Create GraphQL APIs with API-key (the first key is made for you), IAM or
Cognito user pool authorization, then edit the schema (a starter schema is
offered, and a rejected one is explained), create and delete API keys, create
data sources for a DynamoDB table, a Lambda function or none, and attach
JavaScript resolvers to fields of the schema from a template for the data
source.
TheCloud's endpoint checks queries against the schema and the API key but does
not run resolvers yet, so the page says so and offers no query runner.
Create and delete Athena workgroups (with a result folder, optionally
enforced), and run SQL in one: pick a database from the Glue Data Catalog,
preview a table, run with Ctrl+Enter, cancel a running query, read up to 1,000
rows and download the full result CSV from S3. Recent queries in the workgroup
can be reopened. TheCloud runs the SQL for real over the files a Glue table
points at. The Glue page links to the editor.
Create and delete Glue databases, and describe a folder of CSV, JSON-lines or
Parquet files in S3 as a table: its columns, and for CSV the delimiter and
whether the first line is a header. Tables are written with the storage
settings Athena expects, so TheCloud's Athena can query one as soon as it
exists. Glue jobs and crawlers are not offered: the runtime stores them but
never runs them.
Create file systems (with a mount target in each default subnet unless asked
not to), add and remove mount targets, create and delete access points, and
attach a file system to a Lambda function through an access point. A function
not yet in a VPC is put in the file system's mount target subnets with the
default security group, as Lambda requires. TheCloud's mounts are real, so two
functions on one access point share files.
Deleting a file system removes its access points and mount targets first, and
is refused while a function still mounts it.
Create groups from a launch template (in the default subnets unless given),
change their minimum, desired and maximum capacity, replace or remove an
instance, and follow the launches and terminations TheCloud's reconciler makes.
Deleting a group terminates its instances. Scaling policies are not offered:
the runtime stores them but its alarms only drive ECS scaling.
Create pipes from SQS, Kinesis, DynamoDB streams or MSK to Lambda, SQS, SNS,
EventBridge buses or Step Functions, with an optional filter, enrichment and
input template; start and stop them, see the flow with links to each resource,
and send a test message to an SQS source. Sources and targets the runtime's
poller cannot deliver between are refused on create.
Request public certificates (optionally exportable) or import your own, see
each domain's DNS validation records and what uses a certificate, download the
certificate and chain, export an exportable one with its encrypted key, and
revoke it. ListCertificates asks for every key type, since AWS otherwise
leaves EC certificates out.
API Gateway v2 is a separate AWS API from REST APIs, so HTTP and WebSocket APIs
made with the SDK, SAM, CDK or Terraform never showed up. The API Gateway page
now lists all three kinds with a Type column, creates each from the same form,
and opens HTTP and WebSocket APIs in their own panel:
- Quick create: an HTTP API with a Lambda gets a catch-all route on an
auto-deployed $default stage, plus the Lambda permission.
- Routes to Lambda (payload 2.0) or HTTP backends; deleting a route removes
the integration and Lambda permission only it used.
- Stages with or without automatic deployment, and deploy on demand.
- JWT authorizers filled in from a Cognito pool's OpenID Connect discovery
document and an app client, or from any issuer; protect routes with them.
- CORS configuration.
- A tester that sends a real request to a stage, and for WebSocket APIs one
that connects, sends a message and collects the replies.
Capabilities are advertised under a new httpApiActions group, covered by the
cloudProxy guard test. Verified end to end against TheCloud's runtime.
Adds a userpools catalog entry, schema and AwsUserPoolsAdapter, verified
against Floci core:
- list/get/create/delete user pools; create can set email or username
sign-in, a relaxed password policy for local test users, and a public
app client (on by default) whose id is surfaced in the pool metadata
- users as the pool's child items: list (paged), get, create and delete;
passwords are set permanent by default so users can sign in at once
- map Cognito's HTTP-400 error names (UserNotFoundException,
UsernameExistsException, AliasExistsException, InvalidPasswordException)
- link Floci's cognito-idp service to the new page on the diagnostics page
Zakaria