github.com/floci-io/floci/commit/ea74b979ae56fca2fe5072d89b0e30744d86b0bb))
* **lambda:** SIGTERM container before closing runtime API socket ([#2098](https://github.com/floci-io/floci/issues/2098)) ([b911ccd](https://github.com/floci-io/floci/commit/b911ccd01392d095bb2a0c2c7ee1fd02c4c6cd70)), closes [#2091](https://github.com/floci-io/floci/issues/2091) [#2156](https://github.com/floci-io/floci/issues/2156) [#2156](https://github.com/floci-io/floci/issues/2156)
* **lambda:** validate Layers ARNs eagerly on CreateFunction/UpdateFunctionConfiguration ([#2282](https://github.com/floci-io/floci/issues/2282)) ([2f0ef45](https://github.com/floci-io/floci/commit/2f0ef459782e9624048b8eca19f88966ffab81e0)), closes [#2280](https://github.com/floci-io/floci/issues/2280) [InMemoryStorage#get](https://github.com/InMemoryStorage/issues/get)
* **memorydb:** clean up container by id on readiness-timeout rollback ([#2092](https://github.com/floci-io/floci/issues/2092)) ([11d5275](https://github.com/floci-io/floci/commit/11d527547af8db62dde10b406ca0ca642d3f1f54)), closes [#2090](https://github.com/floci-io/floci/issues/2090) [#2090](https://github.com/floci-io/floci/issues/2090)
* **rds:** advertise reachable endpoints ([#2074](https://github.com/floci-io/floci/issues/2074)) ([f417164](https://github.com/floci-io/floci/commit/f417164d429e83145835dcb42b9c5ae49f88c12b))
* **rds:** fault with DBInstanceNotFound/DBClusterNotFoundFault for missing identifiers in Describe* ([#1740](https://github.com/floci-io/floci/issues/1740)) ([02288ab](https://github.com/floci-io/floci/commit/02288abc114e700a7034458526d766d66c407f9e))
* **rds:** preserve configured database images ([#2035](https://github.com/floci-io/floci/issues/2035)) ([9e7cdad](https://github.com/floci-io/floci/commit/9e7cdad29aabe0545e448344e93971e4a6fb18a0))
* **rds:** resolve AWS-managed default DB cluster parameter groups on reference ([#1805](https://github.com/floci-io/floci/issues/1805)) ([b31cbb9](https://github.com/floci-io/floci/commit/b31cbb92315f5febffa3686c36f4e1082cf262f9)), closes [#1820](https://github.com/floci-io/floci/issues/1820) [#1823](https://github.com/floci-io/floci/issues/1823)
* **rds:** restore Terraform RDS and RabbitMQ compatibility ([#1951](https://github.com/floci-io/floci/issues/1951)) ([ea1231b](https://github.com/floci-io/floci/commit/ea1231b8b464fab61e013403eb6ebd69d81aee04))
* **s3:** DeleteObjects honours empty key list ([#2201](https://github.com/floci-io/floci/issues/2201)) ([15d6ce8](https://github.com/floci-io/floci/commit/15d6ce8429adfe9a7f060b14e5556c766e309489)), closes [#2198](https://github.com/floci-io/floci/issues/2198)
* **s3:** derive S3 host suffix matching from DNS config ([#1843](https://github.com/floci-io/floci/issues/1843)) ([188588b](https://github.com/floci-io/floci/commit/188588b4eb13e3fa1c9f756db490ca8c3f8b4803))
* **s3:** enforce auth on object write paths when enforce-auth is enabled ([#2326](https://github.com/floci-io/floci/issues/2326)) ([16a8f04](https://github.com/floci-io/floci/commit/16a8f042e7896583df4d79c8037803fcb7a26e9c)), closes [#2318](https://github.com/floci-io/floci/issues/2318)
* **s3:** Ensure tags are added on multipart s3 uploads. ([#2151](https://github.com/floci-io/floci/issues/2151)) ([f6faf0f](https://github.com/floci-io/floci/commit/f6faf0ffe505d6e9c0442b9edfc6a4cdcdf0ff98))
* **s3:** isolate object byte storage between accounts ([#2241](https://github.com/floci-io/floci/issues/2241)) ([cdb2c36](https://github.com/floci-io/floci/commit/cdb2c36dfe6237a86cee46dfd78bf37e7ffcef6e))
* **s3:** preserve literal '+' in object keys and support encoding-type=url in list-objects ([#1736](https://github.com/floci-io/floci/issues/1736)) ([93b6f5e](https://github.com/floci-io/floci/commit/93b6f5e2b0c5a25a543eb6e5a52c5126cd3420e4)), closes [#1589](https://github.com/floci-io/floci/issues/1589)
* **s3:** route the accelerate subresource instead of falling through ([#2330](https://github.com/floci-io/floci/issues/2330)) ([833de25](https://github.com/floci-io/floci/commit/833de25c0822ac78f83e7558677aac9d88268ad4)), closes [#2295](https://github.com/floci-io/floci/issues/2295)
* **s3:** validate FULL_OBJECT checksum on CompleteMultipartUpload ([#1980](https://github.com/floci-io/floci/issues/1980)) ([d039780](https://github.com/floci-io/floci/commit/d039780e3a2b13602378525687f2f6527da95ab0))
* **s3vectors:** return cosine distance from queries ([#2175](https://github.com/floci-io/floci/issues/2175)) ([2f5bc39](https://github.com/floci-io/floci/commit/2f5bc396803039becb15b0378e2742d207384abf))
* **s3vectors:** route ListVectors instead of falling through to S3 ([#2285](https://github.com/floci-io/floci/issues/2285)) ([6c4d63b](https://github.com/floci-io/floci/commit/6c4d63b0a9adf8a0ab7fa75157a1ea91a7fd7ad8)), closes [#2161](https://github.com/floci-io/floci/issues/2161)
* **s3:** verify SigV4 signature on presigned URLs when enforce-auth is enabled ([#1842](https://github.com/floci-io/floci/issues/1842)) ([3fe836a](https://github.com/floci-io/floci/commit/3fe836aa16d4390540ba97645dac7240746939ef))
* **ses:** pass the custom-verification-email store in the list-management test ([#2182](https://github.com/floci-io/floci/issues/2182)) ([396ef55](https://github.com/floci-io/floci/commit/396ef55512590d8c0a1bd26037db3389e6c675ed)), closes [#1875](https://github.com/floci-io/floci/issues/1875) [#1840](https://github.com/floci-io/floci/issues/1840)
* **sqs:** delayed FIFO message no longer blocks its message group ([#2112](https://github.com/floci-io/floci/issues/2112)) ([fa8f8d7](https://github.com/floci-io/floci/commit/fa8f8d78a4aa6ce81db16ffa7d601961f35c4b8a)), closes [#2104](https://github.com/floci-io/floci/issues/2104)
* **stepfunctions:** publish execution status after its terminal fields ([#2234](https://github.com/floci-io/floci/issues/2234)) ([4ba854a](https://github.com/floci-io/floci/commit/4ba854ab8cb09185a5966f958d23c789a61c7b5e))
* **stepfunctions:** wrap optimized lambda:invoke result in the Invoke envelope ([#2165](https://github.com/floci-io/floci/issues/2165)) ([4581176](https://github.com/floci-io/floci/commit/45811768b272aca826160a55b857be371d68c083)), closes [#2110](https://github.com/floci-io/floci/issues/2110)
* **test:** pass the managed prefix list store in Ec2PublicIpOnLaunchTest ([#2288](https://github.com/floci-io/floci/issues/2288)) ([62ff490](https://github.com/floci-io/floci/commit/62ff490619e7bd3554597c28c704081b4c15add5)), closes [#2023](https://github.com/floci-io/floci/issues/2023) [#2287](https://github.com/floci-io/floci/issues/2287)


### Features

* **apigateway:** API key management — UpdateApiKey, DeleteApiKey, UsagePlan custom-id, generateDistinctId ([#1883](https://github.com/floci-io/floci/issues/1883)) ([b6765b3](https://github.com/floci-io/floci/commit/b6765b30568fba917da622606c25b1ccc88d2bc8)), closes [#2045](https://github.com/floci-io/floci/issues/2045)
* **apigateway:** derive SQS QueueUrl from path-style integration URI when absent from template ([#1903](https://github.com/floci-io/floci/issues/1903)) ([cfbae88](https://github.com/floci-io/floci/commit/cfbae88fcae5dcb62daa48896f743ff9b50bdb6c))
* **apigateway:** route execute-api hostnames for HTTP APIs ([#2054](https://github.com/floci-io/floci/issues/2054)) ([33ba5ac](https://github.com/floci-io/floci/commit/33ba5ac59c5e5eb1aaf71cb3551b5cba7b2a203d))
* **apigatewayv2:** route execute-api hosts to WebSocket $connect and [@connections](https://github.com/connections) ([#2188](https://github.com/floci-io/floci/issues/2188)) ([45bb37f](https://github.com/floci-io/floci/commit/45bb37f1fbe3ba5ec1c5bce85b0f5380425707cf)), closes [#2054](https://github.com/floci-io/floci/issues/2054) [#1846](https://github.com/floci-io/floci/issues/1846) [#1871](https://github.com/floci-io/floci/issues/1871) [#1871](https://github.com/floci-io/floci/issues/1871) [#1846](https://github.com/floci-io/floci/issues/1846)
* **applicationautoscaling:** add Application Auto Scaling control plane ([#2159](https://github.com/floci-io/floci/issues/2159)) ([1795e13](https://github.com/floci-io/floci/commit/1795e131a20bad0e63947b454ef87ece45ac1953)), closes [#2157](https://github.com/floci-io/floci/issues/2157)
* **appsync:** Phase 6 — Query Execution + HTTP Endpoint ([#1884](https://github.com/floci-io/floci/issues/1884)) ([819bfed](https://github.com/floci-io/floci/commit/819bfedc6c17e3198c005f698ed2006af163131b))
* **bedrockagentcore:** emulate the AgentCore control plane and InvokeAgentRuntime stub ([#2316](https://github.com/floci-io/floci/issues/2316)) ([4e6e6df](https://github.com/floci-io/floci/commit/4e6e6df06dd9113b562416703bbd1c6372b87935)), closes [lex00/floci#2](https://github.com/lex00/floci/issues/2) [lex00/floci#3](https://github.com/lex00/floci/issues/3) [lex00/floci#4](https://github.com/lex00/floci/issues/4) [lex00/floci#5](https://github.com/lex00/floci/issues/5) [lex00/floci#6](https://github.com/lex00/floci/issues/6) [#7](https://github.com/floci-io/floci/issues/7) [#8](https://github.com/floci-io/floci/issues/8) [#9](https://github.com/floci-io/floci/issues/9) [#12](https://github.com/floci-io/floci/issues/12) [lex00/floci#14](https://github.com/lex00/floci/issues/14) [#10](https://github.com/floci-io/floci/issues/10) [#11](https://github.com/floci-io/floci/issues/11) [#13](https://github.com/floci-io/floci/issues/13) [lex00/floci#10](https://github.com/lex00/floci/issues/10) [lex00/floci#11](https://github.com/lex00/floci/issues/11) [lex00/floci#13](https://github.com/lex00/floci/issues/13) [#14](https://github.com/floci-io/floci/issues/14)
* **cloudcontrol:** implement CreateResource / DeleteResource / GetResource ([#2037](https://github.com/floci-io/floci/issues/2037)) ([43f47a3](https://github.com/floci-io/floci/commit/43f47a3c96651f009d97644e15f3e6f15b562b6b))
* **cloudformation:** honor resource-level DeletionPolicy ([#2167](https://github.com/floci-io/floci/issues/2167)) ([7d9b9ae](https://github.com/floci-io/floci/commit/7d9b9aedd274df2caf04d71968ca1b8cea9be806)), closes [#1555](https://github.com/floci-io/floci/issues/1555)
* **cloudformation:** implement GetTemplateSummary ([#2148](https://github.com/floci-io/floci/issues/2148)) ([a235b76](https://github.com/floci-io/floci/commit/a235b768350b58571ee8628c6833e6e56fa19a4d)), closes [#1964](https://github.com/floci-io/floci/issues/1964)
* **cloudformation:** provision ApiGateway::Account, AutoScaling::LifecycleHook, and EC2::FlowLog ([#2003](https://github.com/floci-io/floci/issues/2003)) ([9280369](https://github.com/floci-io/floci/commit/9280369b64a1bb526b69daf39b35d2f91fdbbe6f)), closes [#2002](https://github.com/floci-io/floci/issues/2002)
* **cloudformation:** provision AWS::EC2::VPCEndpoint ([#1995](https://github.com/floci-io/floci/issues/1995)) ([a985fa4](https://github.com/floci-io/floci/commit/a985fa4640db5f8f69b9ffa02fb0b59627e93c4e)), closes [#1994](https://github.com/floci-io/floci/issues/1994)
* **cloudformation:** provision AWS::ECS::CapacityProvider and ClusterCapacityProviderAssociations ([#1999](https://github.com/floci-io/floci/issues/1999)) ([907a2df](https://github.com/floci-io/floci/commit/907a2dfbf3739b9c31713728f083609bfb2ec40d)), closes [#1998](https://github.com/floci-io/floci/issues/1998) [#1998](https://github.com/floci-io/floci/issues/1998) [#1825](https://github.com/floci-io/floci/issues/1825)
* **cloudformation:** provision AWS::Events::EventBus as a real custom bus ([#1807](https://github.com/floci-io/floci/issues/1807)) ([bc21367](https://github.com/floci-io/floci/commit/bc21367cc4debab34645afdf777ee12abc80d0a2)), closes [#1803](https://github.com/floci-io/floci/issues/1803) [#2141](https://github.com/floci-io/floci/issues/2141)
* **cloudformation:** provision AWS::Lambda::Permission and fix Version and Alias updates ([#1997](https://github.com/floci-io/floci/issues/1997)) ([105a8ee](https://github.com/floci-io/floci/commit/105a8eeb7e3dca619763c249832a78be34c11c0c)), closes [#1996](https://github.com/floci-io/floci/issues/1996) [LambdaService#deleteVersion](https://github.com/LambdaService/issues/deleteVersion) [#1961](https://github.com/floci-io/floci/issues/1961)
* **cloudformation:** provision the network ACL family ([#2001](https://github.com/floci-io/floci/issues/2001)) ([5e01c07](https://github.com/floci-io/floci/commit/5e01c07b33e59d56e7dfc03e6e84238cdcac6304)), closes [#2000](https://github.com/floci-io/floci/issues/2000)
* **cloudformation:** resolve dynamic references in RDS credentials ([#1809](https://github.com/floci-io/floci/issues/1809)) ([d9e4447](https://github.com/floci-io/floci/commit/d9e4447aebeeef01541b35bc036127b64de06bb8))
* **cloudfront:** enforce signed private content ([#1831](https://github.com/floci-io/floci/issues/1831)) ([5657e35](https://github.com/floci-io/floci/commit/5657e350075381279dbec1f2cc9a9cc118414ddf)), closes [#1820](https://github.com/floci-io/floci/issues/1820) [#1823](https://github.com/floci-io/floci/issues/1823)
* **cloudfront:** serve distribution requests from S3 and custom origins ([#1820](https://github.com/floci-io/floci/issues/1820)) ([82f8016](https://github.com/floci-io/floci/commit/82f80165fb5a01e754bf2512de6e6621a3c9220d)), closes [#1823](https://github.com/floci-io/floci/issues/1823)
* **cloudhsmv2:** implement CloudHSM v2 service ([#1776](https://github.com/floci-io/floci/issues/1776)) ([1cc97d5](https://github.com/floci-io/floci/commit/1cc97d57c10d2476c8509998f01e1dfa289bcdc2)), closes [#2035](https://github.com/floci-io/floci/issues/2035) [#1810](https://github.com/floci-io/floci/issues/1810) [#1827](https://github.com/floci-io/floci/issues/1827)
* **cognito:** add AdminLinkProviderForUser ([#2166](https://github.com/floci-io/floci/issues/2166)) ([0203bc7](https://github.com/floci-io/floci/commit/0203bc7f7e71dc47810b08d4e02f1d71775e2850)), closes [#1563](https://github.com/floci-io/floci/issues/1563)
* **cognito:** add GetUserAttributeVerificationCode support ([#1898](https://github.com/floci-io/floci/issues/1898)) ([24cdabb](https://github.com/floci-io/floci/commit/24cdabb257c3577475ff89e6dd850fd9d4e791a7))
* **dynamodb:** global-table v2 replicas (UpdateTable ReplicaUpdates + Custom::DynamoDBReplica) ([#1811](https://github.com/floci-io/floci/issues/1811)) ([a29464a](https://github.com/floci-io/floci/commit/a29464abc7f42c80e6eba10e8129435d8a4bb4f1))
* **ec2:** add ReplaceRoute ([#2178](https://github.com/floci-io/floci/issues/2178)) ([d943e09](https://github.com/floci-io/floci/commit/d943e09a73e12e5164427f965c20314d3e8d6097)), closes [#2087](https://github.com/floci-io/floci/issues/2087)
* **ec2:** allow a security group rule to take a prefix list as its source ([#2271](https://github.com/floci-io/floci/issues/2271)) ([dfcd492](https://github.com/floci-io/floci/commit/dfcd4921986998b249cf272d65e905ae6bc3dd7d)), closes [#2269](https://github.com/floci-io/floci/issues/2269) [#2266](https://github.com/floci-io/floci/issues/2266)
* **ec2:** config toggle to report the AWS-faithful private IP ([#2024](https://github.com/floci-io/floci/issues/2024)) ([33d35b2](https://github.com/floci-io/floci/commit/33d35b2079daefaa4f96db7288ac2a848c237b56)), closes [#1983](https://github.com/floci-io/floci/issues/1983)
* **ec2:** DescribeImages synthesizes an AMI for an unmatched wildcard name lookup ([#2009](https://github.com/floci-io/floci/issues/2009)) ([cdb6811](https://github.com/floci-io/floci/commit/cdb6811bbf4f8a79df7cd155f723cbb077a298b5)), closes [#2008](https://github.com/floci-io/floci/issues/2008)
* **ec2:** DescribeVpcEndpointServices returns the common interface services with AZs ([#2007](https://github.com/floci-io/floci/issues/2007)) ([42a79a7](https://github.com/floci-io/floci/commit/42a79a7fd71f4f72c6eb37cfd851b4ff5acb712a)), closes [#2004](https://github.com/floci-io/floci/issues/2004)
* **ec2:** support CreateImage (create AMI from instance) ([#1979](https://github.com/floci-io/floci/issues/1979)) ([30a6164](https://github.com/floci-io/floci/commit/30a61646ac22d14b0936cd046164a1af7ae9c371)), closes [#1978](https://github.com/floci-io/floci/issues/1978)
* **ec2:** support managed prefix lists ([#2105](https://github.com/floci-io/floci/issues/2105)) ([ac4b865](https://github.com/floci-io/floci/commit/ac4b865a34bd1d501adfeebc4722785da9946c8b)), closes [#2100](https://github.com/floci-io/floci/issues/2100)
* **ec2:** support transit gateways ([#2329](https://github.com/floci-io/floci/issues/2329)) ([20470b7](https://github.com/floci-io/floci/commit/20470b7f4a72911e9ad10874cc54c0a9fc8819d8))
* **eks:** support IRSA with a real OIDC issuer and JWT validation ([#2108](https://github.com/floci-io/floci/issues/2108)) ([7e5afae](https://github.com/floci-io/floci/commit/7e5afae61be7a304eb3c970eb0c2e47fed894c89))
* **elbv2:** honor preserve_host_header parameter ([#2109](https://github.com/floci-io/floci/issues/2109)) ([2594705](https://github.com/floci-io/floci/commit/2594705f9c93e2c23b00557e412f8442905a0037))
* **eventbridge:** deliver events to event-bus targets ([#1814](https://github.com/floci-io/floci/issues/1814)) ([50fe67d](https://github.com/floci-io/floci/commit/50fe67dde6683ed53cbf8ddf454e35ef3a54c363))
* **firehose:** honor BufferingHints with time and size based flush ([#2314](https://github.com/floci-io/floci/issues/2314)) ([bfda938](https://github.com/floci-io/floci/commit/bfda938f7223f85e54408b0e1ee1b31a87b7e43e)), closes [#1886](https://github.com/floci-io/floci/issues/1886)
* **guardduty:** add GuardDuty detector and organization configuration emulation ([#2346](https://github.com/floci-io/floci/issues/2346)) ([6779aa8](https://github.com/floci-io/floci/commit/6779aa8270f092728a0799f8bbe0dd4e438f4360))
* **iam:** add GetAccountSummary support ([#1986](https://github.com/floci-io/floci/issues/1986)) ([c21337c](https://github.com/floci-io/floci/commit/c21337c3b185ab0c436cdfbc2bede70dadc8330c))
* **iam:** add service-linked role create, delete and deletion status ([#2179](https://github.com/floci-io/floci/issues/2179)) ([c8403ac](https://github.com/floci-io/floci/commit/c8403ac6fce86bdc47a6ec6ddcea125fa22f9574)), closes [#2122](https://github.com/floci-io/floci/issues/2122)
* **iam:** support account aliases ([#2103](https://github.com/floci-io/floci/issues/2103)) ([1215429](https://github.com/floci-io/floci/commit/12154297b5b0c9ca32d86ecd3573ece9edb5f4d5)), closes [#2101](https://github.com/floci-io/floci/issues/2101)
* **iam:** support OIDC identity providers ([#2106](https://github.com/floci-io/floci/issues/2106)) ([f17dd1e](https://github.com/floci-io/floci/commit/f17dd1ed81634f128c9c6132fbb0025ef9326190)), closes [#2102](https://github.com/floci-io/floci/issues/2102)
* **kinesis:** add local inspection endpoints for UI ([#1880](https://github.com/floci-io/floci/issues/1880)) ([486be8f](https://github.com/floci-io/floci/commit/486be8f5b07e53163bdc5a16a585f673ada3d5d0))
* **kinesisanalytics:** add Managed Service for Apache Flink (Kinesis Analytics V2) ([#1914](https://github.com/floci-io/floci/issues/1914)) ([d78520d](https://github.com/floci-io/floci/commit/d78520d5cbbac33f9095fb824e543b6f7e7bd856))
* **kms:** implement UpdateAlias ([#2324](https://github.com/floci-io/floci/issues/2324)) ([984886f](https://github.com/floci-io/floci/commit/984886f6972ae9046b94608eead875efdaf316b0))
* **lambdamicrovms:** AWS Lambda MicroVMs service module and its CloudFormation types ([#2079](https://github.com/floci-io/floci/issues/2079)) ([40e8aad](https://github.com/floci-io/floci/commit/40e8aad55ae644bb6747dc80654f80fc3287a2e6))
* **lambda:** support EFS file system configs ([#2053](https://github.com/floci-io/floci/issues/2053)) ([e1f389f](https://github.com/floci-io/floci/commit/e1f389f61bd1c899a81073528a86cf64e7a7e9ed))
* **logs:** support log group deletion protection ([#2256](https://github.com/floci-io/floci/issues/2256)) ([4215006](https://github.com/floci-io/floci/commit/4215006fe29c781e2af60dfcaed8577dcc18f478))
* **msk:** add configuration CRUD (Create/List/Describe/Delete) ([#2336](https://github.com/floci-io/floci/issues/2336)) ([4c510e5](https://github.com/floci-io/floci/commit/4c510e576c9b64f51cf6024786b25cb81851a378))
* **opensearch:** parse, store, and return AccessPolicies ([#2327](https://github.com/floci-io/floci/issues/2327)) ([78ad357](https://github.com/floci-io/floci/commit/78ad357eb8041622f0bae677bd1ebd745c5be6b1))
* **rds-data:** adding data-api preparedstatement() support ([#1887](https://github.com/floci-io/floci/issues/1887)) ([19a32ab](https://github.com/floci-io/floci/commit/19a32ab51d97706878242ac9a30cd4e576656920))
* **rds:** model DB proxies and their target groups ([#1813](https://github.com/floci-io/floci/issues/1813)) ([e4010ec](https://github.com/floci-io/floci/commit/e4010ec12f21704c153a17b25f051df6a3dd2736))
* **s3:** resolve index documents for static-website directory requests ([#1815](https://github.com/floci-io/floci/issues/1815)) ([6d829ff](https://github.com/floci-io/floci/commit/6d829ff7a4600425fcaf61c5f95444b0b87737ee))
* **s3tables:** emulate metadata service ([#2322](https://github.com/floci-io/floci/issues/2322)) ([b45de1b](https://github.com/floci-io/floci/commit/b45de1bb7dcd7f5527e5a731efcc9870098287f0))
* **ses:** add DKIM actions with domain-inherited email DKIM ([#1904](https://github.com/floci-io/floci/issues/1904)) ([ff0201a](https://github.com/floci-io/floci/commit/ff0201a13a76c31008d37a1e819d384f606c462b))
* **ses:** honor ConfigurationSetName on CreateEmailIdentity (v2) ([#1812](https://github.com/floci-io/floci/issues/1812)) ([cd3588b](https://github.com/floci-io/floci/commit/cd3588b517c22607a1bd4c6687a2f8a8286631a8))
* **ses:** implement custom verification email templates for v1 and v2 ([#1840](https://github.com/floci-io/floci/issues/1840)) ([aed50cc](https://github.com/floci-io/floci/commit/aed50cc2b21875079b96ab4a67afe5fe0034fbe0))
* **ses:** implement PutAccountVdmAttributes and return VdmAttributes from GetAccount (v2) ([#2265](https://github.com/floci-io/floci/issues/2265)) ([80d1dc7](https://github.com/floci-io/floci/commit/80d1dc732e5155772aa503662b3d37ae95d52e2a))
* **ses:** implement SendCustomVerificationEmail for v1 and v2 ([#2191](https://github.com/floci-io/floci/issues/2191)) ([bd01c1a](https://github.com/floci-io/floci/commit/bd01c1a70b2c3f99beac29ce2de359bb6464a978))
* **ses:** implement SendEmail ListManagementOptions suppression and unsubscribe (v2) ([#1875](https://github.com/floci-io/floci/issues/1875)) ([fa9ed91](https://github.com/floci-io/floci/commit/fa9ed9100e30549a3e3f796adea8f021ccdde10c))
* **ses:** implement v1 receipt rule set actions (stored-but-inert) ([#2128](https://github.com/floci-io/floci/issues/2128)) ([ff8d6ef](https://github.com/floci-io/floci/commit/ff8d6efdf33a0118b2490b9a52ee6db6a8fdbca8))
* **stepfunctions:** add UpdateStateMachine and update in place on stack updates ([#1867](https://github.com/floci-io/floci/issues/1867)) ([97ac3ca](https://github.com/floci-io/floci/commit/97ac3cabb513254dcd670012d1416ad480dc2f9f))
* **stepfunctions:** emulate distributed Map ResultWriter (S3 export + manifest) ([#1823](https://github.com/floci-io/floci/issues/1823)) ([59cb643](https://github.com/floci-io/floci/commit/59cb643d6e280737e876327c4aaf64d65d451640)), closes [#1820](https://github.com/floci-io/floci/issues/1820)
* **stepfunctions:** run Map iterations concurrently honoring MaxConcurrency ([#1810](https://github.com/floci-io/floci/issues/1810)) ([a7da1b9](https://github.com/floci-io/floci/commit/a7da1b98566c2ba221c7a81ed2d8ffce95febef9))
* **swf:** add Simple Workflow Service emulation ([#2257](https://github.com/floci-io/floci/issues/2257)) ([ecad6ac](https://github.com/floci-io/floci/commit/ecad6acf581213ef26513f10f2100a6d76409725)), closes [com.amazonaws.swf.base.model#Fault](https://github.com/com.amazonaws.swf.base.model/issues/Fault)


### Performance Improvements

* **lambda:** reuse a populated code volume across restarts via a completion marker ([#1827](https://github.com/floci-io/floci/issues/1827)) ([5d61e95](https://github.com/floci-io/floci/commit/5d61e9523938c5d3b0166e877afd17b911e4a60e))

# [1.6.0](https://github.com/floci-io/floci/compare/1.5.34...1.6.0) (2026-08-06)


### Bug Fixes

* **1790:** better populate describe alarm responses ([#1792](https://github.com/floci-io/floci/issues/1792)) ([fcb22be](https://github.com/floci-io/floci/commit/fcb22be76b3ce5d3e9f2cd3e740d992817d7c140))
* **apigateway:** fall through to less specific resources on method mi… ([#1630](https://github.com/floci-io/floci/issues/1630)) ([96c7aa6](https://github.com/floci-io/floci/commit/96c7aa68ee58bbc03f7bcdff4ac17af18bf56976)), closes [#1547](https://github.com/floci-io/floci/issues/1547)
* **apigateway:** import authorizers and security requirements from OpenAPI ([#1798](https://github.com/floci-io/floci/issues/1798)) ([91e06eb](https://github.com/floci-io/floci/commit/91e06ebebf5725ee0de4899f4caf92616a70c96a))
* **apigateway:** use last duplicate header value ([#1806](https://github.com/floci-io/floci/issues/1806)) ([6a214e8](https://github.com/floci-io/floci/commit/6a214e84d6315faa69ffc17f114c1a0d1825ed90))
* **athena:** report the result CSV object key as OutputLocation ([#1895](https://github.com/floci-io/floci/issues/1895)) ([418ec1b](https://github.com/floci-io/floci/commit/418ec1bdae3dde388ddda7d235cf13f3d5f6f485)), closes [#1752](https://github.com/floci-io/floci/issues/1752)
* **cloudformation:** AWS::IAM::ManagedPolicy exposes PolicyArn for Fn::GetAtt ([#2056](https://github.com/floci-io/floci/issues/2056)) ([f719033](https://github.com/floci-io/floci/commit/f71903379c5bbf3ef5009f3ee721e5d83a2a7c59))
* **cloudformation:** keep uniqueness suffix when truncating generated resource names ([#1802](https://github.com/floci-io/floci/issues/1802)) ([48b2139](https://github.com/floci-io/floci/commit/48b2139b4fbabb4fb30c71e9963bc78f614fa57f)), closes [#1825](https://github.com/floci-io/floci/issues/1825)
* **cloudformation:** preserve subnet public IP setting ([#2031](https://github.com/floci-io/floci/issues/2031)) ([b62d1e7](https://github.com/floci-io/floci/commit/b62d1e762e61e5262b326f07997d349949fd752d))
* **cloudformation:** provision AWS::ApiGatewayV2::Authorizer and wire Route.AuthorizerId ([#1760](https://github.com/floci-io/floci/issues/1760)) ([7f51c74](https://github.com/floci-io/floci/commit/7f51c746cdc2d568b1d9add083365a9df16fa8c8)), closes [#1773](https://github.com/floci-io/floci/issues/1773)
* **cloudformation:** resolve Fn::GetAtt [Vpc, DefaultSecurityGroup] ([#1977](https://github.com/floci-io/floci/issues/1977)) ([bdad066](https://github.com/floci-io/floci/commit/bdad0666947e69215eb454adf3a6a97b93a4f035)), closes [#1976](https://github.com/floci-io/floci/issues/1976)
* **cloudformation:** treat delete of an already-removed DynamoDB table or Lambda function as idempotent ([#1803](https://github.com/floci-io/floci/issues/1803)) ([5cb26ff](https://github.com/floci-io/floci/commit/5cb26ff1170d51cfd5a69430b588793e1e18dfeb))
* **codebuild:** stabilize start and retry responses ([#2052](https://github.com/floci-io/floci/issues/2052)) ([fa96b79](https://github.com/floci-io/floci/commit/fa96b791b467ffc54809ae5541b0bf56e08dae23))
* **cognito:** reject unconfirmed users in SRP auth ([#2027](https://github.com/floci-io/floci/issues/2027)) ([733c72d](https://github.com/floci-io/floci/commit/733c72d02a422c71f4c360b58a263be2d2a10833))
* **dockerfile:** ensure docker-java compatibility ([#2096](https://github.com/floci-io/floci/issues/2096)) ([7ade290](https://github.com/floci-io/floci/commit/7ade290312726732b5ad79688ae75a85ce5673bb))
* **dynamodb:** resolve nested document paths in ADD and DELETE update actions ([#1908](https://github.com/floci-io/floci/issues/1908)) ([c052259](https://github.com/floci-io/floci/commit/c0522593e5c0c03d5635bbb44ff4c8d752f595d9))
* **ec2:** DescribeKeyPairs returns InvalidKeyPair.NotFound for missing names/ids ([#1932](https://github.com/floci-io/floci/issues/1932)) ([7d96106](https://github.com/floci-io/floci/commit/7d961068e1f177d01e4ed8e44b8342fad4a099bf)), closes [#1911](https://github.com/floci-io/floci/issues/1911)
* **ec2:** return AWS-parity MissingParameter for CreateSubnet without VpcId ([#2094](https://github.com/floci-io/floci/issues/2094)) ([88408d8](https://github.com/floci-io/floci/commit/88408d85748d35418dc166bf5eb4150d8d4b02c1)), closes [#2089](https://github.com/floci-io/floci/issues/2089)
* **ecs:** resolve Secrets Manager JSON-key selectors in task definition secrets ([#2133](https://github.com/floci-io/floci/issues/2133)) ([e3c180b](https://github.com/floci-io/floci/commit/e3c180b952ed20319d7a8f8b235aed622c65de7c)), closes [#1912](https://github.com/floci-io/floci/issues/1912)
* **lambda:** carry the owning account into published version snapshots ([#2041](https://github.com/floci-io/floci/issues/2041)) ([f4e8bd8](https://github.com/floci-io/floci/commit/f4e8bd8edfd8fa5bb8e930da0a1dd3523007bad3)), closes [#2040](https://github.com/floci-io/floci/issues/2040)
* **lambda:** report resolved executed version ([#2026](https://github.com/floci-io/floci/issues/2026)) ([2889fbd](https://github.com/floci-io/floci/commit/2889fbdef8fd3cffa1e2185c6f2adeed7501d2e5))
* **lambda:** reset volatile DynamoDB Streams ESM checkpoints on restart ([#2077](https://github.com/floci-io/floci/issues/2077)) ([847c30a](https://github.com/floci-io/floci/commit/847c30a52d29ac39034dacc109b48fc47bab361c))
* **pipes:** register kafka-clients reflection metadata for native image ([#2068](https://github.com/floci-io/floci/issues/2068)) ([ab73379](https://github.com/floci-io/floci/commit/ab733798a38d2498901ede719e2841f04c003a31))
* **s3:** accept a percent-encoded bucket/key separator in copy sources ([#2060](https://github.com/floci-io/floci/issues/2060)) ([a8ed218](https://github.com/floci-io/floci/commit/a8ed218c5790ae3db6202e75aad1b062f655cdbb)), closes [#2038](https://github.com/floci-io/floci/issues/2038)
* **s3:** apply CreateBucketConfiguration tags on bucket creation ([#2115](https://github.com/floci-io/floci/issues/2115)) ([79031a2](https://github.com/floci-io/floci/commit/79031a240ab03a7a6d97758c15b3b100bf158b73))
* **s3:** include EventBridgeConfiguration in GetBucketNotification response ([#2072](https://github.com/floci-io/floci/issues/2072)) ([b8edd37](https://github.com/floci-io/floci/commit/b8edd37b0c9ff8dc0f40b2e56bff085a7ff8ec18))
* **s3:** recognize virtual-hosted-style requests over HTTP/2 ([#1954](https://github.com/floci-io/floci/issues/1954)) ([5f7d4d2](https://github.com/floci-io/floci/commit/5f7d4d2dc85a318db455fdd8bee83839ecb13903)), closes [#1866](https://github.com/floci-io/floci/issues/1866)
* **ssm:** report invalid batch parameter names ([#2075](https://github.com/floci-io/floci/issues/2075)) ([04873bf](https://github.com/floci-io/floci/commit/04873bfd092792eff42824b0405f2050e5fe897c))
* **tls:** reuse the persisted self-signed certificate across restarts ([#1799](https://github.com/floci-io/floci/issues/1799)) ([a4356f2](https://github.com/floci-io/floci/commit/a4356f25fb3cc277b0f6277469ec5fc49f43c7ca))


### Features

* Add AWSCloudFormationReadOnlyAccess as a managed policy. ([#2057](https://github.com/floci-io/floci/issues/2057)) ([0142dc4](https://github.com/floci-io/floci/commit/0142dc434f98ba14a13236196c72036839a1e84b))
* **apigateway:** support floci:override-id for v1 and v2 ([#2045](https://github.com/floci-io/floci/issues/2045)) ([02385da](https://github.com/floci-io/floci/commit/02385da37b1e14ba01938f408b8a5695218619bf)), closes [#1593](https://github.com/floci-io/floci/issues/1593)
* **bedrock:** add proxy backend for real LLM responses via OpenAI-compatible API ([#1789](https://github.com/floci-io/floci/issues/1789)) ([875e0f2](https://github.com/floci-io/floci/commit/875e0f2d3b63ae5fbf7ca1bffb9a1df3a83b8bc2))
* **cloudcontrol:** include EC2 resource tags ([#1933](https://github.com/floci-io/floci/issues/1933)) ([205a8f1](https://github.com/floci-io/floci/commit/205a8f174b926a6f27bfcf830e78289497dcc706))
* **cloudformation:** provision AWS::EC2::LaunchTemplate ([#1973](https://github.com/floci-io/floci/issues/1973)) ([4e0a815](https://github.com/floci-io/floci/commit/4e0a815f20f38b9952a2a899b9a38de4175b27e5)), closes [#1971](https://github.com/floci-io/floci/issues/1971)
* **cloudformation:** provision AWS::EC2::VPCGatewayAttachment ([#1972](https://github.com/floci-io/floci/issues/1972)) ([1a99721](https://github.com/floci-io/floci/commit/1a99721ae04659e986afcc37afbe4c7e5f8560c4)), closes [#1970](https://github.com/floci-io/floci/issues/1970)
* **cloudformation:** provision AWS::SecretsManager::SecretTargetAttachment ([#1804](https://github.com/floci-io/floci/issues/1804)) ([62a576c](https://github.com/floci-io/floci/commit/62a576c8d482dce64b941d3cc987ec2717b9497f))
* **cloudformation:** support AWS::Events::EventBus and EventBusPolicy ([#1794](https://github.com/floci-io/floci/issues/1794)) ([76f602f](https://github.com/floci-io/floci/commit/76f602fafa67df26e60e69a18f4591494e172b0f))
* **cognito:** implement ResendConfirmationCode ([#2071](https://github.com/floci-io/floci/issues/2071)) ([bb7c45c](https://github.com/floci-io/floci/commit/bb7c45ce1bd1c27d06abae095493240209d4647c)), closes [#2067](https://github.com/floci-io/floci/issues/2067)
* **ec2:** added attach and detach volume support ([#1787](https://github.com/floci-io/floci/issues/1787)) ([2c74329](https://github.com/floci-io/floci/commit/2c743299ec3574f2fb2258555a965a0458bded2b))
* **ec2:** return an empty set for DescribeVpnGateways ([#1975](https://github.com/floci-io/floci/issues/1975)) ([3baf4f4](https://github.com/floci-io/floci/commit/3baf4f48496d31d67f5786d2fa5d8fee15bd8e1d)), closes [#1974](https://github.com/floci-io/floci/issues/1974)
* **iam:** list entities attached to managed policies ([#1808](https://github.com/floci-io/floci/issues/1808)) ([78ba5b3](https://github.com/floci-io/floci/commit/78ba5b345793296e3edfd80e74eb68f1691fccb5))
* **iam:** seed Amazon Bedrock managed policies ([#2034](https://github.com/floci-io/floci/issues/2034)) ([5874348](https://github.com/floci-io/floci/commit/58743487a799c46beeb5276bf40f88e7eda4103f)), closes [#1559](https://github.com/floci-io/floci/issues/1559) [#1216](https://github.com/floci-io/floci/issues/1216)
* **iam:** seed the managed policies CDK bootstrap and the scenario stacks attach ([#2064](https://github.com/floci-io/floci/issues/2064)) ([43aea09](https://github.com/floci-io/floci/commit/43aea0983d53c41eff4ed4307663b8ab1424c567)), closes [#2059](https://github.com/floci-io/floci/issues/2059) [#2057](https://github.com/floci-io/floci/issues/2057) [#2057](https://github.com/floci-io/floci/issues/2057)
* **kms:** implement ListKeyPolicies ([#2046](https://github.com/floci-io/floci/issues/2046)) ([760115d](https://github.com/floci-io/floci/commit/760115db14d6f101b0f282b71f81a11deefc9922)), closes [#1528](https://github.com/floci-io/floci/issues/1528)
* **lambda:** implement the Lambda Extensions API ([#1773](https://github.com/floci-io/floci/issues/1773)) ([9f0dec9](https://github.com/floci-io/floci/commit/9f0dec9317d26c53b26345ce15bf3cf9f28eebd3))
* **lambda:** support extra /etc/hosts entries on Lambda launch ([#2073](https://github.com/floci-io/floci/issues/2073)) ([b543aa4](https://github.com/floci-io/floci/commit/b543aa4baad4a35e6f4b4331673dd69038d13e2e))
* **mwaa:** add Amazon MWAA emulation backed by real Airflow (LocalExecutor) ([#2086](https://github.com/floci-io/floci/issues/2086)) ([7e4e3e8](https://github.com/floci-io/floci/commit/7e4e3e8c501a09f036a688df7f468ba58ab0c787))
* **release:** one-button release cut from main and ECR Public versioned publishing ([#2127](https://github.com/floci-io/floci/issues/2127)) ([61011c0](https://github.com/floci-io/floci/commit/61011c0fa80919ef2f0ddf86cf0570594f09b6c3))
* **rum:** add CloudWatch RUM app-monitor service ([#1797](https://github.com/floci-io/floci/issues/1797)) ([aadc93e](https://github.com/floci-io/floci/commit/aadc93e30603e7941dbac168638df5c389e914b7))
* **sqs:** retain MessageGroupId on standard queue messages ([#1891](https://github.com/floci-io/floci/issues/1891)) ([a01b707](https://github.com/floci-io/floci/commit/a01b707bdc674b715bcca1cc7ef2a306f7025c07)), closes [#1496](https://github.com/floci-io/floci/issues/1496)


### Performance Improvements

* **docker:** stop duplicating the native binary into a second image layer ([#2069](https://github.com/floci-io/floci/issues/2069)) ([9e90e5c](https://github.com/floci-io/floci/commit/9e90e5cff3b312af559506fd8d9b97750c91e0d9))

## [1.5.34] - 2026-07-28

### Added

- **cloudtrail:** new in-process service. Supports `CreateTrail`, `DescribeTrails`, `DeleteTrail`, `UpdateTrail`, `PutEventSelectors`, `GetEventSelectors`, `StartLogging`, `StopLogging`, `GetTrailStatus`, `LookupEvents`. S3 data events on hooked ops (`PutObject`, `GetObject`, `HeadObject`, `DeleteObject`, `ListObjects`, `GetObjectAcl`) are buffered per-trail and flushed as gzipped JSON log files into the destination bucket at AWS-shaped key paths (`AWSLogs/${account}/CloudTrail/${region}/yyyy/MM/dd/${file}.json.gz`) at a configurable cadence. IAM-enforcement denials emit matching `AccessDenied` records ([#1460](https://github.com/floci-io/floci/pull/1460))
- **iam:** seeded `AWSCloudTrail_FullAccess` and `AWSCloudTrail_ReadOnlyAccess` AWS managed policies.
- **iam:** distinguish `s3:GetObjectAcl` / `s3:PutObjectAcl` / `s3:Get|Put|DeleteObjectTagging` from base S3 ops via `?acl` / `?tagging` query parameters when resolving an action for IAM enforcement.
- **ses:** implement identity (sending authorization) policies for v1 and v2 ([#1750](https://github.com/floci-io/floci/pull/1750))
- **stepfunctions:** support the HTTP invoke step ([#1503](https://github.com/floci-io/floci/pull/1503))
- **stepfunctions:** implement the `States.JsonMerge` intrinsic ([#1662](https://github.com/floci-io/floci/pull/1662))
- **eks:** add `eks.disable-cni` to start k3s without its bundled CNI, so a real CNI can be installed in its place ([#1793](https://github.com/floci-io/floci/pull/1793))

### Fixed

- **storage:** dedupe storage backends by resolved file path. Two components opening the same file each got an independent in-memory store, and on graceful shutdown the stale duplicate flushed last and overwrote persisted state ([#1931](https://github.com/floci-io/floci/pull/1931))
- **elbv2:** move persisted-listener restore out of `@PostConstruct`. Restoring listeners during bean creation re-entered the CDI proxy and recursed until the process died, so after a restart with persisted listeners every ELBv2 operation failed ([#2015](https://github.com/floci-io/floci/pull/2015))
- **core:** reject REST requests signed for a service Floci does not implement with `UnknownOperationException`, instead of letting them fall through to S3's path-style routes and return a misleading `NoSuchBucket` ([#1967](https://github.com/floci-io/floci/pull/1967))
- **cloudformation:** model `AWS::IAM::Policy` as an inline policy so two stacks can reuse the same generated policy name; report failed rollback cleanup as `ROLLBACK_FAILED`, detach removed IAM inline-policy targets on stack updates, and migrate the legacy managed-policy representation during update or deletion ([#1800](https://github.com/floci-io/floci/pull/1800))
- **core:** return 4xx client errors instead of 500 for malformed JSON-protocol input ([#1926](https://github.com/floci-io/floci/pull/1926))
- **s3:** return 400 `MalformedXML` for an unparseable `PutObjectRetention` `RetainUntilDate` ([#1631](https://github.com/floci-io/floci/pull/1631))
- **s3:** preserve literal question marks in copy source keys ([#1924](https://github.com/floci-io/floci/pull/1924))
- **cognito:** build OIDC URLs from `effectiveBaseUrl` so `FLOCI_HOSTNAME` is honored ([#1929](https://github.com/floci-io/floci/pull/1929))
- **cognito:** prefer phone delivery for signup verification ([#1839](https://github.com/floci-io/floci/pull/1839))
- **dynamodb:** tokenize `UpdateExpression` whitespace-insensitively ([#1862](https://github.com/floci-io/floci/pull/1862))
- **dynamodb:** throw `ValidationException` when a `list_append` operand is not a list type ([#1702](https://github.com/floci-io/floci/pull/1702))
- **firehose:** return `ResourceInUseException` on a duplicate `CreateDeliveryStream` ([#1738](https://github.com/floci-io/floci/pull/1738))
- **ec2:** apply the `cidr-block` filter in `DescribeSubnets` ([#1864](https://github.com/floci-io/floci/pull/1864))
- **neptune:** throw the modeled `InsufficientStorageClusterCapacity` fault when the proxy-port range is exhausted, so SDK clients can map it to a typed exception ([#1879](https://github.com/floci-io/floci/pull/1879))

### Changed

- **ci:** attach provenance and SBOM attestations to the published images ([#2032](https://github.com/floci-io/floci/pull/2032))

## [1.5.33] - 2026-07-15

### Added

- **eks:** support managed node groups and Fargate profiles (create/describe/list/delete) ([#1523](https://github.com/floci-io/floci/pull/1523))
- **stepfunctions:** support JSONata workflow variables (`Assign`) ([#1824](https://github.com/floci-io/floci/pull/1824))
- **cognito:** implement GlobalSignOut ([#1701](https://github.com/floci-io/floci/pull/1701))
- **cognito:** emit `jti`/`origin_jti` claims and support RevokeToken ([#1705](https://github.com/floci-io/floci/pull/1705))
- **cloudformation:** parse secrets in ECS ContainerDefinitions ([#1874](https://github.com/floci-io/floci/pull/1874))

### Fixed

- **s3:** fail fast on unwritable data root instead of opaque 500s ([#1868](https://github.com/floci-io/floci/pull/1868))
- **s3:** handle DeleteBucketReplication instead of deleting the whole bucket ([#1837](https://github.com/floci-io/floci/pull/1837))
- **s3:** return default SSE-S3 from GetBucketEncryption instead of 404 ([#1838](https://github.com/floci-io/floci/pull/1838))
- **s3:** honor ACL headers and explicit grants ([#1768](https://github.com/floci-io/floci/pull/1768))
- **lifecycle:** tear down process-bound containers on shutdown ([#1869](https://github.com/floci-io/floci/pull/1869))
- **ec2:** reject duplicate key pair names in ImportKeyPair ([#1848](https://github.com/floci-io/floci/pull/1848))
- **iam:** pass S3 list condition context to IAM enforcement ([#1748](https://github.com/floci-io/floci/pull/1748))
- **scheduler:** forward MessageAttributes in universal sns:publish target ([#1706](https://github.com/floci-io/floci/pull/1706))
- **elbv2:** expose target health reason parity ([#1743](https://github.com/floci-io/floci/pull/1743))
- **rds:** return DBSubnetGroupNotFoundFault for missing DescribeDBSubnetGroups name ([#1870](https://github.com/floci-io/floci/pull/1870))
- **cloudformation:** carry PackageType through SAM Function expansion ([#1772](https://github.com/floci-io/floci/pull/1772))
- **eks:** register FargateProfileStatus for native-image reflection ([#1876](https://github.com/floci-io/floci/pull/1876))

## [1.5.32] - 2026-07-11

### Fixed

- **iam:** default UserName to the calling access key's owner ([#1801](https://github.com/floci-io/floci/pull/1801))
- **lambda:** register EventSourceMapping nested types for native-image reflection ([#1826](https://github.com/floci-io/floci/pull/1826))
- **lambda:** return event source mapping failure config ([#1629](https://github.com/floci-io/floci/pull/1629))
- **lambda:** return a downloadable GetFunction Code.Location ([#1718](https://github.com/floci-io/floci/pull/1718))
- **ec2:** serialize concurrent mutations of shared resources per resource ([#1786](https://github.com/floci-io/floci/pull/1786))
- **ec2:** round-trip create-time tags and route/SG-rule attributes ([#1763](https://github.com/floci-io/floci/pull/1763))
- **ecs:** assign awsvpc tasks dynamic host ports to avoid collisions ([#1785](https://github.com/floci-io/floci/pull/1785))
- **elbv2:** dispatch same-port listeners by host ([#1700](https://github.com/floci-io/floci/pull/1700))
- **autoscaling:** propagate ASG tags at launch ([#1734](https://github.com/floci-io/floci/pull/1734))
- **s3:** omit checksum headers from GetObject/HeadObject unless `x-amz-checksum-mode: ENABLED` ([#1633](https://github.com/floci-io/floci/pull/1633)); support S3 auth enforcement ([#1689](https://github.com/floci-io/floci/pull/1689))
- **ses:** populate VerificationStatus in v2 ListEmailIdentities ([#1722](https://github.com/floci-io/floci/pull/1722))
- **rds:** preserve network placement metadata ([#1735](https://github.com/floci-io/floci/pull/1735))
- **neptune:** roll back proxy port and container on failed provisioning ([#1742](https://github.com/floci-io/floci/pull/1742))
- **secretsmanager:** return partial result for missing secrets in batch ([#1591](https://github.com/floci-io/floci/pull/1591))
- **scheduler:** honor target EventBridgeParameters DetailType/Source ([#1489](https://github.com/floci-io/floci/pull/1489))
- **tls:** add host.docker.internal to self-signed cert SANs ([#1821](https://github.com/floci-io/floci/pull/1821))
- **aws-core:** register persisted model types for native-image reflection ([#1781](https://github.com/floci-io/floci/pull/1781))

## [1.5.31] - 2026-07-07

### Added

- **stepfunctions:** support Map `ItemReader` for S3-backed JSON datasets ([#1588](https://github.com/floci-io/floci/pull/1588))
- **iam/rds/docdb/elasticache/glue/ssm/backup/s3control:** implement read-only describe/list APIs for resource collection ([#1581](https://github.com/floci-io/floci/pull/1581))
- **eventbridge:** deliver events to Firehose delivery stream targets ([#1739](https://github.com/floci-io/floci/pull/1739))
- **apigateway:** persist API key tags and add the `GetApiKey` route ([#1677](https://github.com/floci-io/floci/pull/1677))
- **scheduler:** dispatch ECS targets to `RunTask` ([#1733](https://github.com/floci-io/floci/pull/1733))
- **secretsmanager:** support `Filters` and pagination in `BatchGetSecretValue` ([#1737](https://github.com/floci-io/floci/pull/1737))
- **ec2:** support registered images and snapshots ([#1601](https://github.com/floci-io/floci/pull/1601)); add instance metadata catalog and architecture parity ([#1596](https://github.com/floci-io/floci/pull/1596))
- **rds-data:** add the Data API for PostgreSQL ([#1720](https://github.com/floci-io/floci/pull/1720))
- **rds:** add mock mode to create clusters and instances without Docker ([#1655](https://github.com/floci-io/floci/pull/1655))
- **cloudwatch:** add Logs Insights query support ([#1448](https://github.com/floci-io/floci/pull/1448))
- **cloudcontrol:** list resources from local services ([#1602](https://github.com/floci-io/floci/pull/1602))
- **cloudformation:** apply S3 Bucket `CorsConfiguration` ([#1617](https://github.com/floci-io/floci/pull/1617))
- **core:** claim wire protocols reactively per the Smithy selection guide ([#1712](https://github.com/floci-io/floci/pull/1712))
- **docs:** generate Supported Actions tables from handler source ([#1641](https://github.com/floci-io/floci/pull/1641))

### Changed

- **lambda:** mount function code from a read-only volume instead of copying per cold start ([#1673](https://github.com/floci-io/floci/pull/1673))

### Fixed

- **stepfunctions:** resolve qualified Lambda function ARNs in `lambda:invoke` ([#1660](https://github.com/floci-io/floci/pull/1660))
- **s3:** fix `CopyObject` handling ([#1670](https://github.com/floci-io/floci/pull/1670))
- **sqs:** honor queue-level `DelaySeconds` for standard queues ([#1567](https://github.com/floci-io/floci/pull/1567)); render Query-protocol errors as XML instead of leaking JSON ([#1732](https://github.com/floci-io/floci/pull/1732))
- **ec2:** honor launch template default version updates ([#1704](https://github.com/floci-io/floci/pull/1704))
- **rds:** improve postgres proxy startup parity ([#1599](https://github.com/floci-io/floci/pull/1599)); resolve tags by ARN resource type, not only DB instances ([#1649](https://github.com/floci-io/floci/pull/1649))
- **eks:** let pods pull images pushed to the Floci ECR registry ([#1762](https://github.com/floci-io/floci/pull/1762))
- **cloudwatch:** return `ResourceNotFound` for `SetAlarmState` on a missing alarm ([#1621](https://github.com/floci-io/floci/pull/1621))
- **lambda:** persist version counters and event-invoke configs across restart ([#1730](https://github.com/floci-io/floci/pull/1730))
- **elasticbeanstalk:** persist applications, versions, and environments across restart ([#1729](https://github.com/floci-io/floci/pull/1729))
- **emr:** return AWS client-error codes instead of 500 `InternalServerError` ([#1731](https://github.com/floci-io/floci/pull/1731))
- **autoscaling:** align active instance refresh behavior ([#1598](https://github.com/floci-io/floci/pull/1598))
- **docker:** isolate managed resource containers ([#1703](https://github.com/floci-io/floci/pull/1703))
- **storage:** make `computeIfAbsent` atomic ([#1699](https://github.com/floci-io/floci/pull/1699))

## [1.5.30] - 2026-07-03

### Added

- **stepfunctions:** add the `ecs:runTask` service integration ([#1564](https://github.com/floci-io/floci/pull/1564)); add the state machine version APIs `PublishStateMachineVersion`, `ListStateMachineVersions`, and `DeleteStateMachineVersion` ([#1562](https://github.com/floci-io/floci/pull/1562)); add `ResultSelector`, Pass-state `Parameters`, `ArrayContains`, and wildcard projection, and fix `IsPresent` for absent paths ([#1558](https://github.com/floci-io/floci/pull/1558)); run executions under the execution's account ([#1566](https://github.com/floci-io/floci/pull/1566))
- **amazonmq:** add the Amazon MQ broker control plane backed by RabbitMQ ([#1642](https://github.com/floci-io/floci/pull/1642))
- **cloudformation:** add StackSets with account-aware provisioning ([#1551](https://github.com/floci-io/floci/pull/1551))
- **ec2:** add VPC Flow Logs ([#1611](https://github.com/floci-io/floci/pull/1611)); publish security-group TCP ingress ports on the host ([#1680](https://github.com/floci-io/floci/pull/1680))
- **firehose:** return `ExtendedS3DestinationDescription` and support `UpdateDestination` ([#1710](https://github.com/floci-io/floci/pull/1710))
- **ses:** implement ContactList CRUD for SES v2 ([#1638](https://github.com/floci-io/floci/pull/1638))
- **iam:** enforce AssumeRole trust policies when enforcement is enabled ([#1552](https://github.com/floci-io/floci/pull/1552))
- **cloudtrail:** support empty lookup events ([#1603](https://github.com/floci-io/floci/pull/1603))
- **tls:** serve HTTPS on 443 and trust Floci's certificate in Lambda containers ([#1595](https://github.com/floci-io/floci/pull/1595))

### Changed

- **lambda:** drop the base64 encode/decode round-trip on the S3 code path ([#1666](https://github.com/floci-io/floci/pull/1666))

### Fixed

- **iam:** resolve attached AWS-managed policies from any account ([#1663](https://github.com/floci-io/floci/pull/1663)); enforce STS session policies ([#1636](https://github.com/floci-io/floci/pull/1636))
- **cloudformation:** register the `!Cidr` and `!GetAZs` shorthand YAML tags ([#1635](https://github.com/floci-io/floci/pull/1635)); treat a missing Secrets Manager secret as already-deleted on stack delete ([#1672](https://github.com/floci-io/floci/pull/1672))
- **ec2:** return `groupSet` from `DescribeInstanceAttribute` ([#1709](https://github.com/floci-io/floci/pull/1709)); align AMI guest and launch template parity ([#1597](https://github.com/floci-io/floci/pull/1597))
- **ses:** align `CreateEmailIdentity` DKIM behavior with AWS ([#1620](https://github.com/floci-io/floci/pull/1620)); treat missing `SendingEnabled` as false in v2 `PutConfigurationSetSendingOptions` ([#1594](https://github.com/floci-io/floci/pull/1594))
- **cognito:** register `VerificationCode` for reflection so hybrid storage can persist state ([#1646](https://github.com/floci-io/floci/pull/1646)); omit unset optional blocks from `CreateUserPoolClient` responses ([#1615](https://github.com/floci-io/floci/pull/1615))
- **ecr:** advertise the published host port when adopting the registry container ([#1715](https://github.com/floci-io/floci/pull/1715))
- **kms:** normalize alias `targetKeyId` to the plain key ID on `CreateAlias` ([#1648](https://github.com/floci-io/floci/pull/1648))
- **s3/sns:** preserve root service-host routing ([#1625](https://github.com/floci-io/floci/pull/1625))
- **tagging:** persist resource tag mappings across restart ([#1711](https://github.com/floci-io/floci/pull/1711))
- **dynamodb:** return a null `Message` for non-failed item cancellation reasons ([#1623](https://github.com/floci-io/floci/pull/1623))
- **elasticache:** roll back the proxy port and container on failed provisioning ([#1618](https://github.com/floci-io/floci/pull/1618))
- **autoscaling:** fail SSM commands for stale ASG instances ([#1600](https://github.com/floci-io/floci/pull/1600))
- **cloudwatch-logs:** preserve ingestion order for same-timestamp events ([#1592](https://github.com/floci-io/floci/pull/1592))
- **elbv2:** wrap void Query responses in their `Result` envelope ([#1189](https://github.com/floci-io/floci/pull/1189))
- **core:** register persisted enums for native-image reflection ([#1695](https://github.com/floci-io/floci/pull/1695))
- **docker:** enable TLS and sync the Docker test runner with the compatibility workflow ([#1714](https://github.com/floci-io/floci/pull/1714))

## [1.5.29] - 2026-06-30

### Added

- **stepfunctions:** add `aws-sdk` CloudFormation/EC2 and S3 `PutObject` service integrations ([#1556](https://github.com/floci-io/floci/pull/1556))
- **appsync:** add the Phase 4 VTL engine for resolver mapping templates ([#1288](https://github.com/floci-io/floci/pull/1288))
- **iam:** add the `AmazonRDSEnhancedMonitoringRole` managed policy ([#1559](https://github.com/floci-io/floci/pull/1559)); route assumed-role credentials to the target account ([#1549](https://github.com/floci-io/floci/pull/1549))
- **cognito:** add overrides for client id and client secret ([#1486](https://github.com/floci-io/floci/pull/1486))
- **core:** add state reset and nuke endpoints ([#1482](https://github.com/floci-io/floci/pull/1482))

### Fixed

- **cloudformation:** treat an already-missing ECS task definition, cluster, or service as delete-complete during stack deletion ([#1645](https://github.com/floci-io/floci/pull/1645))
- **ecs:** honor task `portMappings` hostPort when launching containers ([#1610](https://github.com/floci-io/floci/pull/1610)); register persisted model records for native-image reflection ([#1606](https://github.com/floci-io/floci/pull/1606))
- **ses:** make `FromEmailAddress` optional for v2 `SendEmail` ([#1561](https://github.com/floci-io/floci/pull/1561))
- **elbv2:** publish resolvable local ALB DNS names ([#1492](https://github.com/floci-io/floci/pull/1492))
- **transcribe:** persist vocabularies across restart ([#1608](https://github.com/floci-io/floci/pull/1608))
- **ssm:** retain local service diagnostics on command failure ([#1529](https://github.com/floci-io/floci/pull/1529))
- **storage:** flush persisted state before container teardown on shutdown ([#1607](https://github.com/floci-io/floci/pull/1607))

## [1.5.28] - 2026-06-26

### Added

- **iot:** add experimental IoT Core support with an in-process MQTT broker ([#1359](https://github.com/floci-io/floci/pull/1359))
- **elasticbeanstalk:** add initial Elastic Beanstalk Query API support ([#1362](https://github.com/floci-io/floci/pull/1362))
- **memorydb:** model authentication via ACLs and users ([#1478](https://github.com/floci-io/floci/pull/1478))
- **appsync:** add the `$util` runtime library for VTL resolvers ([#1223](https://github.com/floci-io/floci/pull/1223))
- **pipes:** support Kafka pipe sources (MSK and self-managed via `smk://`) and polling ([#1260](https://github.com/floci-io/floci/pull/1260))
- **ecs:** mount `efsVolumeConfiguration` task volumes as shared local volumes ([#1569](https://github.com/floci-io/floci/pull/1569))
- **ses:** implement `PutConfigurationSetDeliveryOptions` for SES v1 ([#1553](https://github.com/floci-io/floci/pull/1553)); publish SNS notifications to identity feedback topics ([#1540](https://github.com/floci-io/floci/pull/1540))
- **ec2:** add an instance-type metadata catalog ([#1534](https://github.com/floci-io/floci/pull/1534)); add a Java-built Ubuntu AMI guest image ([#1542](https://github.com/floci-io/floci/pull/1542))
- **s3:** support bucket logging configuration ([#1510](https://github.com/floci-io/floci/pull/1510))
- **core:** add opt-in Private Network Access for CORS preflights ([#1530](https://github.com/floci-io/floci/pull/1530))

### Fixed

- **cognito:** align `AdminGetUser` lookup with pool sign-in settings ([#1571](https://github.com/floci-io/floci/pull/1571)); align `CUSTOM_AUTH` trigger failures with AWS behavior ([#1484](https://github.com/floci-io/floci/pull/1484)); align sign-up confirmation with AWS behavior ([#1488](https://github.com/floci-io/floci/pull/1488))
- **lambda:** use the persisted `firstReceiveTimestamp` in the SQS ESM ([#1548](https://github.com/floci-io/floci/pull/1548)); propagate SQS FIFO system attributes to the ESM event ([#1527](https://github.com/floci-io/floci/pull/1527)); populate SQS `messageAttributes` in the Lambda event payload ([#1422](https://github.com/floci-io/floci/pull/1422)); resolve handler paths with a leading `./` against the package ([#1575](https://github.com/floci-io/floci/pull/1575))
- **iam:** resolve AWS-managed policies from any account context ([#1573](https://github.com/floci-io/floci/pull/1573)); make entity stores thread-safe under concurrent mutation ([#1509](https://github.com/floci-io/floci/pull/1509))
- **cloudformation:** fail stack delete when a managed resource cannot be deleted ([#1554](https://github.com/floci-io/floci/pull/1554))
- **codedeploy:** persist applications, deployment groups, configs, on-prem instances, and tags ([#1579](https://github.com/floci-io/floci/pull/1579))
- **codebuild:** create the build working directory before running phases ([#1577](https://github.com/floci-io/floci/pull/1577)); stabilize compatibility tests ([#1565](https://github.com/floci-io/floci/pull/1565))
- **rds:** align subnet group placement handling with AWS behavior ([#1295](https://github.com/floci-io/floci/pull/1295)); align create-time parameter group validation with AWS behavior ([#1330](https://github.com/floci-io/floci/pull/1330))
- **ec2:** persist default egress as a `SecurityGroupRule` and fix `DescribeSecurityGroupRules` filter parsing ([#1525](https://github.com/floci-io/floci/pull/1525))
- **msk:** advertise an externally reachable broker address ([#1239](https://github.com/floci-io/floci/pull/1239))
- **eventbridge:** sync tags to the Resource Groups Tagging API ([#1347](https://github.com/floci-io/floci/pull/1347))
- **s3:** serve a custom error document for missing keys on static websites ([#1334](https://github.com/floci-io/floci/pull/1334))
- **cloudfront:** honor the configured domain-suffix for generated distribution domains ([#1533](https://github.com/floci-io/floci/pull/1533))
- **dynamodb:** throw 400 with exact error messages for invalid expressions ([#1545](https://github.com/floci-io/floci/pull/1545))
- **athena:** serialize timestamps as epoch seconds in `GetWorkGroup` and `GetTableMetadata` ([#1524](https://github.com/floci-io/floci/pull/1524))
- **elbv2:** omit the terminal SSL policy marker ([#1522](https://github.com/floci-io/floci/pull/1522))
- **sfn:** make execution data available via the SDK ([#1506](https://github.com/floci-io/floci/pull/1506))
- **secretsmanager:** register the `AWSPENDING` version before invoking the rotation Lambda ([#1519](https://github.com/floci-io/floci/pull/1519))
- **floci-ui:** report real sidecar-start failures instead of always blaming the image ([#1544](https://github.com/floci-io/floci/pull/1544))
- **core:** implement read APIs required by Steampipe resource collection ([#1538](https://github.com/floci-io/floci/pull/1538))

## [1.5.27] - 2026-06-23

### Added

- **memorydb:** add the MemoryDB service with mock mode ([#1420](https://github.com/floci-io/floci/pull/1420))
- **s3vectors:** add the S3 Vectors service ([#1435](https://github.com/floci-io/floci/pull/1435))
- **codepipeline:** add AWS CodePipeline emulation ([#1469](https://github.com/floci-io/floci/pull/1469))
- **ec2:** add Network ACL support ([#1473](https://github.com/floci-io/floci/pull/1473))
- **secretsmanager:** implement the automatic secret rotation lifecycle ([#1467](https://github.com/floci-io/floci/pull/1467))
- **ses:** support v2 dedicated IP pools and configuration-set option groups ([#1412](https://github.com/floci-io/floci/pull/1412)); support v1 configuration-set tracking and reputation-metrics options ([#1479](https://github.com/floci-io/floci/pull/1479))
- **dynamodb:** add `TableId`, `TableClass`, and `OnDemandThroughput` ([#1457](https://github.com/floci-io/floci/pull/1457))
- **cloudformation:** generate an implicit API Gateway from SAM `Api` events ([#1438](https://github.com/floci-io/floci/pull/1438))
- **neptune:** support a neo4j backend for openCypher via `NEPTUNE_DB_TYPE` ([#1449](https://github.com/floci-io/floci/pull/1449))

### Fixed

- **ecs:** persist durable resources via `StorageBackedMap` so they survive a restart ([#1514](https://github.com/floci-io/floci/pull/1514))
- **codebuild:** persist projects, report groups, and source credentials ([#1515](https://github.com/floci-io/floci/pull/1515))
- **config:** persist config rules, conformance packs, recorders, delivery channels, and tags ([#1516](https://github.com/floci-io/floci/pull/1516))
- **dynamodb:** validate `ExclusiveStartKey` against the key schema ([#1443](https://github.com/floci-io/floci/pull/1443)); reject redundant parentheses, duplicate `contains()` operands, and non-string `begins_with` ([#1442](https://github.com/floci-io/floci/pull/1442)); cap scanned items with `Limit` and carry the full cursor on index scans ([#1456](https://github.com/floci-io/floci/pull/1456))
- **cloudformation:** support OAuth and callback configurations in `UserPoolClient` ([#1458](https://github.com/floci-io/floci/pull/1458)); delete EC2 security groups on stack deletion ([#1472](https://github.com/floci-io/floci/pull/1472)); merge SAM `Globals` into resource properties ([#1427](https://github.com/floci-io/floci/pull/1427))
- **ec2:** omit the empty `stateReason` element in `DescribeInstances` ([#1410](https://github.com/floci-io/floci/pull/1410)); log instance user data ([#1474](https://github.com/floci-io/floci/pull/1474))
- **rds:** fix the PostgreSQL proxy ignoring the requested database name ([#1480](https://github.com/floci-io/floci/pull/1480))
- **cognito:** implement token revocation for `AdminUserGlobalSignOut` ([#1407](https://github.com/floci-io/floci/pull/1407))
- **apigatewayv2:** cascade-delete child resources and return 404 for dangling references ([#1300](https://github.com/floci-io/floci/pull/1300))
- **athena:** add partition keys to the table metadata response ([#1454](https://github.com/floci-io/floci/pull/1454))
- **acm:** restore certificates after a restart by ignoring computed getters ([#1440](https://github.com/floci-io/floci/pull/1440))
- **autoscaling:** reject launch templates without image ids ([#1451](https://github.com/floci-io/floci/pull/1451))
- **ssm:** reject send-command timeouts below the AWS minimum ([#1511](https://github.com/floci-io/floci/pull/1511))
- **docdb/neptune:** stop containers and proxies on emulator shutdown ([#1452](https://github.com/floci-io/floci/pull/1452))
- **ui:** register `StatusResponse` for native-image reflection ([#1441](https://github.com/floci-io/floci/pull/1441)); resolve the readiness probe URL from the container endpoint ([#1471](https://github.com/floci-io/floci/pull/1471))

### Changed

- **kms:** use enums for type-safety and add algorithms to key metadata ([#1430](https://github.com/floci-io/floci/pull/1430))

## [1.5.26] - 2026-06-19

### Added

- **cloudformation:** provision EC2 instances ([#1366](https://github.com/floci-io/floci/pull/1366)); RDS resources ([#1367](https://github.com/floci-io/floci/pull/1367)); EKS clusters and node groups ([#1368](https://github.com/floci-io/floci/pull/1368)); CloudWatch Logs log groups ([#1369](https://github.com/floci-io/floci/pull/1369)); CloudWatch metric alarms ([#1371](https://github.com/floci-io/floci/pull/1371)); Auto Scaling groups and launch configurations ([#1372](https://github.com/floci-io/floci/pull/1372)); Kinesis data streams ([#1370](https://github.com/floci-io/floci/pull/1370)); Kinesis Firehose delivery streams ([#1399](https://github.com/floci-io/floci/pull/1399)); add `Fn::GetAZs` and `Fn::Cidr` intrinsics ([#1365](https://github.com/floci-io/floci/pull/1365))
- **docdb:** Amazon DocumentDB service emulation ([#1341](https://github.com/floci-io/floci/pull/1341))
- **autoscaling:** preserve policy and mixed-instances parity ([#1437](https://github.com/floci-io/floci/pull/1437)); support group reconciliation and instance refresh ([#1393](https://github.com/floci-io/floci/pull/1393))
- **ec2:** support Spot Instance request actions ([#1291](https://github.com/floci-io/floci/pull/1291))
- **ssm:** add `DescribePatchBaselines` and `GetDefaultPatchBaseline` ([#1404](https://github.com/floci-io/floci/pull/1404)); execute run commands in EC2 containers ([#1387](https://github.com/floci-io/floci/pull/1387))
- **kms:** add `EnableKey` support ([#1381](https://github.com/floci-io/floci/pull/1381))
- **cognito:** align user pool client config APIs with AWS behavior ([#1360](https://github.com/floci-io/floci/pull/1360))
- **iam:** provisioning preflight support ([#1250](https://github.com/floci-io/floci/pull/1250))
- **ui:** serve a landing page and launch the floci-ui console on demand ([#1313](https://github.com/floci-io/floci/pull/1313))
- **aws:** expand the EC2 and RDS availability catalogs ([#1391](https://github.com/floci-io/floci/pull/1391))

### Fixed

- **cloudformation:** record a `REVIEW_IN_PROGRESS` event on change-set creation ([#1431](https://github.com/floci-io/floci/pull/1431)); create the stage from an `AWS::ApiGateway::Deployment` inline `StageName` ([#1400](https://github.com/floci-io/floci/pull/1400))
- **lambda:** redrive failed SQS event-source-mapping messages to the DLQ ([#1419](https://github.com/floci-io/floci/pull/1419)); return the `{"status":"OK"}` ack body from the runtime invocation endpoints ([#1418](https://github.com/floci-io/floci/pull/1418))
- **ec2:** enable embedded DNS for instances ([#1390](https://github.com/floci-io/floci/pull/1390)); persist EC2 state so CloudFormation references survive a restart ([#1364](https://github.com/floci-io/floci/pull/1364))
- **cognito:** align the password recovery flow with AWS behavior ([#1415](https://github.com/floci-io/floci/pull/1415)); add missing `UserPoolClient` validation ([#1394](https://github.com/floci-io/floci/pull/1394))
- **autoscaling:** validate the `MixedInstancesPolicy` launch template ([#1439](https://github.com/floci-io/floci/pull/1439))
- **sqs:** process messages from a non-default account ([#1406](https://github.com/floci-io/floci/pull/1406))
- **ecs:** reject a negative `desiredCount` in `CreateService` and `UpdateService` ([#1409](https://github.com/floci-io/floci/pull/1409))
- **auth/s3:** resolve account context from the `X-Amz-Credential` query param in presigned URLs ([#1413](https://github.com/floci-io/floci/pull/1413))
- **apigateway:** support SQS query-protocol integrations (path-style URI) ([#1385](https://github.com/floci-io/floci/pull/1385))
- **rds:** report DB parameter group attachments ([#1392](https://github.com/floci-io/floci/pull/1392))
- **rds-data:** add native MySQL JDBC support ([#1352](https://github.com/floci-io/floci/pull/1352))
- **secretsmanager:** honor `ListSecrets` `MaxResults` and `NextToken` pagination ([#1383](https://github.com/floci-io/floci/pull/1383))
- **kms:** wrap RSA DIGEST signatures in a PKCS#1 `DigestInfo` ([#1396](https://github.com/floci-io/floci/pull/1396))
- **elasticache:** register `Endpoint` for reflection so HybridStorage can persist state ([#1403](https://github.com/floci-io/floci/pull/1403))
- **cloudwatch:** parse decimal epoch timestamps in the JSON protocol handler ([#1388](https://github.com/floci-io/floci/pull/1388))
- **ses:** canonicalize only the domain of suppression-list email addresses ([#1350](https://github.com/floci-io/floci/pull/1350))
- **scheduler:** support aws-sdk universal targets and FIFO `MessageGroupId` ([#1344](https://github.com/floci-io/floci/pull/1344))
- **config:** make runtime defaults explicit ([#1389](https://github.com/floci-io/floci/pull/1389))
- **core:** return an XML error for a missing action and add volume action fallbacks ([#1348](https://github.com/floci-io/floci/pull/1348))

### Changed

- **floci:** regroup the UI and DuckDB under `services.floci` ([#1397](https://github.com/floci-io/floci/pull/1397))
- **ci:** run focused native compatibility tests ([#1375](https://github.com/floci-io/floci/pull/1375))

### Documentation

- **cloudformation:** sync supported resource types and annotate stub actions ([#1405](https://github.com/floci-io/floci/pull/1405))
- **docdb:** document the DocumentDB service ([#1386](https://github.com/floci-io/floci/pull/1386))
- correct the service count to 58 and add EMR, WAF v2, and CloudTrail pages ([#1398](https://github.com/floci-io/floci/pull/1398))
- move brand assets into `docs/assets` and fix README image paths ([#1363](https://github.com/floci-io/floci/pull/1363))

## [1.5.25] - 2026-06-15

### Added

- **batch:** AWS Batch service support ([#1332](https://github.com/floci-io/floci/pull/1332))
- **wafv2:** AWS WAF v2 management API (Phase 1) ([#1327](https://github.com/floci-io/floci/pull/1327))
- **emr:** Amazon EMR management API (Phase 1) ([#1321](https://github.com/floci-io/floci/pull/1321))
- **rds-data:** RDS Data API support ([#1262](https://github.com/floci-io/floci/pull/1262))
- **rds:** provisioning support ([#1253](https://github.com/floci-io/floci/pull/1253))
- **cloudformation:** provision Lambda-backed custom resources and layer versions ([#1146](https://github.com/floci-io/floci/pull/1146))
- **glue:** support partition APIs ([#1315](https://github.com/floci-io/floci/pull/1315)); support column statistics ([#1309](https://github.com/floci-io/floci/pull/1309)); support table statistics deletion ([#1324](https://github.com/floci-io/floci/pull/1324))

### Fixed

- **cloudformation:** provision `AWS::EC2::VPC`/`Subnet` (and related networking) resources instead of stubbing, so exported subnet ids resolve in EC2 and ELBv2 ([#1342](https://github.com/floci-io/floci/pull/1342))
- **sqs:** raise the max message size to 1 MiB ([#1339](https://github.com/floci-io/floci/pull/1339)); release in-flight `ReceiveMessage` long polls when their queue is deleted ([#1286](https://github.com/floci-io/floci/pull/1286)); report `ApproximateNumberOfMessagesDelayed` in `GetQueueAttributes` ([#1285](https://github.com/floci-io/floci/pull/1285))
- **ses:** omit unknown identities from `GetIdentityNotificationAttributes` ([#1338](https://github.com/floci-io/floci/pull/1338)); align `MailFromAttributes` presence with MAIL FROM configuration ([#1310](https://github.com/floci-io/floci/pull/1310), [#1273](https://github.com/floci-io/floci/pull/1273)); persist inline options on v2 `CreateConfigurationSet` ([#1307](https://github.com/floci-io/floci/pull/1307))
- **glue:** return partitions in a deterministic order from `GetPartitions` ([#1335](https://github.com/floci-io/floci/pull/1335)); reject deletes of missing tables ([#1323](https://github.com/floci-io/floci/pull/1323))
- **sts:** persist the session secret key so RDS/ElastiCache IAM tokens validate ([#1266](https://github.com/floci-io/floci/pull/1266))
- **s3:** make conditional puts atomic ([#1329](https://github.com/floci-io/floci/pull/1329)); return `BadRequest` for dot-dot object keys ([#1325](https://github.com/floci-io/floci/pull/1325))
- **elbv2:** enforce ALB subnet availability-zone rules ([#1247](https://github.com/floci-io/floci/pull/1247)); improve target resolution and persistence ([#1254](https://github.com/floci-io/floci/pull/1254))
- **ec2:** embed the image catalog in the native image and load it lazily ([#1308](https://github.com/floci-io/floci/pull/1308))
- **ecs:** validate network mode and resources for Fargate task definitions ([#1274](https://github.com/floci-io/floci/pull/1274))
- **cognito:** include `USERNAME` in the SRP `PASSWORD_VERIFIER` challenge ([#1316](https://github.com/floci-io/floci/pull/1316))
- **appconfig:** stop AppConfig from hijacking the S3 bucket named `configuration` ([#1317](https://github.com/floci-io/floci/pull/1317))
- **athena:** align `GetWorkGroup` with AWS behavior ([#1301](https://github.com/floci-io/floci/pull/1301))
- **msk:** populate `currentBrokerSoftwareInfo` in the cluster describe response ([#1238](https://github.com/floci-io/floci/pull/1238))
- **parity:** pre-create LocalStack/Floci init-hook directories ([#1337](https://github.com/floci-io/floci/pull/1337))

### Documentation

- **lambda:** document Podman rootless support and the Runtime API host override ([#1340](https://github.com/floci-io/floci/pull/1340))

## [1.5.24] - 2026-06-11

### Added

- **cloudtrail:** trail lifecycle support ([#1256](https://github.com/floci-io/floci/pull/1256))
- **cloudmap:** AWS Cloud Map (servicediscovery) management API ([#1217](https://github.com/floci-io/floci/pull/1217))
- **ec2:** provisioning primitives — launch templates, VPC endpoints, NAT gateways, instance type offerings ([#1252](https://github.com/floci-io/floci/pull/1252))
- **ec2:** auto-create default security group and main route table on `CreateVpc` ([#1177](https://github.com/floci-io/floci/pull/1177))
- **eks:** support managed node groups ([#1226](https://github.com/floci-io/floci/pull/1226))
- **kms:** key state and description operations (`DisableKey`, `UpdateKeyDescription`) ([#1251](https://github.com/floci-io/floci/pull/1251))
- **cognito:** verification code subsystem ([#1249](https://github.com/floci-io/floci/pull/1249))
- **athena:** support `DeleteWorkGroup` ([#1213](https://github.com/floci-io/floci/pull/1213)); align `CreateWorkGroup` with AWS ([#1174](https://github.com/floci-io/floci/pull/1174))
- **glue:** register database tags with the Resource Groups Tagging API ([#1248](https://github.com/floci-io/floci/pull/1248)); support `UpdateDatabase` ([#1232](https://github.com/floci-io/floci/pull/1232)); archive table versions and return them from `GetTableVersions` ([#1233](https://github.com/floci-io/floci/pull/1233))
- **elbv2:** align `DescribeLoadBalancers` availability zones with AWS behavior ([#1206](https://github.com/floci-io/floci/pull/1206))
- **ses:** publish events to Firehose, EventBridge, and CloudWatch ([#1188](https://github.com/floci-io/floci/pull/1188))
- **cloudformation:** provision `AWS::StepFunctions::StateMachine` ([#1152](https://github.com/floci-io/floci/pull/1152))
- **s3:** stream range responses ([#1255](https://github.com/floci-io/floci/pull/1255))
- **parity:** emit LocalStack-compatible `Ready.` log line on startup ([#1284](https://github.com/floci-io/floci/pull/1284))

### Fixed

- **athena:** align `ListWorkGroups` with AWS behavior ([#1259](https://github.com/floci-io/floci/pull/1259))
- **elasticache:** return reachable Memcached configuration endpoints ([#1258](https://github.com/floci-io/floci/pull/1258))
- **elbv2:** validate subnet VPC consistency for load balancers ([#1244](https://github.com/floci-io/floci/pull/1244))
- **msk:** poll the correct Redpanda admin readiness endpoint ([#1237](https://github.com/floci-io/floci/pull/1237))
- **lambda:** normalize backslash ZIP path separators on extraction ([#1215](https://github.com/floci-io/floci/pull/1215))
- **s3:** reject relative object keys ([#1235](https://github.com/floci-io/floci/pull/1235))
- **glue:** preserve column parameters ([#1210](https://github.com/floci-io/floci/pull/1210)); support `BatchDeleteTable` ([#1209](https://github.com/floci-io/floci/pull/1209)); normalize catalog names ([#1208](https://github.com/floci-io/floci/pull/1208))
- **docker:** fall back to the default command when entrypoint argv is empty ([#1283](https://github.com/floci-io/floci/pull/1283))
- **cloudmap:** avoid `SecureRandom` in the native image heap ([#1271](https://github.com/floci-io/floci/pull/1271), [#1289](https://github.com/floci-io/floci/pull/1289))

### Documentation

- adopt the AGENTS.md standard and update references ([#1225](https://github.com/floci-io/floci/pull/1225), [#1272](https://github.com/floci-io/floci/pull/1272))
- **cloudmap:** add service docs ([#1221](https://github.com/floci-io/floci/pull/1221))

## [1.5.23] - 2026-06-07

### Added

- **iam:** seed the standard EKS cluster and node-group managed policies ([#1216](https://github.com/floci-io/floci/pull/1216))
- **appsync:** Phase 2 — schema registry, model fixes, CRUDL completion, and AWS scalars ([#1185](https://github.com/floci-io/floci/pull/1185))
- **cloudwatch:** accept a log group ARN via `logGroupIdentifier` ([#1172](https://github.com/floci-io/floci/pull/1172))
- **ecs:** honour task-definition volumes and container `mountPoints` ([#1171](https://github.com/floci-io/floci/pull/1171))
- **ses:** per-configuration-set sending toggle (v1 + v2) ([#1193](https://github.com/floci-io/floci/pull/1193))
- **glue:** support `DeleteDatabase` ([#1181](https://github.com/floci-io/floci/pull/1181))
- **glue:** support user-defined functions ([#1187](https://github.com/floci-io/floci/pull/1187))

### Fixed

- **glue:** enforce table version checks ([#1184](https://github.com/floci-io/floci/pull/1184), [#1211](https://github.com/floci-io/floci/pull/1211))
- **glue:** preserve view table fields ([#1182](https://github.com/floci-io/floci/pull/1182))
- **dynamodb:** persist the SSE specification and return `SSEDescription` for encrypted tables ([#1191](https://github.com/floci-io/floci/pull/1191))
- **dynamodb:** accept `AttributesToGet` with `Select=SPECIFIC_ATTRIBUTES` in `Query` ([#1190](https://github.com/floci-io/floci/pull/1190))
- **dynamodb:** update the reserved keywords list ([#1176](https://github.com/floci-io/floci/pull/1176))
- **ecs:** retain inactive services for Terraform draining and recreation with correct idempotency ([#1166](https://github.com/floci-io/floci/pull/1166))
- **ec2:** include `AttachTime` in the describe-instances network interface response ([#1214](https://github.com/floci-io/floci/pull/1214))
- **stepfunctions:** honor `Catch` on Lambda task failures ([#1196](https://github.com/floci-io/floci/pull/1196))
- **cloudformation:** poll for `CREATE_COMPLETE` in the SAM changeset test ([#1199](https://github.com/floci-io/floci/pull/1199))
- **sns:** align mobile push error codes, payload resolution, and Token rotation with AWS ([#1165](https://github.com/floci-io/floci/pull/1165))
- **elbv2:** align `DeleteTargetGroup` with the AWS Query response ([#1194](https://github.com/floci-io/floci/pull/1194))
- **cloudwatch:** tag rpc-v2-cbor timestamp lists so `GetMetricData` decodes ([#1162](https://github.com/floci-io/floci/pull/1162))

### Documentation

- **ses:** list the v1 `ConfigurationSetEventDestination` actions ([#1192](https://github.com/floci-io/floci/pull/1192))

### Build

- bump Quarkus to 3.36.0 and patch build dependencies ([#1197](https://github.com/floci-io/floci/pull/1197))

## [1.5.22] - 2026-06-04

### Added

- **eks:** make real-mode clusters reachable from the host and authenticate `aws eks get-token` via a token webhook ([#1167](https://github.com/floci-io/floci/pull/1167))
- **ecs:** honour RunTask `containerOverrides` — per-container `command` and `environment` ([#1151](https://github.com/floci-io/floci/pull/1151))
- **ecs:** provision ECS resources via CloudFormation ([#1120](https://github.com/floci-io/floci/pull/1120))
- **elbv2:** provision ELBv2 resources via CloudFormation ([#1121](https://github.com/floci-io/floci/pull/1121))
- **cloudformation:** persist stacks across restart ([#1124](https://github.com/floci-io/floci/pull/1124))
- **sns:** mock mobile push for iOS and Android platform endpoints ([#1115](https://github.com/floci-io/floci/pull/1115))
- **kms:** `GenerateRandom` action ([#1036](https://github.com/floci-io/floci/pull/1036))
- **appsync:** AWS AppSync management API (Phase 1) ([#1108](https://github.com/floci-io/floci/pull/1108))
- **ses:** publish SES events to SNS configuration set destinations ([#1106](https://github.com/floci-io/floci/pull/1106))
- **ses:** V1 `ConfigurationSetEventDestination` CRUD ([#1111](https://github.com/floci-io/floci/pull/1111))
- **ses:** apply the suppression list during send, with a per-configuration-set `SuppressionOptions` override ([#1109](https://github.com/floci-io/floci/pull/1109))

### Fixed

- **eventbridge:** propagate the `PutEvents` call region and account through pattern matching and the delivered envelope ([#1125](https://github.com/floci-io/floci/pull/1125))
- **cloudformation:** roll back failed stack creates ([#1123](https://github.com/floci-io/floci/pull/1123))
- **apigatewayv2:** support the CloudFormation update path ([#1122](https://github.com/floci-io/floci/pull/1122))
- **apigateway:** implement `EndpointConfiguration` for REST APIs ([#1116](https://github.com/floci-io/floci/pull/1116))
- **athena:** align metadata behavior with AWS ([#1119](https://github.com/floci-io/floci/pull/1119))
- **lambda:** support path-style ECR URIs for image functions ([#1135](https://github.com/floci-io/floci/pull/1135))
- **elb:** return `TargetGroupNotFound` for missing target groups ([#1161](https://github.com/floci-io/floci/pull/1161))
- **ecs:** preserve create-time resource tags ([#1139](https://github.com/floci-io/floci/pull/1139))
- **ecr:** resolve the backing registry endpoint from the control plane ([#1113](https://github.com/floci-io/floci/pull/1113))
- **docker:** retry transient registry failures during image pull ([#1117](https://github.com/floci-io/floci/pull/1117))
- **dns:** resolve public hostnames from spawned containers ([#1168](https://github.com/floci-io/floci/pull/1168))
- **s3:** handle empty object suffix ranges ([#1142](https://github.com/floci-io/floci/pull/1142))
- **s3:** return an error on unsupported S3 Select expressions ([#1160](https://github.com/floci-io/floci/pull/1160))
- **core:** use the request region consistently across service operations ([#1105](https://github.com/floci-io/floci/pull/1105))

### Security

- **s3:** enforce SSE-C customer keys on object reads, writes, copies, and multipart uploads ([#1143](https://github.com/floci-io/floci/pull/1143))

### Documentation

- **appsync:** add AppSync service documentation ([#1149](https://github.com/floci-io/floci/pull/1149))
- add light/dark logo branding, mkdocs theming, and README badges ([#1150](https://github.com/floci-io/floci/pull/1150))

### Build

- bump `actions/checkout` from 4 to 6.0.2 ([#1159](https://github.com/floci-io/floci/pull/1159))
- bump `aws-actions/configure-aws-credentials` from 4 to 6.1.2 ([#1158](https://github.com/floci-io/floci/pull/1158))
- bump the actions-minor-patch group with 5 updates ([#1157](https://github.com/floci-io/floci/pull/1157))
## [1.5.21] - 2026-05-31

### Added

- **ses:** SES V2 configuration set event destination operations ([#1079](https://github.com/floci-io/floci/pull/1079))
- **firehose:** `TagDeliveryStream`, `UntagDeliveryStream`, and `ListTagsForDeliveryStream` ([#1061](https://github.com/floci-io/floci/pull/1061))
- **cognito:** custom schema attributes and attribute deletion APIs ([#1060](https://github.com/floci-io/floci/pull/1060))
- **cognito:** OAuth2 `/oauth2/userInfo` endpoint ([#1062](https://github.com/floci-io/floci/pull/1062))
- **kms:** handle `RotateKeyOnDemand` rotation limit ([#1042](https://github.com/floci-io/floci/pull/1042))
- **ec2:** required methods for VPC, subnet, and instance operations ([#959](https://github.com/floci-io/floci/pull/959))

### Fixed

- **ec2:** volume throughput, `DescribeAddressesAttribute`, and IAM instance profile parity ([#1103](https://github.com/floci-io/floci/pull/1103))
- **ec2:** add missing subnet attributes and instance block device `attachTime` ([#1087](https://github.com/floci-io/floci/pull/1087))
- **dynamodb:** merge nested map paths in `ProjectionExpression` ([#1099](https://github.com/floci-io/floci/pull/1099))
- **s3:** reject `response-*` overrides on unsigned requests ([#1098](https://github.com/floci-io/floci/pull/1098))
- **eventbridge:** tag rules on custom buses whose name contains "event-bus" ([#1102](https://github.com/floci-io/floci/pull/1102))
- **apigateway:** implement V1 `DeleteDeployment` endpoint and return correct JSON 404 error ([#1059](https://github.com/floci-io/floci/pull/1059))
- **cloudformation:** forward ApiGatewayV2 `Api` properties to the apigatewayv2 service ([#1086](https://github.com/floci-io/floci/pull/1086))
- **rds:** restore persisted runtime on startup ([#1071](https://github.com/floci-io/floci/pull/1071))
- **logging:** render port numbers without locale grouping separators ([#1104](https://github.com/floci-io/floci/pull/1104))

### Build

- move all builds to GraalVM 25 ([#1107](https://github.com/floci-io/floci/pull/1107))
- enforce JDK 25 requirement with Maven Enforcer Plugin ([#1101](https://github.com/floci-io/floci/pull/1101))

## [1.5.20] - 2026-05-29

### Added

- **cors:** global CORS filter for browser-based local development — allows `OPTIONS` preflight and injects CORS headers on all responses ([#849](https://github.com/floci-io/floci/pull/849))
- **kms:** `CreateGrant`, `RetireGrant`, `RevokeGrant`, `ListGrants`, `ListRetirableGrants`, and `DescribeKey` grant enumeration ([#1073](https://github.com/floci-io/floci/pull/1073))
- **opensearch:** round-trip VPC config, security options, encryption-at-rest, node-to-node encryption, and per-family instance type metadata ([#1039](https://github.com/floci-io/floci/pull/1039))
- **opensearch:** support OpenSearch 3.x, validate engine versions, use real ES 7.10 OSS image ([#1025](https://github.com/floci-io/floci/pull/1025))
- **cloudformation:** SAM Transform support — `AWS::Serverless-2016-10-31` templates are now transformed before stack deployment ([#1012](https://github.com/floci-io/floci/pull/1012))

### Fixed

- **ecs:** reconcile task lifecycle when container exits naturally — tasks reach `STOPPED` state correctly without manual intervention ([#1078](https://github.com/floci-io/floci/pull/1078))
- **s3:** clean up versioned file data on permanent version deletion to prevent stale data accumulation ([#1045](https://github.com/floci-io/floci/pull/1045))
- **apigateway:** resolve APIs created outside the default region so cross-region requests are routed correctly ([#1032](https://github.com/floci-io/floci/pull/1032))
- **eventbridge:** enforce `$or` negation in event pattern matching — negative `$or` conditions now correctly exclude matching events ([#1068](https://github.com/floci-io/floci/pull/1068))
- **apigw-v2:** populate `pathParameters` in Lambda proxy event for HTTP API integrations ([#1067](https://github.com/floci-io/floci/pull/1067))
- **ec2:** skip terminated instances in `DescribeNetworkInterfaces` ([#1074](https://github.com/floci-io/floci/pull/1074))
- **ec2:** return `volumeId` in `BlockDeviceMapping` and `disableApiStop`/`disableApiTermination` in `DescribeInstanceAttribute` ([#1028](https://github.com/floci-io/floci/pull/1028))
- **ec2:** fix `DescribeNetworkInterfaces` response shape — missing fields and incorrect filtering ([#1035](https://github.com/floci-io/floci/pull/1035))
- **ecr:** shut down registry manager on observable shutdown event to prevent port leaks ([#1063](https://github.com/floci-io/floci/pull/1063))
- **s3:** omit whole-object checksum headers on range (`GET` with `Range:`) responses ([#1040](https://github.com/floci-io/floci/pull/1040))
- **s3:** apply `TaggingDirective=COPY` default in `CopyObject` — tags are now copied when directive is omitted ([#1049](https://github.com/floci-io/floci/pull/1049))
- **elbv2:** offload Lambda invocation to a worker thread to avoid blocking the event loop ([#1034](https://github.com/floci-io/floci/pull/1034))
- **cloudformation:** implement nested stack deployment via `AWS::CloudFormation::Stack` ([#1052](https://github.com/floci-io/floci/pull/1052))
- **cloudformation:** retain deleted stacks briefly for destroy-polling so SDKs can observe `DELETE_COMPLETE` status ([#1029](https://github.com/floci-io/floci/pull/1029))
- **lambda:** fix WarmPool timeout when stopping multiple containers — containers now shut down in parallel ([#1055](https://github.com/floci-io/floci/pull/1055))

### Documentation

- **neptune:** add Neptune service page and fix missing index entries ([#1056](https://github.com/floci-io/floci/pull/1056))

## [1.5.19] - 2026-05-24

### Added

- **lambda:** Lambda layer support — `PublishLayerVersion`, `GetLayerVersion`, `ListLayerVersions`, `DeleteLayerVersion` ([#1015](https://github.com/floci-io/floci/pull/1015))
- **elbv2:** `DescribeListenerAttributes`, `ModifyListenerAttributes`, `DescribeCapacityReservation`, and `ModifyCapacityReservation` actions ([#1021](https://github.com/floci-io/floci/pull/1021))
- **kms:** `RotateKeyOnDemand` support for on-demand key rotation ([#990](https://github.com/floci-io/floci/pull/990))
- **apigateway:** Lambda REQUEST authorizer support for HTTP API v2 routes ([#1011](https://github.com/floci-io/floci/pull/1011))
- **apigateway:** persist `UpdateStage` `methodSettings` patch operations on v1 stages ([#1004](https://github.com/floci-io/floci/pull/1004))
- **cognito:** `UpdateGroup`, `ListUsersInGroup`, and `AdminConfirmSignUp` actions ([#998](https://github.com/floci-io/floci/pull/998))
- **ci:** Docker images now published to ECR Public Gallery ([#1000](https://github.com/floci-io/floci/pull/1000))

### Fixed

- **s3:** remove private `hasQueryParam` in `S3Controller` that shadowed the static import from `S3RequestParser` — presigned `PUT` requests with `x-amz-tagging` in `X-Amz-SignedHeaders` were misrouted to `PutObjectTagging` and returned 404 ([#1023](https://github.com/floci-io/floci/pull/1023))
- **iam:** honour 12-digit access key as account ID in IAM ARNs — `CreateRole`, `CreateUser`, `CreateGroup`, `CreatePolicy`, and `CreateInstanceProfile` always returned `000000000000` regardless of caller identity ([#1017](https://github.com/floci-io/floci/pull/1017))
- **s3:** persist inline `x-amz-tagging` header on `PutObject` ([#987](https://github.com/floci-io/floci/pull/987))
- **apigateway:** implement `DeleteDeployment` endpoint and return correct JSON 404 error for missing resources ([#1019](https://github.com/floci-io/floci/pull/1019))
- **rds:** register `DbEndpoint` for native-image reflection ([#1014](https://github.com/floci-io/floci/pull/1014))
- **apigateway:** populate full `APIGatewayRequestAuthorizerEvent` fields for REQUEST authorizers ([#1002](https://github.com/floci-io/floci/pull/1002))
- **sns:** return per-entry failures from `PublishBatch` instead of aborting the whole batch on a single entry failure ([#1008](https://github.com/floci-io/floci/pull/1008))
- **cognito:** CloudFormation provisioning for `UserPool` and `UserPoolClient` resource types ([#1007](https://github.com/floci-io/floci/pull/1007))
- **lifecycle:** fix incorrect readiness status display when TLS is enabled and AppConfig is initialising ([#1006](https://github.com/floci-io/floci/pull/1006))
- **s3:** unblock `.well-known/*` object keys that were hijacked by Cognito OIDC routes ([#1003](https://github.com/floci-io/floci/pull/1003))
- **sns:** preserve binary message attributes through `Publish` and fan-out delivery ([#989](https://github.com/floci-io/floci/pull/989))
- **cognito:** include user attributes in ID token claims ([#985](https://github.com/floci-io/floci/pull/985))
- **ecr:** release registry port when container start fails to prevent port exhaustion ([#1010](https://github.com/floci-io/floci/pull/1010))
- **s3:** restore object data on delete marker removal and return missing version headers ([#966](https://github.com/floci-io/floci/pull/966))
- **sts:** honour 12-digit access key as account ID in STS responses ([#983](https://github.com/floci-io/floci/pull/983))
- **sqs:** accept bare queue name in `QueueUrl` field ([#980](https://github.com/floci-io/floci/pull/980))
- **s3:** accept region-qualified virtual-host form `bucket.s3.<region>.<host>` ([#978](https://github.com/floci-io/floci/pull/978))
- **sqs/sns:** add `ContentBasedDeduplication` support and SNS subscription CloudFormation provisioning ([#974](https://github.com/floci-io/floci/pull/974))
- **s3:** handle `PutBucketRequestPayment` instead of falling through to `CreateBucket` ([#994](https://github.com/floci-io/floci/pull/994))

### Documentation

- **pipes:** add documentation and navigation for EventBridge Pipes ([#1001](https://github.com/floci-io/floci/pull/1001))
- **tagging:** add Resource Groups Tagging service documentation ([#976](https://github.com/floci-io/floci/pull/976))
- **transcribe:** add Transcribe service documentation ([#975](https://github.com/floci-io/floci/pull/975))

## [1.5.18] - 2026-05-21

### Added

- **cloudfront:** CloudFront service emulation — `CreateDistribution`, `GetDistribution`, `UpdateDistribution`, `DeleteDistribution`, `ListDistributions`; distribution state, origins, cache behaviors, and viewer certificate management ([#969](https://github.com/floci-io/floci/pull/969))
- **config:** AWS Config service emulation — configuration recorders, delivery channels, config rules, `StartConfigurationRecorder`, `StopConfigurationRecorder`, `DescribeConfigurationRecorders`, `PutDeliveryChannel`, `DescribeDeliveryChannels`, `PutConfigRule`, `DescribeConfigRules`, `DeleteConfigRule` ([#934](https://github.com/floci-io/floci/pull/934))
- **neptune:** SDK compatibility tests added to the Neptune control plane and Gremlin Docker backend ([#958](https://github.com/floci-io/floci/pull/958))
- **apigatewayv2:** HTTP API requests are now forwarded through ALB listeners — HTTP_PROXY integrations targeting ALB are resolved at dispatch time, enabling ECS/ELBv2 stacks backed by API Gateway HTTP APIs ([#941](https://github.com/floci-io/floci/pull/941))
- **sqs:** persist and return `AWSTraceHeader` system attribute on `SendMessage` and `ReceiveMessage` for X-Ray tracing compatibility ([#909](https://github.com/floci-io/floci/pull/909))
- **sqs:** implement `StartMessageMoveTask`, `ListMessageMoveTasks`, and `CancelMessageMoveTask` with async drain and configurable `MaxNumberOfMessagesPerSecond` rate limiting ([#910](https://github.com/floci-io/floci/pull/910))
- **kms:** implement `GenerateMac` and `VerifyMac` for HMAC keys (`HMAC_256`, `HMAC_384`, `HMAC_512`) ([#927](https://github.com/floci-io/floci/pull/927))
- **apigateway:** handle inbound requests to custom domain names — custom domain name mappings are matched before stage routing, enabling SDK and Terraform workflows that create `AWS::ApiGateway::DomainName` resources ([#922](https://github.com/floci-io/floci/pull/922))
- **ecs:** register ECS service containers as ELBv2 targets — ECS tasks are automatically registered and deregistered in target groups when services scale or update ([#929](https://github.com/floci-io/floci/pull/929))
- **elasticache:** Memcached cluster management — `CreateCacheCluster` and `DescribeCacheClusters` for `memcached` engine; Memcached data-plane proxy backed by a real Memcached Docker container ([#930](https://github.com/floci-io/floci/pull/930))
- **sns:** HTTP/HTTPS endpoint delivery — subscriptions with `http` or `https` protocol now deliver notifications via real HTTP POST with the standard SNS envelope; includes subscription confirmation handshake ([#865](https://github.com/floci-io/floci/pull/865))
- **secretsmanager:** add `RestoreSecret` operation — restores a soft-deleted secret, clears the `DeletedDate`, and returns the updated metadata ([#915](https://github.com/floci-io/floci/pull/915))

### Fixed

- **s3:** return `ObjectLockConfigurationNotFoundError` when `GetObjectLockConfiguration` is called on a bucket that was not created with Object Lock enabled ([#971](https://github.com/floci-io/floci/pull/971))
- **core:** lowercase `smithy-protocol` response header to `smithy-protocol` — some AWS SDK versions rejected the mixed-case variant, breaking CBOR responses ([#968](https://github.com/floci-io/floci/pull/968))
- **s3:** omit `Content-Type` body-description headers and user-defined metadata (`x-amz-meta-*`) from `PutObject` responses — these fields are request-only and their presence in the response caused SDK assertion failures ([#948](https://github.com/floci-io/floci/pull/948))
- **rds:** persist instance and cluster metadata across storage-backed restarts — `DescribeDBInstances` and `DescribeDBClusters` returned empty results after restart ([#945](https://github.com/floci-io/floci/pull/945))
- **s3:** fix `ListObjects` v1 `marker`-based pagination — the next-page marker was not advanced correctly, causing infinite loops or skipped objects on subsequent pages ([#939](https://github.com/floci-io/floci/pull/939))
- **sqs:** reject `SendMessageBatch` when the combined payload exceeds `MaximumMessageSize` — previously only individual message size was checked ([#907](https://github.com/floci-io/floci/pull/907))
- **apigatewayv2:** include `corsConfiguration` in HTTP API `Get`/`Create`/`Update` responses ([#933](https://github.com/floci-io/floci/pull/933))
- **core:** fix crash when the request `Content-Type` header is an empty string — previously threw a `NullPointerException` during media-type parsing ([#940](https://github.com/floci-io/floci/pull/940))
- **lambda:** log an actionable hint when the concurrency pool is exhausted instead of returning a bare 429 ([#935](https://github.com/floci-io/floci/pull/935))
- **dynamodb:** correct `DeleteTable` status transitions — table enters `DELETING` before removal; fix PartiQL `SELECT` scan to respect `FilterExpression` ([#915](https://github.com/floci-io/floci/pull/915))
- **lambda:** make `PortAllocator` a checkout/release pool — prevents port collisions under concurrent invocations and restores released ports to the free set ([#936](https://github.com/floci-io/floci/pull/936))
- **apigatewayv2:** raise Vert.x WebSocket frame size limit to 256 KB to match AWS WebSocket API frame limits ([#938](https://github.com/floci-io/floci/pull/938))
- **apigatewayv2:** include `connectionType` and `enableSimpleResponses` fields in `Integration` and `Authorizer` responses ([#931](https://github.com/floci-io/floci/pull/931))
- **sns:** preserve per-entry `MessageAttributes` in `PublishBatch` — attributes from sibling entries were leaking across batch items ([#891](https://github.com/floci-io/floci/pull/891))
- **lambda:** await `HttpServer` close in `RuntimeApiServer.stop()` to prevent in-flight `/next` polls from being dropped during graceful shutdown ([#926](https://github.com/floci-io/floci/pull/926))
- **apigateway:** accept any `Content-Type` on `PutRestApi` and `ImportRestApi` — previously rejected non-`application/json` bodies, breaking Swagger YAML imports ([#925](https://github.com/floci-io/floci/pull/925))
- **s3:** honor `response-content-type`, `response-content-disposition`, `response-cache-control`, and other `response-*` query parameters on `GetObject` and `HeadObject` ([#923](https://github.com/floci-io/floci/pull/923))
- **cognito:** correct `USER_SRP_AUTH` `PASSWORD_VERIFIER` challenge signature computation — HMAC-SHA256 was using the wrong derived key, causing authentication failures with real SRP clients ([#912](https://github.com/floci-io/floci/pull/912))
- **ec2:** add missing instance response fields (`privateDnsNameOptions`, `maintenanceOptions`, `currentInstanceBootMode`) to fix Terraform nil pointer dereference on `aws_instance` resources ([#883](https://github.com/floci-io/floci/pull/883))
- **sns:** emit canonical AWS error codes (`InvalidParameterValue`) for `Publish` and `PublishBatch` message size violations ([#906](https://github.com/floci-io/floci/pull/906))
- **sqs:** skip JSON `null` tag and attribute values instead of persisting the literal string `"null"` ([#905](https://github.com/floci-io/floci/pull/905))
- **sqs:** scope FIFO deduplication ID lookup per `MessageGroupId` when `DeduplicationScope=messageGroup` is set on the queue ([#908](https://github.com/floci-io/floci/pull/908))

### Documentation

- Update README with service coverage and configuration examples ([#885](https://github.com/floci-io/floci/pull/885))

## [1.5.17] - 2026-05-18

### Added

- **neptune:** Neptune control plane — `CreateDBCluster`, `DescribeDBClusters`, `ModifyDBCluster`, `DeleteDBCluster`, `CreateDBInstance`, `DescribeDBInstances`, `ModifyDBInstance`, `DeleteDBInstance`; each cluster is backed by a real TinkerPop Gremlin Server Docker container behind a transparent TCP proxy ([#881](https://github.com/floci-io/floci/pull/881))
- **apigateway:** `GetAccount` and `UpdateAccount` — account-level configuration including throttle settings and CloudWatch log role ARN; enables Terraform and CDK stacks that call `aws_api_gateway_account` ([#867](https://github.com/floci-io/floci/pull/867))
- **apigatewayv2:** `HTTP_PROXY` integration type — forwards inbound requests to the configured `IntegrationUri` with `RequestParameters` transformations matching AWS-faithful semantics ([#860](https://github.com/floci-io/floci/pull/860))
- **dynamodb:** `ExecuteStatement`, `ExecuteTransaction`, `BatchExecuteStatement` — hand-rolled PartiQL tokenizer and recursive-descent parser supporting SELECT/INSERT/UPDATE/DELETE, `?` positional placeholders, `begins_with`, and `BETWEEN`; translates to existing service calls with no new storage ([#864](https://github.com/floci-io/floci/pull/864))
- **sns:** `FilterPolicyScope=MessageBody` — filter policies scoped to the message body are now evaluated at publish time; previously the scope was persisted but ignored, delivering all messages regardless of the policy ([#863](https://github.com/floci-io/floci/pull/863))
- **cognito:** `PostConfirmation` and `PreSignUp` Lambda triggers — `PostConfirmation_ConfirmSignUp` fires after `ConfirmSignUp`; `PreSignUp_SignUp` fires before user persistence on `SignUp`; `autoConfirmUser=true` in the PreSignUp response auto-confirms and chains into PostConfirmation ([#859](https://github.com/floci-io/floci/pull/859))
- **ses:** `PutAccountSuppressionAttributes` (`PUT /v2/email/account/suppression`) — set account-level suppression list reasons (`BOUNCE`/`COMPLAINT`); `GetAccount` response now includes a `SuppressionAttributes` object reflecting the stored setting ([#853](https://github.com/floci-io/floci/pull/853))
- **cur / bcm-data-exports:** Cost and Usage Reports (`AWSOrigamiServiceGatewayService.*`) and BCM Data Exports (`AWSBillingAndCostManagementDataExports.*`) management planes sharing one underlying export pipeline ([#850](https://github.com/floci-io/floci/pull/850))

### Fixed

- **dynamodb:** honor legacy `Expected` condition in `UpdateItem` — `handleUpdateItem` now reads the `Expected` field, and `evaluateLegacyExpected` normalizes the legacy `{"Value": x}` shape to `{"AttributeValueList": [x]}` before evaluation; conditional writes that should fail were silently succeeding ([#888](https://github.com/floci-io/floci/pull/888))
- **apigatewayv2:** `Route` responses now include `authorizerId` — the field was persisted and used at dispatch time but never emitted by `toV2RouteNode`, breaking SDK and Terraform reads ([#887](https://github.com/floci-io/floci/pull/887))
- **eventbridge:** persisted rules no longer disappear on reload — `Rule.getRegion()` is a derived getter with no setter; `ObjectMapper` wrote `"region"` into `eventbridge-rules.json` and then threw `UnrecognizedPropertyException` on startup, causing all persisted rules to be silently dropped ([#878](https://github.com/floci-io/floci/pull/878))
- **s3:** `PutObject` now returns the checksum for the algorithm actually specified by the caller; previously always returned `ChecksumSHA1` + `ChecksumSHA256` regardless of `--checksum-algorithm` ([#877](https://github.com/floci-io/floci/pull/877))
- **eks:** cluster readiness polling now uses the container's bridge IP instead of the container hostname, fixing clusters stuck in `CREATING` when Floci runs inside Docker; startup failures are handled gracefully instead of returning 500 ([#873](https://github.com/floci-io/floci/pull/873))
- **eventbridge:** region is now correctly propagated through rule dispatch so SQS queue lookup uses the rule's region rather than the primary region ([#870](https://github.com/floci-io/floci/pull/870))
- **eventbridge:** `EventBusName` is now accepted as a full ARN (`arn:aws:events:…:event-bus/my-bus`) in addition to a plain name across all EventBridge operations ([#843](https://github.com/floci-io/floci/pull/843))

## [1.5.16] - 2026-05-15

### Added

- **stepfunctions:** `ValidateStateMachineDefinition` — validates ASL definitions and returns structured diagnostics with `/States/<state>/<field>` paths for precise error location ([#845](https://github.com/floci-io/floci/pull/845))
- **stepfunctions:** `ListTagsForResource`, `TagResource`, `UntagResource` for state machines and activities; covers both the AWS SDK (JSON 1.0) and Terraform (REST) wire paths ([#767](https://github.com/floci-io/floci/pull/767))
- **rds:** cluster parameter group actions — `CreateDBClusterParameterGroup`, `DescribeDBClusterParameterGroups`, `DeleteDBClusterParameterGroup`, `ModifyDBClusterParameterGroup`, `DescribeDBClusterParameters`; mirrors the existing instance-level parameter group shape and unblocks IaC stacks that define Aurora `ClusterParameterGroup` resources ([#838](https://github.com/floci-io/floci/pull/838))
- **s3:** full `SelectObjectContent` evaluator with floci-duck integration — recursive WHERE (AND, OR, NOT, LIKE, BETWEEN, IN, IS NULL, comparisons), JSON Lines and JSON array input formats, cross-format output (CSV→JSON, JSON→CSV), real `BytesScanned`/`BytesReturned` stats; routes CSV and JSON through floci-duck when available with a pure-Java fallback for standalone mode ([#835](https://github.com/floci-io/floci/pull/835))
- **eventbridge:** `UpdateEventBus` — update event bus description, KMS key, dead-letter config, or log config ([#834](https://github.com/floci-io/floci/pull/834))
- **ce:** AWS Cost Explorer service — `GetCostAndUsage`, `GetCostAndUsageWithResources`, `GetDimensionValues`, `GetTags`, `GetReservationCoverage`, `GetReservationUtilization`, `GetSavingsPlansCoverage`, `GetSavingsPlansUtilization`, `GetCostCategories`; cost is synthesized from existing resource state multiplied by the bundled pricing snapshot; supports `DAILY`/`MONTHLY`/`HOURLY` granularity, all standard metrics, and `GroupBy` on `DIMENSION`, `TAG`, and `COST_CATEGORY` ([#832](https://github.com/floci-io/floci/pull/832))
- **transcribe:** AWS Transcribe service — `StartTranscriptionJob`, `GetTranscriptionJob`, `ListTranscriptionJobs`, `DeleteTranscriptionJob`, `CreateVocabulary`, `GetVocabulary`, `ListVocabularies`, `UpdateVocabulary`, `DeleteVocabulary` ([#827](https://github.com/floci-io/floci/pull/827))

### Fixed

- **core:** remove AWS SDK from Floci's runtime classpath to eliminate version conflicts with user-bundled SDKs ([#846](https://github.com/floci-io/floci/pull/846))
- **core:** improve log level structure and reduce noise in hot paths ([#847](https://github.com/floci-io/floci/pull/847))
- **s3:** make `us-east-1` bucket creation idempotent — repeated `CreateBucket` calls for the same bucket in `us-east-1` no longer raise `BucketAlreadyOwnedByYou` ([#844](https://github.com/floci-io/floci/pull/844))
- **ec2:** support wildcard (`*`, `?`) filter values across all EC2 resources (VPCs, Subnets, Security Groups, Instances, Internet Gateways, Route Tables, Volumes), matching real AWS filter behavior ([#837](https://github.com/floci-io/floci/pull/837))
- **pricing:** bundle pricing snapshot resources into the native image — the Price List service was unavailable in GraalVM native builds ([#836](https://github.com/floci-io/floci/pull/836))
- **kms:** `Encrypt` now derives a fresh AES-GCM nonce per call (was deterministic, leaking plaintext equality); `Decrypt` now validates `EncryptionContext` as AAD and raises `InvalidCiphertextException` on any mismatch ([#825](https://github.com/floci-io/floci/pull/825))
- **s3:** strip `charset` parameter from `Content-Type` in XML responses ([#809](https://github.com/floci-io/floci/pull/809))
- **sqs:** FIFO `ReceiveMessage` now returns messages from multiple distinct message groups in a single call ([#785](https://github.com/floci-io/floci/pull/785))
- **sqs:** honor `AttributeNames` and `MessageSystemAttributeNames` on `ReceiveMessage` ([#784](https://github.com/floci-io/floci/pull/784))
- **sqs:** implement `AddPermission` and `RemovePermission` ([#781](https://github.com/floci-io/floci/pull/781))
- **stepfunctions:** honor `TimeoutSeconds` on `Parallel` state ([#771](https://github.com/floci-io/floci/pull/771))

### Documentation

- Improve README readability ([#831](https://github.com/floci-io/floci/pull/831))

## [1.5.15] - 2026-05-13

### Added

- **pricing:** AWS Price List Service — `DescribeServices`, `GetAttributeValues`, `GetProducts`, `ListPriceLists`, `GetPriceListFileUrl` with pagination; backed by a bundled static snapshot; `PriceList` shape matches the real SDK's array-of-JSON-strings format ([#821](https://github.com/floci-io/floci/pull/821))
- **eventbridge:** `TestEventPattern` — validates a sample event against a pattern without firing any targets; returns `{"Result": <bool>}`; raises `InvalidEventPatternException` on malformed patterns ([#824](https://github.com/floci-io/floci/pull/824))
- **ses:** v2 suppression list endpoints — `PutSuppressedDestination`, `GetSuppressedDestination`, `DeleteSuppressedDestination`, `ListSuppressedDestinations` ([#813](https://github.com/floci-io/floci/pull/813))
- **s3:** virtual-hosted style addressing — `*.s3.localhost.floci.io`, `*.localhost.localstack.cloud`, and `*.s3.localhost.localstack.cloud` are now resolved as virtual-hosted buckets; `EmbeddedDnsServer` ships `localhost.localstack.cloud` and `localhost.floci.io` as built-in suffixes so spawned containers resolve correctly without extra config ([#805](https://github.com/floci-io/floci/pull/805))
- **cloudwatch-logs:** `PutSubscriptionFilter`, `DescribeSubscriptionFilters`, `DeleteSubscriptionFilter` — upsert semantics and `ByLogStream` default distribution ([#810](https://github.com/floci-io/floci/pull/810))

### Fixed

- **dynamodb:** broad conformance pass — `ValidationException` (was `InvalidParameterValue`) for table-name errors; min-length 3 enforced for all operations; `ListTables` alphabetical ordering, `Limit` validation, pagination; enum validation for `ReturnValues`/`ReturnConsumedCapacity` fires before table lookup; `ProjectionExpression` on `GetItem`, `Query`, `Scan`, `BatchGetItem`; `Select=COUNT` omits `Items`; parallel scan `Segment`/`TotalSegments` validation with hash-based sharding; reserved words rejected in `FilterExpression`/`ConditionExpression`/`UpdateExpression`; legacy `AttributesToGet`, `AttributeUpdates`, `QueryFilter`, `ScanFilter`, `KeyConditions` API; item size limit (400 KB) and number normalization on write; `TagResource`/`UntagResource`/`ListTagsOfResource` with ARN validation; `SET` into a non-existent nested map auto-creates the map ([#826](https://github.com/floci-io/floci/pull/826))
- **dynamodb:** `SET a = :v, b = a` now reads pre-update value of `a` for `b` (atomic snapshot semantics); `ClientRequestToken` idempotency with 10-minute TTL and SHA-256 body-hash conflict detection; parenthesized arithmetic `SET c = (c - :v)` now applies correctly ([#804](https://github.com/floci-io/floci/pull/804))
- **apigateway:** sibling `{proxy+}` resources now resolved by longest parent prefix, matching real AWS routing behaviour ([#811](https://github.com/floci-io/floci/pull/811))
- **cloudformation:** provision `AWS::ApiGateway::Authorizer` and wire `AuthorizerId` on methods — previously the resource was silently stubbed, leaving stacks reporting `CREATE_COMPLETE` with no authorizer registered ([#796](https://github.com/floci-io/floci/pull/796))
- **cloudformation:** preserve `Targets[].SqsParameters` (including `MessageGroupId`) when provisioning `AWS::Events::Rule` — FIFO SQS targets delivered without a `MessageGroupId` were rejected by AWS ([#793](https://github.com/floci-io/floci/pull/793))
- **sqs:** return MD5 of current request body on FIFO deduplication replay ([#786](https://github.com/floci-io/floci/pull/786))
- **sqs:** honor `MaximumMessageSize` attribute on `SendMessage` ([#782](https://github.com/floci-io/floci/pull/782))
- **sqs:** omit `Messages` field from empty `ReceiveMessage` JSON response ([#780](https://github.com/floci-io/floci/pull/780))
- **sns:** enforce message size limits on `Publish` and `PublishBatch` ([#783](https://github.com/floci-io/floci/pull/783))
- **ses:** allow `SendRawEmail` without `Source` when a `From:` header is present in the MIME payload ([#800](https://github.com/floci-io/floci/pull/800))
- **lambda:** automatically detect the Docker network of the running Floci container and use it for spawned Lambda containers — removes the need to manually set `FLOCI_SERVICES_LAMBDA_DOCKER_NETWORK` in Docker Compose setups ([#765](https://github.com/floci-io/floci/pull/765))
- **core:** fix CRLF line-ending issues on Windows by adding `.gitattributes` normalisation rules ([#790](https://github.com/floci-io/floci/pull/790))

## [1.5.14] - 2026-05-10

### Added

- **textract:** Textract service support — `DetectDocumentText`, `AnalyzeDocument`, `StartDocumentTextDetection`, `GetDocumentTextDetection`, `StartDocumentAnalysis`, `GetDocumentAnalysis` ([#719](https://github.com/floci-io/floci/pull/719))
- **multitenancy:** per-account storage isolation across all services — if the AWS access key ID is exactly 12 digits, it is used directly as the account ID and all resources are fully isolated from other accounts ([#753](https://github.com/floci-io/floci/pull/753))
- **tls:** optional TLS/HTTPS support — set `FLOCI_TLS_ENABLED=true` to serve all endpoints over HTTPS; auto-generates and persists a self-signed certificate that includes `FLOCI_HOSTNAME`/`FLOCI_BASE_URL` in its SANs; user-provided certificates supported via `FLOCI_TLS_CERT_PATH` and `FLOCI_TLS_KEY_PATH` ([#754](https://github.com/floci-io/floci/pull/754))
- **apigatewayv2:** WebSocket data-plane support — `wss://` connections, `PostToConnection`, `GetConnection`, `DeleteConnection`, `@connect`/`@disconnect`/`$default` routes ([#712](https://github.com/floci-io/floci/pull/712))
- **cognito:** `UpdateGroup`, `ListUsersInGroup` ([#761](https://github.com/floci-io/floci/pull/761))
- **cognito:** `AdminCreateUser` with `MessageAction=RESEND` ([#755](https://github.com/floci-io/floci/pull/755))
- **ses:** `UpdateAccountSendingEnabled` (v1 Query protocol) ([#737](https://github.com/floci-io/floci/pull/737))
- **ses:** `TagResource`, `UntagResource`, `ListTagsForResource` on v2 REST JSON protocol ([#749](https://github.com/floci-io/floci/pull/749))
- **ses:** v2 tag endpoints extended to `EmailTemplate` ARNs ([#759](https://github.com/floci-io/floci/pull/759))
- **ses:** v2 tag endpoints extended to `EmailIdentity` ARNs ([#760](https://github.com/floci-io/floci/pull/760))
- **docker:** named-volume storage for child containers (RDS, ElastiCache, OpenSearch, MSK) so data survives container restarts without requiring a host bind-mount ([#743](https://github.com/floci-io/floci/pull/743))
- **docker:** ship `awslocal` CLI wrapper in the `-compat` image ([#746](https://github.com/floci-io/floci/pull/746))

### Fixed

- **cfn:** reconcile Lambda functions on stack update ([#736](https://github.com/floci-io/floci/pull/736))
- **docker:** `/etc/floci/aws/config` missing in published Docker images ([#740](https://github.com/floci-io/floci/pull/740))
- **eventbridge:** persist and forward `SqsParameters.MessageGroupId` for FIFO SQS targets ([#742](https://github.com/floci-io/floci/pull/742))
- **sqs:** tags set at `CreateQueue` not returned by `ListQueueTags` ([#747](https://github.com/floci-io/floci/pull/747))
- **apigateway:** treat `ANY` method as wildcard when matching concrete HTTP methods ([#750](https://github.com/floci-io/floci/pull/750))
- **s3:** parse `versionId` from copy-source header for `CopyObject` and multipart part-copy ([#751](https://github.com/floci-io/floci/pull/751))
- **sqs:** drop uppercase `"Tags"` key from `CreateQueue` JSON handler to match AWS wire format ([#752](https://github.com/floci-io/floci/pull/752))

### Documentation

- All service and configuration docs moved to environment-variable-first; `application.yml` reference moved to `configuration/advanced/`
- New page: [Multi-Account Isolation](docs/configuration/multi-account.md)
- New page: [TLS / HTTPS](docs/configuration/tls.md)
- Go Testcontainers page rewritten to match the published `testcontainers-floci-go` API
- LocalStack migration table completed with all mapped variables (`USE_SSL`, `CUSTOM_SSL_CERT_PATH`, `DOCKER_HOST`, `PERSIST_STATE`, `LAMBDA_REMOTE_DOCKER`)

## [1.5.13] - 2026-05-07

### Added

- **backup:** AWS Backup Phase 1 — vaults, plans, selections, on-demand jobs with simulated CREATED→RUNNING→COMPLETED lifecycle, recovery points, tagging via `SharedTagsController`, and `GetSupportedResourceTypes`
- **codedeploy:** Server platform (Phase 4) — on-premises instance management (`RegisterOnPremisesInstance`, `DeregisterOnPremisesInstance`, `GetOnPremisesInstance`, `BatchGetOnPremisesInstances`, `ListOnPremisesInstances`, `AddTagsToOnPremisesInstances`, `RemoveTagsFromOnPremisesInstances`); Server AppSpec YAML parsing; EC2 and on-premises instance resolution by tag filters; full lifecycle event execution (`ApplicationStop` → `DownloadBundle` → `BeforeInstall` → `Install` → `AfterInstall` → `ApplicationStart` → `ValidateService`); SSM Run Command integration for hook script execution with graceful degradation when SSM is unavailable; per-instance `InstanceTarget` tracking in `ListDeploymentTargets`/`BatchGetDeploymentTargets`
- **elbv2:** Lambda target type — ALB listeners forward requests to Lambda functions using the full ALB→Lambda event format (`httpMethod`, `path`, `queryStringParameters`, `multiValueQueryStringParameters`, `headers`, `multiValueHeaders`, `body`, `isBase64Encoded`); Lambda→ALB response mapping (`statusCode`, `headers`, `multiValueHeaders`, `body`, `isBase64Encoded`); Lambda target groups always report as healthy in `DescribeTargetHealth` without HTTP probing
- **eventbridge:** Archive and Replay support — `CreateArchive`, `DescribeArchive`, `UpdateArchive`, `DeleteArchive`, `ListArchives`, `StartReplay`, `DescribeReplay`, `CancelReplay`, `ListReplays`; events captured automatically to matching archives and replayed on demand ([#702](https://github.com/floci-io/floci/pull/702))
- **route53:** Route53 Phase 1 — hosted zones with auto-created SOA + NS records, `ChangeResourceRecordSets` (CREATE/UPSERT/DELETE with atomic batch validation), `ListResourceRecordSets`, change tracking (always INSYNC), health checks (create/get/list/update/delete), and per-resource tagging via `ChangeTagsForResource` / `ListTagsForResource`
- **scheduler:** `TagResource`, `UntagResource`, `ListTagsForResource` for schedule groups ([#700](https://github.com/floci-io/floci/pull/700))
- **sqs, dynamodb:** TRACE-level payload logging for request and response bodies to aid debugging ([#697](https://github.com/floci-io/floci/pull/697))
- **ssm:** Run Command — `SendCommand`, `GetCommandInvocation`, `ListCommands`, `ListCommandInvocations`, `CancelCommand`, `DescribeInstanceInformation`; `UpdateInstanceInformation` (agent registration); `ec2messages` polling protocol (`GetMessages`, `AcknowledgeMessage`, `SendReply`, `FailMessage`, `DeleteMessage`, `GetEndpoint`) so the real `amazon-ssm-agent` running inside EC2 containers can register, receive commands, and report output
- **transfer:** Transfer Family management-plane API — server lifecycle (`CreateServer`, `DescribeServer`, `DeleteServer`, `ListServers`, `StartServer`, `StopServer`, `UpdateServer`), user management (`CreateUser`, `DescribeUser`, `DeleteUser`, `ListUsers`, `UpdateUser`), SSH key management (`ImportSshPublicKey`, `DeleteSshPublicKey`), and tagging (`TagResource`, `UntagResource`, `ListTagsForResource`)

### Fixed

- **appconfig:** use capital `"Tags"` body key in `TagResource` / `ListTagsForResource` to match AWS SDK wire format ([#704](https://github.com/floci-io/floci/pull/704))
- **docker:** respect `DOCKER_HOST` env var and handle bare `host:port` values without a URI scheme ([#705](https://github.com/floci-io/floci/pull/705))
- **ec2:** `AssociateRouteTable` now returns `<associationState>` in the response; `DescribeRouteTables` supports the `association.route-table-association-id` filter; `DescribeTags` correctly applies `resource-id`, `resource-type`, `key`, and `value` filters ([#706](https://github.com/floci-io/floci/pull/706))

## [1.5.12] - 2026-05-04

### Added

- **apigatewayv2:** WebSocket API support, Update ops, Route/Integration Responses, Models, and Tagging ([#682](https://github.com/floci-io/floci/issues/682))
- **autoscaling:** EC2 Auto Scaling stored-state management API and capacity reconciler ([#681](https://github.com/floci-io/floci/issues/681))
- **ses:** add `TestRenderTemplate` (v1) and `TestRenderEmailTemplate` (v2) ([#692](https://github.com/floci-io/floci/issues/692))
- **glue:** Schema Registry support — registries, schemas, versions, compatibility checks, metadata, tags, and Java SerDe SDK compatibility ([#621](https://github.com/floci-io/floci/issues/621))
- **parity:** LocalStack drop-in compatibility layer ([#696](https://github.com/floci-io/floci/issues/696))

### Fixed

- **sfn:** apply `ItemSelector`/`Parameters` transformation in Map state ([#683](https://github.com/floci-io/floci/issues/683))
- **ecs:** fix delete resource issue ([#685](https://github.com/floci-io/floci/issues/685))
- **lambda:** use function region in container AWS environment ([#687](https://github.com/floci-io/floci/issues/687))
- **cloudformation:** adopt existing DynamoDB tables on stack update ([#689](https://github.com/floci-io/floci/issues/689))
- **cloudformation:** resolve Floci virtual-hosted template URLs ([#690](https://github.com/floci-io/floci/issues/690))
- **docker:** fix `ARG` ordering in compat Dockerfile so `VERSION` build-arg is applied correctly

## [1.5.11] - 2026-05-02

### Added

- **ec2:** real Docker container execution with SSH, UserData, and IMDS support ([#658](https://github.com/floci-io/floci/issues/658))
- **cognito:** implement `AdminRespondToAuthChallenge` operation ([#666](https://github.com/floci-io/floci/issues/666))
- **pipes:** populate SQS message attributes in pipe source records ([#667](https://github.com/floci-io/floci/issues/667))
- **cloudformation:** add `Fn::ImportValue` cross-stack reference resolution ([#669](https://github.com/floci-io/floci/issues/669))
- **elbv2:** ALB proxy, CodeDeploy, and ECS integration ([#677](https://github.com/floci-io/floci/issues/677))
- **lambda:** support `ImageConfig.WorkingDirectory` ([#673](https://github.com/floci-io/floci/issues/673))

### Fixed

- Normalize bare `host:port` Docker host values to prevent URI parse failure ([#665](https://github.com/floci-io/floci/issues/665))
- **athena:** use embedded DNS server to resolve S3 URL used by floci-duck containers ([#672](https://github.com/floci-io/floci/issues/672))
- **iam:** protocol-aware Access Denied response in IAM enforcement filter ([#657](https://github.com/floci-io/floci/issues/657))
- **iam:** read `Action` from form body in IAM enforcement filter ([#655](https://github.com/floci-io/floci/issues/655))
- **lambda:** fix incorrect request size limit ([#674](https://github.com/floci-io/floci/issues/674))
- **sqs:** inject `QueueUrl` into form body for query protocol path-based requests ([#670](https://github.com/floci-io/floci/issues/670))
- **ecr:** properly check if `host-persistent-path` is the name of a Docker volume ([#678](https://github.com/floci-io/floci/issues/678))

## [1.5.10] - 2026-04-30

### Added

- **lambda:** support `ImageConfig` `Command` and `EntryPoint` for container images ([#630](https://github.com/floci-io/floci/issues/630))
- **ses:** add `ConfigurationSet` CRUD on v1 Query and v2 REST JSON protocols ([#631](https://github.com/floci-io/floci/issues/631))
- **cloudformation:** provision `AWS::Pipes::Pipe` resources ([#634](https://github.com/floci-io/floci/issues/634))
- **cognito:** include all standard attributes in `DescribeUserPool` schema ([#642](https://github.com/floci-io/floci/issues/642))
- **ses:** add `SendBulkEmail` (v2) and `SendBulkTemplatedEmail` (v1) ([#645](https://github.com/floci-io/floci/issues/645))
- **cognito:** Custom Auth Flow integration with Lambda triggers ([#646](https://github.com/floci-io/floci/issues/646))
- **codebuild, codedeploy:** implement real Docker-based build execution (phase 2) ([#649](https://github.com/floci-io/floci/issues/649))
- **iam:** seed 23 additional AWS managed execution-role policies ([#650](https://github.com/floci-io/floci/issues/650))
- **dynamodb:** implement `ExportTableToPointInTime`, `DescribeExport`, and `ListExports` ([#653](https://github.com/floci-io/floci/issues/653))
- **cloudformation:** support `AWS::Lambda::EventSourceMapping` resource type ([#654](https://github.com/floci-io/floci/issues/654))

### Fixed

- **docker:** replace `bash /dev/tcp` HEALTHCHECK with `busybox wget` for Alpine runtime compatibility ([#625](https://github.com/floci-io/floci/issues/625))
- **pipes:** resolve `InputTemplate` paths through JSON-encoded string fields ([#635](https://github.com/floci-io/floci/issues/635))
- **dynamodb:** fix GSI query pagination infinite loop when items share a sort key ([#637](https://github.com/floci-io/floci/issues/637))
- **cloudformation:** wrap `ZipFile` inline source in a zip archive before passing to Lambda ([#639](https://github.com/floci-io/floci/issues/639))
- **lambda:** inject log group, log stream, and Floci endpoint env vars into Lambda containers ([#640](https://github.com/floci-io/floci/issues/640))
- **cloudformation:** resolve path-style AWS S3 `TemplateURL` against local S3 ([#641](https://github.com/floci-io/floci/issues/641))
- **eks:** use named Docker volume for k3s data directory to avoid `EINVAL` on macOS APFS ([#643](https://github.com/floci-io/floci/issues/643))
- **apigateway:** support `_custom_id_` tag on `CreateRestApi` ([#644](https://github.com/floci-io/floci/issues/644))
- **apigateway:** implement `GET /restapis/{id}/deployments/{deploymentId}` ([#652](https://github.com/floci-io/floci/issues/652))
- **athena:** connect to floci-duck container via IP instead of DNS ([#648](https://github.com/floci-io/floci/issues/648))

## [1.5.9] - 2026-04-28

### Added

- **elbv2:** Elastic Load Balancing v2 management API — Phase 1 ([#617](https://github.com/floci-io/floci/issues/617))
- **codebuild, codedeploy:** add management APIs ([#622](https://github.com/floci-io/floci/issues/622))

### Fixed

- **cloudformation:** resolve changesets by ARN in `DescribeChangeSet`, `ExecuteChangeSet`, `DeleteChangeSet` ([#608](https://github.com/floci-io/floci/issues/608))
- **lambda:** drop dead pooled containers in `WarmPool.acquire()` before reuse ([#610](https://github.com/floci-io/floci/issues/610))
- **apigateway:** propagate TOKEN authorizer context to `AWS_PROXY` Lambda integrations ([#581](https://github.com/floci-io/floci/issues/581))
- **pipes:** invoke non-Lambda targets per-record instead of batch envelope ([#590](https://github.com/floci-io/floci/issues/590))
- **docker:** avoid host mountinfo false positives in container detection ([#616](https://github.com/floci-io/floci/issues/616))
- **s3:** emit `x-amz-transition-default-minimum-object-size` on lifecycle `GET`/`PUT` ([#615](https://github.com/floci-io/floci/issues/615))
- **s3:** fix OOM on `PutObject` with large payloads ([#620](https://github.com/floci-io/floci/issues/620))
- **kms:** `GetKeyRotationStatus` now returns `false` for asymmetric and HMAC keys ([#618](https://github.com/floci-io/floci/issues/618))
- **lambda:** inject default AWS credentials into Lambda containers ([#623](https://github.com/floci-io/floci/issues/623))
- **ec2:** persist VPC DNS attributes and support `DescribeVpcEndpointServices` ([#624](https://github.com/floci-io/floci/issues/624))

## [1.5.8] - 2026-04-25

### Added

- **pipes:** add filtering, input templates, batch sizes, and DLQ routing ([#576](https://github.com/floci-io/floci/issues/576))
- **cognito:** add `TagResource`, `UntagResource`, `ListTagsForResource` for user pools ([#579](https://github.com/floci-io/floci/issues/579))
- **ses:** implement email template CRUD with stored, inline, and ARN variants ([#573](https://github.com/floci-io/floci/issues/573))
- **sqs:** clear SNS FIFO deduplication cache on `PurgeQueue` ([#594](https://github.com/floci-io/floci/issues/594))
- **athena:** real SQL execution via floci-duck DuckDB sidecar ([#584](https://github.com/floci-io/floci/issues/584))
- **lambda:** embedded DNS server for virtual-hosted S3 URL resolution inside containers ([#585](https://github.com/floci-io/floci/issues/585))
- **lambda:** bind-mount hot-reload via `S3Bucket=hot-reload` ([#601](https://github.com/floci-io/floci/issues/601))

### Fixed

- **dynamodb:** accept full ARN for `TableName` across all operations ([#580](https://github.com/floci-io/floci/issues/580))
- **dynamodb:** enforce `DeletionProtectionEnabled` on create, update, and delete ([#583](https://github.com/floci-io/floci/issues/583))
- **lambda:** support nested Python handler module paths ([#570](https://github.com/floci-io/floci/issues/570))
- **dynamodb:** serialise concurrent mutations and transactions via per-item locks ([#572](https://github.com/floci-io/floci/issues/572))
- **pipes:** return parameters and tags in mutation responses; warn on stream record loss ([#588](https://github.com/floci-io/floci/issues/588))
- **pipes:** read `EventBridgeEventBusParameters` for `Source` and `DetailType` ([#589](https://github.com/floci-io/floci/issues/589))
- **lambda:** parse empty payload without error ([#600](https://github.com/floci-io/floci/issues/600))
- **docker:** make bind-mounted `/var/run/docker.sock` work on all host types ([#602](https://github.com/floci-io/floci/issues/602))
- **lambda:** replace blocking `/next` handler with reactive pattern ([#596](https://github.com/floci-io/floci/issues/596))
- **lambda:** wire `S3VirtualHostFilter` to container-aware DNS suffix ([#598](https://github.com/floci-io/floci/issues/598))
- **s3-control:** accept plain S3 ARN (`arn:aws:s3:::bucket`) in `ListTagsForResource` ([#603](https://github.com/floci-io/floci/issues/603))
- **rds:** fix `DBSubnetGroup` shape, non-master auth pass-through, and volume lifecycle ([#604](https://github.com/floci-io/floci/issues/604))

## [1.5.7] - 2026-04-23

### Fixed

- **docker:** fix Docker image build issue introduced in 1.5.6

## [1.5.6] - 2026-04-23

### Added

- **ses:** SMTP relay support for `SendEmail` and `SendRawEmail` ([#534](https://github.com/floci-io/floci/issues/534))
- **appconfig:** resource tagging and predefined deployment strategies ([#533](https://github.com/floci-io/floci/issues/533))
- **firehose:** implement `DeleteDeliveryStream` API ([#535](https://github.com/floci-io/floci/issues/535))
- **pipes:** EventBridge Pipes service — CRUD API, source polling, and target invocation ([#539](https://github.com/floci-io/floci/issues/539), [#555](https://github.com/floci-io/floci/issues/555))
- **docker:** centralize Docker config and add private registry authentication ([#549](https://github.com/floci-io/floci/issues/549))
- **scheduler:** invoke targets when EventBridge Scheduler schedules fire ([#551](https://github.com/floci-io/floci/issues/551))
- **secretsmanager:** add `UpdateSecretVersionStage` handling ([#545](https://github.com/floci-io/floci/issues/545))
- **cognito, kms:** allow caller-pinned resource IDs via the reserved `floci:override-id` tag ([#568](https://github.com/floci-io/floci/issues/568))
- **sqs:** add option to clear deduplication cache on `PurgeQueue` ([#561](https://github.com/floci-io/floci/issues/561))

### Fixed

- **dynamodb:** return correct attributes for `UPDATED_NEW`/`UPDATED_OLD` on new items ([#538](https://github.com/floci-io/floci/issues/538))
- **lambda:** initialize ESM pollers at startup; fix worker-pool exhaustion in RuntimeApiServer ([#543](https://github.com/floci-io/floci/issues/543))
- **secretsmanager:** fix incorrect update of `AWSPENDING` on secret value update ([#542](https://github.com/floci-io/floci/issues/542))
- **kms:** support `HMAC_*` key specs in `CreateKey` ([#544](https://github.com/floci-io/floci/issues/544))
- **lambda:** add missing `FunctionConfiguration` fields and fix response shape ([#546](https://github.com/floci-io/floci/issues/546))
- **s3:** wrap S3 Control XML errors in `ErrorResponse` wrapper ([#560](https://github.com/floci-io/floci/issues/560))
- **native, acm:** fix native image reflection for ACM ([#559](https://github.com/floci-io/floci/issues/559))
- **s3:** enforce conditional writes ([#566](https://github.com/floci-io/floci/issues/566))

## [1.5.5] - 2026-04-19

### Added

- **eks:** implement EKS service with real k3s data plane support ([#493](https://github.com/floci-io/floci/issues/493))
- **s3:** implement static website hosting with index document redirection ([#507](https://github.com/floci-io/floci/issues/507))
- **lambda:** reactive S3-to-Lambda sync for hot-reloading ([#509](https://github.com/floci-io/floci/issues/509))
- **dynamodb:** support `ReturnValuesOnConditionCheckFailure` ([#505](https://github.com/floci-io/floci/issues/505))
- **eventbridge:** add `PutPermission` and `RemovePermission` support ([#499](https://github.com/floci-io/floci/issues/499))
- **cognito:** implement `AdminEnableUser` and `AdminDisableUser` ([#514](https://github.com/floci-io/floci/issues/514))
- **cognito:** implement `AdminResetUserPassword` ([#516](https://github.com/floci-io/floci/issues/516))
- **kinesis:** support `AT_TIMESTAMP` shard iterator type ([#520](https://github.com/floci-io/floci/issues/520))
- **opensearch:** real OpenSearch container support via Docker image ([#528](https://github.com/floci-io/floci/issues/528))
- **secretsmanager:** add version stages handling in `PutSecretValue` ([#527](https://github.com/floci-io/floci/issues/527))
- **s3:** preserve explicit object server-side-encryption headers ([#515](https://github.com/floci-io/floci/issues/515))

### Fixed

- **dynamodb:** support arithmetic in SET expressions ([#480](https://github.com/floci-io/floci/issues/480))
- **sqs:** include `MD5OfMessageAttributes` in `SendMessageBatch` JSON response ([#496](https://github.com/floci-io/floci/issues/496))
- **cloudformation:** forward Lambda environment variables during stack provisioning ([#510](https://github.com/floci-io/floci/issues/510))
- **kms:** support `ECC_SECG_P256K1` via BouncyCastle JCA ([#502](https://github.com/floci-io/floci/issues/502))
- **dynamodb:** validate sort key in `buildItemKey` to prevent item collisions ([#506](https://github.com/floci-io/floci/issues/506))
- **storage:** make `scan()` return a mutable list for non-in-memory backends ([#517](https://github.com/floci-io/floci/issues/517))
- **ses:** align `/_aws/ses` inspection endpoint with LocalStack behavior ([#512](https://github.com/floci-io/floci/issues/512))
- **lifecycle:** run shutdown hooks before HTTP server stops ([#519](https://github.com/floci-io/floci/issues/519))
- **kinesis:** return real `ShardId` in `PutRecord` and `PutRecords` responses ([#518](https://github.com/floci-io/floci/issues/518))
- **lambda:** restore create-copy-start ordering for provided runtimes ([#524](https://github.com/floci-io/floci/issues/524))
- **lambda:** fix container lifecycle on timeout ([#529](https://github.com/floci-io/floci/issues/529))
- **lambda:** destroy container handle on interrupt and generic exceptions ([#530](https://github.com/floci-io/floci/issues/530))
- **lambda:** wake blocked `/next` poller and drain queue on `RuntimeApiServer.stop()` ([#531](https://github.com/floci-io/floci/issues/531))

### Security

- **s3:** harden path traversal defenses in `S3Service` and `S3Controller` ([#508](https://github.com/floci-io/floci/issues/508))

## [1.5.4] - 2026-04-17

### Added

- **iam:** seed AWS managed policies at startup ([#400](https://github.com/floci-io/floci/issues/400))
- **s3:** preserve `Content-Disposition` on object responses ([#408](https://github.com/floci-io/floci/issues/408))
- **sfn:** add SQS `sendMessage` AWS SDK integrations ([#409](https://github.com/floci-io/floci/issues/409))
- **kinesis:** implement `EnableEnhancedMonitoring` and `DisableEnhancedMonitoring` ([#417](https://github.com/floci-io/floci/issues/417))
- **msk:** implement Amazon MSK service with Redpanda orchestration ([#419](https://github.com/floci-io/floci/issues/419))
- **dynamodb:** add `EnableKinesisStreamingDestination` support ([#427](https://github.com/floci-io/floci/issues/427))
- **lambda:** enforce reserved and per-region concurrency ([#424](https://github.com/floci-io/floci/issues/424))
- **eventbridge:** implement `TagResource` and `UntagResource` ([#453](https://github.com/floci-io/floci/issues/453))
- **cloudwatch:** implement `GetMetricData` ([#451](https://github.com/floci-io/floci/issues/451))
- **cognito:** create, list, and delete user pool client secrets ([#345](https://github.com/floci-io/floci/issues/345))
- **ec2:** implement `CreateVolume`, `DescribeVolumes`, `DeleteVolume` ([#455](https://github.com/floci-io/floci/issues/455))
- **athena, glue, firehose:** implement local Data Lake stack with real SQL execution ([#429](https://github.com/floci-io/floci/issues/429))
- **tagging:** implement Resource Groups Tagging API ([#459](https://github.com/floci-io/floci/issues/459))
- **bedrock-runtime:** stub `Converse` and `InvokeModel` ([#486](https://github.com/floci-io/floci/issues/486))
- **kinesis:** implement `UpdateStreamMode` ([#488](https://github.com/floci-io/floci/issues/488))
- **lambda:** support `ScalingConfig.MaximumConcurrency` on SQS event source mappings ([#490](https://github.com/floci-io/floci/issues/490))
- **lambda:** add `UpdateFunctionConfiguration` API ([#472](https://github.com/floci-io/floci/issues/472))
- **dynamodb:** support `UPDATED_OLD` and `UPDATED_NEW` `ReturnValues` ([#477](https://github.com/floci-io/floci/issues/477))

### Fixed

- **elasticache:** scope single-arg `AUTH` to default user per Redis ACL spec ([#390](https://github.com/floci-io/floci/issues/390))
- **auth:** bind SigV4 token identity and use timing-safe comparison ([#389](https://github.com/floci-io/floci/issues/389))
- **apigatewayv2:** add missing JSON handler operations and `stageName` auto-deploy ([#393](https://github.com/floci-io/floci/issues/393))
- **cloudformation:** populate SQS queue ARN in resource attributes ([#396](https://github.com/floci-io/floci/issues/396))
- **elasticache, rds:** prevent orphaned Docker containers on shutdown and restart ([#398](https://github.com/floci-io/floci/issues/398))
- **s3:** remove XML declaration from `GetBucketLocation` response ([#403](https://github.com/floci-io/floci/issues/403))
- **lambda:** resolve handler paths with subdirectories; skip validation for dotnet runtimes ([#404](https://github.com/floci-io/floci/issues/404))
- **iam:** enforce IAM when enabled ([#411](https://github.com/floci-io/floci/issues/411))
- **dynamodb:** implement `DELETE` action for set attributes ([#415](https://github.com/floci-io/floci/issues/415))
- **sqs:** use queue-level `VisibilityTimeout` as fallback in `ReceiveMessage` ([#413](https://github.com/floci-io/floci/issues/413))
- **lambda:** raise Jackson `maxStringLength` for large inline zip uploads ([#418](https://github.com/floci-io/floci/issues/418))
- **dynamodb:** support `REMOVE` for nested map paths ([#421](https://github.com/floci-io/floci/issues/421))
- **cognito:** return only description fields in `ListUserPoolClients` ([#420](https://github.com/floci-io/floci/issues/420))
- **s3:** honor canned object ACLs on write paths ([#422](https://github.com/floci-io/floci/issues/422))
- **ecr:** fall back to named volume for registry data when `host-persistent-path` is unset inside containers ([#442](https://github.com/floci-io/floci/issues/442))
- **kinesis:** return time-based `MillisBehindLatest` ([#444](https://github.com/floci-io/floci/issues/444))
- **lambda:** accept name, partial ARN, and full ARN for `{FunctionName}` path parameter ([#450](https://github.com/floci-io/floci/issues/450))
- **dynamodb:** accept newline as `UpdateExpression` clause separator ([#449](https://github.com/floci-io/floci/issues/449))
- **cognito:** add `aud` claim to ID tokens ([#454](https://github.com/floci-io/floci/issues/454))
- **s3:** implement bucket ownership controls ([#456](https://github.com/floci-io/floci/issues/456))
- **dynamodb:** support continuous backups and PITR actions ([#458](https://github.com/floci-io/floci/issues/458))
- **kinesis:** accept AWS SDK v2 CBOR content type ([#457](https://github.com/floci-io/floci/issues/457))
- **dynamodb:** fix expression evaluation, `UpdateExpression` paths, and `ConsumedCapacity` ([#197](https://github.com/floci-io/floci/issues/197))
- **lambda:** include `LastUpdateStatus` in function configuration responses ([#463](https://github.com/floci-io/floci/issues/463))
- Add log rotation by default to all Floci-launched containers ([#466](https://github.com/floci-io/floci/issues/466))
- **sqs:** honor queue-level `DelaySeconds` on FIFO queues ([#476](https://github.com/floci-io/floci/issues/476))
- **ecr:** fix port and network issues ([#483](https://github.com/floci-io/floci/issues/483))
- **s3-control:** accept URL-encoded ARNs and return XML errors ([#491](https://github.com/floci-io/floci/issues/491))

## [1.5.3] - 2026-04-12

### Added

- **appconfig:** new AppConfig service ([#324](https://github.com/floci-io/floci/issues/324))
- **ecr:** new ECR service — push, pull, manage repositories and images ([#337](https://github.com/floci-io/floci/issues/337))
- **docker:** add `HEALTHCHECK` to all Floci Dockerfiles ([#328](https://github.com/floci-io/floci/issues/328))
- **lambda:** add `PutFunctionConcurrency` stub ([#325](https://github.com/floci-io/floci/issues/325))

### Changed

- Unify service metadata behind a descriptor-backed catalog for enablement, routing, and storage lookups ([#357](https://github.com/floci-io/floci/issues/357))

### Fixed

- **s3:** return XML error responses for presigned POST failures ([#327](https://github.com/floci-io/floci/issues/327))
- **sqs:** make per-queue message operations atomic ([#333](https://github.com/floci-io/floci/issues/333))
- **eventbridge:** apply `InputPath` when delivering events to targets ([#335](https://github.com/floci-io/floci/issues/335))
- **cloudformation:** topologically sort resources before provisioning ([#332](https://github.com/floci-io/floci/issues/332))
- **s3:** return empty `LocationConstraint` for `us-east-1` buckets ([#336](https://github.com/floci-io/floci/issues/336))
- **dynamodb:** attach `X-Amz-Crc32` header to JSON protocol responses ([#347](https://github.com/floci-io/floci/issues/347))
- **cognito:** return sub UUID as `UserSub` in `SignUp` response ([#351](https://github.com/floci-io/floci/issues/351))
- **kinesis:** accept same-value `Increase`/`DecreaseStreamRetentionPeriod` ([#352](https://github.com/floci-io/floci/issues/352))
- **sns:** recognize attributes set during subscription creation ([#353](https://github.com/floci-io/floci/issues/353))
- **ecr, s3:** fix CDK compatibility and resolve macOS ECR port conflict ([#354](https://github.com/floci-io/floci/issues/354))
- **kms:** implement real asymmetric sign/verify and `GetPublicKey` ([#355](https://github.com/floci-io/floci/issues/355))
- **eventbridge:** implement advanced content filtering operators ([#356](https://github.com/floci-io/floci/issues/356))
- **cognito:** correct HMAC signature computation in `USER_SRP_AUTH` ([#358](https://github.com/floci-io/floci/issues/358))
- **s3:** include non-versioned objects in `ListObjectVersions` response ([#359](https://github.com/floci-io/floci/issues/359))
- **secretsmanager:** resolve partial ARNs without random suffix ([#360](https://github.com/floci-io/floci/issues/360))
- **lambda:** correct Function URL config path from `/url-config` to `/url` ([#364](https://github.com/floci-io/floci/issues/364))
- **elasticache:** scope user auth to groups, use `StorageFactory`, throw `NotFoundFault` ([#367](https://github.com/floci-io/floci/issues/367))
- **apigatewayv2:** fix route matching for path-parameter routes ([#368](https://github.com/floci-io/floci/issues/368))
- **s3:** implement S3 Control `ListTagsForResource`, `TagResource`, `UntagResource` ([#363](https://github.com/floci-io/floci/issues/363))
- **cloudformation:** resolve stacks by ARN in addition to name ([#386](https://github.com/floci-io/floci/issues/386))

## [1.5.2] - 2026-04-10

### Added

- **kinesis:** add `IncreaseStreamRetentionPeriod` and `DecreaseStreamRetentionPeriod` ([#305](https://github.com/floci-io/floci/issues/305))
- **kinesis:** resolve stream name from `StreamARN` parameter ([#304](https://github.com/floci-io/floci/issues/304))
- **kms:** add `GetKeyRotationStatus`, `EnableKeyRotation`, and `DisableKeyRotation` ([#290](https://github.com/floci-io/floci/issues/290))
- **s3:** preserve `Cache-Control` header on `PutObject`, `GetObject`, `HeadObject`, and `CopyObject` ([#313](https://github.com/floci-io/floci/issues/313))

### Fixed

- **apigateway:** implement v2 management API and CloudFormation provisioning ([#323](https://github.com/floci-io/floci/issues/323))
- **cloudwatch:** implement tagging support for metrics and alarms ([#320](https://github.com/floci-io/floci/issues/320))
- **dynamodb:** handle null for Java AWS SDK v2 DynamoDB `EnhancedClient` ([#309](https://github.com/floci-io/floci/issues/309))
- **dynamodb:** implement `list_append` with `if_not_exists` support ([#317](https://github.com/floci-io/floci/issues/317))
- **dynamodb:** remove duplicate `list_append` handler that breaks nested expressions ([#321](https://github.com/floci-io/floci/issues/321))
- **rds:** `DescribeDBInstances` returns empty results due to wrong XML element names and missing `Filters` support ([#319](https://github.com/floci-io/floci/issues/319))
- **s3:** preserve leading slashes in object keys to prevent key collisions ([#286](https://github.com/floci-io/floci/issues/286))
- Support LocalStack-compatible `_user_request_` URL for API Gateway execution ([#314](https://github.com/floci-io/floci/issues/314))

## [1.5.1] - 2026-04-09

### Fixed

- Native image build failure due to `SecureRandom` in `CognitoSrpHelper`

## [1.5.0] - 2026-04-09

### Added

- **cloudformation:** add `AWS::Events::Rule` provisioning support ([#261](https://github.com/floci-io/floci/issues/261))
- **eventbridge:** add `InputTransformer` support and S3 event notifications ([#294](https://github.com/floci-io/floci/issues/294))
- **dynamodb:** load persisted DynamoDB streams on startup ([#299](https://github.com/floci-io/floci/issues/299))

### Fixed

- Native build: append `-march=x86-64-v2` for amd64 compatibility ([#303](https://github.com/floci-io/floci/issues/303))
- **dynamodb:** `DescribeTable` returns `Projection.NonKeyAttributes` ([#300](https://github.com/floci-io/floci/issues/300))
- **rds:** implement missing resource identifiers and fix filtering ([#302](https://github.com/floci-io/floci/issues/302))
- **s3:** implement S3 Lambda notifications ([#278](https://github.com/floci-io/floci/issues/278))
- **cognito:** implement SRP-6a authentication ([#298](https://github.com/floci-io/floci/issues/298))
- **s3:** use case-insensitive field lookup for presigned POST policy validation ([#289](https://github.com/floci-io/floci/issues/289))
- **s3:** use `ConfigProvider` for runtime config lookup in `S3VirtualHostFilter` ([#288](https://github.com/floci-io/floci/issues/288))
- Register Xerces XML resource bundles for native image ([#296](https://github.com/floci-io/floci/issues/296))

## [1.4.0] - 2026-04-08

### Added

- **kms:** add `GetKeyPolicy`, `PutKeyPolicy`, and fix `CreateKey` tag handling ([#280](https://github.com/floci-io/floci/issues/280))
- **ses:** add SES V2 REST JSON protocol support ([#265](https://github.com/floci-io/floci/issues/265))
- **lambda:** add missing runtimes and fix handler validation ([#256](https://github.com/floci-io/floci/issues/256))
- **scheduler:** add EventBridge Scheduler service ([#260](https://github.com/floci-io/floci/issues/260))
- **secretsmanager:** add `BatchGetSecretValue` support ([#264](https://github.com/floci-io/floci/issues/264))
- **sfn:** nested state machine execution and activity support ([#266](https://github.com/floci-io/floci/issues/266))
- Use AWS-specific content type in all JSON-based controller responses ([#240](https://github.com/floci-io/floci/issues/240))

### Fixed

- **dynamodb:** add `list_append` support to update expressions ([#277](https://github.com/floci-io/floci/issues/277))
- Default shell executable to `/bin/sh` for Alpine compatibility ([#241](https://github.com/floci-io/floci/issues/241))
- **lambda:** drain warm pool containers on server shutdown ([#274](https://github.com/floci-io/floci/issues/274))
- **dynamodb:** support `add` function with multiple values ([#263](https://github.com/floci-io/floci/issues/263))
- Handle base64-encoded ACM certificate imports ([#248](https://github.com/floci-io/floci/issues/248))
- **dynamodb:** include `ProvisionedThroughput` in GSI responses ([#273](https://github.com/floci-io/floci/issues/273))
- Return 400 when encoded S3 copy source is malformed ([#244](https://github.com/floci-io/floci/issues/244))
- **cognito:** resolve auth, token, and user lookup issues ([#279](https://github.com/floci-io/floci/issues/279))
- **s3:** enforce presigned POST policy conditions (`eq`, `starts-with`, `content-type`) ([#203](https://github.com/floci-io/floci/issues/203))
- **s3:** fix versioning `IsTruncated`, `PublicAccessBlock`, `ListObjectsV2` pagination, and Kubernetes virtual host routing ([#276](https://github.com/floci-io/floci/issues/276))

## [1.3.0] - 2026-04-06

### Added

- **ec2:** add EC2 service with 61 operations, integration tests, and documentation ([#213](https://github.com/floci-io/floci/issues/213))
- **ecs:** add ECS service ([#209](https://github.com/floci-io/floci/issues/209))
- **dynamodb:** add `ScanFilter` support for `Scan` operation ([#175](https://github.com/floci-io/floci/issues/175))
- **eventbridge:** forward resources array and support resources pattern matching ([#210](https://github.com/floci-io/floci/issues/210))
- **lambda:** add `AddPermission`, `GetPolicy`, `ListTags`, `ListLayerVersions` endpoints ([#223](https://github.com/floci-io/floci/issues/223))
- **sfn:** JSONata improvements, `States.*` intrinsics, DynamoDB `ConditionExpression`, `StartSyncExecution` ([#205](https://github.com/floci-io/floci/issues/205))
- Add `GlobalSecondaryIndexUpdates` support in DynamoDB `UpdateTable` ([#222](https://github.com/floci-io/floci/issues/222))
- Add scheduled rules support for EventBridge Rules ([#217](https://github.com/floci-io/floci/issues/217))

### Fixed

- Fall back to Docker bridge IP when `host.docker.internal` is unresolvable ([#216](https://github.com/floci-io/floci/issues/216))
- **lambda:** copy code to `TASK_DIR` for provided runtimes ([#206](https://github.com/floci-io/floci/issues/206))
- **lambda:** honor `ReportBatchItemFailures` in SQS ESM ([#208](https://github.com/floci-io/floci/issues/208))
- **lambda:** support `Code.S3Bucket` + `Code.S3Key` in `CreateFunction` and `UpdateFunctionCode` ([#219](https://github.com/floci-io/floci/issues/219))
- **ses:** add missing `Result` element to query protocol responses ([#207](https://github.com/floci-io/floci/issues/207))
- **sns:** make `Subscribe` idempotent for same `topic+protocol+endpoint` ([#185](https://github.com/floci-io/floci/issues/185))

## [1.2.0] - 2026-04-04

### Added

- **cloudwatch-logs:** add `ListTagsForResource`, `TagResource`, and `UntagResource` ([#172](https://github.com/hectorvent/floci/issues/172))
- **cognito:** add group management support ([#149](https://github.com/hectorvent/floci/issues/149))
- **s3:** support `Filter` rules in `PutBucketNotificationConfiguration` ([#178](https://github.com/hectorvent/floci/issues/178))
- **lambda:** implement `ListVersionsByFunction` API ([#193](https://github.com/hectorvent/floci/issues/193))
- Officially support Docker named volumes for native images ([#155](https://github.com/hectorvent/floci/issues/155))
- Health endpoint ([#139](https://github.com/hectorvent/floci/issues/139))
- Implement `UploadPartCopy` for S3 multipart uploads ([#98](https://github.com/hectorvent/floci/issues/98))
- Support `GenerateSecretString` and `Description` for `AWS::SecretsManager::Secret` in CloudFormation ([#176](https://github.com/hectorvent/floci/issues/176))
- Support GSI and LSI in CloudFormation DynamoDB table provisioning ([#125](https://github.com/hectorvent/floci/issues/125))
- Add CloudFormation `Fn::FindInMap` and `Mappings` support ([#101](https://github.com/hectorvent/floci/issues/101))
- **lifecycle:** add support for startup and shutdown initialization hooks ([#128](https://github.com/hectorvent/floci/issues/128))
- **s3:** add conditional request headers (`If-Match`, `If-None-Match`, `If-Modified-Since`, `If-Unmodified-Since`) ([#48](https://github.com/hectorvent/floci/issues/48))
- **s3:** add presigned POST upload support ([#120](https://github.com/hectorvent/floci/issues/120))
- **s3:** add `Range` header support for `GetObject` ([#44](https://github.com/hectorvent/floci/issues/44))
- **sfn:** add DynamoDB AWS SDK integration and complete optimized `updateItem` ([#103](https://github.com/hectorvent/floci/issues/103))
- **apigateway:** OpenAPI/Swagger import, models, and request validation ([#113](https://github.com/hectorvent/floci/issues/113))
- **apigateway:** add AWS integration type for REST v1 ([#108](https://github.com/hectorvent/floci/issues/108))

### Fixed

- **cognito:** auto-generate `sub`, fix JWT sub claim, add `AdminUserGlobalSignOut` ([#183](https://github.com/hectorvent/floci/issues/183))
- **cognito:** enrich User Pool responses and implement `MfaConfig` stub ([#198](https://github.com/hectorvent/floci/issues/198))
- **cognito:** OAuth/OIDC parity for RS256/JWKS, `/oauth2/token`, and OAuth app-client settings ([#97](https://github.com/hectorvent/floci/issues/97))
- Globally inject AWS `request-id` headers for SDK compatibility ([#146](https://github.com/hectorvent/floci/issues/146))
- Defer startup hooks until HTTP server is ready ([#159](https://github.com/hectorvent/floci/issues/159))
- **dynamodb:** fix `FilterExpression` for `BOOL` types, List/Set `contains`, and nested attribute paths ([#137](https://github.com/hectorvent/floci/issues/137))
- **lambda:** copy function code to `/var/runtime` for provided runtimes ([#114](https://github.com/hectorvent/floci/issues/114))
- Resolve CloudFormation Lambda `Code.S3Key` base64 decode error ([#62](https://github.com/hectorvent/floci/issues/62))
- Resolve numeric `ExpressionAttributeNames` in DynamoDB expressions ([#192](https://github.com/hectorvent/floci/issues/192))
- Return stable cursor tokens in `GetLogEvents` to fix SDK pagination loop ([#184](https://github.com/hectorvent/floci/issues/184))
- **s3:** evaluate S3 CORS against incoming HTTP requests ([#131](https://github.com/hectorvent/floci/issues/131))
- **s3:** fix list parts for multipart upload ([#164](https://github.com/hectorvent/floci/issues/164))
- **s3:** persist `Content-Encoding` header on S3 objects ([#57](https://github.com/hectorvent/floci/issues/57))
- **s3:** prevent `S3VirtualHostFilter` from hijacking non-S3 requests ([#199](https://github.com/hectorvent/floci/issues/199))
- **s3:** resolve file/folder name collision on persistent filesystem ([#134](https://github.com/hectorvent/floci/issues/134))
- **s3:** return `CommonPrefixes` in `ListObjects` when delimiter is specified ([#133](https://github.com/hectorvent/floci/issues/133))
- **secretsmanager:** return `KmsKeyId` in `DescribeSecret` and improve `ListSecrets` ([#195](https://github.com/hectorvent/floci/issues/195))
- **sns:** enforce `FilterPolicy` on message delivery ([#53](https://github.com/hectorvent/floci/issues/53))
- **sns:** honor `RawMessageDelivery` attribute for SQS subscriptions ([#54](https://github.com/hectorvent/floci/issues/54))
- **sns:** pass `messageDeduplicationId` from FIFO topics to SQS FIFO queues ([#171](https://github.com/hectorvent/floci/issues/171))
- **sqs:** route queue URL path requests to SQS handler ([#153](https://github.com/hectorvent/floci/issues/153))
- **sqs:** support binary message attributes and fix `MD5OfMessageAttributes` ([#168](https://github.com/hectorvent/floci/issues/168))
- **sqs:** translate Query-protocol error codes to JSON `__type` equivalents ([#59](https://github.com/hectorvent/floci/issues/59))
- Support DynamoDB `Query` `BETWEEN` and `ScanIndexForward=false` ([#160](https://github.com/hectorvent/floci/issues/160))

## [1.1.0] - 2026-03-31

### Added

- **acm:** add ACM certificate management service ([#21](https://github.com/hectorvent/floci/issues/21))
- Add `HOSTNAME_EXTERNAL` support for multi-container Docker setups ([#82](https://github.com/hectorvent/floci/issues/82))
- Add JSONata query language support for Step Functions ([#84](https://github.com/hectorvent/floci/issues/84))
- Add Kinesis `ListShards` operation ([#61](https://github.com/hectorvent/floci/issues/61))
- **opensearch:** add OpenSearch service emulation ([#132](https://github.com/hectorvent/floci/issues/132))
- **ses:** add SES (Simple Email Service) emulation ([#14](https://github.com/hectorvent/floci/issues/14))
- Add virtual host support for S3 bucket routing ([#88](https://github.com/hectorvent/floci/issues/88))
- **apigateway:** add AWS integration type for API Gateway REST v1 ([#108](https://github.com/hectorvent/floci/issues/108))
- **apigateway:** OpenAPI/Swagger import, models, and request validation ([#113](https://github.com/hectorvent/floci/issues/113))
- Docker image with AWS CLI (`floci:x.y.z-aws`) ([#95](https://github.com/hectorvent/floci/issues/95))
- Implement `GetRandomPassword` for Secrets Manager ([#80](https://github.com/hectorvent/floci/issues/80))
- **s3:** add presigned POST upload support ([#120](https://github.com/hectorvent/floci/issues/120))
- **s3:** add `Range` header support for `GetObject` ([#44](https://github.com/hectorvent/floci/issues/44))
- **s3:** add conditional request headers ([#48](https://github.com/hectorvent/floci/issues/48))
- **sfn:** add DynamoDB AWS SDK integration ([#103](https://github.com/hectorvent/floci/issues/103))

### Fixed

- Added `versionId` to S3 notifications for versioning-enabled buckets ([#135](https://github.com/hectorvent/floci/issues/135))
- Align S3 `CreateBucket` and `HeadBucket` region behavior with AWS ([#75](https://github.com/hectorvent/floci/issues/75))
- DynamoDB table creation compatibility with Terraform AWS provider v6 ([#89](https://github.com/hectorvent/floci/issues/89))
- **dynamodb:** apply filter expressions in `Query` ([#123](https://github.com/hectorvent/floci/issues/123))
- **dynamodb:** respect `if_not_exists` for `update_item` ([#102](https://github.com/hectorvent/floci/issues/102))
- Fix S3 `NoSuchKey` for non-ASCII keys ([#112](https://github.com/hectorvent/floci/issues/112))
- **kms:** allow ARN and alias to encrypt ([#69](https://github.com/hectorvent/floci/issues/69))
- Resolve compatibility test failures across multiple services ([#109](https://github.com/hectorvent/floci/issues/109))
- **s3:** allow upload up to 512 MB by default ([#110](https://github.com/hectorvent/floci/issues/110))
- **sns:** add `PublishBatch` support to JSON protocol handler
- Storage load after backend is created ([#71](https://github.com/hectorvent/floci/issues/71))

## [1.0.11] - 2026-03-24

### Fixed

- **s3:** add `GetObjectAttributes` and metadata parity ([#29](https://github.com/hectorvent/floci/issues/29))

## [1.0.10] - 2026-03-24

### Fixed

- **s3:** return `versionId` in `CompleteMultipartUpload` response ([#35](https://github.com/hectorvent/floci/issues/35))

## [1.0.9] - 2026-03-24

### Added

- **lambda:** add Ruby runtime support ([#18](https://github.com/hectorvent/floci/issues/18))

## [1.0.8] - 2026-03-24

### Fixed

- **s3:** return `NoSuchVersion` error for non-existent `versionId`

## [1.0.7] - 2026-03-24

### Fixed

- **s3:** fix unit test error

## [1.0.6] - 2026-03-24

### Fixed

- **s3:** truncate `LastModified` timestamps to second precision ([#24](https://github.com/hectorvent/floci/issues/24))

## [1.0.5] - 2026-03-23

### Fixed

- **s3:** fix `CreateBucket` response format for Rust SDK compatibility ([#11](https://github.com/hectorvent/floci/issues/11))

## [1.0.4] - 2026-03-20

### Fixed

- **ci:** fix Docker build on native pipeline
- **ci:** fix workflow artifact download path

## [1.0.2] - 2026-03-15

### Fixed

- **ci:** fix Docker build action trigger

## [1.0.1] - 2026-03-15

### Fixed

- **ci:** fix GitHub Actions workflow trigger

## [1.0.0] - 2026-03-15

Initial public release of Floci — a fast, free, open-source local AWS emulator.

### Added

- SSM, SQS, SNS, SES, S3, DynamoDB, Lambda, API Gateway, Cognito, KMS, Kinesis, Secrets Manager,
  CloudFormation, Step Functions, IAM, STS, ElastiCache, RDS, EventBridge, and CloudWatch emulation
- AWS SDK and CLI wire-protocol compatibility on port 4566
- Native binary and JVM Docker images
- In-memory, persistent, hybrid, and WAL storage modes

---

[1.5.33]: https://github.com/floci-io/floci/compare/1.5.32...1.5.33
[1.5.31]: https://github.com/floci-io/floci/compare/1.5.31...1.5.32
[1.5.31]: https://github.com/floci-io/floci/compare/1.5.30...1.5.31
[1.5.30]: https://github.com/floci-io/floci/compare/1.5.29...1.5.30
[1.5.29]: https://github.com/floci-io/floci/compare/1.5.28...1.5.29
[1.5.28]: https://github.com/floci-io/floci/compare/1.5.27...1.5.28
[1.5.27]: https://github.com/floci-io/floci/compare/1.5.26...1.5.27
[1.5.26]: https://github.com/floci-io/floci/compare/1.5.25...1.5.26
[1.5.25]: https://github.com/floci-io/floci/compare/1.5.24...1.5.25
[1.5.24]: https://github.com/floci-io/floci/compare/1.5.23...1.5.24
[1.5.23]: https://github.com/floci-io/floci/compare/1.5.22...1.5.23
[1.5.22]: https://github.com/floci-io/floci/compare/1.5.21...1.5.22
[1.5.21]: https://github.com/floci-io/floci/compare/1.5.20...1.5.21
[1.5.20]: https://github.com/floci-io/floci/compare/1.5.19...1.5.20
[1.5.19]: https://github.com/floci-io/floci/compare/1.5.18...1.5.19
[1.5.18]: https://github.com/floci-io/floci/compare/1.5.17...1.5.18
[1.5.17]: https://github.com/floci-io/floci/compare/1.5.16...1.5.17
[1.5.16]: https://github.com/floci-io/floci/compare/1.5.15...1.5.16
[1.5.15]: https://github.com/floci-io/floci/compare/1.5.14...1.5.15
[1.5.14]: https://github.com/floci-io/floci/compare/1.5.13...1.5.14
[1.5.13]: https://github.com/floci-io/floci/compare/1.5.12...1.5.13
[1.5.12]: https://github.com/floci-io/floci/compare/1.5.11...1.5.12
[1.5.11]: https://github.com/floci-io/floci/compare/1.5.10...1.5.11
[1.5.10]: https://github.com/floci-io/floci/compare/1.5.9...1.5.10
[1.5.9]: https://github.com/floci-io/floci/compare/1.5.8...1.5.9
[1.5.8]: https://github.com/floci-io/floci/compare/1.5.7...1.5.8
[1.5.7]: https://github.com/floci-io/floci/compare/1.5.5...1.5.7
[1.5.6]: https://github.com/floci-io/floci/compare/1.5.5...1.5.7
[1.5.5]: https://github.com/floci-io/floci/compare/1.5.4...1.5.5
[1.5.4]: https://github.com/floci-io/floci/compare/1.5.3...1.5.4
[1.5.3]: https://github.com/floci-io/floci/compare/1.5.2...1.5.3
[1.5.2]: https://github.com/floci-io/floci/compare/1.5.1...1.5.2
[1.5.1]: https://github.com/floci-io/floci/compare/1.5.0...1.5.1
[1.5.0]: https://github.com/floci-io/floci/compare/1.4.0...1.5.0
[1.4.0]: https://github.com/floci-io/floci/compare/1.3.0...1.4.0
[1.3.0]: https://github.com/floci-io/floci/compare/1.2.0...1.3.0
[1.2.0]: https://github.com/hectorvent/floci/compare/1.1.0...1.2.0
[1.1.0]: https://github.com/hectorvent/floci/compare/1.0.11...1.1.0
[1.0.11]: https://github.com/hectorvent/floci/compare/1.0.10...1.0.11
[1.0.10]: https://github.com/hectorvent/floci/compare/1.0.9...1.0.10
[1.0.9]: https://github.com/hectorvent/floci/compare/1.0.8...1.0.9
[1.0.8]: https://github.com/hectorvent/floci/compare/1.0.7...1.0.8
[1.0.7]: https://github.com/hectorvent/floci/compare/1.0.6...1.0.7
[1.0.6]: https://github.com/hectorvent/floci/compare/1.0.5...1.0.6
[1.0.5]: https://github.com/hectorvent/floci/compare/1.0.4...1.0.5
[1.0.4]: https://github.com/hectorvent/floci/compare/1.0.3...1.0.4
[1.0.2]: https://github.com/hectorvent/floci/compare/1.0.1...1.0.2
[1.0.1]: https://github.com/hectorvent/floci/compare/1.0.0...1.0.1
[1.0.0]: https://github.com/hectorvent/floci/releases/tag/1.0.0