floci Files

🎉 Highlights

This release adds AWS Lightsail, brings AppSync Phase 5 completing the four-release AppSync build-out, lands EventBridge Pipes enrichment, and ships a substantial ECS conformance push with EFS ownership, secrets resolution, and awsvpc port allocation. S3 gains auth enforcement, Step Functions payload templates get more capable, and a CloudFormation architectural refactor kicks off. Welcome to the 2 first-time contributors.

🆕 New: AWS Lightsail

AWS Lightsail emulation lands (#1583). Simple compute workloads that use Lightsail rather than EC2 can now be tested locally, extending Floci's compute coverage beyond the enterprise-tier services.

🧩 AppSync Phase 5 (complete build-out)

The AppSync journey completes with Phase 5 (#1590): Management API coverage expansion, AWS behavior alignment, and async schema creation. Across five phases (Phase 1 → 5 spanning 1.5.22 through this release), AppSync has grown from a management-API stub to a working GraphQL emulator with schema registry, $util runtime, VTL engine, and AWS-aligned behavior. This is one of the most complete phased service build-outs Floci has done.

🚢 ECS conformance push

Four coordinated ECS improvements land this cycle:

• EFS access point POSIX ownership applied to shared local volumes (@abanna, [#1686])
• containerDefinitions[].secrets resolved from SSM and Secrets Manager (@hampsterx, [#1687])
• AWS SDK baseline env injected into launched task containers (@abanna, [#1697])
• awsvpc tasks assigned dynamic host ports to avoid collisions (#1785)

Together these unblock realistic ECS deployment patterns: EFS-backed stateful services, tasks that read secrets at startup, applications that expect AWS SDK defaults to be present, and multiple awsvpc tasks running side by side.

📨 EventBridge Pipes: enrichment

Pipes now apply enrichment before target delivery (#1658). The full source-filter-enrichment-target flow for Pipes is now testable end to end.

🔒 S3 auth enforcement

S3 now supports auth enforcement (#1689). Applications that depend on presigned URLs, IAM-authorized access, or bucket policy denial paths now behave more like real S3 rather than a permissive endpoint.

🧱 CloudFormation: per-service provisioner registry

An architectural refactor extracts a per-service provisioner registry, migrating SQS as the first service (#1825). Groundwork for cleaner CloudFormation provisioning across the growing catalog. Also lands: UpdateTerminationProtection support (#1692).

🌐 EC2: create-time tag round-trip + concurrent mutation safety

Two important EC2 correctness fixes:

• Create-time tags and route/security-group-rule attributes round-trip properly (#1763)
• Concurrent mutations of shared resources serialized per resource (#1786)

The concurrency fix is the kind of change that eliminates a class of subtle test flakiness.

🧩 Step Functions: template expressions

Payload template resolution now handles .$ inside arrays and $$ context in intrinsic args (@abanna, [#1691]). Real state machine definitions that use these expression patterns now work correctly.

✨ New Features

New service

• feat(lightsail): add AWS Lightsail emulation by @kotov228 in https://github.com/floci-io/floci/pull/1583

AppSync

• feat(appsync): Phase 5 — Management API coverage, AWS behavior alignment, async schema creation by @AgustinBertagna in https://github.com/floci-io/floci/pull/1590

ECS

• feat(ecs): apply EFS access point POSIX ownership to shared local volumes by @abanna in https://github.com/floci-io/floci/pull/1686
• feat(ecs): resolve containerDefinitions[].secrets from SSM / Secrets Manager by @hampsterx in https://github.com/floci-io/floci/pull/1687
• feat(ecs): inject the AWS SDK baseline env into launched task containers by @abanna in https://github.com/floci-io/floci/pull/1697

Pipes / S3 / Step Functions / CloudFormation

• feat(pipes): apply EventBridge Pipe enrichment before target delivery by @abanna in https://github.com/floci-io/floci/pull/1658
• feat(s3): support S3 auth enforcement by @electrum in https://github.com/floci-io/floci/pull/1689
• feat(stepfunctions): resolve payload-template .$ inside arrays and $$ context in intrinsic args by @abanna in https://github.com/floci-io/floci/pull/1691
• feat(cloudformation): support UpdateTerminationProtection by @abanna in https://github.com/floci-io/floci/pull/1692

SES / KMS

• feat(ses): implement PutEmailIdentityConfigurationSetAttributes for SES v2 by @okinaka in https://github.com/floci-io/floci/pull/1698
• feat(ses): implement Contact CRUD for SES v2 by @okinaka in https://github.com/floci-io/floci/pull/1723
• feat(kms): support KeyId filter on ListAliases by @mikelamutxastegi in https://github.com/floci-io/floci/pull/1651

🐛 Bug Fixes

ECS

• fix(ecs): assign awsvpc tasks dynamic host ports to avoid collisions by @hectorvent in https://github.com/floci-io/floci/pull/1785
• fix(ecs): pass LaunchedContainerAwsEnv to EcsContainerManager in volumes test by @hectorvent in https://github.com/floci-io/floci/pull/1784

EC2

• fix(ec2): round-trip create-time tags and route / SG-rule attributes by @hectorvent in https://github.com/floci-io/floci/pull/1763
• fix(ec2): serialize concurrent mutations of shared resources per resource by @hectorvent in https://github.com/floci-io/floci/pull/1786

Lambda

• fix(lambda): return a downloadable GetFunction Code.Location by @Jongsic in https://github.com/floci-io/floci/pull/1718
• fix(lambda): return event source mapping failure config by @codingkiddo in https://github.com/floci-io/floci/pull/1629
• fix(lambda): register EventSourceMapping nested types for native-image reflection by @hectorvent in https://github.com/floci-io/floci/pull/1826

S3 / SES / Secrets Manager

• fix(s3): omit checksum headers from GetObject / HeadObject unless x-amz-checksum-mode: ENABLED by @mihaiblidaru in https://github.com/floci-io/floci/pull/1633
• fix(ses): populate VerificationStatus in v2 ListEmailIdentities by @okinaka in https://github.com/floci-io/floci/pull/1722
• fix(secretsmanager): return partial result for missing secrets in batch by @b6k-dev in https://github.com/floci-io/floci/pull/1591

ELBv2 / Auto Scaling / RDS / Neptune / Scheduler / IAM / TLS

• fix(elbv2): dispatch same-port listeners by host by @jvanzyl in https://github.com/floci-io/floci/pull/1700
• fix(autoscaling): propagate ASG tags at launch by @jvanzyl in https://github.com/floci-io/floci/pull/1734
• fix(rds): preserve network placement metadata by @jvanzyl in https://github.com/floci-io/floci/pull/1735
• fix(neptune): roll back proxy port and container on failed provisioning by @ahmedk20 in https://github.com/floci-io/floci/pull/1742
• fix(scheduler): honor target EventBridgeParameters DetailType / Source by @saliougaye in https://github.com/floci-io/floci/pull/1489
• fix(iam): default UserName to the calling access key's owner by @hectorvent in https://github.com/floci-io/floci/pull/1801
• fix(tls): add host.docker.internal to self-signed cert SANs by @JESUSLUG in https://github.com/floci-io/floci/pull/1821

Core

• fix(core): register persisted model types for native-image reflection by @hectorvent in https://github.com/floci-io/floci/pull/1781

🧰 Refactors

• refactor(cloudformation): extract a per-service provisioner registry, migrate SQS by @hectorvent in https://github.com/floci-io/floci/pull/1825
• chore: adopt shared ARN and XML utilities across services by @hectorvent in https://github.com/floci-io/floci/pull/1780

📚 Documentation

• docs: sync service action tables by @jvanzyl in https://github.com/floci-io/floci/pull/1769
• docs: regenerate action tables for docdb, elasticache, rds by @okinaka in https://github.com/floci-io/floci/pull/1765
• docs: fill supported action descriptions by @hampsterx in https://github.com/floci-io/floci/pull/1819

👋 New Contributors

A warm welcome to everyone making their first contribution to Floci:

• @saliougaye in https://github.com/floci-io/floci/pull/1489
• @mihaiblidaru in https://github.com/floci-io/floci/pull/1633

Full Changelog: https://github.com/floci-io/floci/compare/1.5.31...1.5.32