What floci-io/floci shipped

This week in Floci: EC2 Instance Connect works with the unmodified AWS agent, Bedrock lists foundation models and inference profiles, RDS snapshots cover MySQL and MariaDB, Security Hub imports ASFF findings, and API Gateway usage plans now count per key and enforce quota.

Floci shipped a busy week. EC2 Instance Connect now answers SendSSHPublicKey and works with the unmodified AWS agent. Bedrock serves ListFoundationModels, GetFoundationModel, ListInferenceProfiles and GetInferenceProfile. RDS CreateDBSnapshot and RestoreDBInstanceFromDBSnapshot now work for MySQL and MariaDB. Security Hub imports and queries ASFF findings. Step Functions checks the execution role on DynamoDB, S3, RDS Data and Redshift Data tasks. API Gateway counts usage plan calls per key and enforces quota and throttle, and now supports documentation parts. DocumentDB does cluster snapshots and restores, Redshift does audit logging to S3, and ECR registry requests no longer stall during garbage collection.

This week: EventBridge V2 with SQS routing, Pipes to Redshift via the Data API, s3-dist-cp steps running in docker mode, npm packages retained from public external connections, and read-back fixes for flow logs, DB cluster tags and ListMetrics pagination.

This week's changes to Floci: EventBridge V2 is in, with routing to SQS consumer subscribers, $or filtering and IAM fixed to share the events space. Pipes can now deliver to a Redshift cluster or Serverless workgroup through the Data API. In docker runner mode, s3-dist-cp steps run instead of failing and taking the cluster down, and a step's Properties, core-site and spark-log4j2 are now applied. On the registry side, npm packages can be retained from a repository's public:npmjs external connection. Inspector2 gained Disable with per-resource-type transitions, and TCP listeners on a network load balancer now relay raw bytes instead of answering HTTP 400. Read-backs are more faithful: flow logs keep their CloudWatch log group, DB clusters store their tags and KMS key, cache clusters keep En

Weekly roundup: IAM checks now use the resources a request names, SSM label filters work on parameter history, PrefixList is provisioned, Kinesis batch bisection is honored, and Lambda gets an init timeout setting.

This week in Floci: IAM enforcement now checks a request against the resources it acts on rather than a wildcard for many namespaces. GetParametersByPath applies label filters to parameter history, and AWS::EC2::PrefixList is provisioned instead of stubbed, so Ref and routes resolve to a real list. The Kinesis poller honors BisectBatchOnFunctionError, Lambda adds an init-timeout-seconds budget for cold runtimes, and Web Functions delete the oldest unused revisions past 50. Smaller fixes cover SNS filter policy scope, ECS awsvpc host ports and usage plan patching.

This week: Cognito accepts Google identity providers, S3 bucket policy checks join the enforce-auth switch, EMR answers three release operations, and a CloudFormation bucket rename now deletes the old bucket. Plus CORS on HTTP API responses and SNS actions on alarm transitions.

This week in Floci: Cognito now supports Google identity provider federation, from callback through token exchange and attribute mapping, and S3's bucket policy and ACL checks now come under the same enforce-auth setting as the IAM checks. EMR answers ListReleaseLabels, DescribeReleaseLabel and ListSupportedInstanceTypes, so Terraform data sources that pick a release now work. CloudFormation removes the displaced bucket when an S3 bucket rename is a replacement, unless the update replace policy retains it, and a function's LoggingConfig now reaches Lambda. HTTP API CORS configuration now applies to integration responses, not only the preflight, and CloudWatch publishes SNS alarm actions on state transitions.

This week: CloudFormation provisions Application Auto Scaling targets and policies plus real CloudFront public keys, key groups and functions. ElastiCache serverless cache APIs land, and Cognito serves OAuth token revocation.

This week in Floci: CloudFormation now provisions Application Auto Scaling scalable targets and scaling policies, and creates real CloudFront public keys, key groups and functions instead of reporting CREATE_COMPLETE for stubs. ElastiCache gained serverless cache management APIs, and Cognito now serves the OAuth token revocation endpoint on its own host and on custom domains. Validation also tightened: CreateSubnet rejects CIDRs outside the VPC address space, IAM evaluates every action against the resource it acts on, and malformed RDS snapshot copy, parameter reset and proxy boolean flags are rejected before anything is created or changed.

This week: Redshift Serverless workgroups run, EKS labels and taints reach nodes, Cognito user groups attach, IoT custom authorizers work, EventBridge API destinations land, Transfer adds User, EMR resizes clusters, EKS drops the default storage class, IAM models SSH keys, REST a

Floci shipped significant progress across managed services this week. Redshift Serverless now supports workgroups that actually run, EKS applies nodegroup labels and taints to Kubernetes nodes, Cognito user groups attach instead of remaining stubbed, and IoT serves the custom authorizer management API. EMR can resize running clusters, EventBridge supports API destination targets, Transfer adds User support, and IAM models SSH public keys. REST Lambda authorizers now validate policies and respect caching instead of accepting invalid output blindly.

Floci ships ECS task role credentials, Route 53 private DNS from containers, and multi-partition S3 region rules. EC2 route targets, KMS ECC keys, and ElastiCache HELLO AUTH also land.

This week's Floci update strengthens container authentication and DNS: ECS tasks now receive IAM role credentials, Route 53 resolves private zones from cluster containers, and S3 applies region rules across partitions. Additional improvements include EC2 route target support, KMS elliptic curve imported keys, ElastiCache HELLO AUTH, and SES pagination.

This week: SageMaker GPU support, EKS Pod Identity, Glue catalog/classifiers, EventBridge→StepFunctions, Redshift JSON COPY, Cognito USER_AUTH, Batch job control, plus cryptographic credential generation and dozens of correctness fixes.

This week's Floci updates span AWS service expansion and critical fixes. New: SageMaker GPU-backed training, EKS Pod Identity associations, Glue catalog policies and classifiers, EventBridge-to-StepFunctions routing, Redshift JSON/manifest COPY, Cognito USER_AUTH flow, Batch job cancellation. Security: switched credential generation to cryptographic randomness. Correctness: fixed Cognito auth flows, DynamoDB item limits, KMS error codes, CloudFormation lifecycle, ECS request handling, and dozens more.