FlociClone/CHANGELOG.md

Changelog

Entries in this file are generated by semantic-release from Conventional Commit messages — do not edit it by hand; your commit message is the changelog entry. Historic sections at the bottom were maintained by hand in the Keep a Changelog format.

2.1.0 (2026-09-15)

Bug Fixes

• acm: reflect the requested ValidationDomain in DescribeCertificate (#3264) (922eb0b)
• acm: reject RequestCertificate key algorithms real ACM does not support (#3044) (db6c419), closes #3027
• acm: report SUCCESS domain validation once a certificate is issued (#3112) (9b28388)
• acm: stop hex-shaped names becoming bogus IP address SANs (#3335) (7a7531a)
• amazonmq: add configuration for AMQP and console host port ranges (#3315) (2d5a8f7)
• apigateway: add missing authorizer arg to two VtlContext test calls (38056a0), closes #3560
• apigateway: allow idempotent custom-id tags (#3430) (eb62225)
• apigateway: answer an unmatched REST request with 403, not 404/405 (#3547) (fb82fb2)
• apigateway: decode the ~0 JSON Pointer escape in stage method-settings patch paths (#3526) (bc44fc9)
• apigateway: enforce ApiKeyRequired on REST API methods (#3537) (3b31c5a), closes #3507 #3507
• apigateway: enforce AWS_IAM authorization on the execute-api data plane (#2895) (06349c8), closes #2810
• apigateway: expose VTL authorizer and parameter maps (#3538) (2290247)
• apigateway: fall back to a parameterised sibling on method mismatch (#3399) (f03a716)
• apigateway: implement MOCK integration response selection based on status code (#3327) (8d011cb)
• apigateway: import x-amazon-apigateway-any-method on OpenAPI import (#2876) (b85dd2b)
• apigateway: include apiKeyId in the REQUEST authorizer identity context (#3143) (dced3e7)
• apigateway: only emit the greedy path parameter for greedy resources (#3397) (547090b)
• apigateway: prefer path parameters in VTL lookups (#3560) (166b13a)
• apigateway: report rootResourceId and the API key defaults (#3269) (c57b8ff)
• apigateway: return the full integration configuration on read-back (#3432) (a91d7be)
• apigateway: take the last value of a repeated query string parameter (#3548) (e8edc3d)
• apigatewayv2: provision integration, route and stage on quick create (#2877) (2a637d3), closes #1902
• appconfigdata: honor requested poll interval (#3092) (8686651)
• appconfigdata: return empty payload on repeat polls (#3295) (47d96f6)
• appsync: verify JWT signatures and SigV4 requests for GraphQL auth (#3541) (f38a384)
• athena: project the column names the Glue table declares (#3414) (ebe9cf2)
• athena: read a projecting table's partition paths, not its whole location (#3415) (6d6940b)
• athena: register every Glue database as a DuckDB schema so . resolves (#2993) (0ab9979)
• autoscaling: round-trip launch configuration InstanceMonitoring and BlockDeviceMappings (#3174) (4cc850e)
• autoscaling: round-trip the dropped Auto Scaling group fields (#3494) (cebb011)
• autoscaling: validate monitoring booleans (#3219) (84a7ce6)
• bound CloudTrail delivery retries (#3298) (d44a3fe)
• build: publish arm64 baseline release image (#3461) (e0d4318)
• cdk: parse CDK endpoint URLs safely (#3352) (c5e1a7f)
• cloudcontrol: reject ListResources for unsupported resource types instead of returning empty (#3141) (5cf10ec), closes #2043
• cloudcontrol: scope resources by caller account (#3244) (b6080ea)
• cloudformation: apply AWS::SQS::Queue tags from the template (#3532) (a5045d3), closes #2985
• cloudformation: delete AWS::IAM::User on stack deletion (#3076) (7b5c6e2), closes #2490
• cloudformation: expand AWS::Serverless::StateMachine, and reject every unresolvable DefinitionUri on both StateMachine and HttpApi (#2885) (f2b4c08)
• cloudformation: expose the RDS resource-id GetAtt attributes (#3527) (b618fa9)
• cloudformation: identify unsupported SAM Cognito authorizers (#3535) (809ce40)
• cloudformation: keep a generated physical name across stack updates (#2788) (1528c65)
• cloudformation: keep generated names across updates for Scheduler, SQS and MicrovmImage (#2985) (9162b99), closes #2788
• cloudformation: keep unchanged VPCs and security groups on stack update (#3033) (dde11ae)
• cloudformation: merge Fn::Transform AWS::Include before provisioning, and honour GetTemplate TemplateStage (#2886) (77b4881)
• cloudformation: persist FunctionResponseTypes on Lambda::EventSourceMapping (#2964) (9e2c031), closes #2848
• cloudformation: preserve list intrinsics and conditional tags (#2986) (9f44254)
• cloudformation: preserve SAM implicit API auth (#3501) (8963c66)
• cloudformation: provision AWS::Scheduler::ScheduleGroup (#2796) (961d82d)
• cloudformation: provision CloudFront policies and origin access controls (#3228) (895adce), closes #2441
• cloudformation: reconcile AWS::Pipes::Pipe on UpdateStack (#2970) (a31a959)
• cloudformation: refuse UpdateStack on a ROLLBACK_COMPLETE stack (#3104) (d2d7eb4), closes #3097
• cloudformation: replace AWS RDSDBCluster when EngineMode or StorageEncrypted changes (#3555) (589b1ab)
• cloudformation: resolve dynamic references for all template values (#3301) (924e35c), closes ProvisionContext#resolveOptional #2213
• cloudformation: resolve FunctionResponseTypes through whole-property intrinsics (#2996) (9eb4fc8), closes #2964 #2964 #2796 #2946
• cloudformation: resolve list-valued intrinsics for DBSubnetGroup SubnetIds (#2946) (f214050), closes #2937 #2937 #2937 #2937 #2937 #2937 #2937
• cloudformation: scope stack state by account (#3185) (0cff315)
• cloudformation: set Fn::GetAtt attributes the schemas declare (#2761) (7095641)
• cloudformation: skip re-invoking custom resource handlers when properties are unchanged (#2785) (71c7836)
• cloudformation: validate WAFv2 WebACL and Config rule required properties (#3576) (36c8396), closes #2711
• cloudformation: wire Route53 and Scheduler provisioners into the test fixture (#2922) (cf10d25), closes #2722 #2796
• cloudfront: echo OriginSslProtocols and round-trip legacy cache behavior fields (#3182) (006f3c7)
• cloudfront: echo TrustedSigners in cache behaviors so the AWS provider does not segfault (#3015) (75e93e5), closes #2767
• cloudfront: emit origin timeout fields (#3299) (3523378), closes #3221
• cloudfront: persist and echo LambdaFunctionAssociations and FunctionAssociations (#2915) (3d3ab00), closes #2835
• cloudfront: report Logging on distribution reads (#3318) (d4e9dcb)
• cloudfront: stop duplicating CachedMethods into AllowedMethods.Items (#3217) (9e9b0b6)
• cloudhsmv2: tighten backup and tag fidelity (#3443) (daff15d)
• cloudtrail: bound log flush memory (#3293) (d3530d9)
• cloudtrail: implement CreateTrail with tagging support and add integration tests (#3206) (991470e)
• cloudtrail: serialize trail mutations to prevent lost updates (#2911) (8c2619f), closes #2904
• cloudtrail: stop CloudTrailLogWriterBoundedRetryIntegrationTest relying on S3 key order (#3363) (34be181), closes #3361
• cloudwatch: fail Logs Insights queries with unsupported syntax instead of silently dropping it (#3139) (121a929)
• cloudwatchlogs: bound stored events and enforce retention (#3611) (6ce3fbb)
• cloudwatch: wrap TagResource and UntagResource in their declared Result element (#3211) (65db87d)
• codebuild: persist build numbers across restarts (#3049) (51f5591)
• codebuild: resolve project ARNs in batch lookup (#2999) (de92212)
• codedeploy: default server hook timeout to one hour (#3606) (73ef15f)
• codedeploy: fail closed on unreachable, erroring, or timed-out lifecycle hooks (#3563) (d167cc5)
• codepipeline: cap QUEUED and PARALLEL pipelines at 50 active executions (#3503) (2104b33)
• codepipeline: poll S3 source changes (#3525) (ffd2488)
• codepipeline: populate stage execution status (#3478) (129ba0a)
• cognito: clear stale pending admin updates (#2533) (a704f73)
• cognito: delete a pool's users and resource servers on DeleteUserPool (#3419) (c48e81d), closes #2858
• cognito: delete a user pool's records with the pool (#2949) (2a4ca61), closes #3419 #2864 #2936 #2864
• cognito: fail listUsers/listUserPoolClients on an absent user pool (#2962) (4bf17a1), closes #2952
• cognito: invoke the CustomMessage Lambda trigger before delivering verification emails (#3140) (148ec83)
• cognito: name missing user pools in errors (#2936) (c30ca8f)
• cognito: serialize attribute verification updates (#2535) (530717e)
• cognito: verify self-service access tokens (#3184) (3c247eb)
• compat: avoid CloudWatch statistics time race (#3320) (bf49390)
• compat: require Kinesis stream details (#3321) (53a5164)
• compat: retry RedshiftTest's SDK calls past a brief connection-refused hiccup (#3216) (974d357)
• config: accept any Host header again after the Quarkus 3.39 upgrade (#3222) (1f4d43c), closes #3175
• core: accept ARNs from every AWS partition (#3376) (1726c6a), closes #2485
• core: accept only JSON objects as JSON protocol request bodies (#3509) (9f9a828)
• core: prevent REST JSON requests falling through to S3 (#3498) (e62e99f)
• core: quarantine unreadable hybrid storage (#2250) (cc8b8e9)
• core: read ARN resource segments by structure, not by position (#3392) (7c08b35)
• docdb: accept an existing security group on CreateDBCluster and ModifyDBCluster (#2991) (91d7ab8), closes #2990
• docker: allow explicit root for restricted sockets (#3558) (d8e7382)
• docker: PortAllocator also checks ports other containers already publish on the host (#2805) (afa5960)
• docker: produce a working native image from Dockerfile.native (#3325) (a501eab)
• docker: translate misleading disk-quota error for keyring exhaustion (#2797) (7828ab2), closes floci-io/floci#2243
• dynamodb: add missing request validation (#3287) (4d199b1)
• dynamodb: append list values for out-of-range indexes (#3088) (f8a1c31)
• dynamodb: apply GSI throughput updates (#3032) (2d26f93), closes #3028
• dynamodb: bind every PartiQL parameter type and reject unordered operands (#3288) (66ca9dc)
• dynamodb: calculate consumed capacity correctly (#3071) (97915d3)
• dynamodb: enforce primary key size limits (#3354) (8624ccc)
• dynamodb: flush persistence once per affected table in batch and transact writes (#2998) (80725e6), closes #2995 #2995 #2995
• dynamodb: honor customer-supplied KMS key for table SSE (#1923) (e313ab5), closes #1811
• dynamodb: keep stream iterators stable after trimming (#3313) (b377134)
• dynamodb: match AWS on UpdateItem results and request limits (#3447) (6d43e16)
• dynamodb: match AWS wording and order for Select rejections (#3410) (dffe34e)
• dynamodb: merge shared-prefix projection paths and compact list indices (#3072) (5c8cff6)
• dynamodb: more request validations in Query and Scan (#3360) (fbe92aa), closes #3287
• dynamodb: name the table in the ResourceNotFoundException message (#2929) (58b2e5f)
• dynamodb: partition parallel scan by partition key hash (#3225) (#3429) (9c9aa67)
• dynamodb: re-check TTL under item lock before sweeper deletes (#3562) (f1bbe12)
• dynamodb: read every attribute through an ALL-projection index in PartiQL (#3309) (4cb9314)
• dynamodb: reject a BETWEEN with reversed bounds at parse time (#3183) (df0bf82)
• dynamodb: reject ConsistentRead on GSI Scan (#2931) (6dec214)
• dynamodb: reject out-of-bound query cursors (#3389) (862e4a1)
• dynamodb: reject QueryFilter with KeyConditionExpression (#2935) (7d693de)
• dynamodb: reject unused ExpressionAttributeNames/Values on PutItem, DeleteItem, Scan, Query (#2923) (262495d), closes #2893 #2893 #st #2893
• dynamodb: route Kinesis CDC to the table owner's account and retry failed forwards (#3063) (a9df872)
• dynamodb: stage transact write mutations before commit (#3189) (8343583)
• dynamodb: word BatchWriteItem key rejections the way AWS does (#3227) (f4954de)
• ec2,ecr,eks,elasticache,msk,opensearch: degrade gracefully with no Docker daemon (#2975) (1aa981f), closes #2386 #3023
• ec2,ssm: explain missing IMDS registration for SSM-only managed instances (#3283) (f77cf4d)
• ec2: add network capacity to instance type responses (#3179) (f9686d5)
• ec2: align catalog image owner filtering (#3463) (a6f1751)
• ec2: answer DescribeTransitGatewayConnects with an empty list (#3274) (f30ba77)
• ec2: bound launches and close userdata streams (#3135) (dd33308)
• ec2: bound user data output capture (#3144) (653c139)
• ec2: build the instance AWS_ENDPOINT_URL from the shared container endpoint (#3579) (1ae779a), closes #3578
• ec2: carry DeliverLogsPermissionArn through CreateFlowLogs and DescribeFlowLogs (#3172) (acc0904)
• ec2: describe launchable unknown AMI ids in DescribeImages (#3168) (de5dc0d)
• ec2: generate real key material in CreateKeyPair and fingerprint imported keys (#3307) (2fbe2b7), closes PKCS#1 PKCS#8
• ec2: guard null group entries in DescribeNetworkInterfaces group-id filter (#2887) (5c71713)
• ec2: honor AMI architecture for containers (#3096) (43cdbe2)
• ec2: include network metadata in instance type responses (#2943) (c54b237)
• ec2: include supported usage classes in DescribeInstanceTypes (#3347) (19f410d)
• ec2: let dnf swap curl-minimal for curl when installing the IMDS proxy (#3284) (5648be7), closes floci-io/floci#3281
• ec2: match cidr-block-association filters on DescribeVpcs (#3257) (eb3a6b2), closes #3256
• ec2: nest cidrBlockState in AssociateVpcCidrBlock response (#3243) (496b376), closes #3241
• ec2: place a subnet in the zone its request names, not always az1 (#2890) (c32f8b5)
• ec2: reclaim instance containers orphaned by a hard restart (#3031) (94b9665), closes #2029
• ec2: register all guest network addresses with IMDS (#3546) (3c6568b)
• ec2: reject a CreateSubnet whose CIDR overlaps an existing subnet (#3171) (614166f)
• ec2: report a NAT gateway's addresses, not just its allocation id (#2892) (bed2704)
• ec2: report NotFound for launch templates requested by name (#3246) (8bc4891), closes #3234
• ec2: store and validate CreateVpcEndpoint SubnetConfiguration (#3491) (5d0b0b4)
• ec2: store instance metadata options and add ModifyInstanceMetadataOptions (#3215) (5eacd01), closes lex00/floci#116
• ec2: tolerate a null groupId in the network-interface group-id filter (#2921) (e44df51)
• ecr: clean up registry storage (#2982) (732e009)
• ecr: enforce immutable image tags (#3009) (9507996)
• ecr: join the ECR API with the backing registry (#2466) (064f302)
• ecr: recover backing registry containers (#3486) (8e3bd63)
• ecs: enforce host-volume bind-mount safety fail-closed at register and run time (#3543) (126af73)
• ecs: reconcile services in every account, not just the default one (#3297) (42bc0d9)
• efs: implement UpdateFileSystemProtection and report protection on describe (#2842) (db182b3)
• eks: validate IAM authentication tokens (#2912) (309043b)
• elasticache: honor the requested Port on CreateReplicationGroup (#3276) (67198c7)
• elasticache: implement parameter group reservation to prevent deletion during provisioning (#3023) (d398376)
• elasticache: resolve order-dependent crossGroupAuthIsRejected test failure (#1991) (#3074) (173ff45)
• elbv2: bound Lambda and target body sizes (#3149) (ec41b1e)
• elbv2: do not let a listener bind a port Floci reserves for itself (#3034) (bf517ac)
• elbv2: drop access logs from a Gateway Load Balancer's attributes (9bf93b9)
• elbv2: report the attribute defaults, not only what was modified (910e64e)
• eventbridge,scheduler: read cron day-of-week as AWS 1-7 SUN-SAT (#3147) (60a8a9d), closes 2#1
• eventbridge: scope replay cancellation by ARN (#3058) (2e303e2)
• firehose: isolate streams by account and region (#3267) (141b159)
• firehose: keep buffered records when S3 delivery fails (#3471) (6507f32)
• github-actions: continue Docker compatibility tests after failures (#3351) (051a2f0)
• glue: bound DeleteSchemaVersions ranges before expanding them (#3508) (76c1907)
• glue: populate CatalogId on GetDatabase and GetDatabases (#2814) (342f58b), closes #2793
• guardduty: scope organization state across accounts (#3278) (ed116ae)
• honor Kinesis ExplicitHashKey routing (#3069) (a006b27)
• iam: distinguish cross-account resource grants (#3590) (2f76640)
• iam: enforce temporary credential lifecycle (#3487) (ad1061c)
• iam: report the real default version of AWS-managed policies (#3275) (abfa8e9)
• iam: resolve DynamoDB table ARN from request body for IAM enforcement (#2928) (3db883d), closes #2925
• iam: use AWS-managed policy documents (#3237) (379910b)
• identitystore: self-heal the bootstrap identity store on hasIdentityStore (#3387) (b87ee5b), closes #3386
• init-hooks: terminate hook process trees on timeout (#3372) (d99f162)
• iot: isolate topic rule actions and run the error action (#3012) (7ec4c89)
• kinesis: handle minimum partition key hash (#2950) (30b8f88)
• kinesis: reject non-string tag members instead of coercing them (#3099) (fcb5bd0), closes #2512
• kinesis: stop dropping shard records under concurrent producers and resharding (#3000) (73deb13)
• kms: apply real RSAES-OAEP for RSA keys in Encrypt and Decrypt (#3038) (e5afe35), closes #3024
• kms: give ECC_NIST_EDWARDS25519 an actual Ed25519 key (#2930) (146753b), closes #2924
• kms: protect ciphertext blobs with an AES-GCM envelope (#3544) (494bab4)
• kms: support ML-DSA keys (#3047) (b713c4b)
• kms: support SM2 signing in China regions (#3046) (5198cf2)
• kms: validate KeyUsage against KeySpec on CreateKey (#2787) (#3004) (69e8bf1)
• lambda: apply Architectures on UpdateFunctionCode (#2907) (9b582b3)
• lambda: bound ZIP extraction resources (#3127) (0fce2d2)
• lambda: correct Function URL body encoding, cookies, and error status (#3196) (d049875), closes #3153
• lambda: defer handler validation to invocation (#3332) (8b25e50), closes #3311
• lambda: deliver extension INVOKE when the runtime receives the invocation (#3070) (43e2a48), closes #2573
• lambda: do not publish a version when nothing has changed (#2941) (c48b6b0), closes #2822
• lambda: enforce handler deadline at dispatch (#3177) (438ae61), closes #3154
• lambda: fail the whole SQS batch on malformed batchItemFailures (#3169) (bcd422a), closes #3152
• lambda: give each published version its own copy of the code (#3041) (4ee5a52), closes #2958
• lambda: honor configured function architecture (#2994) (7fdd145)
• lambda: honor DynamoDB stream partial batch failures (#3466) (c6316d1)
• lambda: honor MaximumBatchingWindowInSeconds on SQS event source mappings (#3203) (ec2d678), closes #3155
• lambda: honor MaximumRetryAttempts and DestinationConfig.OnFailure for DynamoDB Streams ESM (#3263) (#3428) (1af3b56)
• lambda: honour Qualifier on GetFunction and GetFunctionConfiguration (#2932) (cf628ba), closes #1988 #2821
• lambda: honour the CodeSha256 precondition on PublishVersion (#2939) (3d2b882), closes #2822
• lambda: omit Environment when no variables are set (#2838) (2bf9b57)
• lambda: persist, validate and enforce event source mapping FilterCriteria (#3060) (5512db0)
• lambda: recover a DynamoDB Streams ESM from a trimmed checkpoint (#3412) (62abde8)
• lambda: reject dotted and over-length function names (#3300) (49903ab), closes #3238
• lambda: reject scalar structure members (#3051) (ec034a5)
• lambda: replace the fabric8 kubernetes client with a plain REST client (#2919) (97ce09f), closes #2914 PKCS#8
• lambda: report real runtime errors instead of Function.TimedOut (#3505) (34062f6), closes #3314
• lambda: resolve layer version ARNs by account (#2948) (24a8c84), closes #2813 #2813 #2809
• lambda: scope extracted function code by region (#3265) (290559c)
• lambda: serialise the version snapshot against function updates (#3010) (ebd849a), closes #2939 #3041 #3051 #2939 #3007
• lambda: stop rejecting a foreign-platform image the daemon cannot describe (#3357) (570f975)
• lambda: warn before runtime api port exhaustion (#3496) (bea8f85)
• lifecycle: clear storage before services clear on state reset (#3388) (22bae1f)
• lifecycle: run every shutdown step even when one of them fails (#3472) (3bdb019)
• memorydb: scope resources by account and region (#3261) (e02accf)
• mq: match CreateBroker EngineType and DeploymentMode without regard to case (#3268) (c1e5cc2)
• msk: isolate MSK resources by account and region (#3353) (970cd30)
• mwaa: also detect a crashed sibling Postgres container, not just Airflow (#3454) (fe07621)
• mwaa: apply AirflowConfigurationOptions to the Airflow container (#3457) (d429d10), closes #3436
• mwaa: isolate environments by account and region (#3400) (c6e64a0)
• mwaa: mark CREATE_FAILED when the Airflow container exits before becoming ready (#3446) (2a682a6), closes #3437
• mwaa: match real MWAA's Airflow/Python pairing for the emulated image tag (#3445) (473a26a), closes #3438
• mwaa: probe the metadata database over TCP before starting Airflow (#3406) (be578ac)
• mwaa: reject a malformed configured AirflowVersion as ValidationException (#3453) (a7902b9)
• neptune: isolate resources by account and region (#3401) (70176d6)
• networkfirewall: model CreateFirewall* collisions and enforce UpdateToken (#3198) (215a802), closes #2600
• opensearch: include CognitoOptions in domain status (#2860) (047db09), closes #2801
• opensearch: keep publishing the domain's host port when floci runs in a container (#2798) (96c55ec)
• opensearch: keep readiness polling after errors (#3373) (713a166)
• organizations: return account state (#3053) (587d0b5)
• parse S3 EventBridge notification XML (#3350) (ad9a88c)
• pipes: replace kafka-clients with a Kafka REST Proxy client (#3160) (cd2847d)
• pipes: restore a CloudFormation snapshot without re-validating it (#3218) (d95ed9f), closes #3192 #3209
• ram: emulate organization sharing side effects (#3279) (d322d48)
• ram: enforce resource share principal visibility (#3266) (8e10fd1)
• rds: bound PostgreSQL handshake packet lengths (#3102) (148ea6f)
• rds: bound RDS/Redshift auth proxy connections and handshakes (#3545) (1987bf0)
• rds: enhance DB cluster handling by recording createOnly properties and updating rollback logic (#3636) (b2b43df)
• rds: format unexpected query errors as XML error envelope (#3121) (daeea78), closes #3110
• rds: keep the control plane working with no Docker daemon (#3170) (49dfd1b), closes lex00/floci#38
• rds: map Aurora MySQL engine versions to the MySQL image tag (#3382) (d9cc2a0)
• rds: persist PubliclyAccessible on Create/ModifyDBInstance and echo it on Describe (#2484) (d45a437), closes #2420
• rds: populate MasterUserSecret for Aurora clusters with ManageMasterUserPassword (#3148) (6345c37), closes #3061
• rds: preserve aurora engine identity in parameter group names and managed secrets (#1920) (5719e65), closes #1829
• rds: register instances before starting auth proxy (#3467) (34efd89)
• rds: report backing container failures (#3455) (68c783b)
• rds: run IAM PostgreSQL sessions as the role named in the token (#3106) (c22ded9), closes #3087
• rds: scope event reconciliation and prune history (#3533) (04f0c3b)
• rds: support tagging DB proxy target groups (#3145) (e0bf589)
• rds: use MySQL 8.4 auth options (#3001) (e26e9a6)
• rds: wait for the final PostgreSQL server before reporting the instance ready (#3405) (14b0875), closes #3384
• redshift: emit ClusterAvailabilityStatus and AvailabilityZoneRelocationStatus (#3109) (025ac71), closes #3098
• resourceexplorer2: reject invalid pagination tokens (#3444) (f482a2d)
• route53: require exact match for ChangeResourceRecordSets DELETE (#3565) (9da5895)
• s3: authorize read on copyobject/uploadpartcopy source (#3450) (bb58176), closes #2333
• s3: decode unsigned streaming checksum payloads (#3476) (d11fff3)
• s3: enforce auth on bucket-level config writes when enforce-auth is enabled (#3536) (28105c0), closes #2326 #2335
• s3: enforce source resource policies on object copies (#3539) (19917ed)
• s3: evaluate IAM policy on presigned URL and presigned POST requests (#3504) (8a45211), closes #3195
• s3: honor max-keys=0 and reject invalid max-keys values (#3510) (b994d58)
• s3: honor per-object VersionId in batch DeleteObjects (#3232) (d9cddc5), closes #1045
• s3: honor x-amz-bypass-governance-retention in batch DeleteObjects (#3366) (7d96799)
• s3: honor x-amz-tagging query parameter on presigned PutObject and CreateMultipartUpload (#3615) (52bafb7), closes #3608
• s3: make GetObject atomic against concurrent same-key overwrites (#2874) (b4aab99)
• s3: preserve SSE-KMS key ID metadata (#2145) (d466ffe)
• s3: return composite multipart checksums and match S3 on UploadPart, GetObjectAttributes and CopyObject responses (#3093) (724be0a), closes #877
• s3: route signed multipart requests by virtual host (#3464) (01ec7af)
• s3: shrink getObject's lock to a cheap seqlock check, not the I/O (#2901) (3a212d8)
• s3: validate multipart completion parts (#3312) (31f8860)
• s3: verify SigV4 signature on presigned POST uploads (#3081) (ffab3dc)
• s3: verify the SigV4 header signature when enforce-auth is enabled (#3573) (bfe2b71), closes #1842 #3081 #2332
• s3: verify virtual-hosted presigned URLs (#3048) (3dee17e)
• scheduler: forward MessageAttributes in universal sqs target (#3435) (ffdd5b8)
• secretsmanager: serialize secret version updates with the rotation lock (#3247) (172765a)
• security: map EXTRA_CORS_* env variables to enable global CORS preflight (#1890) (18044d9)
• serialize GetRecords ApproximateArrivalTimestamp as a plain decimal (#2359) (5b4d1af), closes #2099 #2358
• ses: align v1 Query boolean parsing with probed xsd 1.1 behavior (#3075) (f677eda)
• ses: create email identities atomically so failures leave nothing behind (#3146) (618ca58)
• sfn: apply state input and output paths (#3289) (9fa36e9), closes #3258
• sfn: enforce the alias and published version quotas per state machine (#3580) (4707d4d), closes #3575 #3614
• sfn: fail States.Runtime on an unresolvable JSONPath in a payload template (#3199) (618f52e), closes #2521
• sfn: merge ResultPath at a bracket-index reference path (#3483) (99c19d0), closes #3479
• sfn: preserve Lambda function errors (#3456) (ae58097)
• sfn: preserve mocked response indexes (#3391) (78cf107)
• sfn: resolve context reference paths (#3390) (ce07393)
• sfn: return empty objects for null state paths (#3371) (3090e33)
• sfn: support advanced JSONPath expressions (#3398) (5bf8075)
• sfn: treat null as falsy in JSONPath negation (#3497) (c18c80e)
• sns: honor FifoThroughputScope=MessageGroup on FIFO topics (#3181) (a1d0597)
• sqs: bound message move task history (#3292) (520568e)
• sqs: honour ReceiveMessageWaitTimeSeconds when ReceiveMessage omits WaitTimeSeconds (#2989) (ad0f4a1)
• sqs: keep DLQ messages when a move task cannot deliver them (#3470) (a9feb3c)
• sqs: match AWS queue attribute defaults and MaximumMessageSize range (#3626) (1482d45)
• ssm: apply every DescribeParameters filter and page the results (#3646) (ea88947), closes #3642
• ssm: set the Arn attribute on AWS::SSM::Parameter (#3019) (3600038)
• stepfunctions: abort executions abandoned by a restart (#2969) (504203f)
• stepfunctions: fail an intrinsic argument that matches nothing (#2872) (fad54f3), closes #2870 #2927
• stepfunctions: let Express executions reuse names and type the nested StartExecution refusal (#3059) (8a2161a)
• stepfunctions: persist execution history across restarts (#3291) (35159c5)
• stepfunctions: reject the QueryLanguage definitions AWS rejects (#2972) (e3230a7)
• stepfunctions: resolve state machine alias ARNs (#3607) (e828363)
• stepfunctions: resolve the States.Format template argument like every other argument (#2963) (fa265a4), closes #2927
• storage: load each backend once and close WAL writers on shutdown (#3469) (1b83ef3)
• storage: log effective storage mode at boot (#3495) (15eff7e), closes #2225
• storage: migrate legacy entries by exact key (#3408) (d92211d)
• sts: reject unverified web identity tokens (#3151) (1de6b80)
• sts: return ExpiredTokenException for an expired web identity token (#3210) (90fa707), closes #3205
• sts: validate SAML assertions before assuming roles (#3204) (1b12525)
• support SSM PutParameter tags and ECS container healthCheck (#2567) (#3550) (7d6e958)
• swf: improve polling mechanism with timeout and backoff strategy (#3207) (f765195)
• test: disable the GuardDuty organization admin GuardDutyMembersIntegrationTest enables (#3348) (3669c8e)
• test: isolate MQTT WebSocket concurrency from TLS (#3431) (9f36a87)
• test: relax S3 concurrent write stress timeout (#3396) (901b83c)
• test: sign the CopyObject source-permission requests for real (#3588) (62407e2), closes #3539 #3539 #3573 #3573
• test: stop XmlParserTest matching a localized parser message (#3458) (c127794)
• test: tear down the organization DetectiveIntegrationTest creates (#3229) (1a804ae), closes #3226
• test: tear down the organizations the service-managed StackSets test creates (#3158) (6914530), closes #3055
• test: wait for DeleteStack to actually complete in CloudFront policies test (#3473) (ec2ab07)
• tls: fail startup when public listener cannot bind (#3362) (2fd55b5)
• transcribe: isolate jobs and vocabularies by account and region (#3402) (c4ff42b)
• transfer: allow DeleteServer regardless of server state (#2897) (e7256f5), closes #2802 #1834 #2802
• transfer: isolate servers and users by account and region (#3403) (43eace4)
• ui: verify Floci connectivity in readiness probe (#2753) (c0b5461)
• wafv2: reject non-CIDR IPSet addresses (#3511) (a40409f), closes #3328
• wafv2: validate resource names on operations (#3066) (0a57f0a)

Features

• accessanalyzer: add analyzer lifecycle (#3117) (aebed6e)
• account: add alternate contact operations (#3118) (d80734e)
• acm: enhance email validation to report approval mailboxes and omit DNS records (#3290) (8180d4b)
• acm: map CertificateExport and CertificateTransparencyLoggingPreference onto the certificate options (#3111) (6150569)
• acm: provision AWS::CertificateManager::Certificate (#3003) (38176b9)
• agentcore: expand Bedrock AgentCore control-plane coverage (#3317) (483dfb4)
• apigateway: provision AWS::ApiGateway::DomainName and BasePathMapping (#3040) (c3d977a)
• apigateway: support HTTP and HTTP_PROXY integrations on REST APIs (#3433) (96707f6)
• appintegrations: add data and event integrations (#3379) (137a39a)
• aps: implement AMP rule groups namespaces (#3330) (6eca854), closes #3329
• asl: add support for States.ArrayPartition, States.ArrayRange, States.ArrayUnique, and States.MathRandom intrinsics with comprehensive tests (#3224) (cf8466b)
• athena: add UpdateWorkGroup support (#3468) (ea5925f)
• athena: create, update and delete data catalogs (#3381) (cb6b4d8)
• athena: support ListTagsForResource for workgroups (#3242) (b988dc5)
• autoscaling: warm pools, scheduled actions, traffic sources, and process suspension (#2973) (0980114)
• batch: add UpdateComputeEnvironment and DeleteComputeEnvironment (#2857) (3b7ba5c), closes #2293
• batch: support array and multi-node parallel jobs (#3595) (74d4782)
• bcm-pricing-calculator: emulate workload estimates (#3441) (a985773)
• bedrock-agentcore: implement AgentCore Memory events (#3556) (3003f05)
• bedrock-runtime: implement ConverseStream for stub and proxy backends (#2889) (4465575)
• bedrock-runtime: stream ConverseStream incrementally (#3043) (0471d6f)
• bedrock: add guardrail lifecycle and versions (#3380) (cae8f9a)
• budgets: add full service emulation (#3165) (7a5ae96)
• cloudformation: pass EngineMode and StorageEncrypted to RDS clusters (#3482) (4471e92)
• cloudformation: provision AWS::ApiGateway::ApiKey (#3122) (cbde58f)
• cloudformation: provision AWS::ApiGateway::UsagePlan and UsagePlanKey (#3123) (3a4982c)
• cloudformation: provision AWS::AutoScaling::ScalingPolicy (#3124) (17af959)
• cloudformation: provision AWS::Backup::BackupVault (#3125) (631df1d)
• cloudformation: provision AWS::Lambda::Url (#3423) (10becc5)
• cloudformation: provision AWS::SNS::TopicPolicy (#3126) (ba3dd65)
• cloudformation: provision Route 53 hosted zones (#2722) (ab26a42)
• cloudformation: provision the AppSync resource types (#3424) (55ada9b)
• cloudformation: report a stubbed unsupported resource type instead of hiding it (#2971) (5dc0808), closes #2967
• cloudformation: support service-managed stacksets (#3055) (41022d0)
• cloudtrail: implement AddTags, RemoveTags and ListTags (#2934) (671628b), closes floci-io/floci#2297
• cloudtrail: support AdvancedEventSelectors and CloudFormation Trail provisioning (#2720) (fd3c4d9), closes #1192 #1194
• cloudwatch: implement the dashboard operations on both protocols (#2888) (e8eb4f2)
• cloudwatchlogs: add cross-account policy operations (#3089) (6a728f1)
• cloudwatch: provision AWS::CloudWatch::Dashboard (#3231) (460aa07)
• cloudwatch: store and serve metric stream definitions (#3214) (5b7c2c4)
• cognito: check the custom domain certificate in ACM and mark it in use (#3035) (d771783)
• cognitoidentity: identity pool management plane (CRUD, roles, principal-tag maps, tags) (#2977) (dd9cdc1)
• cognito: implement identity provider configuration CRUD (#2858) (0a3bc03)
• cognito: implement log delivery configuration (#2867) (b8f1e22), closes #2855
• cognito: implement managed login branding (#2869) (1e4e8b9), closes #2856
• cognito: implement SetUserPoolMfaConfig (#2831) (906717a)
• cognito: implement user MFA preferences (#2896) (82ee360)
• cognito: implement VerifyUserAttribute (#2018) (36c3ee4)
• cognito: provision AWS::Cognito::UserPoolDomain (#3005) (f3c251e)
• cognito: route custom domains by Host (#3095) (b4d80a5)
• cognito: support pending user attribute verification (#2531) (a03c4d6)
• controlcatalog: add control lookup operations (#3130) (d99675a)
• controltower: add enabled control operations (#3056) (b199894)
• core: derive ARN partition from the region (#3334) (dc61c1a)
• datasync: add the DataSync management plane (#3377) (128d3ef)
• detective: add organization member operations (#3190) (5864b01)
• docker: containers Floci launches trust the Floci CA (#3091) (024bfa0), closes #3079 #3086 #3086
• dynamodb: import tables from S3 and report new exports as IN_PROGRESS (#3138) (cbec02d)
• dynamodb: index-qualified PartiQL SELECT with ConsistentRead validation (#2953) (84ec8ae)
• dynamodb: resource policies and GSI-level OnDemandThroughput (#2976) (17e02ed)
• ec2: answer MonitorInstances and UnmonitorInstances (#3319) (8921ca1)
• ec2: back each VPC with a real Docker network in RFC 1918 space (#3272) (cf1aabc)
• ec2: Capacity Reservation CRUD (#2974) (0c33ef2)
• ec2: capture the instance file system in CreateImage, and implement Deregister/CopyImage (#3306) (a228507)
• ec2: carry the remaining launch template data fields (#3493) (0431677)
• ec2: honour AmazonProvidedIpv6CidrBlock on a VPC (#2891) (0cf3144)
• ec2: implement DescribeSpotPriceHistory (#3359) (ee23e26)
• ec2: implement instant CreateFleet (#2956) (1f87f7c)
• ec2: report instance credit specifications (#3492) (325bdfb)
• ec2: support snapshot block public access (#3490) (fe40e06)
• ec2: support standalone network interface create/attach/detach (#2843) (906af8c)
• ec2: support VPC peering connections (#2654) (14f99a5)
• ecr: prefer locally present images over the loopback registry rewrite (#3022) (23728e0)
• ecs: honor UpdateService forceNewDeployment and emit EventBridge lifecycle events (#2938) (14ca62d), closes #2557 #2557 #2557 #2557 #2557 #2557
• ecs: scope EFS volume mounts to rootDirectory and accessPointId (#3449) (543bde7), closes #2563
• elasticache: add validation for cache parameter group existence in replication group operations (#2957) (6c9cc95)
• eventbridge: run ECS tasks from classic rule targets (#3484) (cfe9f84), closes #2558
• firehose: apply the Lambda transform to buffered records (#3393) (d96516d)
• firehose: convert array, struct and map columns to Parquet (#3521) (6790024)
• firehose: convert JSON records to Parquet via the floci-duck sidecar (#3333) (9a2a893)
• firehose: validate and persist DataFormatConversionConfiguration (#3236) (8a122d2)
• firehose: validate and persist ProcessingConfiguration (#3375) (debf9fb)
• floci-core: resolve active Docker context when DOCKER_HOST is unset (#3197) (e31590b), closes #1990
• globalaccelerator: add the Global Accelerator management plane (#3378) (2e79f5c)
• glue: jobs and crawlers (#2591) (de6bf8f)
• glue: support GetPartitionIndexes (#3416) (606e7b9)
• guardduty: add member account operations (#3052) (b6489ac)
• iam: resolve resource and request tag condition keys for EC2 and S3 (#3212) (64538f7)
• iam: support DynamoDB fine-grained access control (#2926) (#3011) (6653b9a), closes #aliases
• identity-center: complete IAM Identity Center emulation (#3331) (cbfa034)
• identitystore: add full service emulation (#3159) (6264b09)
• inspector2: add organization configuration operations (#3162) (4944764)
• iot: configurable DescribeEndpoint address for published AWS IoT ports (#3202) (53a84c8)
• iot: domain configurations (#3008) (9220c05)
• iot: evaluate the SQL subset of topic rules (#3021) (d45c645)
• iot: firehose and cloudwatchLogs rule actions (#3013) (ebdf092)
• iot: MQTT over TLS listener on 8883 (#3142) (ee2f55b)
• iot: MQTT over WebSocket at /mqtt (#3150) (c4027bb), closes #3142
• iot: provision AWS::IoT::Thing, Policy and TopicRule (#3014) (dec348d)
• iot: real device certificates issued by the local CA (#3079) (c67e598), closes PKCS#10 PKCS#10
• iot: rule SQL message functions, isNull, isUndefined, IN and array literals (#3036) (b88034c)
• iot: verify device certificates on the MQTT TLS listener (#3180) (19a8536)
• kinesis: implement UpdateShardCount API (#3200) (e3766ea), closes #3064
• kms: support ImportKeyMaterial for Origin=EXTERNAL keys (#3068) (37faaa8), closes #1916
• lakeformation: add UpdateResource action (#2944) (ee24c77)
• lambda: mint EKS bearer tokens natively for the kubernetes executor (#2981) (252bfe8), closes #2919
• lambda: provision AWS::Lambda::EventInvokeConfig (#3230) (af42564)
• lambda: support self-managed Apache Kafka event source mappings (#3062) (#3082) (ee5c87d)
• macie2: add organization administration operations (#3105) (3927c66)
• marketplace-agreement: emulate AWS Marketplace Agreement API (#3339) (c99ecea)
• marketplace-catalog: emulate AWS Marketplace Catalog API (#3338) (50fa334)
• marketplace-deployment: emulate AWS Marketplace Deployment API (#3341) (48d2928)
• marketplace-discovery: emulate AWS Marketplace Discovery API (#3342) (07d6cab)
• marketplace-entitlement: emulate AWS Marketplace Entitlement API (#3340) (87f2c2d)
• marketplace-metering: emulate AWS Marketplace Metering API (#3344) (efcbc4d)
• marketplace-reporting: emulate AWS Marketplace Reporting API (#3343) (3c080e1)
• neptune: support the Terraform aws_neptune_cluster read-back contract (#3017) (a7be2dd)
• oam: emulate observability access manager (#3440) (a0fd815)
• pipes: validate ParallelizationFactor on Kinesis and DynamoDB sources (#3192) (5fd89e2)
• ram: support resource-share invitation accept/reject (#3120) (81b8127)
• rds: accept AWS IAM DB auth users on MySQL (#3395) (485b7c5)
• rds: implement CreateDBSnapshot and RestoreDBInstanceFromDBSnap… (#1894) (2869502), closes #1817
• rds: persist EngineMode and StorageEncrypted on DB clusters (#3448) (828b53c), closes #2559
• redshift-data: emulate the Amazon Redshift Data API (#3186) (b9039fe)
• redshift: emulate GetClusterCredentials and GetClusterCredentialsWithIAM (#3273) (6b17ef2)
• redshift: emulate Redshift COPY FROM s3 over Simple Query protocol (#3100) (85180a4)
• redshift: emulate Redshift UNLOAD TO s3 over Simple Query protocol (#3129) (4570bf6)
• redshift: intercept Extended Query protocol (#3474) (e9454af)
• redshift: provision AWS::Redshift::Cluster through CloudFormation (#3427) (e5bd8be)
• redshift: rewrite Redshift table DDL keywords for a PostgreSQL backend (#2947) (17ea9a9)
• redshift: wire the Simple Query DDL interceptor into the proxy (#3029) (4daba7e)
• route53: support cross-account VPC associations (#3116) (162211d)
• route53: update supported operations and add VPC association actions (#2959) (df0e7bc)
• s3: add Intelligent-Tiering configuration CRUD (#2997) (96d16de)
• s3: add object annotations support (#3324) (f9f90cf)
• s3: support bucket analytics and inventory configurations (#3213) (703744c)
• securityhub: add organization configuration operations (#3161) (9d4e71f)
• serve custom domains over TLS as soon as they are created (#3086) (67bbd2c), closes PKCS#8 PKCS#8 PKCS#1 #3035 #3035 #3095 #3095
• servicequotas: add quota request history lookup (#3054) (532e279)
• ses: implement v1 receipt filters (CreateReceiptFilter, ListReceiptFilters, DeleteReceiptFilter) (#3163) (2c6a92c)
• ses: implement v1 receipt rules with locally validated action targets (#3119) (fd665a0)
• ses: implement v1 ReorderReceiptRuleSet and CloneReceiptRuleSet (#3176) (f485122)
• ses: preserve raw message fidelity and envelope sender in the SMTP relay (#3522) (505b5d2)
• ses: support tag operations on tenant ARNs (#2832) (812911f)
• ses: support v2 dedicated IP (IP-level) and scaling/warmup APIs (#3420) (e219ea4)
• sfn: publish history events for Parallel branches and Map iterations (#3167) (fd21ac9)
• ssm: answer the public Amazon Linux AMI parameters (#3173) (8142457)
• ssm: model documents and associations with full lifecycle operations (#3057) (f00fb4c)
• ssoadmin: add permission sets and assignments (#3103) (1bf7494)
• stepfunctions: add SNS Publish service integration (#3316) (283890d)
• stepfunctions: close ASL gaps in intrinsics, Choice, StartExecution and ResultPath (#3002) (352d89f)
• stepfunctions: resolve Fail state ErrorPath and CausePath dynamically (#3302) (650914f), closes #3255
• tls: a local root CA that signs Floci's server certificate (#3078) (3c6c005)
• translate: add Amazon Translate mock service (#2879) (10192f0)
• ui: publish a console contract so any web console can be the sidecar (#3641) (a5ebda0)
• verifiedpermissions: add full service emulation (#3128) (2d51259)

Performance Improvements

• apigateway: avoid repeated root resource scans (#3404) (0a45d2e)
• build: drop KotlinPoet and ICU4J from the protobuf schema path (#2992) (21f165b)
• build: keep only the snappy JNI libraries the image will use (#2940) (4ce53b5)
• build: keep the managed policy catalog files out of the native image (#3489) (24e13f3)
• build: replace BouncyCastle with JDK crypto API as much as possible (#2988) (ffe8a92)
• build: replace quarkus-jdbc extensions with plain JDBC drivers (#3465) (569f9f5)
• docker: drop the gosu layer and two no-op native-image inputs (#3037) (b0a8dff)
• docker: shrink image by 28% using ubi9-micro (109 MB to 78 MB compressed) (#3085) (64f06e0), closes #3037
• docker: trim the compat image's CLI extras and Python build leftovers (#3108) (a6bd055)
• s3: drop unused hashes on S3Object creation (#3589) (a5ab167)

2.0.1 (2026-09-01)

Bug Fixes

• rds-data: fixing empty array response from statement (#2880) (46283f3)

2.0.0 (2026-09-01)

• fix(stepfunctions)!: reject JSONata top-level references at definition time (#2699) (5534460)

Bug Fixes

• acm: correct wildcard validation record names (#2575) (88bf0a2)
• apigateway: match measured JWT claim wire format and enforce route authorizationScopes (#2011) (4980210)
• apigateway: pass RequestContext to ApiGatewayExecuteController in trailing-slash tests (#2394) (41953d8), closes #2377
• apigateway: project HTTP API v2 cookies (#2391) (48880aa)
• apigateway: report RestApi as available (#2816) (62dbd9d)
• apigateway: route CORS preflight (OPTIONS) to deployed API integ… (#1955) (0e3391c), closes #1928
• apigateway: support AWS type Lambda integration and fix duplicate Content-Type header (#2049) (72dfa63)
• apigateway: support underscores in v2 path parameters (#2721) (c18af5b)
• apigatewayv2: CloudFormation AuthorizationScopes pass-through and scope-ingestion hardening (follow-up to #2011) (#2431) (d0a96d8)
• apigatewayv2: preserve trailing slash in HTTP API event path (#2367) (6469637), closes #1863 #2136
• apigatewayv2: propagate Lambda REQUEST authorizer context to HTTP API backends (#2715) (908d70d), closes #1011 #812 #581
• apigatewayv2: return stage tags across protocols (#2413) (5744082)
• apigatewayv2: route requests to API-owning account (#2377) (ba9ce84)
• apply S3 Vectors metadata filters (#2417) (bd8d99b), closes #2160
• appsync: honor configured base URL in API URIs (#2457) (86e1c01)
• appsync: use ApiKey.id as the API key value (#2645) (2932500)
• appsync: wait for schema creation in SDK test (#2456) (43e5e90)
• athena: route database DDL to Glue (#2757) (2480daa)
• bedrock-agentcore: allow maxResults up to 1000 (#2487) (9792198)
• bedrock-agentcore: support memory tagging and dropped fields (#2501) (feb669d), closes #2316
• build: resolve the JSON schema library from Maven Central (#2811) (66d910c)
• ci: replace setup-java's broken maven cache with actions/cache (#2503) (a68bfc4)
• cloudformation: adopt managed policy on stack update (#2717) (51edcca)
• cloudformation: fail the stack when Lambda S3 code cannot be read (#2650) (231c097), closes #2648
• cloudformation: keep a rolled-back stack's diagnostics until the next redeploy (#2365) (c54f8dd), closes #2207 Stack#changeSets #2419
• cloudformation: no-op stack update for unchanged fixed-name resources (#2385) (5864ff6), closes lex00/floci#16
• cloudformation: reconcile DynamoDB streams declared by StreamSpecification (#2411) (c4597f2)
• cloudformation: resolve IAM assume role policy intrinsics (#2630) (6a1d86e)
• cloudformation: tolerate missing stack resources during deletion (#2039) (12b8ddd)
• cloudfront: include terraform-required distribution fields (#1940) (8ac23de), closes #1930
• cloudfront: separate DEVELOPMENT and LIVE function stages (#2622) (0dfec3c)
• cloudwatch: decompress gzipped cbor bodies. (#2379) (f952fff)
• cloudwatch: evaluate alarms over CloudWatch's wider evaluation range (#2771) (cfe8566), closes #2700
• cognito: AWS-accurate UsernameAttributes pools — UUID username, alias sign-in, and token/revocation parity (#1849) (1ca19c7)
• cognito: enforce user pool password policies (#2070) (3aaf745), closes #2066 #2066
• cognito: reject self-managed verification status (#2532) (f8597bd)
• docdb: give a record without an ARN the one it should have had (#2425) (7602002)
• docdb: refuse an engine version a live account does not list (#2682) (46d2f4e), closes #2681
• docdb: scope cluster and instance identifiers per region (#2440) (3887a6c), closes #2408
• docdb: store and return cluster and instance settings (#2651) (f019573), closes #2614
• dynamodb: cap GSI multi-attribute key parts at 4 attributes (#2475) (13f6867), closes #2460
• dynamodb: enforce composite query order (#2471) (e4356de), closes #2462
• dynamodb: hybrid persistence (#2677) (e531683)
• dynamodb: recognize every HASH attribute of a composite GSI partition key (#2474) (768e96a), closes #2461
• dynamodb: reject key attribute values whose type does not match the key schema (#2625) (bf6c7b0), closes #2624
• dynamodb: reject LSI KeySchema with other than one sort key (#2476) (0397826), closes #2459
• dynamodb: return LastEvaluatedKey when Limit stops exactly at the last item (#2389) (41ff13e), closes #2383
• dynamodb: stop getSortKeyNames() from corrupting persisted tables (#2463) (726c9c7), closes #2415
• dynamodb: tolerate whitespace before a function's own parenthesis (#2510) (e4b101d), closes #2509
• dynamodb: validate cursor key types (#2470) (e3df59a), closes #2468
• dynamodb: validate index access paths (#2278) (30f965d)
• dynamodb: validate query key types (#2469) (a57c6c8), closes #2467
• ec2: apply availability-zone filter in DescribeInstances (#2543) (3bdcd5b), closes #2542
• ec2: canonicalize IPv4 route destinations at the API boundary (#2620) (8f76e13), closes Ec2ServicePersistenceTest#legacyNonCanonicalRouteDestinationCanonicalizesOnRestart
• ec2: create /run/sshd before starting sshd (#1855) (3daab4a)
• ec2: derive default vpc/subnet/sg ids per region (#2384) (337dead), closes Ec2ServiceTest#defaultVpcSubnetAndSecurityGroupIdsAreRegionScoped lex00/floci#21 pre-#21 pre-#21 #21 #21 floci-io/floci#21
• ec2: honour documented Describe* filters and stop ENIs inheriting instance tags (#2747) (26ae4ef)
• ec2: install packages with yum on Amazon Linux 2 guests (#2448) (c9f456e), closes #2449
• ec2: install the SSH client package in guests, not just the server (#2449) (f3029ee)
• ec2: reject a duplicate route destination with RouteAlreadyExists (#2546) (1be97c9)
• ec2: report a reachable EIP address, and run gzipped user-data (#2621) (41b5148)
• ec2: retry Docker port collisions (#2029) (b27b32f)
• ec2: round-trip launch template data instead of discarding it (#2595) (f1ad306), closes Ec2ServicePersistenceTest#legacyIamProfileAndInstanceTagsSurviveRestart
• ec2: store and report a route's IPv6 destination, and stop DeleteRoute NPEing (#2492) (e18a262)
• ecs: apply cluster settings given on CreateCluster (#2845) (19013b8), closes #2806
• ecs: report schedulingStrategy, deploymentController and availabilityZoneRebalancing on services (#2482) (13664e7)
• ecs: roll service tasks onto a changed task definition (#2483) (f3b22e7)
• ecs: round-trip command and entryPoint on container definitions (#2446) (5c45c14), closes #2445
• ecs: round-trip runtimePlatform and logConfiguration on task definitions (#2443) (a2389e7)
• ecs: scope service tasks by owning service, not by caller-supplied group (#2731) (c6b9e4c), closes #2716
• eks: implement cluster restoration after restart to maintain state (#2780) (eaecb36)
• elasticache: keep a replication group's encryption, snapshot settings, tags and ARN (#2632) (75f8f42), closes #2615
• elasticache: report transit encryption, not the auth-token flag (#2844) (90d1a19)
• elasticache: return the modeled capacity fault on proxy-port exhaustion (#2423) (f40d2e3)
• elb: route Classic (v1) requests to a dedicated handler instead of ELBv2 (#2619) (afe26c6)
• eventbridge: AWS-conformant InputTransformer from CloudFormation and PutTargets (#1885) (9b3aee6)
• eventbridge: return 400 for missing resources (#2553) (4083d06)
• firehose: use request region in delivery stream ARN (#2719) (47e0647)
• iam: correct GetAccountSummary provider and access-key counts (#2426) (17e77ba)
• iam: implement UpdateAccountPasswordPolicy, Get and Delete (#2616) (f411a31)
• inject AWS SDK environment into Flink sidecars (#2486) (127e51e), closes #2404
• kinesis-cbor: timestamps mis-scaled 1000x on the CBOR path (#2432) (39ed771), closes #2368
• kinesis: apply CreateStream's Tags instead of dropping them (#2494) (564dbf2)
• kinesis: reject non-blob Data instead of coercing it with asText (#2551) (df5581e), closes #2516
• kms: grant fidelity (#2639) (5400204)
• lambda: delete only the named version when DeleteFunction has a Qualifier (#2824) (ca4c84c), closes #2819
• lambda: honour ListLayers and ListLayerVersions query parameters (#2817) (4462963), closes #2808
• lambda: honour Publish on CreateFunction and UpdateFunctionCode (#2825) (a7b2b79), closes #2820
• lambda: implement GetLayerVersionByArn (#2812) (5b363ff)
• lambda: make the code-volume populate concurrency configurable (#2830) (968ff78), closes #2050
• lambda: read deployment packages via the zip central directory (#2649) (cd3f367), closes #2593 #1215
• lambda: replace the extracted package instead of merging into it (#2672) (e4c6903), closes #2647
• lambda: resolve ARN and function URL invocations in owning account (#2414) (c22652d)
• lambda: resolve launched-container placeholder creds to the owning account (#2657) (be89286)
• lambda: return VpcConfig, SnapStart and LoggingConfig from every read path (#2527) (94795dd), closes -_/#A-Za-z0-9
• lambda: round-trip StartingPosition on event source mappings (#2370) (151e3fc)
• lambda: serialize resource policy mutations (#2430) (2314c85)
• lifecycle: run start/ready hooks when FLOCI_PORT is non-default (#2439) (ba97c08), closes #2437
• memorydb,neptune,docdb: degrade gracefully with no Docker daemon (#2386) (65b22ff), closes lex00/floci#44
• msk: accept an empty serverProperties on Create/UpdateConfiguration (#2491) (fcd662f)
• msk: persist CreateCluster broker node groups, encryption, client auth, logging, configuration and tags (#2366) (0205e4e), closes #2571
• msk: reject numberOfBrokerNodes values that only look whole after double rounding (#2571) (bd436ee), closes MskService#validateCreateRequest
• msk: return BadRequestException when a configuration ARN does not exist (#2572) (247bd59), closes MskService#describeConfiguration
• opensearch: address spawned domain containers by IP, not name (#2746) (fcc6067)
• preserve Firehose compression format in CloudFormation (#2406) (ebd4a07)
• preserve Route 53 private hosted-zone VPC associations (#2342) (967ea84), closes #2294
• rds,docdb: list DocumentDB clusters and instances in the RDS-family list form (#2623) (3b0e31b), closes #2613 #1829
• rds,firehose,cognito: match AWS's real defaults so a second terraform plan reports no changes (#2420) (5ed3a8c), closes FirehoseService#mergeDestination
• rds: clear CLIENT_SSL before forwarding the TLS-terminated handshake response to the backend (#2698) (0090739)
• rds: grant the MySQL/MariaDB master user RDS-master-equivalent privileges (#2679) (6c96f47)
• rds: keep the tags given to CreateDBSubnetGroup (#2627) (20ecb89), closes #2612
• rds: propagate ModifyDBCluster master-password rotations to the backend and every proxy (#2727) (895b59f), closes #2709
• rds: propagate ModifyDBInstance master-password rotations to the backend and proxy (#2709) (09a05c2)
• rds: reject a duplicate create while provisioning is in flight (#2525) (7ef698c), closes #2051
• rds: store and return the encryption and backup settings given on create (#2617) (5033ace), closes #2611
• repair main CI (AslExecutor test compilation, Redshift compat test endpoint) (#2726) (477e8ae), closes #2703 #2688
• s3: accept the log-delivery-write canned ACL (#2653) (2a014d2)
• s3: emit post events for browser uploads (#2577) (d8ef1c8)
• s3: prevent compliance retention downgrade (#2755) (2e5935d)
• s3: resolve virtual-hosted buckets whose names contain dots (#2493) (ea2b62f)
• s3: return x-amz-version-id from presigned POST (#2608) (066e6c9), closes #2607
• s3: route the replication subresource instead of falling through (#2519) (ce4f6d1), closes #2296
• secretsmanager,rds: rotate secrets that an AWS service manages (#2378) (23015a7)
• secretsmanager: raise InvalidRequestException, not ResourceNotFoundException, for pending-deletion secrets (#2514) (fd78ae4), closes #2513
• secretsmanager: stop CreateSecret overwriting a secret inside its recovery window (#2555) (1e443ac), closes #2549
• security: reject unregistered SigV4 access keys and unbound usernames (#2680) (f9d28c9), closes #2657
• serialize Kinesis stream creation timestamps as plain decimals (#2173) (c335086), closes #2099
• ses: enforce full AWS tag validation across all SES resources (#2504) (29f6e7a)
• ses: reject non-string tag members with SerializationException (#2512) (60dd795)
• ses: report the sending account in send-event payloads (#2499) (bd36b02)
• ses: return DeliveryOptions from v1 DescribeConfigurationSet (#2841) (7473c57)
• signin: preserve AWS token error modes (#2554) (399bf20)
• ssm: stop re-reading shared mutable state in the command status rollup (#2477) (6f1ce9b), closes #2264 #2264
• ssm: validate SettingValue and require an account list on ModifyDocumentPermission (#2635) (149ac63)
• stepfunctions: bound $range allocation at the AWS memory limit (#2790) (f7f16cd), closes #2738 #2737
• stepfunctions: bound a running execution the four ways AWS does (#2782) (9288769), closes #2733
• stepfunctions: bound JSONata evaluation by time and depth (#2697) (3954018), closes Frame#setRuntimeBounds #2667
• stepfunctions: end the execution when a state throws an Error (#2693) (acf8879), closes #2666
• stepfunctions: fail the state when a JSONata expression returns nothing (#2689) (ea11e67), closes #2665
• stepfunctions: keep a JSONata expression's explicit null in the output (#2684) (48e0ecd), closes #2664 #2665
• stepfunctions: let a mocked response with no attempts start the execution (#2823) (63a2a60), closes #2523
• stepfunctions: refuse the definitions AWS refuses, at both validation entry points (#2786) (ead70ea)
• stepfunctions: resolve the substitutions in a JSONata error cause (#2687) (09d813d), closes #2668
• stepfunctions: write a large whole number in full in $string (#2683) (2a7ee7a), closes #2669
• ui: reconnect the UI sidecar without restarting Floci (#2718) (02f9754), closes HI#severity
• update .gitignore to include .mission/ for shared tooling visibility (#2750) (2bc3736)

Features

• acm: certificate validation records and revocation (#2655) (3bd9bcc)
• apigateway: API key import/usage-plan fidelity and update-operation fixes (#2631) (9b9e7f5)
• apigatewayv2: OpenAPI import and Terraform-visible API/stage attributes (#2714) (881695e)
• apigatewayv2: support custom domain names and API mappings (#2390) (74da157)
• applicationautoscaling: evaluate target-tracking and step-scaling policies against ECS (#2692) (2a7c94b), closes #2565
• appsync: Phase 7 — GraphQL execute authentication (#2380) (3f12428)
• aps: add Amazon Managed Service for Prometheus workspaces (#2604) (277809f)
• autoscaling: P0 operations and lifecycle-hook delete-by-name (#2673) (e9a379b)
• batch: add update and delete job queue endpoints with corresponding service logic (#2807) (6f123e8)
• cloudformation: apply security-group rules — inline properties and standalone resources (#1993) (1461a10), closes #1992
• cloudformation: CDK Provider-framework custom resources and changeset/SSM param fidelity (#2688) (08e532a), closes #2455 #2455 #2666
• cloudformation: CodeBuild/CodePipeline CFN provisioning (#2685) (ac94232)
• cloudformation: expand SAM AWS::Serverless::HttpApi to ApiGatew… (#1956) (6fa53ab)
• cloudformation: provision WAFv2 web ACLs and AWS Config rules (#2701) (8a705d0), closes CloudFormationTemplateEngine#resolveNode
• cloudfront: apply response-headers policies when serving (#1833) (520c0f4), closes #1820 #1823
• cloudfront: forward origin custom headers (#1832) (f2ad05c), closes #1820 #1823
• cloudwatch-logs: add resource policy actions (#2574) (859db2f)
• cloudwatch: Adds support for orderBy, pagination, limit in DescribeLogStreams response (#2362) (846e78d)
• codegurureviewer: repository association lifecycle with tagging (#2741) (0b46d80)
• codepipeline: validate ListPipelineExecutions filters and PutApprovalResult inputs (#2696) (a155e66)
• cognito: user pool domain operations (Create/Describe/DeleteUserPoolDomain) (#2742) (ed16713)
• comprehend: add Amazon Comprehend sync text-analysis actions (#2674) (5c1b69c), closes #2660
• config: compliance evaluation loop, retention, pagination (#2642) (1b3417a)
• connect: instance management (CreateInstance family, attributes, storage configs, tags) (#2740) (7b6266e)
• controltower: add AWS Control Tower with landing-zone and baseline lifecycle (#2578) (4524099)
• core: add configurable mock responses for stub AI services (#2765) (e2e69f6), closes #2764
• core: label emulated resource containers with io.floci.* identity (#2497) (8247014), closes #1818 #1818
• docs: guard the service matrix against undocumented services (#2465) (700acc6), closes #2436
• ec2: IPAM with real CIDR allocation, EBS encryption defaults, and transit gateway route export (#2596) (9563b7e), closes #2526 floci-io/floci#2605
• ec2: support ModifyVpcEndpoint and persist the endpoint policy (#2526) (2e8cbc1), closes #2317
• ec2: support transit gateway route tables, associations and routes (#2348) (bc0f88c), closes #2308 #2329
• ec2: support transit gateway VPC attachments (#2347) (74e43a4), closes #2308
• ecs: rewrite ECR image URIs on RunTask like Lambda already does (#2641) (c405093), closes #2568
• efs: add Elastic File System (file systems, mount targets, access points) (#2371) (943b4c1)
• elasticache: support cache parameter groups (#2392) (6b62817)
• elasticache: support cache subnet groups (#2401) (06d58aa)
• elasticache: support cluster-mode replication groups (#2633) (97ff0bc)
• emrserverless: support EMR Serverless applications (#2403) (8a673fc)
• eventbridge: add Connection API actions (#1897) (36a55f5)
• firehose: add StartDeliveryStreamEncryption and StopDeliveryStreamEncryption (#2583) (4affa05)
• firehose: deliver records from a Kinesis stream source (#2528) (009ac0b)
• firehose: honor CompressionFormat and FileExtension on S3 delivery (#2410) (bba5ffb), closes #2328
• fis: add AWS FIS support (#2435) (04d120f)
• iam: enforce SCPs and populate aws:PrincipalArn during policy evaluation (#2637) (7188b3e), closes iam.md#service-control-policies-scps iam.md#bypass-rules hi#water
• kinesis: add PutRecords request caps and a per-stream max record size (#2438) (353d9c8)
• kinesisanalytics: emit MSF-style JSON CloudWatch logs from Flink (#2656) (aaae992)
• lakeformation: lake formation (#2427) (ac6cb06)
• lambda: add the ability to name and label lambda containers, code volumes (#2409) (f8b07a7)
• lambda: code-signing endpoints and account settings (#2646) (c90c5ad), closes #2225 #2206 #1987
• lambda: support kubernetes as the lambda runner (#1941) (bc13801)
• logs: add AssociateKmsKey and DisassociateKmsKey for log groups (#2584) (4435c62)
• msk: add configuration revision actions (#2344) (7505110), closes #2339 #2340 #2299 2336/#2343 #2343 MskService#updateConfiguration MskConfiguration#addRevision
• networkfirewall: emulate AWS Network Firewall (#2580) (715bab6), closes #2579
• organizations: add AWS Organizations service (#2489) (87e8044)
• organizations: add CloudFormation resource types (#2495) (054508d)
• organizations: add ListAccountsWithInvalidEffectivePolicy (#2628) (18521ed)
• organizations: add management account email configuration and tests (#2749) (89fd37a)
• rds-data: adding data-api support for lable/name and batch (#2518) (a3044e0)
• rds,docdb: answer DescribeGlobalClusters (#2402) (29b0d60)
• rds,docdb: tag DocumentDB clusters and parameter groups (#2408) (7b83bd5)
• rds: add option group CRUD (#2352) (3374bfe), closes #2304
• rds: match proxy TLS cert SAN to the advertised endpoint (#2603) (b1d7286)
• rds: model Aurora Serverless v2 scaling configuration on DB clusters (#1829) (d778a6e)
• redshift: implement Redshift emulation with snapshot and parameter group support (#2472) (a1383fd)
• rekognition: add Amazon Rekognition sync image-analysis actions (#2706) (cf6fede), closes #2705
• resourceexplorer2: add AWS Resource Explorer 2 with cross-service resource discovery (#2485) (d3871e1), closes #1583 #1797
• route53resolver: add Route 53 Resolver with DNS Firewall domain lists (#2582) (d60bd6e), closes #2579
• route53: VPC association lifecycle actions (#2638) (e471946)
• s3: apply VersioningConfiguration in CloudFormation S3 bucket provisioning (#2626) (64c38c7)
• s3: opt-in global bucket namespace and replication config (#2640) (c96dc98), closes #2519
• s3: support bucket metrics configurations (#2382) (8d33c65)
• secretsmanager: persist and return secret resource policies (#2587) (8b23ed8)
• servicecatalog: emulate AWS Service Catalog with Control Tower Account Factory (#2585) (2e843e9)
• servicequotas,ram: add Service Quotas and AWS RAM resource sharing (#2579) (f912c3b)
• ses: extend tag endpoints to contact lists, custom verification email templates, and dedicated IP pools (#2589) (c7cd78e)
• ses: support +label subaddressing on mailbox simulator addresses (#2464) (c969ffc)
• ses: support v2 PutAccountDetails and GetAccount Details (#2498) (622ba0a)
• ses: support v2 tenant CRUD (CreateTenant/GetTenant/ListTenants/DeleteTenant) (#2644) (2963601)
• ses: support v2 tenant resource associations (#2710) (67f75c7)
• ses: support v2 tenant suppression attributes and tenant-scoped suppression list (#2743) (fc3c283)
• ses: support v2 tenant-scoped sending with association gate (#2815) (b0fe831)
• sfn: support mocked service integrations (SFN_MOCK_CONFIG) (#2452) (b6418db), closes #2283
• sfn: support Retry policies in Task, Parallel, and Map states (#2455) (56e74d6), closes #2283
• signin: add secure branded consent flow (#2429) (09d7502)
• signin: support AWS login credentials provider (#2428) (470ec77)
• sns: deliver topic broadcasts to application-protocol platform endpoints (#1856) (f45d64a)
• ssm: document lifecycle, share permissions, and account-scoped service settings (#2629) (7f6b875)
• ssoadmin: serve Identity Center ListInstances (#2581) (a2bd22d), closes #2579
• stepfunctions: add the JSONata functions of the Step Functions dialect (#2676) (eb5134d)
• stepfunctions: describe a distributed Map run after it finishes (#2694) (ff61c2b), closes #2671
• stepfunctions: dispatch the seven Task service integrations of #2663 (#2686) (14112b8)
• stepfunctions: emit task history events and chain previousEventId (#2703) (5600d21), closes #2520

Performance Improvements

• cloudformation: probe Lambda S3 code with headObject, not getObject (#2728) (ff36141), closes #2648 #2675

BREAKING CHANGES

• state machines whose JSONata expressions reference a bare top-level name are now rejected at creation, as on AWS. Anchor the reference with $states.input. for input or $ for an Assign variable.

• fix(stepfunctions): parse a JSONata payload key named after an ASL field

The deny list of fields AWS does not parse as JSONata was applied to every key at every depth, so a payload key named Next, Comment, Resource, Retry, Default, ErrorEquals, Credentials, Branches, ItemProcessor or Iterator hid its expression. AWS parses a payload whole: Assign: {"Next": "{% phone %}"} and Arguments: {"Payload": {"Comment": "{% phone %}"}} are both refused with Reference to 'phone' at the top level is not supported. The deny list now stops applying once the walk enters Output, Assign, Arguments, ItemSelector or BatchInput.

The same walk refused ItemReader.ReaderConfig.CSVHeaders, which holds literal column names: validate-state-machine-definition returns OK for it and create-state-machine stores the machine, so CSVHeaders joins the list.

1.7.0 (2026-08-18)

Bug Fixes

• apigateway: apply MOCK integration response headers (#1822) (a49c3e5), closes #1955 #1955
• apigateway: create the stage when CreateDeployment carries a stageName (#2130) (f34e0b5)
• apigateway: fall back to REST API region scan for non-SigV4 Authorization headers (#2149) (5156095), closes ApiGatewayV2Service#resolveHttpApiRegion ApiGatewayService#resolveRestApiRegion #2169 #2169 #2054 #2054
• apigateway: honor configured execute-api hostname (#2286) (3cfa983)
• apigateway: match Content-Type case-insensitively in Lambda proxy responses (#2150) (10048ad)
• apigateway: preserve trailing slash in proxy event path (#1863) (4236388), closes #1557
• apigatewayv2: encode binary Lambda request bodies (#2203) (28e9f6e)
• apigateway: verify and propagate HTTP API v2 JWT authorizer claims (#2353) (0444753)
• appconfig: accept top-level resource ARNs in TagResource/ListTagsForResource (#2279) (0818e5e), closes AppConfigTagHandler#parseArn
• appconfig: add DeleteConfigurationProfile/DeleteHostedConfigurationVersion/ListDeploymentStrategies/DeleteDeploymentStrategy (#2280) (be62502)
• cloudformation: apply AssumeRolePolicyDocument when adopting an existing IAM role on update (#2143) (4a5fae4)
• cloudformation: create AWS::IAM::Role inline Policies instead of silently dropping them (#1969) (8d2a5bd), closes #1952 #1825 #1952
• cloudformation: don't double-encode string-form SNS RedrivePolicy and FilterPolicy (#2325) (c12f3fa), closes CloudFormationTemplateEngine#resolveJsonAttribute
• cloudformation: expand AWS::Serverless::HttpApi via SAM transform (#2146) (5812910), closes #1758 #1758
• cloudformation: expand SAM AutoPublishAlias into Version + Alias (#1961) (7d66bf0), closes #1987 #1988 #1987 #1987 #1988 #1987 #1987
• cloudformation: honor resource-level conditions (#2255) (8ef71d6)
• cloudformation: honor stack status filters (#2244) (34c9c6c)
• cloudformation: infer Lambda FunctionName mode for pre-fix persisted stacks (#2177) (0cbfba8), closes #2163 #1831 #1831 #2261
• cloudformation: map FIFO and redrive attributes for AWS::SQS::Queue (#1939) (58112b1)
• cloudformation: pass the CloudFront service argument in the provisioner tests (#2261) (6ca7d44), closes #1820 #1807
• cloudformation: physically delete nested stacks and removed resources on update (#2345) (291a974)
• cloudformation: reconcile AWS::Logs::LogGroup in place on UpdateStack (#2152) (76b264f), closes #1965
• cloudformation: resolve ASG launch templates by id and MixedInstancesPolicy (#2005) (#2019) (0971cf6)
• cloudwatch: keep GetLogEvents paging inside the list bounds (#2355) (c163a86)
• cloudwatch: page FilterLogEvents forward with a usable nextToken (#2354) (112602f)
• cloudwatch: reject invalid log event tokens (#2249) (12cf6e2)
• cloudwatch: return logStreamName on FilterLogEvents results (#2259) (a0adea9), closes #2210
• cloudwatch: warn on unsupported Logs Insights filter operators (#2170) (f1c8197), closes #2042
• cognito: expire refresh tokens and scope them to their own pool in REFRESH_TOKEN_AUTH (#2135) (7d8aced), closes #2132 #2139 #2132
• cognito: HMAC-sign refresh tokens to prevent forgery (#2139) (c4f4181)
• cognito: mark verified contact attribute on ConfirmSignUp (#1881) (d891425)
• cognito: reject invalid refresh tokens in InitiateAuth REFRESH_TOKEN_AUTH (#2132) (3ce5041), closes #2113
• cognito: restore the SecureRandom import (#2337) (7a2dc53), closes #2139 #1881 #1881
• compat: install AWS CLI v2 in the compat image so AWS_ENDPOINT_URL is honored (#2315) (9fda5f5)
• core: extract shared pagination helper, reject maxResults=0 (#2343) (25b46e2), closes #2339 #2340
• core: stop leaked executor threads from pinning test classloaders (#2363) (6962e91)
• docker: fall back to Windows named pipe when docker-host is at its unix-socket default (#2030) (c48c062)
• docker: label containers and volumes per emulator (#2341) (d819c00)
• dynamodb: compare Value when legacy Expected supplies Exists (#2125) (a2b20cc)
• dynamodb: isolate item storage and locks between accounts (#2240) (a803626)
• dynamodb: order Query by full composite sort key (#2114) (cd3c6b5), closes #1675
• ec2: assign a public IP only when the subnet opts in via MapPublicIpOnLaunch (#2023) (2ab795c), closes #1984
• ec2: delete key pairs by name through the storage backend (#2187) (fc74987), closes #2185
• ec2: keep the source on security group rules (#2266) (a6f5f12), closes #2190
• ec2: reject prefix list names AWS reserves for its own lists (#2274) (2d003b5), closes #2273
• ec2: sshd can only be started from an absolute path since OpenSSH v3.9 (#2351) (c194bff)
• ec2: start sshd even when run-instances omits a key pair (#2245) (da5ff91)
• ec2: type a security group rule's tags as security-group-rule (#2272) (4058dfa), closes #2270
• ecs: report service deployments and MISSING failures on DescribeServices (#2176) (8b8f837), closes #2174
• eks: validate subnet IDs exist before creating a cluster (#1943) (66fd109), closes #1942
• elasticache: clean up container by id on readiness-timeout rollback (#2090) (91b6a40)
• elasticache: store the user Engine instead of hardcoding redis (#2331) (7a4fc45), closes #2290
• eventbridge: boolean/numeric pattern values are matched correctly (#1889) (517094a)
• firehose: build S3 object keys with AWS prefix expressions and name suffix (#1858) (a79e04e), closes floci-io/floci#1857
• firehose: return Kinesis source in stream description (#2025) (988696b)
• iam,lambda: return resource tags in Get and Create responses (#2262) (b71bfc4), closes #2155 #2199
• iam: include policy description in GetPolicy/ListPolicies/CreatePolicy responses (#2155) (1150cfc), closes #2154
• iam: route long-term access keys to owning accounts (#2319) (02898cf)
• iam: seed AmazonAPIGatewayPushToCloudWatchLogs managed policy (#2147) (b1f953e), closes #2121
• iam: seed the full AWS managed policy catalog (#2194) (527615b), closes ClassLoader#getResourceAsStream
• iot: match topic rules outside the default region (#2169) (9b451cc), closes #2065
• kinesis: reject records over the 1 MiB size limit (#1896) (5afb60d), closes #1755
• kinesis: resolve LATEST shard iterator position at GetShardIterator time (#1901) (3b760bd), closes #1900
• kms: reject mismatched keys in decryption requests (#1893) (0cfffbe)
• lambda,iam: assume execution role for in-function SDK calls (#1909) (573d4bd), closes #2040
• lambda: disable HTTP/2 cleartext on the runtime API server (#2181) (cb06a73)
• lambda: drain parked extensions before closing the runtime API server (#2156) (c0f36ea)
• lambda: give published versions their code location (#2012) (42022fe), closes #1988 #1987 #1987
• lambda: propagate image inspection failures (#2268) (9ebf9fe)
• lambda: reassemble container log lines split across Docker frames (#1953) (6344852)
• lambda: reconcile code volumes against real Docker state and clean up superseded ones (#2208) (a5daab6), closes #2164
• lambda: scope resource-policy statements to the request Qualifier (#2129) (ea74b97)
• lambda: SIGTERM container before closing runtime API socket (#2098) (b911ccd), closes #2091 #2156 #2156
• lambda: validate Layers ARNs eagerly on CreateFunction/UpdateFunctionConfiguration (#2282) (2f0ef45), closes #2280 InMemoryStorage#get
• memorydb: clean up container by id on readiness-timeout rollback (#2092) (11d5275), closes #2090 #2090
• rds: advertise reachable endpoints (#2074) (f417164)
• rds: fault with DBInstanceNotFound/DBClusterNotFoundFault for missing identifiers in Describe* (#1740) (02288ab)
• rds: preserve configured database images (#2035) (9e7cdad)
• rds: resolve AWS-managed default DB cluster parameter groups on reference (#1805) (b31cbb9), closes #1820 #1823
• rds: restore Terraform RDS and RabbitMQ compatibility (#1951) (ea1231b)
• s3: DeleteObjects honours empty key list (#2201) (15d6ce8), closes #2198
• s3: derive S3 host suffix matching from DNS config (#1843) (188588b)
• s3: enforce auth on object write paths when enforce-auth is enabled (#2326) (16a8f04), closes #2318
• s3: Ensure tags are added on multipart s3 uploads. (#2151) (f6faf0f)
• s3: isolate object byte storage between accounts (#2241) (cdb2c36)
• s3: preserve literal '+' in object keys and support encoding-type=url in list-objects (#1736) (93b6f5e), closes #1589
• s3: route the accelerate subresource instead of falling through (#2330) (833de25), closes #2295
• s3: validate FULL_OBJECT checksum on CompleteMultipartUpload (#1980) (d039780)
• s3vectors: return cosine distance from queries (#2175) (2f5bc39)
• s3vectors: route ListVectors instead of falling through to S3 (#2285) (6c4d63b), closes #2161
• s3: verify SigV4 signature on presigned URLs when enforce-auth is enabled (#1842) (3fe836a)
• ses: pass the custom-verification-email store in the list-management test (#2182) (396ef55), closes #1875 #1840
• sqs: delayed FIFO message no longer blocks its message group (#2112) (fa8f8d7), closes #2104
• stepfunctions: publish execution status after its terminal fields (#2234) (4ba854a)
• stepfunctions: wrap optimized lambda:invoke result in the Invoke envelope (#2165) (4581176), closes #2110
• test: pass the managed prefix list store in Ec2PublicIpOnLaunchTest (#2288) (62ff490), closes #2023 #2287

Features

• apigateway: API key management — UpdateApiKey, DeleteApiKey, UsagePlan custom-id, generateDistinctId (#1883) (b6765b3), closes #2045
• apigateway: derive SQS QueueUrl from path-style integration URI when absent from template (#1903) (cfbae88)
• apigateway: route execute-api hostnames for HTTP APIs (#2054) (33ba5ac)
• apigatewayv2: route execute-api hosts to WebSocket $connect and @connections (#2188) (45bb37f), closes #2054 #1846 #1871 #1871 #1846
• applicationautoscaling: add Application Auto Scaling control plane (#2159) (1795e13), closes #2157
• appsync: Phase 6 — Query Execution + HTTP Endpoint (#1884) (819bfed)
• bedrockagentcore: emulate the AgentCore control plane and InvokeAgentRuntime stub (#2316) (4e6e6df), closes lex00/floci#2 lex00/floci#3 lex00/floci#4 lex00/floci#5 lex00/floci#6 #7 #8 #9 #12 lex00/floci#14 #10 #11 #13 lex00/floci#10 lex00/floci#11 lex00/floci#13 #14
• cloudcontrol: implement CreateResource / DeleteResource / GetResource (#2037) (43f47a3)
• cloudformation: honor resource-level DeletionPolicy (#2167) (7d9b9ae), closes #1555
• cloudformation: implement GetTemplateSummary (#2148) (a235b76), closes #1964
• cloudformation: provision ApiGateway::Account, AutoScaling::LifecycleHook, and EC2::FlowLog (#2003) (9280369), closes #2002
• cloudformation: provision AWS::EC2::VPCEndpoint (#1995) (a985fa4), closes #1994
• cloudformation: provision AWS::ECS::CapacityProvider and ClusterCapacityProviderAssociations (#1999) (907a2df), closes #1998 #1998 #1825
• cloudformation: provision AWS::Events::EventBus as a real custom bus (#1807) (bc21367), closes #1803 #2141
• cloudformation: provision AWS::Lambda::Permission and fix Version and Alias updates (#1997) (105a8ee), closes #1996 LambdaService#deleteVersion #1961
• cloudformation: provision the network ACL family (#2001) (5e01c07), closes #2000
• cloudformation: resolve dynamic references in RDS credentials (#1809) (d9e4447)
• cloudfront: enforce signed private content (#1831) (5657e35), closes #1820 #1823
• cloudfront: serve distribution requests from S3 and custom origins (#1820) (82f8016), closes #1823
• cloudhsmv2: implement CloudHSM v2 service (#1776) (1cc97d5), closes #2035 #1810 #1827
• cognito: add AdminLinkProviderForUser (#2166) (0203bc7), closes #1563
• cognito: add GetUserAttributeVerificationCode support (#1898) (24cdabb)
• dynamodb: global-table v2 replicas (UpdateTable ReplicaUpdates + Custom::DynamoDBReplica) (#1811) (a29464a)
• ec2: add ReplaceRoute (#2178) (d943e09), closes #2087
• ec2: allow a security group rule to take a prefix list as its source (#2271) (dfcd492), closes #2269 #2266
• ec2: config toggle to report the AWS-faithful private IP (#2024) (33d35b2), closes #1983
• ec2: DescribeImages synthesizes an AMI for an unmatched wildcard name lookup (#2009) (cdb6811), closes #2008
• ec2: DescribeVpcEndpointServices returns the common interface services with AZs (#2007) (42a79a7), closes #2004
• ec2: support CreateImage (create AMI from instance) (#1979) (30a6164), closes #1978
• ec2: support managed prefix lists (#2105) (ac4b865), closes #2100
• ec2: support transit gateways (#2329) (20470b7)
• eks: support IRSA with a real OIDC issuer and JWT validation (#2108) (7e5afae)
• elbv2: honor preserve_host_header parameter (#2109) (2594705)
• eventbridge: deliver events to event-bus targets (#1814) (50fe67d)
• firehose: honor BufferingHints with time and size based flush (#2314) (bfda938), closes #1886
• guardduty: add GuardDuty detector and organization configuration emulation (#2346) (6779aa8)
• iam: add GetAccountSummary support (#1986) (c21337c)
• iam: add service-linked role create, delete and deletion status (#2179) (c8403ac), closes #2122
• iam: support account aliases (#2103) (1215429), closes #2101
• iam: support OIDC identity providers (#2106) (f17dd1e), closes #2102
• kinesis: add local inspection endpoints for UI (#1880) (486be8f)
• kinesisanalytics: add Managed Service for Apache Flink (Kinesis Analytics V2) (#1914) (d78520d)
• kms: implement UpdateAlias (#2324) (984886f)
• lambdamicrovms: AWS Lambda MicroVMs service module and its CloudFormation types (#2079) (40e8aad)
• lambda: support EFS file system configs (#2053) (e1f389f)
• logs: support log group deletion protection (#2256) (4215006)
• msk: add configuration CRUD (Create/List/Describe/Delete) (#2336) (4c510e5)
• opensearch: parse, store, and return AccessPolicies (#2327) (78ad357)
• rds-data: adding data-api preparedstatement() support (#1887) (19a32ab)
• rds: model DB proxies and their target groups (#1813) (e4010ec)
• s3: resolve index documents for static-website directory requests (#1815) (6d829ff)
• s3tables: emulate metadata service (#2322) (b45de1b)
• ses: add DKIM actions with domain-inherited email DKIM (#1904) (ff0201a)
• ses: honor ConfigurationSetName on CreateEmailIdentity (v2) (#1812) (cd3588b)
• ses: implement custom verification email templates for v1 and v2 (#1840) (aed50cc)
• ses: implement PutAccountVdmAttributes and return VdmAttributes from GetAccount (v2) (#2265) (80d1dc7)
• ses: implement SendCustomVerificationEmail for v1 and v2 (#2191) (bd01c1a)
• ses: implement SendEmail ListManagementOptions suppression and unsubscribe (v2) (#1875) (fa9ed91)
• ses: implement v1 receipt rule set actions (stored-but-inert) (#2128) (ff8d6ef)
• stepfunctions: add UpdateStateMachine and update in place on stack updates (#1867) (97ac3ca)
• stepfunctions: emulate distributed Map ResultWriter (S3 export + manifest) (#1823) (59cb643), closes #1820
• stepfunctions: run Map iterations concurrently honoring MaxConcurrency (#1810) (a7da1b9)
• swf: add Simple Workflow Service emulation (#2257) (ecad6ac), closes com.amazonaws.swf.base.model#Fault

Performance Improvements

• lambda: reuse a populated code volume across restarts via a completion marker (#1827) (5d61e95)

1.6.0 (2026-08-06)

Bug Fixes

• 1790: better populate describe alarm responses (#1792) (fcb22be)
• apigateway: fall through to less specific resources on method mi… (#1630) (96c7aa6), closes #1547
• apigateway: import authorizers and security requirements from OpenAPI (#1798) (91e06eb)
• apigateway: use last duplicate header value (#1806) (6a214e8)
• athena: report the result CSV object key as OutputLocation (#1895) (418ec1b), closes #1752
• cloudformation: AWS::IAM::ManagedPolicy exposes PolicyArn for Fn::GetAtt (#2056) (f719033)
• cloudformation: keep uniqueness suffix when truncating generated resource names (#1802) (48b2139), closes #1825
• cloudformation: preserve subnet public IP setting (#2031) (b62d1e7)
• cloudformation: provision AWS::ApiGatewayV2::Authorizer and wire Route.AuthorizerId (#1760) (7f51c74), closes #1773
• cloudformation: resolve Fn::GetAtt [Vpc, DefaultSecurityGroup] (#1977) (bdad066), closes #1976
• cloudformation: treat delete of an already-removed DynamoDB table or Lambda function as idempotent (#1803) (5cb26ff)
• codebuild: stabilize start and retry responses (#2052) (fa96b79)
• cognito: reject unconfirmed users in SRP auth (#2027) (733c72d)
• dockerfile: ensure docker-java compatibility (#2096) (7ade290)
• dynamodb: resolve nested document paths in ADD and DELETE update actions (#1908) (c052259)
• ec2: DescribeKeyPairs returns InvalidKeyPair.NotFound for missing names/ids (#1932) (7d96106), closes #1911
• ec2: return AWS-parity MissingParameter for CreateSubnet without VpcId (#2094) (88408d8), closes #2089
• ecs: resolve Secrets Manager JSON-key selectors in task definition secrets (#2133) (e3c180b), closes #1912
• lambda: carry the owning account into published version snapshots (#2041) (f4e8bd8), closes #2040
• lambda: report resolved executed version (#2026) (2889fbd)
• lambda: reset volatile DynamoDB Streams ESM checkpoints on restart (#2077) (847c30a)
• pipes: register kafka-clients reflection metadata for native image (#2068) (ab73379)
• s3: accept a percent-encoded bucket/key separator in copy sources (#2060) (a8ed218), closes #2038
• s3: apply CreateBucketConfiguration tags on bucket creation (#2115) (79031a2)
• s3: include EventBridgeConfiguration in GetBucketNotification response (#2072) (b8edd37)
• s3: recognize virtual-hosted-style requests over HTTP/2 (#1954) (5f7d4d2), closes #1866
• ssm: report invalid batch parameter names (#2075) (04873bf)
• tls: reuse the persisted self-signed certificate across restarts (#1799) (a4356f2)

Features

• Add AWSCloudFormationReadOnlyAccess as a managed policy. (#2057) (0142dc4)
• apigateway: support floci:override-id for v1 and v2 (#2045) (02385da), closes #1593
• bedrock: add proxy backend for real LLM responses via OpenAI-compatible API (#1789) (875e0f2)
• cloudcontrol: include EC2 resource tags (#1933) (205a8f1)
• cloudformation: provision AWS::EC2::LaunchTemplate (#1973) (4e0a815), closes #1971
• cloudformation: provision AWS::EC2::VPCGatewayAttachment (#1972) (1a99721), closes #1970
• cloudformation: provision AWS::SecretsManager::SecretTargetAttachment (#1804) (62a576c)
• cloudformation: support AWS::Events::EventBus and EventBusPolicy (#1794) (76f602f)
• cognito: implement ResendConfirmationCode (#2071) (bb7c45c), closes #2067
• ec2: added attach and detach volume support (#1787) (2c74329)
• ec2: return an empty set for DescribeVpnGateways (#1975) (3baf4f4), closes #1974
• iam: list entities attached to managed policies (#1808) (78ba5b3)
• iam: seed Amazon Bedrock managed policies (#2034) (5874348), closes #1559 #1216
• iam: seed the managed policies CDK bootstrap and the scenario stacks attach (#2064) (43aea09), closes #2059 #2057 #2057
• kms: implement ListKeyPolicies (#2046) (760115d), closes #1528
• lambda: implement the Lambda Extensions API (#1773) (9f0dec9)
• lambda: support extra /etc/hosts entries on Lambda launch (#2073) (b543aa4)
• mwaa: add Amazon MWAA emulation backed by real Airflow (LocalExecutor) (#2086) (7e4e3e8)
• release: one-button release cut from main and ECR Public versioned publishing (#2127) (61011c0)
• rum: add CloudWatch RUM app-monitor service (#1797) (aadc93e)
• sqs: retain MessageGroupId on standard queue messages (#1891) (a01b707), closes #1496

Performance Improvements

• docker: stop duplicating the native binary into a second image layer (#2069) (9e90e5c)

[1.5.34] - 2026-07-28

Added

• cloudtrail: new in-process service. Supports CreateTrail, DescribeTrails, DeleteTrail, UpdateTrail, PutEventSelectors, GetEventSelectors, StartLogging, StopLogging, GetTrailStatus, LookupEvents. S3 data events on hooked ops (PutObject, GetObject, HeadObject, DeleteObject, ListObjects, GetObjectAcl) are buffered per-trail and flushed as gzipped JSON log files into the destination bucket at AWS-shaped key paths (AWSLogs/${account}/CloudTrail/${region}/yyyy/MM/dd/${file}.json.gz) at a configurable cadence. IAM-enforcement denials emit matching AccessDenied records (#1460)
• iam: seeded AWSCloudTrail_FullAccess and AWSCloudTrail_ReadOnlyAccess AWS managed policies.
• iam: distinguish s3:GetObjectAcl / s3:PutObjectAcl / s3:Get|Put|DeleteObjectTagging from base S3 ops via ?acl / ?tagging query parameters when resolving an action for IAM enforcement.
• ses: implement identity (sending authorization) policies for v1 and v2 (#1750)
• stepfunctions: support the HTTP invoke step (#1503)
• stepfunctions: implement the States.JsonMerge intrinsic (#1662)
• eks: add eks.disable-cni to start k3s without its bundled CNI, so a real CNI can be installed in its place (#1793)

Fixed

• storage: dedupe storage backends by resolved file path. Two components opening the same file each got an independent in-memory store, and on graceful shutdown the stale duplicate flushed last and overwrote persisted state (#1931)
• elbv2: move persisted-listener restore out of @PostConstruct. Restoring listeners during bean creation re-entered the CDI proxy and recursed until the process died, so after a restart with persisted listeners every ELBv2 operation failed (#2015)
• core: reject REST requests signed for a service Floci does not implement with UnknownOperationException, instead of letting them fall through to S3's path-style routes and return a misleading NoSuchBucket (#1967)
• cloudformation: model AWS::IAM::Policy as an inline policy so two stacks can reuse the same generated policy name; report failed rollback cleanup as ROLLBACK_FAILED, detach removed IAM inline-policy targets on stack updates, and migrate the legacy managed-policy representation during update or deletion (#1800)
• core: return 4xx client errors instead of 500 for malformed JSON-protocol input (#1926)
• s3: return 400 MalformedXML for an unparseable PutObjectRetention RetainUntilDate (#1631)
• s3: preserve literal question marks in copy source keys (#1924)
• cognito: build OIDC URLs from effectiveBaseUrl so FLOCI_HOSTNAME is honored (#1929)
• cognito: prefer phone delivery for signup verification (#1839)
• dynamodb: tokenize UpdateExpression whitespace-insensitively (#1862)
• dynamodb: throw ValidationException when a list_append operand is not a list type (#1702)
• firehose: return ResourceInUseException on a duplicate CreateDeliveryStream (#1738)
• ec2: apply the cidr-block filter in DescribeSubnets (#1864)
• neptune: throw the modeled InsufficientStorageClusterCapacity fault when the proxy-port range is exhausted, so SDK clients can map it to a typed exception (#1879)

Changed

• ci: attach provenance and SBOM attestations to the published images (#2032)

1.5.33 - 2026-07-15

Added

• eks: support managed node groups and Fargate profiles (create/describe/list/delete) (#1523)
• stepfunctions: support JSONata workflow variables (Assign) (#1824)
• cognito: implement GlobalSignOut (#1701)
• cognito: emit jti/origin_jti claims and support RevokeToken (#1705)
• cloudformation: parse secrets in ECS ContainerDefinitions (#1874)

Fixed

• s3: fail fast on unwritable data root instead of opaque 500s (#1868)
• s3: handle DeleteBucketReplication instead of deleting the whole bucket (#1837)
• s3: return default SSE-S3 from GetBucketEncryption instead of 404 (#1838)
• s3: honor ACL headers and explicit grants (#1768)
• lifecycle: tear down process-bound containers on shutdown (#1869)
• ec2: reject duplicate key pair names in ImportKeyPair (#1848)
• iam: pass S3 list condition context to IAM enforcement (#1748)
• scheduler: forward MessageAttributes in universal sns:publish target (#1706)
• elbv2: expose target health reason parity (#1743)
• rds: return DBSubnetGroupNotFoundFault for missing DescribeDBSubnetGroups name (#1870)
• cloudformation: carry PackageType through SAM Function expansion (#1772)
• eks: register FargateProfileStatus for native-image reflection (#1876)

[1.5.32] - 2026-07-11

Fixed

• iam: default UserName to the calling access key's owner (#1801)
• lambda: register EventSourceMapping nested types for native-image reflection (#1826)
• lambda: return event source mapping failure config (#1629)
• lambda: return a downloadable GetFunction Code.Location (#1718)
• ec2: serialize concurrent mutations of shared resources per resource (#1786)
• ec2: round-trip create-time tags and route/SG-rule attributes (#1763)
• ecs: assign awsvpc tasks dynamic host ports to avoid collisions (#1785)
• elbv2: dispatch same-port listeners by host (#1700)
• autoscaling: propagate ASG tags at launch (#1734)
• s3: omit checksum headers from GetObject/HeadObject unless x-amz-checksum-mode: ENABLED (#1633); support S3 auth enforcement (#1689)
• ses: populate VerificationStatus in v2 ListEmailIdentities (#1722)
• rds: preserve network placement metadata (#1735)
• neptune: roll back proxy port and container on failed provisioning (#1742)
• secretsmanager: return partial result for missing secrets in batch (#1591)
• scheduler: honor target EventBridgeParameters DetailType/Source (#1489)
• tls: add host.docker.internal to self-signed cert SANs (#1821)
• aws-core: register persisted model types for native-image reflection (#1781)

1.5.31 - 2026-07-07

Added

• stepfunctions: support Map ItemReader for S3-backed JSON datasets (#1588)
• iam/rds/docdb/elasticache/glue/ssm/backup/s3control: implement read-only describe/list APIs for resource collection (#1581)
• eventbridge: deliver events to Firehose delivery stream targets (#1739)
• apigateway: persist API key tags and add the GetApiKey route (#1677)
• scheduler: dispatch ECS targets to RunTask (#1733)
• secretsmanager: support Filters and pagination in BatchGetSecretValue (#1737)
• ec2: support registered images and snapshots (#1601); add instance metadata catalog and architecture parity (#1596)
• rds-data: add the Data API for PostgreSQL (#1720)
• rds: add mock mode to create clusters and instances without Docker (#1655)
• cloudwatch: add Logs Insights query support (#1448)
• cloudcontrol: list resources from local services (#1602)
• cloudformation: apply S3 Bucket CorsConfiguration (#1617)
• core: claim wire protocols reactively per the Smithy selection guide (#1712)
• docs: generate Supported Actions tables from handler source (#1641)

Changed

• lambda: mount function code from a read-only volume instead of copying per cold start (#1673)

Fixed

• stepfunctions: resolve qualified Lambda function ARNs in lambda:invoke (#1660)
• s3: fix CopyObject handling (#1670)
• sqs: honor queue-level DelaySeconds for standard queues (#1567); render Query-protocol errors as XML instead of leaking JSON (#1732)
• ec2: honor launch template default version updates (#1704)
• rds: improve postgres proxy startup parity (#1599); resolve tags by ARN resource type, not only DB instances (#1649)
• eks: let pods pull images pushed to the Floci ECR registry (#1762)
• cloudwatch: return ResourceNotFound for SetAlarmState on a missing alarm (#1621)
• lambda: persist version counters and event-invoke configs across restart (#1730)
• elasticbeanstalk: persist applications, versions, and environments across restart (#1729)
• emr: return AWS client-error codes instead of 500 InternalServerError (#1731)
• autoscaling: align active instance refresh behavior (#1598)
• docker: isolate managed resource containers (#1703)
• storage: make computeIfAbsent atomic (#1699)

1.5.30 - 2026-07-03

Added

• stepfunctions: add the ecs:runTask service integration (#1564); add the state machine version APIs PublishStateMachineVersion, ListStateMachineVersions, and DeleteStateMachineVersion (#1562); add ResultSelector, Pass-state Parameters, ArrayContains, and wildcard projection, and fix IsPresent for absent paths (#1558); run executions under the execution's account (#1566)
• amazonmq: add the Amazon MQ broker control plane backed by RabbitMQ (#1642)
• cloudformation: add StackSets with account-aware provisioning (#1551)
• ec2: add VPC Flow Logs (#1611); publish security-group TCP ingress ports on the host (#1680)
• firehose: return ExtendedS3DestinationDescription and support UpdateDestination (#1710)
• ses: implement ContactList CRUD for SES v2 (#1638)
• iam: enforce AssumeRole trust policies when enforcement is enabled (#1552)
• cloudtrail: support empty lookup events (#1603)
• tls: serve HTTPS on 443 and trust Floci's certificate in Lambda containers (#1595)

Changed

• lambda: drop the base64 encode/decode round-trip on the S3 code path (#1666)

Fixed

• iam: resolve attached AWS-managed policies from any account (#1663); enforce STS session policies (#1636)
• cloudformation: register the !Cidr and !GetAZs shorthand YAML tags (#1635); treat a missing Secrets Manager secret as already-deleted on stack delete (#1672)
• ec2: return groupSet from DescribeInstanceAttribute (#1709); align AMI guest and launch template parity (#1597)
• ses: align CreateEmailIdentity DKIM behavior with AWS (#1620); treat missing SendingEnabled as false in v2 PutConfigurationSetSendingOptions (#1594)
• cognito: register VerificationCode for reflection so hybrid storage can persist state (#1646); omit unset optional blocks from CreateUserPoolClient responses (#1615)
• ecr: advertise the published host port when adopting the registry container (#1715)
• kms: normalize alias targetKeyId to the plain key ID on CreateAlias (#1648)
• s3/sns: preserve root service-host routing (#1625)
• tagging: persist resource tag mappings across restart (#1711)
• dynamodb: return a null Message for non-failed item cancellation reasons (#1623)
• elasticache: roll back the proxy port and container on failed provisioning (#1618)
• autoscaling: fail SSM commands for stale ASG instances (#1600)
• cloudwatch-logs: preserve ingestion order for same-timestamp events (#1592)
• elbv2: wrap void Query responses in their Result envelope (#1189)
• core: register persisted enums for native-image reflection (#1695)
• docker: enable TLS and sync the Docker test runner with the compatibility workflow (#1714)

1.5.29 - 2026-06-30

Added

• stepfunctions: add aws-sdk CloudFormation/EC2 and S3 PutObject service integrations (#1556)
• appsync: add the Phase 4 VTL engine for resolver mapping templates (#1288)
• iam: add the AmazonRDSEnhancedMonitoringRole managed policy (#1559); route assumed-role credentials to the target account (#1549)
• cognito: add overrides for client id and client secret (#1486)
• core: add state reset and nuke endpoints (#1482)

Fixed

• cloudformation: treat an already-missing ECS task definition, cluster, or service as delete-complete during stack deletion (#1645)
• ecs: honor task portMappings hostPort when launching containers (#1610); register persisted model records for native-image reflection (#1606)
• ses: make FromEmailAddress optional for v2 SendEmail (#1561)
• elbv2: publish resolvable local ALB DNS names (#1492)
• transcribe: persist vocabularies across restart (#1608)
• ssm: retain local service diagnostics on command failure (#1529)
• storage: flush persisted state before container teardown on shutdown (#1607)

1.5.28 - 2026-06-26

Added

• iot: add experimental IoT Core support with an in-process MQTT broker (#1359)
• elasticbeanstalk: add initial Elastic Beanstalk Query API support (#1362)
• memorydb: model authentication via ACLs and users (#1478)
• appsync: add the $util runtime library for VTL resolvers (#1223)
• pipes: support Kafka pipe sources (MSK and self-managed via smk://) and polling (#1260)
• ecs: mount efsVolumeConfiguration task volumes as shared local volumes (#1569)
• ses: implement PutConfigurationSetDeliveryOptions for SES v1 (#1553); publish SNS notifications to identity feedback topics (#1540)
• ec2: add an instance-type metadata catalog (#1534); add a Java-built Ubuntu AMI guest image (#1542)
• s3: support bucket logging configuration (#1510)
• core: add opt-in Private Network Access for CORS preflights (#1530)

Fixed

• cognito: align AdminGetUser lookup with pool sign-in settings (#1571); align CUSTOM_AUTH trigger failures with AWS behavior (#1484); align sign-up confirmation with AWS behavior (#1488)
• lambda: use the persisted firstReceiveTimestamp in the SQS ESM (#1548); propagate SQS FIFO system attributes to the ESM event (#1527); populate SQS messageAttributes in the Lambda event payload (#1422); resolve handler paths with a leading ./ against the package (#1575)
• iam: resolve AWS-managed policies from any account context (#1573); make entity stores thread-safe under concurrent mutation (#1509)
• cloudformation: fail stack delete when a managed resource cannot be deleted (#1554)
• codedeploy: persist applications, deployment groups, configs, on-prem instances, and tags (#1579)
• codebuild: create the build working directory before running phases (#1577); stabilize compatibility tests (#1565)
• rds: align subnet group placement handling with AWS behavior (#1295); align create-time parameter group validation with AWS behavior (#1330)
• ec2: persist default egress as a SecurityGroupRule and fix DescribeSecurityGroupRules filter parsing (#1525)
• msk: advertise an externally reachable broker address (#1239)
• eventbridge: sync tags to the Resource Groups Tagging API (#1347)
• s3: serve a custom error document for missing keys on static websites (#1334)
• cloudfront: honor the configured domain-suffix for generated distribution domains (#1533)
• dynamodb: throw 400 with exact error messages for invalid expressions (#1545)
• athena: serialize timestamps as epoch seconds in GetWorkGroup and GetTableMetadata (#1524)
• elbv2: omit the terminal SSL policy marker (#1522)
• sfn: make execution data available via the SDK (#1506)
• secretsmanager: register the AWSPENDING version before invoking the rotation Lambda (#1519)
• floci-ui: report real sidecar-start failures instead of always blaming the image (#1544)
• core: implement read APIs required by Steampipe resource collection (#1538)

1.5.27 - 2026-06-23

Added

• memorydb: add the MemoryDB service with mock mode (#1420)
• s3vectors: add the S3 Vectors service (#1435)
• codepipeline: add AWS CodePipeline emulation (#1469)
• ec2: add Network ACL support (#1473)
• secretsmanager: implement the automatic secret rotation lifecycle (#1467)
• ses: support v2 dedicated IP pools and configuration-set option groups (#1412); support v1 configuration-set tracking and reputation-metrics options (#1479)
• dynamodb: add TableId, TableClass, and OnDemandThroughput (#1457)
• cloudformation: generate an implicit API Gateway from SAM Api events (#1438)
• neptune: support a neo4j backend for openCypher via NEPTUNE_DB_TYPE (#1449)

Fixed

• ecs: persist durable resources via StorageBackedMap so they survive a restart (#1514)
• codebuild: persist projects, report groups, and source credentials (#1515)
• config: persist config rules, conformance packs, recorders, delivery channels, and tags (#1516)
• dynamodb: validate ExclusiveStartKey against the key schema (#1443); reject redundant parentheses, duplicate contains() operands, and non-string begins_with (#1442); cap scanned items with Limit and carry the full cursor on index scans (#1456)
• cloudformation: support OAuth and callback configurations in UserPoolClient (#1458); delete EC2 security groups on stack deletion (#1472); merge SAM Globals into resource properties (#1427)
• ec2: omit the empty stateReason element in DescribeInstances (#1410); log instance user data (#1474)
• rds: fix the PostgreSQL proxy ignoring the requested database name (#1480)
• cognito: implement token revocation for AdminUserGlobalSignOut (#1407)
• apigatewayv2: cascade-delete child resources and return 404 for dangling references (#1300)
• athena: add partition keys to the table metadata response (#1454)
• acm: restore certificates after a restart by ignoring computed getters (#1440)
• autoscaling: reject launch templates without image ids (#1451)
• ssm: reject send-command timeouts below the AWS minimum (#1511)
• docdb/neptune: stop containers and proxies on emulator shutdown (#1452)
• ui: register StatusResponse for native-image reflection (#1441); resolve the readiness probe URL from the container endpoint (#1471)

Changed

• kms: use enums for type-safety and add algorithms to key metadata (#1430)

1.5.26 - 2026-06-19

Added

• cloudformation: provision EC2 instances (#1366); RDS resources (#1367); EKS clusters and node groups (#1368); CloudWatch Logs log groups (#1369); CloudWatch metric alarms (#1371); Auto Scaling groups and launch configurations (#1372); Kinesis data streams (#1370); Kinesis Firehose delivery streams (#1399); add Fn::GetAZs and Fn::Cidr intrinsics (#1365)
• docdb: Amazon DocumentDB service emulation (#1341)
• autoscaling: preserve policy and mixed-instances parity (#1437); support group reconciliation and instance refresh (#1393)
• ec2: support Spot Instance request actions (#1291)
• ssm: add DescribePatchBaselines and GetDefaultPatchBaseline (#1404); execute run commands in EC2 containers (#1387)
• kms: add EnableKey support (#1381)
• cognito: align user pool client config APIs with AWS behavior (#1360)
• iam: provisioning preflight support (#1250)
• ui: serve a landing page and launch the floci-ui console on demand (#1313)
• aws: expand the EC2 and RDS availability catalogs (#1391)

Fixed

• cloudformation: record a REVIEW_IN_PROGRESS event on change-set creation (#1431); create the stage from an AWS::ApiGateway::Deployment inline StageName (#1400)
• lambda: redrive failed SQS event-source-mapping messages to the DLQ (#1419); return the {"status":"OK"} ack body from the runtime invocation endpoints (#1418)
• ec2: enable embedded DNS for instances (#1390); persist EC2 state so CloudFormation references survive a restart (#1364)
• cognito: align the password recovery flow with AWS behavior (#1415); add missing UserPoolClient validation (#1394)
• autoscaling: validate the MixedInstancesPolicy launch template (#1439)
• sqs: process messages from a non-default account (#1406)
• ecs: reject a negative desiredCount in CreateService and UpdateService (#1409)
• auth/s3: resolve account context from the X-Amz-Credential query param in presigned URLs (#1413)
• apigateway: support SQS query-protocol integrations (path-style URI) (#1385)
• rds: report DB parameter group attachments (#1392)
• rds-data: add native MySQL JDBC support (#1352)
• secretsmanager: honor ListSecrets MaxResults and NextToken pagination (#1383)
• kms: wrap RSA DIGEST signatures in a PKCS#1 DigestInfo (#1396)
• elasticache: register Endpoint for reflection so HybridStorage can persist state (#1403)
• cloudwatch: parse decimal epoch timestamps in the JSON protocol handler (#1388)
• ses: canonicalize only the domain of suppression-list email addresses (#1350)
• scheduler: support aws-sdk universal targets and FIFO MessageGroupId (#1344)
• config: make runtime defaults explicit (#1389)
• core: return an XML error for a missing action and add volume action fallbacks (#1348)

Changed

• floci: regroup the UI and DuckDB under services.floci (#1397)
• ci: run focused native compatibility tests (#1375)

Documentation

• cloudformation: sync supported resource types and annotate stub actions (#1405)
• docdb: document the DocumentDB service (#1386)
• correct the service count to 58 and add EMR, WAF v2, and CloudTrail pages (#1398)
• move brand assets into docs/assets and fix README image paths (#1363)

1.5.25 - 2026-06-15

Added

• batch: AWS Batch service support (#1332)
• wafv2: AWS WAF v2 management API (Phase 1) (#1327)
• emr: Amazon EMR management API (Phase 1) (#1321)
• rds-data: RDS Data API support (#1262)
• rds: provisioning support (#1253)
• cloudformation: provision Lambda-backed custom resources and layer versions (#1146)
• glue: support partition APIs (#1315); support column statistics (#1309); support table statistics deletion (#1324)

Fixed

• cloudformation: provision AWS::EC2::VPC/Subnet (and related networking) resources instead of stubbing, so exported subnet ids resolve in EC2 and ELBv2 (#1342)
• sqs: raise the max message size to 1 MiB (#1339); release in-flight ReceiveMessage long polls when their queue is deleted (#1286); report ApproximateNumberOfMessagesDelayed in GetQueueAttributes (#1285)
• ses: omit unknown identities from GetIdentityNotificationAttributes (#1338); align MailFromAttributes presence with MAIL FROM configuration (#1310, #1273); persist inline options on v2 CreateConfigurationSet (#1307)
• glue: return partitions in a deterministic order from GetPartitions (#1335); reject deletes of missing tables (#1323)
• sts: persist the session secret key so RDS/ElastiCache IAM tokens validate (#1266)
• s3: make conditional puts atomic (#1329); return BadRequest for dot-dot object keys (#1325)
• elbv2: enforce ALB subnet availability-zone rules (#1247); improve target resolution and persistence (#1254)
• ec2: embed the image catalog in the native image and load it lazily (#1308)
• ecs: validate network mode and resources for Fargate task definitions (#1274)
• cognito: include USERNAME in the SRP PASSWORD_VERIFIER challenge (#1316)
• appconfig: stop AppConfig from hijacking the S3 bucket named configuration (#1317)
• athena: align GetWorkGroup with AWS behavior (#1301)
• msk: populate currentBrokerSoftwareInfo in the cluster describe response (#1238)
• parity: pre-create LocalStack/Floci init-hook directories (#1337)

Documentation

• lambda: document Podman rootless support and the Runtime API host override (#1340)

1.5.24 - 2026-06-11

Added

• cloudtrail: trail lifecycle support (#1256)
• cloudmap: AWS Cloud Map (servicediscovery) management API (#1217)
• ec2: provisioning primitives — launch templates, VPC endpoints, NAT gateways, instance type offerings (#1252)
• ec2: auto-create default security group and main route table on CreateVpc (#1177)
• eks: support managed node groups (#1226)
• kms: key state and description operations (DisableKey, UpdateKeyDescription) (#1251)
• cognito: verification code subsystem (#1249)
• athena: support DeleteWorkGroup (#1213); align CreateWorkGroup with AWS (#1174)
• glue: register database tags with the Resource Groups Tagging API (#1248); support UpdateDatabase (#1232); archive table versions and return them from GetTableVersions (#1233)
• elbv2: align DescribeLoadBalancers availability zones with AWS behavior (#1206)
• ses: publish events to Firehose, EventBridge, and CloudWatch (#1188)
• cloudformation: provision AWS::StepFunctions::StateMachine (#1152)
• s3: stream range responses (#1255)
• parity: emit LocalStack-compatible Ready. log line on startup (#1284)

Fixed

• athena: align ListWorkGroups with AWS behavior (#1259)
• elasticache: return reachable Memcached configuration endpoints (#1258)
• elbv2: validate subnet VPC consistency for load balancers (#1244)
• msk: poll the correct Redpanda admin readiness endpoint (#1237)
• lambda: normalize backslash ZIP path separators on extraction (#1215)
• s3: reject relative object keys (#1235)
• glue: preserve column parameters (#1210); support BatchDeleteTable (#1209); normalize catalog names (#1208)
• docker: fall back to the default command when entrypoint argv is empty (#1283)
• cloudmap: avoid SecureRandom in the native image heap (#1271, #1289)

Documentation

• adopt the AGENTS.md standard and update references (#1225, #1272)
• cloudmap: add service docs (#1221)

1.5.23 - 2026-06-07

Added

• iam: seed the standard EKS cluster and node-group managed policies (#1216)
• appsync: Phase 2 — schema registry, model fixes, CRUDL completion, and AWS scalars (#1185)
• cloudwatch: accept a log group ARN via logGroupIdentifier (#1172)
• ecs: honour task-definition volumes and container mountPoints (#1171)
• ses: per-configuration-set sending toggle (v1 + v2) (#1193)
• glue: support DeleteDatabase (#1181)
• glue: support user-defined functions (#1187)

Fixed

• glue: enforce table version checks (#1184, #1211)
• glue: preserve view table fields (#1182)
• dynamodb: persist the SSE specification and return SSEDescription for encrypted tables (#1191)
• dynamodb: accept AttributesToGet with Select=SPECIFIC_ATTRIBUTES in Query (#1190)
• dynamodb: update the reserved keywords list (#1176)
• ecs: retain inactive services for Terraform draining and recreation with correct idempotency (#1166)
• ec2: include AttachTime in the describe-instances network interface response (#1214)
• stepfunctions: honor Catch on Lambda task failures (#1196)
• cloudformation: poll for CREATE_COMPLETE in the SAM changeset test (#1199)
• sns: align mobile push error codes, payload resolution, and Token rotation with AWS (#1165)
• elbv2: align DeleteTargetGroup with the AWS Query response (#1194)
• cloudwatch: tag rpc-v2-cbor timestamp lists so GetMetricData decodes (#1162)

Documentation

• ses: list the v1 ConfigurationSetEventDestination actions (#1192)

Build

• bump Quarkus to 3.36.0 and patch build dependencies (#1197)

1.5.22 - 2026-06-04

Added

• eks: make real-mode clusters reachable from the host and authenticate aws eks get-token via a token webhook (#1167)
• ecs: honour RunTask containerOverrides — per-container command and environment (#1151)
• ecs: provision ECS resources via CloudFormation (#1120)
• elbv2: provision ELBv2 resources via CloudFormation (#1121)
• cloudformation: persist stacks across restart (#1124)
• sns: mock mobile push for iOS and Android platform endpoints (#1115)
• kms: GenerateRandom action (#1036)
• appsync: AWS AppSync management API (Phase 1) (#1108)
• ses: publish SES events to SNS configuration set destinations (#1106)
• ses: V1 ConfigurationSetEventDestination CRUD (#1111)
• ses: apply the suppression list during send, with a per-configuration-set SuppressionOptions override (#1109)

Fixed

• eventbridge: propagate the PutEvents call region and account through pattern matching and the delivered envelope (#1125)
• cloudformation: roll back failed stack creates (#1123)
• apigatewayv2: support the CloudFormation update path (#1122)
• apigateway: implement EndpointConfiguration for REST APIs (#1116)
• athena: align metadata behavior with AWS (#1119)
• lambda: support path-style ECR URIs for image functions (#1135)
• elb: return TargetGroupNotFound for missing target groups (#1161)
• ecs: preserve create-time resource tags (#1139)
• ecr: resolve the backing registry endpoint from the control plane (#1113)
• docker: retry transient registry failures during image pull (#1117)
• dns: resolve public hostnames from spawned containers (#1168)
• s3: handle empty object suffix ranges (#1142)
• s3: return an error on unsupported S3 Select expressions (#1160)
• core: use the request region consistently across service operations (#1105)

Security

• s3: enforce SSE-C customer keys on object reads, writes, copies, and multipart uploads (#1143)

Documentation

• appsync: add AppSync service documentation (#1149)
• add light/dark logo branding, mkdocs theming, and README badges (#1150)

Build

• bump actions/checkout from 4 to 6.0.2 (#1159)
• bump aws-actions/configure-aws-credentials from 4 to 6.1.2 (#1158)
• bump the actions-minor-patch group with 5 updates (#1157)

1.5.21 - 2026-05-31

Added

• ses: SES V2 configuration set event destination operations (#1079)
• firehose: TagDeliveryStream, UntagDeliveryStream, and ListTagsForDeliveryStream (#1061)
• cognito: custom schema attributes and attribute deletion APIs (#1060)
• cognito: OAuth2 /oauth2/userInfo endpoint (#1062)
• kms: handle RotateKeyOnDemand rotation limit (#1042)
• ec2: required methods for VPC, subnet, and instance operations (#959)

Fixed

• ec2: volume throughput, DescribeAddressesAttribute, and IAM instance profile parity (#1103)
• ec2: add missing subnet attributes and instance block device attachTime (#1087)
• dynamodb: merge nested map paths in ProjectionExpression (#1099)
• s3: reject response-* overrides on unsigned requests (#1098)
• eventbridge: tag rules on custom buses whose name contains "event-bus" (#1102)
• apigateway: implement V1 DeleteDeployment endpoint and return correct JSON 404 error (#1059)
• cloudformation: forward ApiGatewayV2 Api properties to the apigatewayv2 service (#1086)
• rds: restore persisted runtime on startup (#1071)
• logging: render port numbers without locale grouping separators (#1104)

Build

• move all builds to GraalVM 25 (#1107)
• enforce JDK 25 requirement with Maven Enforcer Plugin (#1101)

1.5.20 - 2026-05-29

Added

• cors: global CORS filter for browser-based local development — allows OPTIONS preflight and injects CORS headers on all responses (#849)
• kms: CreateGrant, RetireGrant, RevokeGrant, ListGrants, ListRetirableGrants, and DescribeKey grant enumeration (#1073)
• opensearch: round-trip VPC config, security options, encryption-at-rest, node-to-node encryption, and per-family instance type metadata (#1039)
• opensearch: support OpenSearch 3.x, validate engine versions, use real ES 7.10 OSS image (#1025)
• cloudformation: SAM Transform support — AWS::Serverless-2016-10-31 templates are now transformed before stack deployment (#1012)

Fixed

• ecs: reconcile task lifecycle when container exits naturally — tasks reach STOPPED state correctly without manual intervention (#1078)
• s3: clean up versioned file data on permanent version deletion to prevent stale data accumulation (#1045)
• apigateway: resolve APIs created outside the default region so cross-region requests are routed correctly (#1032)
• eventbridge: enforce $or negation in event pattern matching — negative $or conditions now correctly exclude matching events (#1068)
• apigw-v2: populate pathParameters in Lambda proxy event for HTTP API integrations (#1067)
• ec2: skip terminated instances in DescribeNetworkInterfaces (#1074)
• ec2: return volumeId in BlockDeviceMapping and disableApiStop/disableApiTermination in DescribeInstanceAttribute (#1028)
• ec2: fix DescribeNetworkInterfaces response shape — missing fields and incorrect filtering (#1035)
• ecr: shut down registry manager on observable shutdown event to prevent port leaks (#1063)
• s3: omit whole-object checksum headers on range (GET with Range:) responses (#1040)
• s3: apply TaggingDirective=COPY default in CopyObject — tags are now copied when directive is omitted (#1049)
• elbv2: offload Lambda invocation to a worker thread to avoid blocking the event loop (#1034)
• cloudformation: implement nested stack deployment via AWS::CloudFormation::Stack (#1052)
• cloudformation: retain deleted stacks briefly for destroy-polling so SDKs can observe DELETE_COMPLETE status (#1029)
• lambda: fix WarmPool timeout when stopping multiple containers — containers now shut down in parallel (#1055)

Documentation

• neptune: add Neptune service page and fix missing index entries (#1056)

1.5.19 - 2026-05-24

Added

• lambda: Lambda layer support — PublishLayerVersion, GetLayerVersion, ListLayerVersions, DeleteLayerVersion (#1015)
• elbv2: DescribeListenerAttributes, ModifyListenerAttributes, DescribeCapacityReservation, and ModifyCapacityReservation actions (#1021)
• kms: RotateKeyOnDemand support for on-demand key rotation (#990)
• apigateway: Lambda REQUEST authorizer support for HTTP API v2 routes (#1011)
• apigateway: persist UpdateStage methodSettings patch operations on v1 stages (#1004)
• cognito: UpdateGroup, ListUsersInGroup, and AdminConfirmSignUp actions (#998)
• ci: Docker images now published to ECR Public Gallery (#1000)

Fixed

• s3: remove private hasQueryParam in S3Controller that shadowed the static import from S3RequestParser — presigned PUT requests with x-amz-tagging in X-Amz-SignedHeaders were misrouted to PutObjectTagging and returned 404 (#1023)
• iam: honour 12-digit access key as account ID in IAM ARNs — CreateRole, CreateUser, CreateGroup, CreatePolicy, and CreateInstanceProfile always returned 000000000000 regardless of caller identity (#1017)
• s3: persist inline x-amz-tagging header on PutObject (#987)
• apigateway: implement DeleteDeployment endpoint and return correct JSON 404 error for missing resources (#1019)
• rds: register DbEndpoint for native-image reflection (#1014)
• apigateway: populate full APIGatewayRequestAuthorizerEvent fields for REQUEST authorizers (#1002)
• sns: return per-entry failures from PublishBatch instead of aborting the whole batch on a single entry failure (#1008)
• cognito: CloudFormation provisioning for UserPool and UserPoolClient resource types (#1007)
• lifecycle: fix incorrect readiness status display when TLS is enabled and AppConfig is initialising (#1006)
• s3: unblock .well-known/* object keys that were hijacked by Cognito OIDC routes (#1003)
• sns: preserve binary message attributes through Publish and fan-out delivery (#989)
• cognito: include user attributes in ID token claims (#985)
• ecr: release registry port when container start fails to prevent port exhaustion (#1010)
• s3: restore object data on delete marker removal and return missing version headers (#966)
• sts: honour 12-digit access key as account ID in STS responses (#983)
• sqs: accept bare queue name in QueueUrl field (#980)
• s3: accept region-qualified virtual-host form bucket.s3.<region>.<host> (#978)
• sqs/sns: add ContentBasedDeduplication support and SNS subscription CloudFormation provisioning (#974)
• s3: handle PutBucketRequestPayment instead of falling through to CreateBucket (#994)

Documentation

• pipes: add documentation and navigation for EventBridge Pipes (#1001)
• tagging: add Resource Groups Tagging service documentation (#976)
• transcribe: add Transcribe service documentation (#975)

1.5.18 - 2026-05-21

Added

• cloudfront: CloudFront service emulation — CreateDistribution, GetDistribution, UpdateDistribution, DeleteDistribution, ListDistributions; distribution state, origins, cache behaviors, and viewer certificate management (#969)
• config: AWS Config service emulation — configuration recorders, delivery channels, config rules, StartConfigurationRecorder, StopConfigurationRecorder, DescribeConfigurationRecorders, PutDeliveryChannel, DescribeDeliveryChannels, PutConfigRule, DescribeConfigRules, DeleteConfigRule (#934)
• neptune: SDK compatibility tests added to the Neptune control plane and Gremlin Docker backend (#958)
• apigatewayv2: HTTP API requests are now forwarded through ALB listeners — HTTP_PROXY integrations targeting ALB are resolved at dispatch time, enabling ECS/ELBv2 stacks backed by API Gateway HTTP APIs (#941)
• sqs: persist and return AWSTraceHeader system attribute on SendMessage and ReceiveMessage for X-Ray tracing compatibility (#909)
• sqs: implement StartMessageMoveTask, ListMessageMoveTasks, and CancelMessageMoveTask with async drain and configurable MaxNumberOfMessagesPerSecond rate limiting (#910)
• kms: implement GenerateMac and VerifyMac for HMAC keys (HMAC_256, HMAC_384, HMAC_512) (#927)
• apigateway: handle inbound requests to custom domain names — custom domain name mappings are matched before stage routing, enabling SDK and Terraform workflows that create AWS::ApiGateway::DomainName resources (#922)
• ecs: register ECS service containers as ELBv2 targets — ECS tasks are automatically registered and deregistered in target groups when services scale or update (#929)
• elasticache: Memcached cluster management — CreateCacheCluster and DescribeCacheClusters for memcached engine; Memcached data-plane proxy backed by a real Memcached Docker container (#930)
• sns: HTTP/HTTPS endpoint delivery — subscriptions with http or https protocol now deliver notifications via real HTTP POST with the standard SNS envelope; includes subscription confirmation handshake (#865)
• secretsmanager: add RestoreSecret operation — restores a soft-deleted secret, clears the DeletedDate, and returns the updated metadata (#915)

Fixed

• s3: return ObjectLockConfigurationNotFoundError when GetObjectLockConfiguration is called on a bucket that was not created with Object Lock enabled (#971)
• core: lowercase smithy-protocol response header to smithy-protocol — some AWS SDK versions rejected the mixed-case variant, breaking CBOR responses (#968)
• s3: omit Content-Type body-description headers and user-defined metadata (x-amz-meta-*) from PutObject responses — these fields are request-only and their presence in the response caused SDK assertion failures (#948)
• rds: persist instance and cluster metadata across storage-backed restarts — DescribeDBInstances and DescribeDBClusters returned empty results after restart (#945)
• s3: fix ListObjects v1 marker-based pagination — the next-page marker was not advanced correctly, causing infinite loops or skipped objects on subsequent pages (#939)
• sqs: reject SendMessageBatch when the combined payload exceeds MaximumMessageSize — previously only individual message size was checked (#907)
• apigatewayv2: include corsConfiguration in HTTP API Get/Create/Update responses (#933)
• core: fix crash when the request Content-Type header is an empty string — previously threw a NullPointerException during media-type parsing (#940)
• lambda: log an actionable hint when the concurrency pool is exhausted instead of returning a bare 429 (#935)
• dynamodb: correct DeleteTable status transitions — table enters DELETING before removal; fix PartiQL SELECT scan to respect FilterExpression (#915)
• lambda: make PortAllocator a checkout/release pool — prevents port collisions under concurrent invocations and restores released ports to the free set (#936)
• apigatewayv2: raise Vert.x WebSocket frame size limit to 256 KB to match AWS WebSocket API frame limits (#938)
• apigatewayv2: include connectionType and enableSimpleResponses fields in Integration and Authorizer responses (#931)
• sns: preserve per-entry MessageAttributes in PublishBatch — attributes from sibling entries were leaking across batch items (#891)
• lambda: await HttpServer close in RuntimeApiServer.stop() to prevent in-flight /next polls from being dropped during graceful shutdown (#926)
• apigateway: accept any Content-Type on PutRestApi and ImportRestApi — previously rejected non-application/json bodies, breaking Swagger YAML imports (#925)
• s3: honor response-content-type, response-content-disposition, response-cache-control, and other response-* query parameters on GetObject and HeadObject (#923)
• cognito: correct USER_SRP_AUTH PASSWORD_VERIFIER challenge signature computation — HMAC-SHA256 was using the wrong derived key, causing authentication failures with real SRP clients (#912)
• ec2: add missing instance response fields (privateDnsNameOptions, maintenanceOptions, currentInstanceBootMode) to fix Terraform nil pointer dereference on aws_instance resources (#883)
• sns: emit canonical AWS error codes (InvalidParameterValue) for Publish and PublishBatch message size violations (#906)
• sqs: skip JSON null tag and attribute values instead of persisting the literal string "null" (#905)
• sqs: scope FIFO deduplication ID lookup per MessageGroupId when DeduplicationScope=messageGroup is set on the queue (#908)

Documentation

• Update README with service coverage and configuration examples (#885)

1.5.17 - 2026-05-18

Added

• neptune: Neptune control plane — CreateDBCluster, DescribeDBClusters, ModifyDBCluster, DeleteDBCluster, CreateDBInstance, DescribeDBInstances, ModifyDBInstance, DeleteDBInstance; each cluster is backed by a real TinkerPop Gremlin Server Docker container behind a transparent TCP proxy (#881)
• apigateway: GetAccount and UpdateAccount — account-level configuration including throttle settings and CloudWatch log role ARN; enables Terraform and CDK stacks that call aws_api_gateway_account (#867)
• apigatewayv2: HTTP_PROXY integration type — forwards inbound requests to the configured IntegrationUri with RequestParameters transformations matching AWS-faithful semantics (#860)
• dynamodb: ExecuteStatement, ExecuteTransaction, BatchExecuteStatement — hand-rolled PartiQL tokenizer and recursive-descent parser supporting SELECT/INSERT/UPDATE/DELETE, ? positional placeholders, begins_with, and BETWEEN; translates to existing service calls with no new storage (#864)
• sns: FilterPolicyScope=MessageBody — filter policies scoped to the message body are now evaluated at publish time; previously the scope was persisted but ignored, delivering all messages regardless of the policy (#863)
• cognito: PostConfirmation and PreSignUp Lambda triggers — PostConfirmation_ConfirmSignUp fires after ConfirmSignUp; PreSignUp_SignUp fires before user persistence on SignUp; autoConfirmUser=true in the PreSignUp response auto-confirms and chains into PostConfirmation (#859)
• ses: PutAccountSuppressionAttributes (PUT /v2/email/account/suppression) — set account-level suppression list reasons (BOUNCE/COMPLAINT); GetAccount response now includes a SuppressionAttributes object reflecting the stored setting (#853)
• cur / bcm-data-exports: Cost and Usage Reports (AWSOrigamiServiceGatewayService.*) and BCM Data Exports (AWSBillingAndCostManagementDataExports.*) management planes sharing one underlying export pipeline (#850)

Fixed

• dynamodb: honor legacy Expected condition in UpdateItem — handleUpdateItem now reads the Expected field, and evaluateLegacyExpected normalizes the legacy {"Value": x} shape to {"AttributeValueList": [x]} before evaluation; conditional writes that should fail were silently succeeding (#888)
• apigatewayv2: Route responses now include authorizerId — the field was persisted and used at dispatch time but never emitted by toV2RouteNode, breaking SDK and Terraform reads (#887)
• eventbridge: persisted rules no longer disappear on reload — Rule.getRegion() is a derived getter with no setter; ObjectMapper wrote "region" into eventbridge-rules.json and then threw UnrecognizedPropertyException on startup, causing all persisted rules to be silently dropped (#878)
• s3: PutObject now returns the checksum for the algorithm actually specified by the caller; previously always returned ChecksumSHA1 + ChecksumSHA256 regardless of --checksum-algorithm (#877)
• eks: cluster readiness polling now uses the container's bridge IP instead of the container hostname, fixing clusters stuck in CREATING when Floci runs inside Docker; startup failures are handled gracefully instead of returning 500 (#873)
• eventbridge: region is now correctly propagated through rule dispatch so SQS queue lookup uses the rule's region rather than the primary region (#870)
• eventbridge: EventBusName is now accepted as a full ARN (arn:aws:events:…:event-bus/my-bus) in addition to a plain name across all EventBridge operations (#843)

1.5.16 - 2026-05-15

Added

• stepfunctions: ValidateStateMachineDefinition — validates ASL definitions and returns structured diagnostics with /States/<state>/<field> paths for precise error location (#845)
• stepfunctions: ListTagsForResource, TagResource, UntagResource for state machines and activities; covers both the AWS SDK (JSON 1.0) and Terraform (REST) wire paths (#767)
• rds: cluster parameter group actions — CreateDBClusterParameterGroup, DescribeDBClusterParameterGroups, DeleteDBClusterParameterGroup, ModifyDBClusterParameterGroup, DescribeDBClusterParameters; mirrors the existing instance-level parameter group shape and unblocks IaC stacks that define Aurora ClusterParameterGroup resources (#838)
• s3: full SelectObjectContent evaluator with floci-duck integration — recursive WHERE (AND, OR, NOT, LIKE, BETWEEN, IN, IS NULL, comparisons), JSON Lines and JSON array input formats, cross-format output (CSV→JSON, JSON→CSV), real BytesScanned/BytesReturned stats; routes CSV and JSON through floci-duck when available with a pure-Java fallback for standalone mode (#835)
• eventbridge: UpdateEventBus — update event bus description, KMS key, dead-letter config, or log config (#834)
• ce: AWS Cost Explorer service — GetCostAndUsage, GetCostAndUsageWithResources, GetDimensionValues, GetTags, GetReservationCoverage, GetReservationUtilization, GetSavingsPlansCoverage, GetSavingsPlansUtilization, GetCostCategories; cost is synthesized from existing resource state multiplied by the bundled pricing snapshot; supports DAILY/MONTHLY/HOURLY granularity, all standard metrics, and GroupBy on DIMENSION, TAG, and COST_CATEGORY (#832)
• transcribe: AWS Transcribe service — StartTranscriptionJob, GetTranscriptionJob, ListTranscriptionJobs, DeleteTranscriptionJob, CreateVocabulary, GetVocabulary, ListVocabularies, UpdateVocabulary, DeleteVocabulary (#827)

Fixed

• core: remove AWS SDK from Floci's runtime classpath to eliminate version conflicts with user-bundled SDKs (#846)
• core: improve log level structure and reduce noise in hot paths (#847)
• s3: make us-east-1 bucket creation idempotent — repeated CreateBucket calls for the same bucket in us-east-1 no longer raise BucketAlreadyOwnedByYou (#844)
• ec2: support wildcard (*, ?) filter values across all EC2 resources (VPCs, Subnets, Security Groups, Instances, Internet Gateways, Route Tables, Volumes), matching real AWS filter behavior (#837)
• pricing: bundle pricing snapshot resources into the native image — the Price List service was unavailable in GraalVM native builds (#836)
• kms: Encrypt now derives a fresh AES-GCM nonce per call (was deterministic, leaking plaintext equality); Decrypt now validates EncryptionContext as AAD and raises InvalidCiphertextException on any mismatch (#825)
• s3: strip charset parameter from Content-Type in XML responses (#809)
• sqs: FIFO ReceiveMessage now returns messages from multiple distinct message groups in a single call (#785)
• sqs: honor AttributeNames and MessageSystemAttributeNames on ReceiveMessage (#784)
• sqs: implement AddPermission and RemovePermission (#781)
• stepfunctions: honor TimeoutSeconds on Parallel state (#771)

Documentation

• Improve README readability (#831)

1.5.15 - 2026-05-13

Added

• pricing: AWS Price List Service — DescribeServices, GetAttributeValues, GetProducts, ListPriceLists, GetPriceListFileUrl with pagination; backed by a bundled static snapshot; PriceList shape matches the real SDK's array-of-JSON-strings format (#821)
• eventbridge: TestEventPattern — validates a sample event against a pattern without firing any targets; returns {"Result": <bool>}; raises InvalidEventPatternException on malformed patterns (#824)
• ses: v2 suppression list endpoints — PutSuppressedDestination, GetSuppressedDestination, DeleteSuppressedDestination, ListSuppressedDestinations (#813)
• s3: virtual-hosted style addressing — *.s3.localhost.floci.io, *.localhost.localstack.cloud, and *.s3.localhost.localstack.cloud are now resolved as virtual-hosted buckets; EmbeddedDnsServer ships localhost.localstack.cloud and localhost.floci.io as built-in suffixes so spawned containers resolve correctly without extra config (#805)
• cloudwatch-logs: PutSubscriptionFilter, DescribeSubscriptionFilters, DeleteSubscriptionFilter — upsert semantics and ByLogStream default distribution (#810)

Fixed

• dynamodb: broad conformance pass — ValidationException (was InvalidParameterValue) for table-name errors; min-length 3 enforced for all operations; ListTables alphabetical ordering, Limit validation, pagination; enum validation for ReturnValues/ReturnConsumedCapacity fires before table lookup; ProjectionExpression on GetItem, Query, Scan, BatchGetItem; Select=COUNT omits Items; parallel scan Segment/TotalSegments validation with hash-based sharding; reserved words rejected in FilterExpression/ConditionExpression/UpdateExpression; legacy AttributesToGet, AttributeUpdates, QueryFilter, ScanFilter, KeyConditions API; item size limit (400 KB) and number normalization on write; TagResource/UntagResource/ListTagsOfResource with ARN validation; SET into a non-existent nested map auto-creates the map (#826)
• dynamodb: SET a = :v, b = a now reads pre-update value of a for b (atomic snapshot semantics); ClientRequestToken idempotency with 10-minute TTL and SHA-256 body-hash conflict detection; parenthesized arithmetic SET c = (c - :v) now applies correctly (#804)
• apigateway: sibling {proxy+} resources now resolved by longest parent prefix, matching real AWS routing behaviour (#811)
• cloudformation: provision AWS::ApiGateway::Authorizer and wire AuthorizerId on methods — previously the resource was silently stubbed, leaving stacks reporting CREATE_COMPLETE with no authorizer registered (#796)
• cloudformation: preserve Targets[].SqsParameters (including MessageGroupId) when provisioning AWS::Events::Rule — FIFO SQS targets delivered without a MessageGroupId were rejected by AWS (#793)
• sqs: return MD5 of current request body on FIFO deduplication replay (#786)
• sqs: honor MaximumMessageSize attribute on SendMessage (#782)
• sqs: omit Messages field from empty ReceiveMessage JSON response (#780)
• sns: enforce message size limits on Publish and PublishBatch (#783)
• ses: allow SendRawEmail without Source when a From: header is present in the MIME payload (#800)
• lambda: automatically detect the Docker network of the running Floci container and use it for spawned Lambda containers — removes the need to manually set FLOCI_SERVICES_LAMBDA_DOCKER_NETWORK in Docker Compose setups (#765)
• core: fix CRLF line-ending issues on Windows by adding .gitattributes normalisation rules (#790)

1.5.14 - 2026-05-10

Added

• textract: Textract service support — DetectDocumentText, AnalyzeDocument, StartDocumentTextDetection, GetDocumentTextDetection, StartDocumentAnalysis, GetDocumentAnalysis (#719)
• multitenancy: per-account storage isolation across all services — if the AWS access key ID is exactly 12 digits, it is used directly as the account ID and all resources are fully isolated from other accounts (#753)
• tls: optional TLS/HTTPS support — set FLOCI_TLS_ENABLED=true to serve all endpoints over HTTPS; auto-generates and persists a self-signed certificate that includes FLOCI_HOSTNAME/FLOCI_BASE_URL in its SANs; user-provided certificates supported via FLOCI_TLS_CERT_PATH and FLOCI_TLS_KEY_PATH (#754)
• apigatewayv2: WebSocket data-plane support — wss:// connections, PostToConnection, GetConnection, DeleteConnection, @connect/@disconnect/$default routes (#712)
• cognito: UpdateGroup, ListUsersInGroup (#761)
• cognito: AdminCreateUser with MessageAction=RESEND (#755)
• ses: UpdateAccountSendingEnabled (v1 Query protocol) (#737)
• ses: TagResource, UntagResource, ListTagsForResource on v2 REST JSON protocol (#749)
• ses: v2 tag endpoints extended to EmailTemplate ARNs (#759)
• ses: v2 tag endpoints extended to EmailIdentity ARNs (#760)
• docker: named-volume storage for child containers (RDS, ElastiCache, OpenSearch, MSK) so data survives container restarts without requiring a host bind-mount (#743)
• docker: ship awslocal CLI wrapper in the -compat image (#746)

Fixed

• cfn: reconcile Lambda functions on stack update (#736)
• docker: /etc/floci/aws/config missing in published Docker images (#740)
• eventbridge: persist and forward SqsParameters.MessageGroupId for FIFO SQS targets (#742)
• sqs: tags set at CreateQueue not returned by ListQueueTags (#747)
• apigateway: treat ANY method as wildcard when matching concrete HTTP methods (#750)
• s3: parse versionId from copy-source header for CopyObject and multipart part-copy (#751)
• sqs: drop uppercase "Tags" key from CreateQueue JSON handler to match AWS wire format (#752)

Documentation

• All service and configuration docs moved to environment-variable-first; application.yml reference moved to configuration/advanced/
• New page: Multi-Account Isolation
• New page: TLS / HTTPS
• Go Testcontainers page rewritten to match the published testcontainers-floci-go API
• LocalStack migration table completed with all mapped variables (USE_SSL, CUSTOM_SSL_CERT_PATH, DOCKER_HOST, PERSIST_STATE, LAMBDA_REMOTE_DOCKER)

1.5.13 - 2026-05-07

Added

• backup: AWS Backup Phase 1 — vaults, plans, selections, on-demand jobs with simulated CREATED→RUNNING→COMPLETED lifecycle, recovery points, tagging via SharedTagsController, and GetSupportedResourceTypes
• codedeploy: Server platform (Phase 4) — on-premises instance management (RegisterOnPremisesInstance, DeregisterOnPremisesInstance, GetOnPremisesInstance, BatchGetOnPremisesInstances, ListOnPremisesInstances, AddTagsToOnPremisesInstances, RemoveTagsFromOnPremisesInstances); Server AppSpec YAML parsing; EC2 and on-premises instance resolution by tag filters; full lifecycle event execution (ApplicationStop → DownloadBundle → BeforeInstall → Install → AfterInstall → ApplicationStart → ValidateService); SSM Run Command integration for hook script execution with graceful degradation when SSM is unavailable; per-instance InstanceTarget tracking in ListDeploymentTargets/BatchGetDeploymentTargets
• elbv2: Lambda target type — ALB listeners forward requests to Lambda functions using the full ALB→Lambda event format (httpMethod, path, queryStringParameters, multiValueQueryStringParameters, headers, multiValueHeaders, body, isBase64Encoded); Lambda→ALB response mapping (statusCode, headers, multiValueHeaders, body, isBase64Encoded); Lambda target groups always report as healthy in DescribeTargetHealth without HTTP probing
• eventbridge: Archive and Replay support — CreateArchive, DescribeArchive, UpdateArchive, DeleteArchive, ListArchives, StartReplay, DescribeReplay, CancelReplay, ListReplays; events captured automatically to matching archives and replayed on demand (#702)
• route53: Route53 Phase 1 — hosted zones with auto-created SOA + NS records, ChangeResourceRecordSets (CREATE/UPSERT/DELETE with atomic batch validation), ListResourceRecordSets, change tracking (always INSYNC), health checks (create/get/list/update/delete), and per-resource tagging via ChangeTagsForResource / ListTagsForResource
• scheduler: TagResource, UntagResource, ListTagsForResource for schedule groups (#700)
• sqs, dynamodb: TRACE-level payload logging for request and response bodies to aid debugging (#697)
• ssm: Run Command — SendCommand, GetCommandInvocation, ListCommands, ListCommandInvocations, CancelCommand, DescribeInstanceInformation; UpdateInstanceInformation (agent registration); ec2messages polling protocol (GetMessages, AcknowledgeMessage, SendReply, FailMessage, DeleteMessage, GetEndpoint) so the real amazon-ssm-agent running inside EC2 containers can register, receive commands, and report output
• transfer: Transfer Family management-plane API — server lifecycle (CreateServer, DescribeServer, DeleteServer, ListServers, StartServer, StopServer, UpdateServer), user management (CreateUser, DescribeUser, DeleteUser, ListUsers, UpdateUser), SSH key management (ImportSshPublicKey, DeleteSshPublicKey), and tagging (TagResource, UntagResource, ListTagsForResource)

Fixed

• appconfig: use capital "Tags" body key in TagResource / ListTagsForResource to match AWS SDK wire format (#704)
• docker: respect DOCKER_HOST env var and handle bare host:port values without a URI scheme (#705)
• ec2: AssociateRouteTable now returns <associationState> in the response; DescribeRouteTables supports the association.route-table-association-id filter; DescribeTags correctly applies resource-id, resource-type, key, and value filters (#706)

1.5.12 - 2026-05-04

Added

• apigatewayv2: WebSocket API support, Update ops, Route/Integration Responses, Models, and Tagging (#682)
• autoscaling: EC2 Auto Scaling stored-state management API and capacity reconciler (#681)
• ses: add TestRenderTemplate (v1) and TestRenderEmailTemplate (v2) (#692)
• glue: Schema Registry support — registries, schemas, versions, compatibility checks, metadata, tags, and Java SerDe SDK compatibility (#621)
• parity: LocalStack drop-in compatibility layer (#696)

Fixed

• sfn: apply ItemSelector/Parameters transformation in Map state (#683)
• ecs: fix delete resource issue (#685)
• lambda: use function region in container AWS environment (#687)
• cloudformation: adopt existing DynamoDB tables on stack update (#689)
• cloudformation: resolve Floci virtual-hosted template URLs (#690)
• docker: fix ARG ordering in compat Dockerfile so VERSION build-arg is applied correctly

1.5.11 - 2026-05-02

Added

• ec2: real Docker container execution with SSH, UserData, and IMDS support (#658)
• cognito: implement AdminRespondToAuthChallenge operation (#666)
• pipes: populate SQS message attributes in pipe source records (#667)
• cloudformation: add Fn::ImportValue cross-stack reference resolution (#669)
• elbv2: ALB proxy, CodeDeploy, and ECS integration (#677)
• lambda: support ImageConfig.WorkingDirectory (#673)

Fixed

• Normalize bare host:port Docker host values to prevent URI parse failure (#665)
• athena: use embedded DNS server to resolve S3 URL used by floci-duck containers (#672)
• iam: protocol-aware Access Denied response in IAM enforcement filter (#657)
• iam: read Action from form body in IAM enforcement filter (#655)
• lambda: fix incorrect request size limit (#674)
• sqs: inject QueueUrl into form body for query protocol path-based requests (#670)
• ecr: properly check if host-persistent-path is the name of a Docker volume (#678)

1.5.10 - 2026-04-30

Added

• lambda: support ImageConfig Command and EntryPoint for container images (#630)
• ses: add ConfigurationSet CRUD on v1 Query and v2 REST JSON protocols (#631)
• cloudformation: provision AWS::Pipes::Pipe resources (#634)
• cognito: include all standard attributes in DescribeUserPool schema (#642)
• ses: add SendBulkEmail (v2) and SendBulkTemplatedEmail (v1) (#645)
• cognito: Custom Auth Flow integration with Lambda triggers (#646)
• codebuild, codedeploy: implement real Docker-based build execution (phase 2) (#649)
• iam: seed 23 additional AWS managed execution-role policies (#650)
• dynamodb: implement ExportTableToPointInTime, DescribeExport, and ListExports (#653)
• cloudformation: support AWS::Lambda::EventSourceMapping resource type (#654)

Fixed

• docker: replace bash /dev/tcp HEALTHCHECK with busybox wget for Alpine runtime compatibility (#625)
• pipes: resolve InputTemplate paths through JSON-encoded string fields (#635)
• dynamodb: fix GSI query pagination infinite loop when items share a sort key (#637)
• cloudformation: wrap ZipFile inline source in a zip archive before passing to Lambda (#639)
• lambda: inject log group, log stream, and Floci endpoint env vars into Lambda containers (#640)
• cloudformation: resolve path-style AWS S3 TemplateURL against local S3 (#641)
• eks: use named Docker volume for k3s data directory to avoid EINVAL on macOS APFS (#643)
• apigateway: support _custom_id_ tag on CreateRestApi (#644)
• apigateway: implement GET /restapis/{id}/deployments/{deploymentId} (#652)
• athena: connect to floci-duck container via IP instead of DNS (#648)

1.5.9 - 2026-04-28

Added

• elbv2: Elastic Load Balancing v2 management API — Phase 1 (#617)
• codebuild, codedeploy: add management APIs (#622)

Fixed

• cloudformation: resolve changesets by ARN in DescribeChangeSet, ExecuteChangeSet, DeleteChangeSet (#608)
• lambda: drop dead pooled containers in WarmPool.acquire() before reuse (#610)
• apigateway: propagate TOKEN authorizer context to AWS_PROXY Lambda integrations (#581)
• pipes: invoke non-Lambda targets per-record instead of batch envelope (#590)
• docker: avoid host mountinfo false positives in container detection (#616)
• s3: emit x-amz-transition-default-minimum-object-size on lifecycle GET/PUT (#615)
• s3: fix OOM on PutObject with large payloads (#620)
• kms: GetKeyRotationStatus now returns false for asymmetric and HMAC keys (#618)
• lambda: inject default AWS credentials into Lambda containers (#623)
• ec2: persist VPC DNS attributes and support DescribeVpcEndpointServices (#624)

1.5.8 - 2026-04-25

Added

• pipes: add filtering, input templates, batch sizes, and DLQ routing (#576)
• cognito: add TagResource, UntagResource, ListTagsForResource for user pools (#579)
• ses: implement email template CRUD with stored, inline, and ARN variants (#573)
• sqs: clear SNS FIFO deduplication cache on PurgeQueue (#594)
• athena: real SQL execution via floci-duck DuckDB sidecar (#584)
• lambda: embedded DNS server for virtual-hosted S3 URL resolution inside containers (#585)
• lambda: bind-mount hot-reload via S3Bucket=hot-reload (#601)

Fixed

• dynamodb: accept full ARN for TableName across all operations (#580)
• dynamodb: enforce DeletionProtectionEnabled on create, update, and delete (#583)
• lambda: support nested Python handler module paths (#570)
• dynamodb: serialise concurrent mutations and transactions via per-item locks (#572)
• pipes: return parameters and tags in mutation responses; warn on stream record loss (#588)
• pipes: read EventBridgeEventBusParameters for Source and DetailType (#589)
• lambda: parse empty payload without error (#600)
• docker: make bind-mounted /var/run/docker.sock work on all host types (#602)
• lambda: replace blocking /next handler with reactive pattern (#596)
• lambda: wire S3VirtualHostFilter to container-aware DNS suffix (#598)
• s3-control: accept plain S3 ARN (arn:aws:s3:::bucket) in ListTagsForResource (#603)
• rds: fix DBSubnetGroup shape, non-master auth pass-through, and volume lifecycle (#604)

1.5.7 - 2026-04-23

Fixed

• docker: fix Docker image build issue introduced in 1.5.6

1.5.6 - 2026-04-23

Added

• ses: SMTP relay support for SendEmail and SendRawEmail (#534)
• appconfig: resource tagging and predefined deployment strategies (#533)
• firehose: implement DeleteDeliveryStream API (#535)
• pipes: EventBridge Pipes service — CRUD API, source polling, and target invocation (#539, #555)
• docker: centralize Docker config and add private registry authentication (#549)
• scheduler: invoke targets when EventBridge Scheduler schedules fire (#551)
• secretsmanager: add UpdateSecretVersionStage handling (#545)
• cognito, kms: allow caller-pinned resource IDs via the reserved floci:override-id tag (#568)
• sqs: add option to clear deduplication cache on PurgeQueue (#561)

Fixed

• dynamodb: return correct attributes for UPDATED_NEW/UPDATED_OLD on new items (#538)
• lambda: initialize ESM pollers at startup; fix worker-pool exhaustion in RuntimeApiServer (#543)
• secretsmanager: fix incorrect update of AWSPENDING on secret value update (#542)
• kms: support HMAC_* key specs in CreateKey (#544)
• lambda: add missing FunctionConfiguration fields and fix response shape (#546)
• s3: wrap S3 Control XML errors in ErrorResponse wrapper (#560)
• native, acm: fix native image reflection for ACM (#559)
• s3: enforce conditional writes (#566)

1.5.5 - 2026-04-19

Added

• eks: implement EKS service with real k3s data plane support (#493)
• s3: implement static website hosting with index document redirection (#507)
• lambda: reactive S3-to-Lambda sync for hot-reloading (#509)
• dynamodb: support ReturnValuesOnConditionCheckFailure (#505)
• eventbridge: add PutPermission and RemovePermission support (#499)
• cognito: implement AdminEnableUser and AdminDisableUser (#514)
• cognito: implement AdminResetUserPassword (#516)
• kinesis: support AT_TIMESTAMP shard iterator type (#520)
• opensearch: real OpenSearch container support via Docker image (#528)
• secretsmanager: add version stages handling in PutSecretValue (#527)
• s3: preserve explicit object server-side-encryption headers (#515)

Fixed

• dynamodb: support arithmetic in SET expressions (#480)
• sqs: include MD5OfMessageAttributes in SendMessageBatch JSON response (#496)
• cloudformation: forward Lambda environment variables during stack provisioning (#510)
• kms: support ECC_SECG_P256K1 via BouncyCastle JCA (#502)
• dynamodb: validate sort key in buildItemKey to prevent item collisions (#506)
• storage: make scan() return a mutable list for non-in-memory backends (#517)
• ses: align /_aws/ses inspection endpoint with LocalStack behavior (#512)
• lifecycle: run shutdown hooks before HTTP server stops (#519)
• kinesis: return real ShardId in PutRecord and PutRecords responses (#518)
• lambda: restore create-copy-start ordering for provided runtimes (#524)
• lambda: fix container lifecycle on timeout (#529)
• lambda: destroy container handle on interrupt and generic exceptions (#530)
• lambda: wake blocked /next poller and drain queue on RuntimeApiServer.stop() (#531)

Security

• s3: harden path traversal defenses in S3Service and S3Controller (#508)

1.5.4 - 2026-04-17

Added

• iam: seed AWS managed policies at startup (#400)
• s3: preserve Content-Disposition on object responses (#408)
• sfn: add SQS sendMessage AWS SDK integrations (#409)
• kinesis: implement EnableEnhancedMonitoring and DisableEnhancedMonitoring (#417)
• msk: implement Amazon MSK service with Redpanda orchestration (#419)
• dynamodb: add EnableKinesisStreamingDestination support (#427)
• lambda: enforce reserved and per-region concurrency (#424)
• eventbridge: implement TagResource and UntagResource (#453)
• cloudwatch: implement GetMetricData (#451)
• cognito: create, list, and delete user pool client secrets (#345)
• ec2: implement CreateVolume, DescribeVolumes, DeleteVolume (#455)
• athena, glue, firehose: implement local Data Lake stack with real SQL execution (#429)
• tagging: implement Resource Groups Tagging API (#459)
• bedrock-runtime: stub Converse and InvokeModel (#486)
• kinesis: implement UpdateStreamMode (#488)
• lambda: support ScalingConfig.MaximumConcurrency on SQS event source mappings (#490)
• lambda: add UpdateFunctionConfiguration API (#472)
• dynamodb: support UPDATED_OLD and UPDATED_NEW ReturnValues (#477)

Fixed

• elasticache: scope single-arg AUTH to default user per Redis ACL spec (#390)
• auth: bind SigV4 token identity and use timing-safe comparison (#389)
• apigatewayv2: add missing JSON handler operations and stageName auto-deploy (#393)
• cloudformation: populate SQS queue ARN in resource attributes (#396)
• elasticache, rds: prevent orphaned Docker containers on shutdown and restart (#398)
• s3: remove XML declaration from GetBucketLocation response (#403)
• lambda: resolve handler paths with subdirectories; skip validation for dotnet runtimes (#404)
• iam: enforce IAM when enabled (#411)
• dynamodb: implement DELETE action for set attributes (#415)
• sqs: use queue-level VisibilityTimeout as fallback in ReceiveMessage (#413)
• lambda: raise Jackson maxStringLength for large inline zip uploads (#418)
• dynamodb: support REMOVE for nested map paths (#421)
• cognito: return only description fields in ListUserPoolClients (#420)
• s3: honor canned object ACLs on write paths (#422)
• ecr: fall back to named volume for registry data when host-persistent-path is unset inside containers (#442)
• kinesis: return time-based MillisBehindLatest (#444)
• lambda: accept name, partial ARN, and full ARN for {FunctionName} path parameter (#450)
• dynamodb: accept newline as UpdateExpression clause separator (#449)
• cognito: add aud claim to ID tokens (#454)
• s3: implement bucket ownership controls (#456)
• dynamodb: support continuous backups and PITR actions (#458)
• kinesis: accept AWS SDK v2 CBOR content type (#457)
• dynamodb: fix expression evaluation, UpdateExpression paths, and ConsumedCapacity (#197)
• lambda: include LastUpdateStatus in function configuration responses (#463)
• Add log rotation by default to all Floci-launched containers (#466)
• sqs: honor queue-level DelaySeconds on FIFO queues (#476)
• ecr: fix port and network issues (#483)
• s3-control: accept URL-encoded ARNs and return XML errors (#491)

1.5.3 - 2026-04-12

Added

• appconfig: new AppConfig service (#324)
• ecr: new ECR service — push, pull, manage repositories and images (#337)
• docker: add HEALTHCHECK to all Floci Dockerfiles (#328)
• lambda: add PutFunctionConcurrency stub (#325)

Changed

• Unify service metadata behind a descriptor-backed catalog for enablement, routing, and storage lookups (#357)

Fixed

• s3: return XML error responses for presigned POST failures (#327)
• sqs: make per-queue message operations atomic (#333)
• eventbridge: apply InputPath when delivering events to targets (#335)
• cloudformation: topologically sort resources before provisioning (#332)
• s3: return empty LocationConstraint for us-east-1 buckets (#336)
• dynamodb: attach X-Amz-Crc32 header to JSON protocol responses (#347)
• cognito: return sub UUID as UserSub in SignUp response (#351)
• kinesis: accept same-value Increase/DecreaseStreamRetentionPeriod (#352)
• sns: recognize attributes set during subscription creation (#353)
• ecr, s3: fix CDK compatibility and resolve macOS ECR port conflict (#354)
• kms: implement real asymmetric sign/verify and GetPublicKey (#355)
• eventbridge: implement advanced content filtering operators (#356)
• cognito: correct HMAC signature computation in USER_SRP_AUTH (#358)
• s3: include non-versioned objects in ListObjectVersions response (#359)
• secretsmanager: resolve partial ARNs without random suffix (#360)
• lambda: correct Function URL config path from /url-config to /url (#364)
• elasticache: scope user auth to groups, use StorageFactory, throw NotFoundFault (#367)
• apigatewayv2: fix route matching for path-parameter routes (#368)
• s3: implement S3 Control ListTagsForResource, TagResource, UntagResource (#363)
• cloudformation: resolve stacks by ARN in addition to name (#386)

1.5.2 - 2026-04-10

Added

• kinesis: add IncreaseStreamRetentionPeriod and DecreaseStreamRetentionPeriod (#305)
• kinesis: resolve stream name from StreamARN parameter (#304)
• kms: add GetKeyRotationStatus, EnableKeyRotation, and DisableKeyRotation (#290)
• s3: preserve Cache-Control header on PutObject, GetObject, HeadObject, and CopyObject (#313)

Fixed

• apigateway: implement v2 management API and CloudFormation provisioning (#323)
• cloudwatch: implement tagging support for metrics and alarms (#320)
• dynamodb: handle null for Java AWS SDK v2 DynamoDB EnhancedClient (#309)
• dynamodb: implement list_append with if_not_exists support (#317)
• dynamodb: remove duplicate list_append handler that breaks nested expressions (#321)
• rds: DescribeDBInstances returns empty results due to wrong XML element names and missing Filters support (#319)
• s3: preserve leading slashes in object keys to prevent key collisions (#286)
• Support LocalStack-compatible _user_request_ URL for API Gateway execution (#314)

1.5.1 - 2026-04-09

Fixed

• Native image build failure due to SecureRandom in CognitoSrpHelper

1.5.0 - 2026-04-09

Added

• cloudformation: add AWS::Events::Rule provisioning support (#261)
• eventbridge: add InputTransformer support and S3 event notifications (#294)
• dynamodb: load persisted DynamoDB streams on startup (#299)

Fixed

• Native build: append -march=x86-64-v2 for amd64 compatibility (#303)
• dynamodb: DescribeTable returns Projection.NonKeyAttributes (#300)
• rds: implement missing resource identifiers and fix filtering (#302)
• s3: implement S3 Lambda notifications (#278)
• cognito: implement SRP-6a authentication (#298)
• s3: use case-insensitive field lookup for presigned POST policy validation (#289)
• s3: use ConfigProvider for runtime config lookup in S3VirtualHostFilter (#288)
• Register Xerces XML resource bundles for native image (#296)

1.4.0 - 2026-04-08

Added

• kms: add GetKeyPolicy, PutKeyPolicy, and fix CreateKey tag handling (#280)
• ses: add SES V2 REST JSON protocol support (#265)
• lambda: add missing runtimes and fix handler validation (#256)
• scheduler: add EventBridge Scheduler service (#260)
• secretsmanager: add BatchGetSecretValue support (#264)
• sfn: nested state machine execution and activity support (#266)
• Use AWS-specific content type in all JSON-based controller responses (#240)

Fixed

• dynamodb: add list_append support to update expressions (#277)
• Default shell executable to /bin/sh for Alpine compatibility (#241)
• lambda: drain warm pool containers on server shutdown (#274)
• dynamodb: support add function with multiple values (#263)
• Handle base64-encoded ACM certificate imports (#248)
• dynamodb: include ProvisionedThroughput in GSI responses (#273)
• Return 400 when encoded S3 copy source is malformed (#244)
• cognito: resolve auth, token, and user lookup issues (#279)
• s3: enforce presigned POST policy conditions (eq, starts-with, content-type) (#203)
• s3: fix versioning IsTruncated, PublicAccessBlock, ListObjectsV2 pagination, and Kubernetes virtual host routing (#276)

1.3.0 - 2026-04-06

Added

• ec2: add EC2 service with 61 operations, integration tests, and documentation (#213)
• ecs: add ECS service (#209)
• dynamodb: add ScanFilter support for Scan operation (#175)
• eventbridge: forward resources array and support resources pattern matching (#210)
• lambda: add AddPermission, GetPolicy, ListTags, ListLayerVersions endpoints (#223)
• sfn: JSONata improvements, States.* intrinsics, DynamoDB ConditionExpression, StartSyncExecution (#205)
• Add GlobalSecondaryIndexUpdates support in DynamoDB UpdateTable (#222)
• Add scheduled rules support for EventBridge Rules (#217)

Fixed

• Fall back to Docker bridge IP when host.docker.internal is unresolvable (#216)
• lambda: copy code to TASK_DIR for provided runtimes (#206)
• lambda: honor ReportBatchItemFailures in SQS ESM (#208)
• lambda: support Code.S3Bucket + Code.S3Key in CreateFunction and UpdateFunctionCode (#219)
• ses: add missing Result element to query protocol responses (#207)
• sns: make Subscribe idempotent for same topic+protocol+endpoint (#185)

1.2.0 - 2026-04-04

Added

• cloudwatch-logs: add ListTagsForResource, TagResource, and UntagResource (#172)
• cognito: add group management support (#149)
• s3: support Filter rules in PutBucketNotificationConfiguration (#178)
• lambda: implement ListVersionsByFunction API (#193)
• Officially support Docker named volumes for native images (#155)
• Health endpoint (#139)
• Implement UploadPartCopy for S3 multipart uploads (#98)
• Support GenerateSecretString and Description for AWS::SecretsManager::Secret in CloudFormation (#176)
• Support GSI and LSI in CloudFormation DynamoDB table provisioning (#125)
• Add CloudFormation Fn::FindInMap and Mappings support (#101)
• lifecycle: add support for startup and shutdown initialization hooks (#128)
• s3: add conditional request headers (If-Match, If-None-Match, If-Modified-Since, If-Unmodified-Since) (#48)
• s3: add presigned POST upload support (#120)
• s3: add Range header support for GetObject (#44)
• sfn: add DynamoDB AWS SDK integration and complete optimized updateItem (#103)
• apigateway: OpenAPI/Swagger import, models, and request validation (#113)
• apigateway: add AWS integration type for REST v1 (#108)

Fixed

• cognito: auto-generate sub, fix JWT sub claim, add AdminUserGlobalSignOut (#183)
• cognito: enrich User Pool responses and implement MfaConfig stub (#198)
• cognito: OAuth/OIDC parity for RS256/JWKS, /oauth2/token, and OAuth app-client settings (#97)
• Globally inject AWS request-id headers for SDK compatibility (#146)
• Defer startup hooks until HTTP server is ready (#159)
• dynamodb: fix FilterExpression for BOOL types, List/Set contains, and nested attribute paths (#137)
• lambda: copy function code to /var/runtime for provided runtimes (#114)
• Resolve CloudFormation Lambda Code.S3Key base64 decode error (#62)
• Resolve numeric ExpressionAttributeNames in DynamoDB expressions (#192)
• Return stable cursor tokens in GetLogEvents to fix SDK pagination loop (#184)
• s3: evaluate S3 CORS against incoming HTTP requests (#131)
• s3: fix list parts for multipart upload (#164)
• s3: persist Content-Encoding header on S3 objects (#57)
• s3: prevent S3VirtualHostFilter from hijacking non-S3 requests (#199)
• s3: resolve file/folder name collision on persistent filesystem (#134)
• s3: return CommonPrefixes in ListObjects when delimiter is specified (#133)
• secretsmanager: return KmsKeyId in DescribeSecret and improve ListSecrets (#195)
• sns: enforce FilterPolicy on message delivery (#53)
• sns: honor RawMessageDelivery attribute for SQS subscriptions (#54)
• sns: pass messageDeduplicationId from FIFO topics to SQS FIFO queues (#171)
• sqs: route queue URL path requests to SQS handler (#153)
• sqs: support binary message attributes and fix MD5OfMessageAttributes (#168)
• sqs: translate Query-protocol error codes to JSON __type equivalents (#59)
• Support DynamoDB Query BETWEEN and ScanIndexForward=false (#160)

1.1.0 - 2026-03-31

Added

• acm: add ACM certificate management service (#21)
• Add HOSTNAME_EXTERNAL support for multi-container Docker setups (#82)
• Add JSONata query language support for Step Functions (#84)
• Add Kinesis ListShards operation (#61)
• opensearch: add OpenSearch service emulation (#132)
• ses: add SES (Simple Email Service) emulation (#14)
• Add virtual host support for S3 bucket routing (#88)
• apigateway: add AWS integration type for API Gateway REST v1 (#108)
• apigateway: OpenAPI/Swagger import, models, and request validation (#113)
• Docker image with AWS CLI (floci:x.y.z-aws) (#95)
• Implement GetRandomPassword for Secrets Manager (#80)
• s3: add presigned POST upload support (#120)
• s3: add Range header support for GetObject (#44)
• s3: add conditional request headers (#48)
• sfn: add DynamoDB AWS SDK integration (#103)

Fixed

• Added versionId to S3 notifications for versioning-enabled buckets (#135)
• Align S3 CreateBucket and HeadBucket region behavior with AWS (#75)
• DynamoDB table creation compatibility with Terraform AWS provider v6 (#89)
• dynamodb: apply filter expressions in Query (#123)
• dynamodb: respect if_not_exists for update_item (#102)
• Fix S3 NoSuchKey for non-ASCII keys (#112)
• kms: allow ARN and alias to encrypt (#69)
• Resolve compatibility test failures across multiple services (#109)
• s3: allow upload up to 512 MB by default (#110)
• sns: add PublishBatch support to JSON protocol handler
• Storage load after backend is created (#71)

1.0.11 - 2026-03-24

Fixed

• s3: add GetObjectAttributes and metadata parity (#29)

1.0.10 - 2026-03-24

Fixed

• s3: return versionId in CompleteMultipartUpload response (#35)

1.0.9 - 2026-03-24

Added

• lambda: add Ruby runtime support (#18)

1.0.8 - 2026-03-24

Fixed

• s3: return NoSuchVersion error for non-existent versionId

1.0.7 - 2026-03-24

Fixed

• s3: fix unit test error

1.0.6 - 2026-03-24

Fixed

• s3: truncate LastModified timestamps to second precision (#24)

1.0.5 - 2026-03-23

Fixed

• s3: fix CreateBucket response format for Rust SDK compatibility (#11)

1.0.4 - 2026-03-20

Fixed

• ci: fix Docker build on native pipeline
• ci: fix workflow artifact download path

1.0.2 - 2026-03-15

Fixed

• ci: fix Docker build action trigger

1.0.1 - 2026-03-15

Fixed

• ci: fix GitHub Actions workflow trigger

1.0.0 - 2026-03-15

Initial public release of Floci — a fast, free, open-source local AWS emulator.

Added

• SSM, SQS, SNS, SES, S3, DynamoDB, Lambda, API Gateway, Cognito, KMS, Kinesis, Secrets Manager, CloudFormation, Step Functions, IAM, STS, ElastiCache, RDS, EventBridge, and CloudWatch emulation
• AWS SDK and CLI wire-protocol compatibility on port 4566
• Native binary and JVM Docker images
• In-memory, persistent, hybrid, and WAL storage modes

---