Skip to content

CHANGELOG.md

Latest commit

 

History

History
698 lines (545 loc) · 62.9 KB

CHANGELOG.md

File metadata and controls

698 lines (545 loc) · 62.9 KB
Raw

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

1.5.17 - 2026-05-18

Added

  • neptune: Neptune control plane — CreateDBCluster, DescribeDBClusters, ModifyDBCluster, DeleteDBCluster, CreateDBInstance, DescribeDBInstances, ModifyDBInstance, DeleteDBInstance; each cluster is backed by a real TinkerPop Gremlin Server Docker container behind a transparent TCP proxy (#881)
  • apigateway: GetAccount and UpdateAccount — account-level configuration including throttle settings and CloudWatch log role ARN; enables Terraform and CDK stacks that call aws_api_gateway_account (#867)
  • apigatewayv2: HTTP_PROXY integration type — forwards inbound requests to the configured IntegrationUri with RequestParameters transformations matching AWS-faithful semantics (#860)
  • dynamodb: ExecuteStatement, ExecuteTransaction, BatchExecuteStatement — hand-rolled PartiQL tokenizer and recursive-descent parser supporting SELECT/INSERT/UPDATE/DELETE, ? positional placeholders, begins_with, and BETWEEN; translates to existing service calls with no new storage (#864)
  • sns: FilterPolicyScope=MessageBody — filter policies scoped to the message body are now evaluated at publish time; previously the scope was persisted but ignored, delivering all messages regardless of the policy (#863)
  • cognito: PostConfirmation and PreSignUp Lambda triggers — PostConfirmation_ConfirmSignUp fires after ConfirmSignUp; PreSignUp_SignUp fires before user persistence on SignUp; autoConfirmUser=true in the PreSignUp response auto-confirms and chains into PostConfirmation (#859)
  • ses: PutAccountSuppressionAttributes (PUT /v2/email/account/suppression) — set account-level suppression list reasons (BOUNCE/COMPLAINT); GetAccount response now includes a SuppressionAttributes object reflecting the stored setting (#853)
  • cur / bcm-data-exports: Cost and Usage Reports (AWSOrigamiServiceGatewayService.*) and BCM Data Exports (AWSBillingAndCostManagementDataExports.*) management planes sharing one underlying export pipeline (#850)

Fixed

  • dynamodb: honor legacy Expected condition in UpdateItem — handleUpdateItem now reads the Expected field, and evaluateLegacyExpected normalizes the legacy {"Value": x} shape to {"AttributeValueList": [x]} before evaluation; conditional writes that should fail were silently succeeding (#888)
  • apigatewayv2: Route responses now include authorizerId — the field was persisted and used at dispatch time but never emitted by toV2RouteNode, breaking SDK and Terraform reads (#887)
  • eventbridge: persisted rules no longer disappear on reload — Rule.getRegion() is a derived getter with no setter; ObjectMapper wrote "region" into eventbridge-rules.json and then threw UnrecognizedPropertyException on startup, causing all persisted rules to be silently dropped (#878)
  • s3: PutObject now returns the checksum for the algorithm actually specified by the caller; previously always returned ChecksumSHA1 + ChecksumSHA256 regardless of --checksum-algorithm (#877)
  • eks: cluster readiness polling now uses the container's bridge IP instead of the container hostname, fixing clusters stuck in CREATING when Floci runs inside Docker; startup failures are handled gracefully instead of returning 500 (#873)
  • eventbridge: region is now correctly propagated through rule dispatch so SQS queue lookup uses the rule's region rather than the primary region (#870)
  • eventbridge: EventBusName is now accepted as a full ARN (arn:aws:events:…:event-bus/my-bus) in addition to a plain name across all EventBridge operations (#843)

1.5.16 - 2026-05-15

Added

  • stepfunctions: ValidateStateMachineDefinition — validates ASL definitions and returns structured diagnostics with /States/<state>/<field> paths for precise error location (#845)
  • stepfunctions: ListTagsForResource, TagResource, UntagResource for state machines and activities; covers both the AWS SDK (JSON 1.0) and Terraform (REST) wire paths (#767)
  • rds: cluster parameter group actions — CreateDBClusterParameterGroup, DescribeDBClusterParameterGroups, DeleteDBClusterParameterGroup, ModifyDBClusterParameterGroup, DescribeDBClusterParameters; mirrors the existing instance-level parameter group shape and unblocks IaC stacks that define Aurora ClusterParameterGroup resources (#838)
  • s3: full SelectObjectContent evaluator with floci-duck integration — recursive WHERE (AND, OR, NOT, LIKE, BETWEEN, IN, IS NULL, comparisons), JSON Lines and JSON array input formats, cross-format output (CSV→JSON, JSON→CSV), real BytesScanned/BytesReturned stats; routes CSV and JSON through floci-duck when available with a pure-Java fallback for standalone mode (#835)
  • eventbridge: UpdateEventBus — update event bus description, KMS key, dead-letter config, or log config (#834)
  • ce: AWS Cost Explorer service — GetCostAndUsage, GetCostAndUsageWithResources, GetDimensionValues, GetTags, GetReservationCoverage, GetReservationUtilization, GetSavingsPlansCoverage, GetSavingsPlansUtilization, GetCostCategories; cost is synthesized from existing resource state multiplied by the bundled pricing snapshot; supports DAILY/MONTHLY/HOURLY granularity, all standard metrics, and GroupBy on DIMENSION, TAG, and COST_CATEGORY (#832)
  • transcribe: AWS Transcribe service — StartTranscriptionJob, GetTranscriptionJob, ListTranscriptionJobs, DeleteTranscriptionJob, CreateVocabulary, GetVocabulary, ListVocabularies, UpdateVocabulary, DeleteVocabulary (#827)

Fixed

  • core: remove AWS SDK from Floci's runtime classpath to eliminate version conflicts with user-bundled SDKs (#846)
  • core: improve log level structure and reduce noise in hot paths (#847)
  • s3: make us-east-1 bucket creation idempotent — repeated CreateBucket calls for the same bucket in us-east-1 no longer raise BucketAlreadyOwnedByYou (#844)
  • ec2: support wildcard (*, ?) filter values across all EC2 resources (VPCs, Subnets, Security Groups, Instances, Internet Gateways, Route Tables, Volumes), matching real AWS filter behavior (#837)
  • pricing: bundle pricing snapshot resources into the native image — the Price List service was unavailable in GraalVM native builds (#836)
  • kms: Encrypt now derives a fresh AES-GCM nonce per call (was deterministic, leaking plaintext equality); Decrypt now validates EncryptionContext as AAD and raises InvalidCiphertextException on any mismatch (#825)
  • s3: strip charset parameter from Content-Type in XML responses (#809)
  • sqs: FIFO ReceiveMessage now returns messages from multiple distinct message groups in a single call (#785)
  • sqs: honor AttributeNames and MessageSystemAttributeNames on ReceiveMessage (#784)
  • sqs: implement AddPermission and RemovePermission (#781)
  • stepfunctions: honor TimeoutSeconds on Parallel state (#771)

Documentation

  • Improve README readability (#831)

1.5.15 - 2026-05-13

Added

  • pricing: AWS Price List Service — DescribeServices, GetAttributeValues, GetProducts, ListPriceLists, GetPriceListFileUrl with pagination; backed by a bundled static snapshot; PriceList shape matches the real SDK's array-of-JSON-strings format (#821)
  • eventbridge: TestEventPattern — validates a sample event against a pattern without firing any targets; returns {"Result": <bool>}; raises InvalidEventPatternException on malformed patterns (#824)
  • ses: v2 suppression list endpoints — PutSuppressedDestination, GetSuppressedDestination, DeleteSuppressedDestination, ListSuppressedDestinations (#813)
  • s3: virtual-hosted style addressing — *.s3.localhost.floci.io, *.localhost.localstack.cloud, and *.s3.localhost.localstack.cloud are now resolved as virtual-hosted buckets; EmbeddedDnsServer ships localhost.localstack.cloud and localhost.floci.io as built-in suffixes so spawned containers resolve correctly without extra config (#805)
  • cloudwatch-logs: PutSubscriptionFilter, DescribeSubscriptionFilters, DeleteSubscriptionFilter — upsert semantics and ByLogStream default distribution (#810)

Fixed

  • dynamodb: broad conformance pass — ValidationException (was InvalidParameterValue) for table-name errors; min-length 3 enforced for all operations; ListTables alphabetical ordering, Limit validation, pagination; enum validation for ReturnValues/ReturnConsumedCapacity fires before table lookup; ProjectionExpression on GetItem, Query, Scan, BatchGetItem; Select=COUNT omits Items; parallel scan Segment/TotalSegments validation with hash-based sharding; reserved words rejected in FilterExpression/ConditionExpression/UpdateExpression; legacy AttributesToGet, AttributeUpdates, QueryFilter, ScanFilter, KeyConditions API; item size limit (400 KB) and number normalization on write; TagResource/UntagResource/ListTagsOfResource with ARN validation; SET into a non-existent nested map auto-creates the map (#826)
  • dynamodb: SET a = :v, b = a now reads pre-update value of a for b (atomic snapshot semantics); ClientRequestToken idempotency with 10-minute TTL and SHA-256 body-hash conflict detection; parenthesized arithmetic SET c = (c - :v) now applies correctly (#804)
  • apigateway: sibling {proxy+} resources now resolved by longest parent prefix, matching real AWS routing behaviour (#811)
  • cloudformation: provision AWS::ApiGateway::Authorizer and wire AuthorizerId on methods — previously the resource was silently stubbed, leaving stacks reporting CREATE_COMPLETE with no authorizer registered (#796)
  • cloudformation: preserve Targets[].SqsParameters (including MessageGroupId) when provisioning AWS::Events::Rule — FIFO SQS targets delivered without a MessageGroupId were rejected by AWS (#793)
  • sqs: return MD5 of current request body on FIFO deduplication replay (#786)
  • sqs: honor MaximumMessageSize attribute on SendMessage (#782)
  • sqs: omit Messages field from empty ReceiveMessage JSON response (#780)
  • sns: enforce message size limits on Publish and PublishBatch (#783)
  • ses: allow SendRawEmail without Source when a From: header is present in the MIME payload (#800)
  • lambda: automatically detect the Docker network of the running Floci container and use it for spawned Lambda containers — removes the need to manually set FLOCI_SERVICES_LAMBDA_DOCKER_NETWORK in Docker Compose setups (#765)
  • core: fix CRLF line-ending issues on Windows by adding .gitattributes normalisation rules (#790)

1.5.14 - 2026-05-10

Added

  • textract: Textract service support — DetectDocumentText, AnalyzeDocument, StartDocumentTextDetection, GetDocumentTextDetection, StartDocumentAnalysis, GetDocumentAnalysis (#719)
  • multitenancy: per-account storage isolation across all services — if the AWS access key ID is exactly 12 digits, it is used directly as the account ID and all resources are fully isolated from other accounts (#753)
  • tls: optional TLS/HTTPS support — set FLOCI_TLS_ENABLED=true to serve all endpoints over HTTPS; auto-generates and persists a self-signed certificate that includes FLOCI_HOSTNAME/FLOCI_BASE_URL in its SANs; user-provided certificates supported via FLOCI_TLS_CERT_PATH and FLOCI_TLS_KEY_PATH (#754)
  • apigatewayv2: WebSocket data-plane support — wss:// connections, PostToConnection, GetConnection, DeleteConnection, @connect/@disconnect/$default routes (#712)
  • cognito: UpdateGroup, ListUsersInGroup (#761)
  • cognito: AdminCreateUser with MessageAction=RESEND (#755)
  • ses: UpdateAccountSendingEnabled (v1 Query protocol) (#737)
  • ses: TagResource, UntagResource, ListTagsForResource on v2 REST JSON protocol (#749)
  • ses: v2 tag endpoints extended to EmailTemplate ARNs (#759)
  • ses: v2 tag endpoints extended to EmailIdentity ARNs (#760)
  • docker: named-volume storage for child containers (RDS, ElastiCache, OpenSearch, MSK) so data survives container restarts without requiring a host bind-mount (#743)
  • docker: ship awslocal CLI wrapper in the -compat image (#746)

Fixed

  • cfn: reconcile Lambda functions on stack update (#736)
  • docker: /etc/floci/aws/config missing in published Docker images (#740)
  • eventbridge: persist and forward SqsParameters.MessageGroupId for FIFO SQS targets (#742)
  • sqs: tags set at CreateQueue not returned by ListQueueTags (#747)
  • apigateway: treat ANY method as wildcard when matching concrete HTTP methods (#750)
  • s3: parse versionId from copy-source header for CopyObject and multipart part-copy (#751)
  • sqs: drop uppercase "Tags" key from CreateQueue JSON handler to match AWS wire format (#752)

Documentation

  • All service and configuration docs moved to environment-variable-first; application.yml reference moved to configuration/advanced/
  • New page: Multi-Account Isolation
  • New page: TLS / HTTPS
  • Go Testcontainers page rewritten to match the published testcontainers-floci-go API
  • LocalStack migration table completed with all mapped variables (USE_SSL, CUSTOM_SSL_CERT_PATH, DOCKER_HOST, PERSIST_STATE, LAMBDA_REMOTE_DOCKER)

1.5.13 - 2026-05-07

Added

  • backup: AWS Backup Phase 1 — vaults, plans, selections, on-demand jobs with simulated CREATED→RUNNING→COMPLETED lifecycle, recovery points, tagging via SharedTagsController, and GetSupportedResourceTypes
  • codedeploy: Server platform (Phase 4) — on-premises instance management (RegisterOnPremisesInstance, DeregisterOnPremisesInstance, GetOnPremisesInstance, BatchGetOnPremisesInstances, ListOnPremisesInstances, AddTagsToOnPremisesInstances, RemoveTagsFromOnPremisesInstances); Server AppSpec YAML parsing; EC2 and on-premises instance resolution by tag filters; full lifecycle event execution (ApplicationStop → DownloadBundle → BeforeInstall → Install → AfterInstall → ApplicationStart → ValidateService); SSM Run Command integration for hook script execution with graceful degradation when SSM is unavailable; per-instance InstanceTarget tracking in ListDeploymentTargets/BatchGetDeploymentTargets
  • elbv2: Lambda target type — ALB listeners forward requests to Lambda functions using the full ALB→Lambda event format (httpMethod, path, queryStringParameters, multiValueQueryStringParameters, headers, multiValueHeaders, body, isBase64Encoded); Lambda→ALB response mapping (statusCode, headers, multiValueHeaders, body, isBase64Encoded); Lambda target groups always report as healthy in DescribeTargetHealth without HTTP probing
  • eventbridge: Archive and Replay support — CreateArchive, DescribeArchive, UpdateArchive, DeleteArchive, ListArchives, StartReplay, DescribeReplay, CancelReplay, ListReplays; events captured automatically to matching archives and replayed on demand (#702)
  • route53: Route53 Phase 1 — hosted zones with auto-created SOA + NS records, ChangeResourceRecordSets (CREATE/UPSERT/DELETE with atomic batch validation), ListResourceRecordSets, change tracking (always INSYNC), health checks (create/get/list/update/delete), and per-resource tagging via ChangeTagsForResource / ListTagsForResource
  • scheduler: TagResource, UntagResource, ListTagsForResource for schedule groups (#700)
  • sqs, dynamodb: TRACE-level payload logging for request and response bodies to aid debugging (#697)
  • ssm: Run Command — SendCommand, GetCommandInvocation, ListCommands, ListCommandInvocations, CancelCommand, DescribeInstanceInformation; UpdateInstanceInformation (agent registration); ec2messages polling protocol (GetMessages, AcknowledgeMessage, SendReply, FailMessage, DeleteMessage, GetEndpoint) so the real amazon-ssm-agent running inside EC2 containers can register, receive commands, and report output
  • transfer: Transfer Family management-plane API — server lifecycle (CreateServer, DescribeServer, DeleteServer, ListServers, StartServer, StopServer, UpdateServer), user management (CreateUser, DescribeUser, DeleteUser, ListUsers, UpdateUser), SSH key management (ImportSshPublicKey, DeleteSshPublicKey), and tagging (TagResource, UntagResource, ListTagsForResource)

Fixed

  • appconfig: use capital "Tags" body key in TagResource / ListTagsForResource to match AWS SDK wire format (#704)
  • docker: respect DOCKER_HOST env var and handle bare host:port values without a URI scheme (#705)
  • ec2: AssociateRouteTable now returns <associationState> in the response; DescribeRouteTables supports the association.route-table-association-id filter; DescribeTags correctly applies resource-id, resource-type, key, and value filters (#706)

1.5.12 - 2026-05-04

Added

  • apigatewayv2: WebSocket API support, Update ops, Route/Integration Responses, Models, and Tagging (#682)
  • autoscaling: EC2 Auto Scaling stored-state management API and capacity reconciler (#681)
  • ses: add TestRenderTemplate (v1) and TestRenderEmailTemplate (v2) (#692)
  • glue: Schema Registry support — registries, schemas, versions, compatibility checks, metadata, tags, and Java SerDe SDK compatibility (#621)
  • parity: LocalStack drop-in compatibility layer (#696)

Fixed

  • sfn: apply ItemSelector/Parameters transformation in Map state (#683)
  • ecs: fix delete resource issue (#685)
  • lambda: use function region in container AWS environment (#687)
  • cloudformation: adopt existing DynamoDB tables on stack update (#689)
  • cloudformation: resolve Floci virtual-hosted template URLs (#690)
  • docker: fix ARG ordering in compat Dockerfile so VERSION build-arg is applied correctly

1.5.11 - 2026-05-02

Added

  • ec2: real Docker container execution with SSH, UserData, and IMDS support (#658)
  • cognito: implement AdminRespondToAuthChallenge operation (#666)
  • pipes: populate SQS message attributes in pipe source records (#667)
  • cloudformation: add Fn::ImportValue cross-stack reference resolution (#669)
  • elbv2: ALB proxy, CodeDeploy, and ECS integration (#677)
  • lambda: support ImageConfig.WorkingDirectory (#673)

Fixed

  • Normalize bare host:port Docker host values to prevent URI parse failure (#665)
  • athena: use embedded DNS server to resolve S3 URL used by floci-duck containers (#672)
  • iam: protocol-aware Access Denied response in IAM enforcement filter (#657)
  • iam: read Action from form body in IAM enforcement filter (#655)
  • lambda: fix incorrect request size limit (#674)
  • sqs: inject QueueUrl into form body for query protocol path-based requests (#670)
  • ecr: properly check if host-persistent-path is the name of a Docker volume (#678)

1.5.10 - 2026-04-30

Added

  • lambda: support ImageConfig Command and EntryPoint for container images (#630)
  • ses: add ConfigurationSet CRUD on v1 Query and v2 REST JSON protocols (#631)
  • cloudformation: provision AWS::Pipes::Pipe resources (#634)
  • cognito: include all standard attributes in DescribeUserPool schema (#642)
  • ses: add SendBulkEmail (v2) and SendBulkTemplatedEmail (v1) (#645)
  • cognito: Custom Auth Flow integration with Lambda triggers (#646)
  • codebuild, codedeploy: implement real Docker-based build execution (phase 2) (#649)
  • iam: seed 23 additional AWS managed execution-role policies (#650)
  • dynamodb: implement ExportTableToPointInTime, DescribeExport, and ListExports (#653)
  • cloudformation: support AWS::Lambda::EventSourceMapping resource type (#654)

Fixed

  • docker: replace bash /dev/tcp HEALTHCHECK with busybox wget for Alpine runtime compatibility (#625)
  • pipes: resolve InputTemplate paths through JSON-encoded string fields (#635)
  • dynamodb: fix GSI query pagination infinite loop when items share a sort key (#637)
  • cloudformation: wrap ZipFile inline source in a zip archive before passing to Lambda (#639)
  • lambda: inject log group, log stream, and Floci endpoint env vars into Lambda containers (#640)
  • cloudformation: resolve path-style AWS S3 TemplateURL against local S3 (#641)
  • eks: use named Docker volume for k3s data directory to avoid EINVAL on macOS APFS (#643)
  • apigateway: support _custom_id_ tag on CreateRestApi (#644)
  • apigateway: implement GET /restapis/{id}/deployments/{deploymentId} (#652)
  • athena: connect to floci-duck container via IP instead of DNS (#648)

1.5.9 - 2026-04-28

Added

  • elbv2: Elastic Load Balancing v2 management API — Phase 1 (#617)
  • codebuild, codedeploy: add management APIs (#622)

Fixed

  • cloudformation: resolve changesets by ARN in DescribeChangeSet, ExecuteChangeSet, DeleteChangeSet (#608)
  • lambda: drop dead pooled containers in WarmPool.acquire() before reuse (#610)
  • apigateway: propagate TOKEN authorizer context to AWS_PROXY Lambda integrations (#581)
  • pipes: invoke non-Lambda targets per-record instead of batch envelope (#590)
  • docker: avoid host mountinfo false positives in container detection (#616)
  • s3: emit x-amz-transition-default-minimum-object-size on lifecycle GET/PUT (#615)
  • s3: fix OOM on PutObject with large payloads (#620)
  • kms: GetKeyRotationStatus now returns false for asymmetric and HMAC keys (#618)
  • lambda: inject default AWS credentials into Lambda containers (#623)
  • ec2: persist VPC DNS attributes and support DescribeVpcEndpointServices (#624)

1.5.8 - 2026-04-25

Added

  • pipes: add filtering, input templates, batch sizes, and DLQ routing (#576)
  • cognito: add TagResource, UntagResource, ListTagsForResource for user pools (#579)
  • ses: implement email template CRUD with stored, inline, and ARN variants (#573)
  • sqs: clear SNS FIFO deduplication cache on PurgeQueue (#594)
  • athena: real SQL execution via floci-duck DuckDB sidecar (#584)
  • lambda: embedded DNS server for virtual-hosted S3 URL resolution inside containers (#585)
  • lambda: bind-mount hot-reload via S3Bucket=hot-reload (#601)

Fixed

  • dynamodb: accept full ARN for TableName across all operations (#580)
  • dynamodb: enforce DeletionProtectionEnabled on create, update, and delete (#583)
  • lambda: support nested Python handler module paths (#570)
  • dynamodb: serialise concurrent mutations and transactions via per-item locks (#572)
  • pipes: return parameters and tags in mutation responses; warn on stream record loss (#588)
  • pipes: read EventBridgeEventBusParameters for Source and DetailType (#589)
  • lambda: parse empty payload without error (#600)
  • docker: make bind-mounted /var/run/docker.sock work on all host types (#602)
  • lambda: replace blocking /next handler with reactive pattern (#596)
  • lambda: wire S3VirtualHostFilter to container-aware DNS suffix (#598)
  • s3-control: accept plain S3 ARN (arn:aws:s3:::bucket) in ListTagsForResource (#603)
  • rds: fix DBSubnetGroup shape, non-master auth pass-through, and volume lifecycle (#604)

1.5.7 - 2026-04-23

Fixed

  • docker: fix Docker image build issue introduced in 1.5.6

1.5.6 - 2026-04-23

Added

  • ses: SMTP relay support for SendEmail and SendRawEmail (#534)
  • appconfig: resource tagging and predefined deployment strategies (#533)
  • firehose: implement DeleteDeliveryStream API (#535)
  • pipes: EventBridge Pipes service — CRUD API, source polling, and target invocation (#539, #555)
  • docker: centralize Docker config and add private registry authentication (#549)
  • scheduler: invoke targets when EventBridge Scheduler schedules fire (#551)
  • secretsmanager: add UpdateSecretVersionStage handling (#545)
  • cognito, kms: allow caller-pinned resource IDs via the reserved floci:override-id tag (#568)
  • sqs: add option to clear deduplication cache on PurgeQueue (#561)

Fixed

  • dynamodb: return correct attributes for UPDATED_NEW/UPDATED_OLD on new items (#538)
  • lambda: initialize ESM pollers at startup; fix worker-pool exhaustion in RuntimeApiServer (#543)
  • secretsmanager: fix incorrect update of AWSPENDING on secret value update (#542)
  • kms: support HMAC_* key specs in CreateKey (#544)
  • lambda: add missing FunctionConfiguration fields and fix response shape (#546)
  • s3: wrap S3 Control XML errors in ErrorResponse wrapper (#560)
  • native, acm: fix native image reflection for ACM (#559)
  • s3: enforce conditional writes (#566)

1.5.5 - 2026-04-19

Added

  • eks: implement EKS service with real k3s data plane support (#493)
  • s3: implement static website hosting with index document redirection (#507)
  • lambda: reactive S3-to-Lambda sync for hot-reloading (#509)
  • dynamodb: support ReturnValuesOnConditionCheckFailure (#505)
  • eventbridge: add PutPermission and RemovePermission support (#499)
  • cognito: implement AdminEnableUser and AdminDisableUser (#514)
  • cognito: implement AdminResetUserPassword (#516)
  • kinesis: support AT_TIMESTAMP shard iterator type (#520)
  • opensearch: real OpenSearch container support via Docker image (#528)
  • secretsmanager: add version stages handling in PutSecretValue (#527)
  • s3: preserve explicit object server-side-encryption headers (#515)

Fixed

  • dynamodb: support arithmetic in SET expressions (#480)
  • sqs: include MD5OfMessageAttributes in SendMessageBatch JSON response (#496)
  • cloudformation: forward Lambda environment variables during stack provisioning (#510)
  • kms: support ECC_SECG_P256K1 via BouncyCastle JCA (#502)
  • dynamodb: validate sort key in buildItemKey to prevent item collisions (#506)
  • storage: make scan() return a mutable list for non-in-memory backends (#517)
  • ses: align /_aws/ses inspection endpoint with LocalStack behavior (#512)
  • lifecycle: run shutdown hooks before HTTP server stops (#519)
  • kinesis: return real ShardId in PutRecord and PutRecords responses (#518)
  • lambda: restore create-copy-start ordering for provided runtimes (#524)
  • lambda: fix container lifecycle on timeout (#529)
  • lambda: destroy container handle on interrupt and generic exceptions (#530)
  • lambda: wake blocked /next poller and drain queue on RuntimeApiServer.stop() (#531)

Security

  • s3: harden path traversal defenses in S3Service and S3Controller (#508)

1.5.4 - 2026-04-17

Added

  • iam: seed AWS managed policies at startup (#400)
  • s3: preserve Content-Disposition on object responses (#408)
  • sfn: add SQS sendMessage AWS SDK integrations (#409)
  • kinesis: implement EnableEnhancedMonitoring and DisableEnhancedMonitoring (#417)
  • msk: implement Amazon MSK service with Redpanda orchestration (#419)
  • dynamodb: add EnableKinesisStreamingDestination support (#427)
  • lambda: enforce reserved and per-region concurrency (#424)
  • eventbridge: implement TagResource and UntagResource (#453)
  • cloudwatch: implement GetMetricData (#451)
  • cognito: create, list, and delete user pool client secrets (#345)
  • ec2: implement CreateVolume, DescribeVolumes, DeleteVolume (#455)
  • athena, glue, firehose: implement local Data Lake stack with real SQL execution (#429)
  • tagging: implement Resource Groups Tagging API (#459)
  • bedrock-runtime: stub Converse and InvokeModel (#486)
  • kinesis: implement UpdateStreamMode (#488)
  • lambda: support ScalingConfig.MaximumConcurrency on SQS event source mappings (#490)
  • lambda: add UpdateFunctionConfiguration API (#472)
  • dynamodb: support UPDATED_OLD and UPDATED_NEW ReturnValues (#477)

Fixed

  • elasticache: scope single-arg AUTH to default user per Redis ACL spec (#390)
  • auth: bind SigV4 token identity and use timing-safe comparison (#389)
  • apigatewayv2: add missing JSON handler operations and stageName auto-deploy (#393)
  • cloudformation: populate SQS queue ARN in resource attributes (#396)
  • elasticache, rds: prevent orphaned Docker containers on shutdown and restart (#398)
  • s3: remove XML declaration from GetBucketLocation response (#403)
  • lambda: resolve handler paths with subdirectories; skip validation for dotnet runtimes (#404)
  • iam: enforce IAM when enabled (#411)
  • dynamodb: implement DELETE action for set attributes (#415)
  • sqs: use queue-level VisibilityTimeout as fallback in ReceiveMessage (#413)
  • lambda: raise Jackson maxStringLength for large inline zip uploads (#418)
  • dynamodb: support REMOVE for nested map paths (#421)
  • cognito: return only description fields in ListUserPoolClients (#420)
  • s3: honor canned object ACLs on write paths (#422)
  • ecr: fall back to named volume for registry data when host-persistent-path is unset inside containers (#442)
  • kinesis: return time-based MillisBehindLatest (#444)
  • lambda: accept name, partial ARN, and full ARN for {FunctionName} path parameter (#450)
  • dynamodb: accept newline as UpdateExpression clause separator (#449)
  • cognito: add aud claim to ID tokens (#454)
  • s3: implement bucket ownership controls (#456)
  • dynamodb: support continuous backups and PITR actions (#458)
  • kinesis: accept AWS SDK v2 CBOR content type (#457)
  • dynamodb: fix expression evaluation, UpdateExpression paths, and ConsumedCapacity (#197)
  • lambda: include LastUpdateStatus in function configuration responses (#463)
  • Add log rotation by default to all Floci-launched containers (#466)
  • sqs: honor queue-level DelaySeconds on FIFO queues (#476)
  • ecr: fix port and network issues (#483)
  • s3-control: accept URL-encoded ARNs and return XML errors (#491)

1.5.3 - 2026-04-12

Added

  • appconfig: new AppConfig service (#324)
  • ecr: new ECR service — push, pull, manage repositories and images (#337)
  • docker: add HEALTHCHECK to all Floci Dockerfiles (#328)
  • lambda: add PutFunctionConcurrency stub (#325)

Changed

  • Unify service metadata behind a descriptor-backed catalog for enablement, routing, and storage lookups (#357)

Fixed

  • s3: return XML error responses for presigned POST failures (#327)
  • sqs: make per-queue message operations atomic (#333)
  • eventbridge: apply InputPath when delivering events to targets (#335)
  • cloudformation: topologically sort resources before provisioning (#332)
  • s3: return empty LocationConstraint for us-east-1 buckets (#336)
  • dynamodb: attach X-Amz-Crc32 header to JSON protocol responses (#347)
  • cognito: return sub UUID as UserSub in SignUp response (#351)
  • kinesis: accept same-value Increase/DecreaseStreamRetentionPeriod (#352)
  • sns: recognize attributes set during subscription creation (#353)
  • ecr, s3: fix CDK compatibility and resolve macOS ECR port conflict (#354)
  • kms: implement real asymmetric sign/verify and GetPublicKey (#355)
  • eventbridge: implement advanced content filtering operators (#356)
  • cognito: correct HMAC signature computation in USER_SRP_AUTH (#358)
  • s3: include non-versioned objects in ListObjectVersions response (#359)
  • secretsmanager: resolve partial ARNs without random suffix (#360)
  • lambda: correct Function URL config path from /url-config to /url (#364)
  • elasticache: scope user auth to groups, use StorageFactory, throw NotFoundFault (#367)
  • apigatewayv2: fix route matching for path-parameter routes (#368)
  • s3: implement S3 Control ListTagsForResource, TagResource, UntagResource (#363)
  • cloudformation: resolve stacks by ARN in addition to name (#386)

1.5.2 - 2026-04-10

Added

  • kinesis: add IncreaseStreamRetentionPeriod and DecreaseStreamRetentionPeriod (#305)
  • kinesis: resolve stream name from StreamARN parameter (#304)
  • kms: add GetKeyRotationStatus, EnableKeyRotation, and DisableKeyRotation (#290)
  • s3: preserve Cache-Control header on PutObject, GetObject, HeadObject, and CopyObject (#313)

Fixed

  • apigateway: implement v2 management API and CloudFormation provisioning (#323)
  • cloudwatch: implement tagging support for metrics and alarms (#320)
  • dynamodb: handle null for Java AWS SDK v2 DynamoDB EnhancedClient (#309)
  • dynamodb: implement list_append with if_not_exists support (#317)
  • dynamodb: remove duplicate list_append handler that breaks nested expressions (#321)
  • rds: DescribeDBInstances returns empty results due to wrong XML element names and missing Filters support (#319)
  • s3: preserve leading slashes in object keys to prevent key collisions (#286)
  • Support LocalStack-compatible _user_request_ URL for API Gateway execution (#314)

1.5.1 - 2026-04-09

Fixed

  • Native image build failure due to SecureRandom in CognitoSrpHelper

1.5.0 - 2026-04-09

Added

  • cloudformation: add AWS::Events::Rule provisioning support (#261)
  • eventbridge: add InputTransformer support and S3 event notifications (#294)
  • dynamodb: load persisted DynamoDB streams on startup (#299)

Fixed

  • Native build: append -march=x86-64-v2 for amd64 compatibility (#303)
  • dynamodb: DescribeTable returns Projection.NonKeyAttributes (#300)
  • rds: implement missing resource identifiers and fix filtering (#302)
  • s3: implement S3 Lambda notifications (#278)
  • cognito: implement SRP-6a authentication (#298)
  • s3: use case-insensitive field lookup for presigned POST policy validation (#289)
  • s3: use ConfigProvider for runtime config lookup in S3VirtualHostFilter (#288)
  • Register Xerces XML resource bundles for native image (#296)

1.4.0 - 2026-04-08

Added

  • kms: add GetKeyPolicy, PutKeyPolicy, and fix CreateKey tag handling (#280)
  • ses: add SES V2 REST JSON protocol support (#265)
  • lambda: add missing runtimes and fix handler validation (#256)
  • scheduler: add EventBridge Scheduler service (#260)
  • secretsmanager: add BatchGetSecretValue support (#264)
  • sfn: nested state machine execution and activity support (#266)
  • Use AWS-specific content type in all JSON-based controller responses (#240)

Fixed

  • dynamodb: add list_append support to update expressions (#277)
  • Default shell executable to /bin/sh for Alpine compatibility (#241)
  • lambda: drain warm pool containers on server shutdown (#274)
  • dynamodb: support add function with multiple values (#263)
  • Handle base64-encoded ACM certificate imports (#248)
  • dynamodb: include ProvisionedThroughput in GSI responses (#273)
  • Return 400 when encoded S3 copy source is malformed (#244)
  • cognito: resolve auth, token, and user lookup issues (#279)
  • s3: enforce presigned POST policy conditions (eq, starts-with, content-type) (#203)
  • s3: fix versioning IsTruncated, PublicAccessBlock, ListObjectsV2 pagination, and Kubernetes virtual host routing (#276)

1.3.0 - 2026-04-06

Added

  • ec2: add EC2 service with 61 operations, integration tests, and documentation (#213)
  • ecs: add ECS service (#209)
  • dynamodb: add ScanFilter support for Scan operation (#175)
  • eventbridge: forward resources array and support resources pattern matching (#210)
  • lambda: add AddPermission, GetPolicy, ListTags, ListLayerVersions endpoints (#223)
  • sfn: JSONata improvements, States.* intrinsics, DynamoDB ConditionExpression, StartSyncExecution (#205)
  • Add GlobalSecondaryIndexUpdates support in DynamoDB UpdateTable (#222)
  • Add scheduled rules support for EventBridge Rules (#217)

Fixed

  • Fall back to Docker bridge IP when host.docker.internal is unresolvable (#216)
  • lambda: copy code to TASK_DIR for provided runtimes (#206)
  • lambda: honor ReportBatchItemFailures in SQS ESM (#208)
  • lambda: support Code.S3Bucket + Code.S3Key in CreateFunction and UpdateFunctionCode (#219)
  • ses: add missing Result element to query protocol responses (#207)
  • sns: make Subscribe idempotent for same topic+protocol+endpoint (#185)

1.2.0 - 2026-04-04

Added

  • cloudwatch-logs: add ListTagsForResource, TagResource, and UntagResource (#172)
  • cognito: add group management support (#149)
  • s3: support Filter rules in PutBucketNotificationConfiguration (#178)
  • lambda: implement ListVersionsByFunction API (#193)
  • Officially support Docker named volumes for native images (#155)
  • Health endpoint (#139)
  • Implement UploadPartCopy for S3 multipart uploads (#98)
  • Support GenerateSecretString and Description for AWS::SecretsManager::Secret in CloudFormation (#176)
  • Support GSI and LSI in CloudFormation DynamoDB table provisioning (#125)
  • Add CloudFormation Fn::FindInMap and Mappings support (#101)
  • lifecycle: add support for startup and shutdown initialization hooks (#128)
  • s3: add conditional request headers (If-Match, If-None-Match, If-Modified-Since, If-Unmodified-Since) (#48)
  • s3: add presigned POST upload support (#120)
  • s3: add Range header support for GetObject (#44)
  • sfn: add DynamoDB AWS SDK integration and complete optimized updateItem (#103)
  • apigateway: OpenAPI/Swagger import, models, and request validation (#113)
  • apigateway: add AWS integration type for REST v1 (#108)

Fixed

  • cognito: auto-generate sub, fix JWT sub claim, add AdminUserGlobalSignOut (#183)
  • cognito: enrich User Pool responses and implement MfaConfig stub (#198)
  • cognito: OAuth/OIDC parity for RS256/JWKS, /oauth2/token, and OAuth app-client settings (#97)
  • Globally inject AWS request-id headers for SDK compatibility (#146)
  • Defer startup hooks until HTTP server is ready (#159)
  • dynamodb: fix FilterExpression for BOOL types, List/Set contains, and nested attribute paths (#137)
  • lambda: copy function code to /var/runtime for provided runtimes (#114)
  • Resolve CloudFormation Lambda Code.S3Key base64 decode error (#62)
  • Resolve numeric ExpressionAttributeNames in DynamoDB expressions (#192)
  • Return stable cursor tokens in GetLogEvents to fix SDK pagination loop (#184)
  • s3: evaluate S3 CORS against incoming HTTP requests (#131)
  • s3: fix list parts for multipart upload (#164)
  • s3: persist Content-Encoding header on S3 objects (#57)
  • s3: prevent S3VirtualHostFilter from hijacking non-S3 requests (#199)
  • s3: resolve file/folder name collision on persistent filesystem (#134)
  • s3: return CommonPrefixes in ListObjects when delimiter is specified (#133)
  • secretsmanager: return KmsKeyId in DescribeSecret and improve ListSecrets (#195)
  • sns: enforce FilterPolicy on message delivery (#53)
  • sns: honor RawMessageDelivery attribute for SQS subscriptions (#54)
  • sns: pass messageDeduplicationId from FIFO topics to SQS FIFO queues (#171)
  • sqs: route queue URL path requests to SQS handler (#153)
  • sqs: support binary message attributes and fix MD5OfMessageAttributes (#168)
  • sqs: translate Query-protocol error codes to JSON __type equivalents (#59)
  • Support DynamoDB Query BETWEEN and ScanIndexForward=false (#160)

1.1.0 - 2026-03-31

Added

  • acm: add ACM certificate management service (#21)
  • Add HOSTNAME_EXTERNAL support for multi-container Docker setups (#82)
  • Add JSONata query language support for Step Functions (#84)
  • Add Kinesis ListShards operation (#61)
  • opensearch: add OpenSearch service emulation (#132)
  • ses: add SES (Simple Email Service) emulation (#14)
  • Add virtual host support for S3 bucket routing (#88)
  • apigateway: add AWS integration type for API Gateway REST v1 (#108)
  • apigateway: OpenAPI/Swagger import, models, and request validation (#113)
  • Docker image with AWS CLI (floci:x.y.z-aws) (#95)
  • Implement GetRandomPassword for Secrets Manager (#80)
  • s3: add presigned POST upload support (#120)
  • s3: add Range header support for GetObject (#44)
  • s3: add conditional request headers (#48)
  • sfn: add DynamoDB AWS SDK integration (#103)

Fixed

  • Added versionId to S3 notifications for versioning-enabled buckets (#135)
  • Align S3 CreateBucket and HeadBucket region behavior with AWS (#75)
  • DynamoDB table creation compatibility with Terraform AWS provider v6 (#89)
  • dynamodb: apply filter expressions in Query (#123)
  • dynamodb: respect if_not_exists for update_item (#102)
  • Fix S3 NoSuchKey for non-ASCII keys (#112)
  • kms: allow ARN and alias to encrypt (#69)
  • Resolve compatibility test failures across multiple services (#109)
  • s3: allow upload up to 512 MB by default (#110)
  • sns: add PublishBatch support to JSON protocol handler
  • Storage load after backend is created (#71)

1.0.11 - 2026-03-24

Fixed

  • s3: add GetObjectAttributes and metadata parity (#29)

1.0.10 - 2026-03-24

Fixed

  • s3: return versionId in CompleteMultipartUpload response (#35)

1.0.9 - 2026-03-24

Added

  • lambda: add Ruby runtime support (#18)

1.0.8 - 2026-03-24

Fixed

  • s3: return NoSuchVersion error for non-existent versionId

1.0.7 - 2026-03-24

Fixed

  • s3: fix unit test error

1.0.6 - 2026-03-24

Fixed

  • s3: truncate LastModified timestamps to second precision (#24)

1.0.5 - 2026-03-23

Fixed

  • s3: fix CreateBucket response format for Rust SDK compatibility (#11)

1.0.4 - 2026-03-20

Fixed

  • ci: fix Docker build on native pipeline
  • ci: fix workflow artifact download path

1.0.2 - 2026-03-15

Fixed

  • ci: fix Docker build action trigger

1.0.1 - 2026-03-15

Fixed

  • ci: fix GitHub Actions workflow trigger

1.0.0 - 2026-03-15

Initial public release of Floci — a fast, free, open-source local AWS emulator.

Added

  • SSM, SQS, SNS, SES, S3, DynamoDB, Lambda, API Gateway, Cognito, KMS, Kinesis, Secrets Manager, CloudFormation, Step Functions, IAM, STS, ElastiCache, RDS, EventBridge, and CloudWatch emulation
  • AWS SDK and CLI wire-protocol compatibility on port 4566
  • Native binary and JVM Docker images
  • In-memory, persistent, hybrid, and WAL storage modes