Repository navigation
Parity sweep: burn down items_still_open across all AWS services (685 → 161) - #2482
Merged
Merged
Conversation
Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ck SyncType on DeleteResourceDataSync LastModifiedUser/CreatedBy/LastModifiedBy now come from the request's resolved IAM principal (awsmeta.CallerArn), omitted when unresolved. items_still_open adjudicated: 14 moved to structural_gaps, 7 left open. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…Events Entity keys, filter ListJobs by namespace items_still_open adjudicated in both PARITY.md files. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… details, SDK-valid VariantStatus - list pagination uses pkgs/page tokens instead of integer offsets - CreatedBy/LastModifiedBy IamIdentity on model package groups, packages, projects - UpdateProject applies provisioning and template-provider updates - DescribeProject TemplateProviderDetails used the create-side key; SDK decoded empty entries - VariantStatus used InService, which the SDK enum lacks; now Creating/Updating with StartTime - DescribeFeatureGroup OnlineStoreTotalSizeBytes from stored records Snapshot golden also carries the cloudwatchlogs/iot additive rows. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…e, state machine TimeoutSeconds redshift: - Tags on parameter groups, snapshots, event subscriptions and IdC apps; TagKeys/TagValues filters on their describes - DescribeTags returned the bare cluster id as ResourceName; SDK expects the ARN - CopyClusterSnapshot kept the source ARN on the copy - ModifyCluster NewClusterIdentifier re-keys the cluster and its references - IdC application ServiceIntegrations; GetReservedNodeExchangeConfigurationOptions validation stepfunctions: top-level TimeoutSeconds was ignored; executions now end TIMED_OUT with States.Timeout, and RedriveExecution accepts them. cloudformation: PARITY.md adjudication only. Snapshot golden rows land with the rds commit. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…uster restore inheritance, receiver configs docdb: - CreateDBCluster GlobalClusterIdentifier was ignored; now joins as secondary - ReadReplicaIdentifiers was never serialized - CertificateDetails from the CA catalog; orderable options emit Vpc rds: - Failover/SwitchoverGlobalCluster move the writer; non-member targets rejected - CreateDBInstanceReadReplica honors SourceDBClusterIdentifier - cluster restores inherit engine/KMS/master user/retention from source - DBClusterSnapshot records MasterUsername, Port, storage and IAM auth cleanrooms: - receiverConfigurations on protected query/job summaries - request-only type key dropped from ProtectedJob responses - ability-change types derived for existing members Snapshot golden includes the redshift rows from da52afb. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…tIds, OpenZFS volume config, domain-owner checks fsx: - ClientRequestToken honored on create/copy/restore/update ops; changed params return IncompatibleParameterError - SubnetIds required with per-deployment-type counts - OpenZFS volume config stored, updated and enforced on delete/restore/copy - DRA S3 auto-import/export, file cache DRAs, self-managed AD config - UpdateFileCache accepted an invented StorageCapacityGiB member; removed - CopyBackup SourceRegion codeartifact: failedVersions carry errorMessage; domain-owner validated. bedrockruntime: PARITY.md adjudication only. Snapshot golden fsx rows land with the next commit. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…fig, shard metrics, DryRun s3: - PutObject x-amz-write-offset-bytes appends on directory buckets - GetBucketMetadataConfiguration returns a computed result, not the create body - request-metrics tag filters and FirstByteLatency - list ops emit RestoreStatus when requested - PutObject Size populated for notifications; ListObjectVersions no longer hardcodes STANDARD kinesis: - shard-level enhanced metrics; stream OutgoingRecords/Bytes were missing - DryRun returns DryRunOperationException without side effects - unflushed channel buffers persist across restarts xray: insight detection honors per-group FilterExpression. quicksight: asset bundle import overrides echoed; KnowledgeBase PrimaryOwnerUsername. Snapshot golden also carries the fsx rows from a29457c. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ake aggregates, conformance pack params codepipeline: Custom-owner actions now create real jobs that block the run until PutJobSuccess/FailureResult; continuation tokens queue follow-ups. cloudtrail: StartQuery by QueryAlias resolves the dashboard widget; dashboard refresh starts per-widget queries; lake SQL SUM/AVG/MIN/MAX/HAVING. awsconfig: conformance pack input parameters substituted; ListDiscoveredResources IncludeDeletedResources via tombstones; EvaluationTimeout range-checked. appsync: internal apiId/tags no longer leak onto the wire. Snapshot golden rows land with the next commit. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… Splunk failures, replicator Apache Kafka clusters firehose: - deliverToSplunk swallowed failures and always reported success - PutRecord/Batch, backup and per-destination delivery metrics - Elasticsearch/OpenSearch VpcConfiguration validated against EC2 kafka: - channels transition CREATING/UPDATING/DELETING - replicators keep apacheKafkaCluster and ReplicationInfo cluster ids (previously dropped, and an empty amazonMskCluster was always emitted) verifiedpermissions: policy store EncryptionState; Cedar entity Tags converted. workspaces: IdC ApplicationArn; enum validation on image/application filters. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…nt settings, aggregations, remaining filters ec2: - Filter.N on peering, route-search, multicast, capacity blocks and more - DescribeInstanceImageMetadata reported the caller as every image owner - peering/capacity-block/secondary-interface wire fields - ModifyReservedInstances mints replacements; CreateFleet ValidUntil enforced - AssociateVpcCidrBlock applies the VPC user guide restriction matrix - Docker compute usage metrics dms: all 18 engine settings blocks round-trip (credentials stripped); CDC window. elasticbeanstalk: ComposeEnvironments was a stub listing environments; now reads env.yaml from bundles. RequestId no longer a fixed literal. inspector2: 12/15 aggregation types, AccountIds, ClientToken replay, CIS sorting, coverage metadata, ECS GetClustersForImage. Snapshot golden also carries rows from 49fa96b and 3a5dba6. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…nfigs, AppBlockArn checks, finding filters athena: Identity Center, managed results and S3 access-grant workgroup configs; UpdateWorkGroup Remove* flags were silently ignored; EngineConfiguration validated; ImportNotebook reads NotebookS3LocationUri. appstream: AppBlockArn must exist on Create/UpdateApplication. accessanalyzer: resourceOwnerAccount/error/resourceControlPolicyRestriction filters no longer match everything. vpclattice: required txtMethodConfig members were missing; isManagedAssociation emitted. workmail: PARITY.md adjudication only. Snapshot golden athena row lands with the next commit. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…icky task lists, V2 filters, session expiry swf: decision and activity timeouts enforced; sticky task lists route and revert; pending task queues persist; empty registrationStatus rejected. securityhub: GetResourcesV2 ignored its filters; trends/statistics apply Filters; ListMembers OnlyAssociated defaults true per SDK; BatchUpdateFindings limits; CreateTicketV2 ClientToken; metadata.uid resolvable. neptune: SnapshotType public/shared always returned nothing; FailoverState echoed. redshiftdata: sessions expire after SessionKeepAliveSeconds. opsworks: ELB VpcId/SubnetIds/AZs derived; errors carry the JSON 1.1 content type. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… token revocation, port ranges, async states cognitoidp: ClientMetadata reaches every trigger; ConfirmForgotPassword fires PostConfirmation; RevokeToken invalidates derived access tokens; refresh RetryGracePeriodSeconds; case-insensitive/alias sign-in; ForceAliasCreation. ecs: StopServiceDeployment returned a wrapped object, SDK expects the bare ARN; ROLLBACK stop type; containerPortRange allocation; placement retries on port collision; resourceManagementType and daemonName filters. directoryservice: async trust/snapshot/share/setting states; updated settings stuck in Requested forever; replica Region resolves to the owner directory. eks: RollbackConfig.TimeoutMinutes validated. Snapshot golden also carries rows from earlier commits on this branch. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…-catalog settings, org feature stats glue: StartWorkflowRun RunProperties, IncludeGraph, blueprint include flags, GetPartitions Segment/ExcludeColumnSchema, SearchTables sort, real TaskRunProperties shape, session tags, ClientToken on glossaries and DQ runs, UpdateSchema checkpoint, partition CatalogId. lakeformation: ListPermissions IncludeRelated; Grant/Revoke CatalogId defaults the resource catalog; data lake settings per catalog. guardduty: countByFeature and free-trial days from member features. datasync: ScheduleDetails after a user disables a schedule. kinesisanalyticsv2: PARITY.md adjudication only. Snapshot golden rows land with the next commit. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… qualified function URLs, PITR restore lambda: AWS/Lambda Invocations/Errors/Duration/Throttles emitted; function URLs scoped by Qualifier; DeleteFunction leaked URL listeners and ports; qualifier-level event invoke config for async retries; UpdateFunctionCode DryRun; ESM tuning validation per SDK; TenancyConfig/CapacityProviderConfig stored. lightsail: point-in-time database restore; ApplyImmediately defers changes to the maintenance window; RotateMasterUserPassword was ignored; omitted PubliclyAccessible reset to false; certificate DomainValidationRecords. medialive: DeleteReservation keeps DELETED with TTL; busy-channel guards on DeleteCluster/DeleteNode; UsedChannelEngineVersions. memorydb: DescribeSnapshots ShowDetail; resharding PendingUpdates; multi-region ShardCount propagates. mediatailor: ListAlerts requires resourceArn. Snapshot golden rows land with the next commit; metrics emitter wiring in cli follows. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…e jobs, flow validation, WS metrics batch: array jobs spawn children with SEQUENTIAL/N_TO_N deps and cascade; multi-node node jobs and nodeOverrides; ListJobs arrayJobId/multiNodeJobId; eks/ecs property overrides; env/resource overrides merge by key. NodeRangeProperty used containerProperties where the SDK uses container (legacy key aliased in UnmarshalJSON). bedrockagent: ValidateFlowDefinition covers cycles, reachability, connections, conditions and loops; PrepareFlow fails on findings; ClientToken replay survives restart and covers KB document ingest/delete. apigatewayv2: HTTP DataProcessed, WS IntegrationError, route-level detailed metrics; WS routing uses the stage's deployment snapshot. account: region enable/disable and primary email update are async. acm: ACME domain validation settles VALIDATING to VALID. Snapshot golden rows land with the next commit. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…dentials, outpost bucket ARNs, SelectColumn metadata s3control: GetDataAccess was a stub returning empty credentials for any target; it now matches access grants and returns 403 when none covers the target. CreateBucket uses X-Amz-Outpost-Id in the ARN; MfaDelete and ManifestGenerator stored and echoed. timestreamquery: PrepareQuery Columns use the SelectColumn shape. sts, ses, servicediscovery, rolesanywhere: PARITY.md adjudication only. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…etrics and DLQ attributes, per-database SQLite, Ethereum nodes eventbridge: PutEvents and invocation metrics; DLQ messages carry ERROR_MESSAGE/EXHAUSTED_RETRY_CONDITION/RETRY_ATTEMPTS and the documented ERROR_FROM_TARGET code instead of an invented one; DLQ send checks the queue policy. rdsdata: Database selects a distinct SQLite database; ExecuteSql reaches the real engine; continueAfterTimeout on docker clusters; 1 MB response cap. networkmanager: attachment updates transition through UPDATING; route analysis follows TGW peerings (resolver wiring follows). managedblockchain: Ethereum mainnet nodes; framework attributes were dropped on clone. mq, mediastoredata: PARITY.md adjudication only. Refs: gopherstack-9x62.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ective): replication-group topology, domain processing windows, endpoint devices - elasticache: replication groups own real member clusters per node group; Create/Modify cluster, RG, global-datastore and snapshot parameter families implemented (placement, scaling, shard changes, failover); NoOperationFault/NodeGroupNotFoundFault; StorageEncryptionType and EffectiveDurability derived. - elasticsearch: package association details, domain processing windows and per-field OptionStatus, SubnetResolver hook for VPC options. - directconnect: AwsDevice/AwsDeviceV2/AwsLogicalDeviceId, same-endpoint LAG association rule, VirtualGatewayRegion, MACsec secret creator hook. - comprehend: training status vocabulary fix, VpcConfig/RedactionConfig and DocumentReaderConfig validation, flywheel iterations train models. - codedeploy: legacy String revision type. - detective: remaining items reclassified as structural. Snapshot golden rows land with the next commit. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…s, ECS health and metrics, SWF Lambda tasks - lambda: handler wired into wireServiceMetrics; S3ObjectVersion code fetch through a versioned S3 adapter. - docdb/rds: ManageMasterUserPassword creates, rotates and deletes a real Secrets Manager secret. - iam: delegation request OwnerId/ApproverId from the caller ARN. - docdb/neptune/medialive: VpcId, SupportedNetworkTypes and channel ENIs resolved from EC2 subnets; NetworkTypeNotSupported on DUAL mismatch. - ecs: CPU/Memory utilization metrics from container stats, ELB-unhealthy task replacement, capacity-provider ASG validation. - swf: ScheduleLambdaFunction decisions invoke Lambda. - cleanrooms: association schemas from Glue tables; awsconfig conformance pack templates from S3/SSM; appsync wafWebAclArn from wafv2; workmail DeleteDirectory removes the Directory Service directory. Includes snapshot golden rows for earlier batches. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ices, cost drivers, job summary aggregation, CSR passthrough - codebuild: build-matrix batch expansion; RetryBuildBatch state rules, RETRY_FAILED_BUILDS carry-forward and PriorBuildSummaryList. - ce: GetCostComparisonDrivers from the cost ledger; DimensionalValueCount for TAG and COST_CATEGORY monitors. - backup: AggregationPeriod bucketing on job summaries; scan result status. - acmpca: CSRPassthrough templates, issuer path-length enforcement, EXPIRED CA status. - wafv2: Scope/Vendor/Name validation on managed catalog ops. - transcribe: MedicalScribeContext. - ssoadmin: primary Region listed and protected from RemoveRegion. Snapshot golden rows land with the next commit. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…sis, MQ RAM shares, Logs target authz - eventbridge: root authz tests attach the events.amazonaws.com sqs:SendMessage policy that AWS requires on a DLQ; CloudWatch Logs targets authorize logs:PutLogEvents against the log-group resource policy and now create the log stream before delivering. - directconnect: MACsec CAK/CKN keys stored as real Secrets Manager secrets. - elasticsearch: VPCOptions VPCId and AvailabilityZones from EC2 subnets. - networkmanager: route analysis walks transit gateway peering attachments in both directions. - mq: DescribeSharedResources reports RAM shares and their resources. - mediastoredata: ContainerNotFoundException for unknown containers. - comprehend: training-status test moved to an internal test file. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…,resourcegroupstaggingapi,sqs): live resource queries, delegation endpoints, invoke target validation - resourcegroups: TAG_FILTERS_1_0 and CLOUDFORMATION_STACK_1_0 queries evaluate live with stack QueryErrors. - resourcegroupstaggingapi: ListRequiredTags reads the Organizations effective TAG_POLICY. - route53resolver: HostVPCId from EC2 subnets; INBOUND_DELEGATION endpoints and DELEGATE rules. - sesv2: EndpointId and identity ARN validation on SendEmail. - sagemakerruntime: InferenceComponentName and TargetContainerHostname validation. - rekognition: video job NotificationChannel publishes completion to SNS. - sqs: remaining items reclassified. Includes snapshot golden rows for earlier batches. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…sion promote, run options, XKS keys, owning service - ram: PromoteResourceShareCreatedFromPolicy requires a matching promoted permission (UnmatchedPolicyPermissionException); ClientToken replay on 13 more ops. The Glue RAM wiring test now promotes the permission first, as the SDK documents. - omics: StartRun configurationName/runId, batch filters and failed submissions, outputBucketOwnerId, upload ClientToken, workflow owner checks, read set creationType. - kms: XksKeyId on CreateKey; ALL_KEY_MATERIAL rotations for EXTERNAL keys. - secretsmanager: OwningService from managed names; owning-service and primary-region filters. - iotdataplane: GetConnection after DeleteConnection reports the disconnect. - mwaa: CreateWebLoginToken IamIdentity from the caller. - outposts, organizations, mgn: items reclassified. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…s, target group attribute defaults, foreign registry checks - dynamodb: vector indexes on CreateTable/UpdateTable/DescribeTable and restore overrides; SearchVectors scores COSINE/EUCLIDEAN/DOT_PRODUCT with filters and topK; GSI capacity and transaction metrics. - elbv2: CreateTargetGroup seeds the documented attribute defaults per load balancer family and target type. - ecr: foreign registryId rejected on repository-scoped ops. - efs: DescribeTags Marker/MaxItems paging; IpAddressInUse. - forecast: predictor and forecast lineage fields and DatasetGroupArn filters. - iotanalytics, fis, cloudcontrol: items reclassified. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…...): template versions, Select SQL expressions, vault policy enforcement, JWT OpenID tokens - pinpoint: template versions keep content; ?version= on Get/Update/Delete; UpdateTemplateActiveVersion pins a version; version numbers no longer reused after the trim. - glacier: Select SQL parentheses/NOT/BETWEEN/IN/LIKE/arithmetic/CAST/ COALESCE/NULLIF; vault lock and access policy Deny enforced on data ops with principal and condition matching. - databrew: CreatedBy/LastModifiedBy/PublishedBy/StartedBy from the caller instead of a literal; required-member validation. - cognitoidentity: OpenID tokens are JWTs with expiry and principal tags. - iotwireless: single import tasks keyed by Id with stored fields; WirelessDeviceType validation; ClientRequestToken replay persisted. - grafana: license removal chaos path; SSO grants across identity stores. - elb: CreateLoadBalancer checks security groups and subnets in EC2. - codeconnections: sync blocker contexts. codecommit: file/folder merge conflict resolution. cloudwatch: ApplyOnTransformedLogs on insight rules. - mediaconvert, identitystore: items reclassified. Snapshot golden rows land with the next commit. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ponse cache, real TestInvokeAuthorizer, translation jobs over S3, AZ ids - apigateway: embed=methods/apisummary; stage response cache with CacheHitCount/CacheMissCount and FlushStageCache; GetExport Accept and extensions; GetSdk required parameters; CloneFrom; TestInvokeAuthorizer runs the real authorizer instead of returning a fixed principal; TestInvokeMethod stage variables, path parameters, client certificates. - translate: terminology CSV/TSV/TMX parsing with skipped counts; parallel data statistics from S3; translation jobs translate S3 input documents; EncryptionKey validation. - autoscaling: LaunchInstances placement, AvailabilityZoneIds, IncludeDeletedGroups, InstanceId-derived launch settings. - applicationautoscaling: ResourceId shape validation per dimension. - bedrock: automated reasoning test case bodies, client token replay, KMS key checks, OfferType validation. - sns: AuthenticateOnUnsubscribe; SMS and application outcome metrics. - shield: LockedSubscriptionException outside the renewal window. - waf: tag ops require an existing resource. - appconfig, textract: items reclassified. Snapshot golden rows land with the next commit. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…# cron tokens fire, function LIVE stage, deep spec validation - scheduler: L, LW, L-n, nW, nL and n#m cron tokens now match instead of being accepted and never firing; day-of-week L-n rejected. - cloudfront: Stage on Get/Describe(Connection)Function with a LIVE snapshot taken at publish; distribution tenant ManagedCertificateRequest stored and reflected in GetManagedCertificateDetails. - appmesh: virtual node, route, gateway and gateway route specs validated (required members, unions, enums, ranges). - s3tables: CreateTable Iceberg Metadata validated and stored. - apprunner: CreateVpcIngressConnection requires an existing service. - amplify, transfer, support, appconfigdata, timestreamwrite: items reclassified. Includes snapshot golden rows for earlier batches. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…mination, probe VpcId from EC2, import source resolution test - emr: AutoTerminationPolicy.IdleTimeout terminates idle WAITING clusters. - networkmonitor: Probe.VpcId resolved from the source subnet via EC2. - resiliencehub: ImportResourcesToDraftAppVersion source resolution tested. - polly: ValidationException wire code covered on remaining ops. - apigatewaymanagementapi: dead constant removed. - pipes, opensearch, dax, emrserverless, codestarconnections, mediastore, kinesisanalytics: items reclassified. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ix lightsail LB test race EFS file systems are backed by host directories (<data-dir>/efs with --persist) and access points resolve to their RootDirectory.Path, created with CreationInfo ownership and permissions and contained against path escapes. Lambda functions with FileSystemConfigs get the access point bind-mounted at LocalMountPath; Create/Update validate one config, a VpcConfig with subnets, an access point ARN, the /mnt/ path pattern, and a mount target in the function's VPC. PosixUser is not applied (runtime containers run as root). TestLoadBalancerRoundTrip waits for the instance to reach running before attaching it, which raced the pending->running transition in CI. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
StartQueryExecution runs SELECT/WITH queries for real: each referenced Glue table's S3 objects (or registered partitions, with partition keys as columns) load into a per-query in-memory SQLite database. CSV (OpenCSVSerde, LazySimpleSerDe with delimiters, header skip and \N nulls), JSON lines and gzip are read; Parquet/ORC/Avro fail with NOT_SUPPORTED. The common Presto subset is translated (quoted and qualified identifiers, CAST, date/time literals and functions, approx_distinct, regexp_like, CTEs, joins, windows). DDL (CREATE EXTERNAL TABLE, DROP TABLE, MSCK REPAIR, ADD PARTITION, SHOW, DESCRIBE) routes to Glue. Results are written to the output location as quoted CSV plus metadata, with statistics; row, byte and time caps apply and StopQueryExecution cancels. Interrupted queries restored from a snapshot are FAILED. CTAS/INSERT/UNLOAD still do not write S3 data. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…S Firewall in the embedded DNS The embedded DNS server gains an interceptor hook. Route 53 Resolver maps each query's source IP to a VPC (EC2 ENI/instance IPs, then subnet CIDRs) and applies, for that VPC: DNS Firewall rule groups by priority (BLOCK NODATA/NXDOMAIN/OVERRIDE, ALLOW, ALERT), then the most specific of associated FORWARD/SYSTEM/RECURSIVE rules and private hosted zones. FORWARD rules query their TargetIps with failover (SERVFAIL when all fail); private zones answer authoritatively from Route 53; query logs go to CloudWatch Logs destinations. Unmapped sources keep the static records. S3/Firehose log destinations, DoH targets and Advanced firewall rules are not modelled. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
With BATCH_EXECUTE_JOBS=true (--batch-execute-jobs) jobs run in Docker: SUBMITTED through RUNNABLE, STARTING, RUNNING to SUCCEEDED or FAILED by the real exit code, with Ref:: parameter substitution, resource limits, AWS_BATCH_* and endpoint environment, job-role credentials from STS, retryStrategy with evaluateOnExit, attemptDurationSeconds timeouts, TerminateJob stopping the container, and output in CloudWatch Logs under /aws/batch/job. Array children, dependsOn (N_TO_N, SEQUENTIAL), queue priority and compute environment maxvCpus capacity are honoured. The default remains the simulated lifecycle. DescribeJobs now reports exit code 0 (the field was dropped when zero) and overlays the latest attempt's log stream, exit code and reason. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…sults CREATE TABLE AS (format, external_location, partitioned_by, field_delimiter, write_compression; IF NOT EXISTS; WITH [NO] DATA) writes TEXTFILE/CSV/JSON objects (optionally gzipped, key=value partition layout) and registers the Glue table and partitions; INSERT INTO appends objects and registers new partitions; UNLOAD writes files without a table. Non-empty targets fail HIVE_PATH_ALREADY_EXISTS, existing tables TABLE_ALREADY_EXISTS, and Parquet/ORC/Avro output NOT_SUPPORTED. GetQueryResults returns SQL NULL as a Datum with no VarCharValue (previously an empty string); the result CSV leaves NULL unquoted and writes "" for empty strings. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
SendCommand to a running, container-backed EC2 instance with an
instance profile runs the document's steps in the container (shell or
pwsh, {{ param }} substitution, working directory, execution timeout):
exit 0 is Success, non-zero Failed with ResponseCode, timeouts TimedOut,
CancelCommand kills the process. MaxConcurrency and MaxErrors are
honoured; stdout/stderr are truncated as documented, with full output
written to the S3 output location and CloudWatch Logs when configured.
tag: targets resolve against these instances, which appear as online
managed instances in DescribeInstanceInformation. Other targets keep the
simulated behaviour, which now also reports ResponseCode.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
ServerlessV2ScalingConfiguration is validated on create, modify and restore (MinCapacity 0-256, MaxCapacity 0.5-256 in 0.5 steps, min <= max, SecondsUntilAutoPause 300-86400, default 300); ModifyDBCluster used to ignore it and now merges partial updates. Clusters with MinCapacity 0 pause after their idle window: the engine container stops (data kept), status stays available as in AWS, zero capacity metrics and pause/resume events are published. Proxy connections, a new counting forwarder for MySQL-family engines, and Data API calls count as activity; a connection resumes the cluster, and a Data API call on a paused cluster starts the resume and returns DatabaseResumingException until it completes. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- athena: date_add returns NULL for amounts outside int32 instead of converting an unbounded ParseInt result (go/incorrect-integer-conversion). - efs: every file operation on a file-system or access-point path checks it stays under the storage root (go/path-injection); directories outside the root are never removed. - cloudfront: the canned signed-URL policy is built with json.Marshal (go/unsafe-quoting). Custom origins now validate the origin certificate against the system pool, as CloudFront does (502 for untrusted chains), instead of skipping verification. - athena: SQLResultPage is exported (CodeFactor unexported-return). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Docker-backed instances in a VPC join a labelled bridge network (gopherstack-vpc-<id>) whose IPAM subnet is the VPC CIDR, with the instance's subnet-allocated private IP as a static IP, so instances in a VPC reach each other by private IP; VPCs are isolated from each other. On an address-pool conflict the network falls back to Docker IPAM and the instance is tagged with a note. DeleteVpc removes the network once empty; idle labelled networks are pruned at start, and unlabelled networks are never touched. TCP/UDP ports opened to 0.0.0.0/0 or ::/0 by the instance's security groups are published on 127.0.0.1; the host ports are listed at /_gopherstack/ec2/instances/<id>/ports and in a gopherstack:published-ports tag. Rule changes apply to later launches; intra-VPC security group enforcement is not modelled. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
recordSuccessfulPhases emitted the elapsed phase time as a float, but the SDK types durationInSeconds as int64, so BatchGetBuilds failed to decode whenever the elapsed time was fractional. Durations are now truncated to whole seconds. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…nd metadata relay; SSM CodeQL fixes - A reserved create-time tag, gopherstack:id, pins the generated ID of EC2 instances/VPCs/subnets/security groups, ECS tasks, KMS keys, Cognito user pools, API Gateway REST and HTTP APIs, EFS file systems, CloudFront distributions, ELBv2 load balancers, RDS DbiResourceIds and Secrets Manager ARN suffixes. The tag is validated against each ID format, conflicts return the service's exists error, and it is never stored, listed or accepted by tag-on-existing calls. A guard test drives all of them through the SDK; see docs/pinned-ids.md. - LINKLOCAL_PROXY=true attaches ECS task and EC2 instance containers to a labelled network with a relay at 169.254.170.2 and 169.254.169.254, so tasks use AWS_CONTAINER_CREDENTIALS_RELATIVE_URI and instances use the default IMDS address, as SDKs expect. Fixes a cancelled request context on half-closed relay connections. - ssm: no computed allocation size in document parsing; exit codes are clamped to int32 (CodeQL). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… for completion The test created an external table without LOCATION (which Athena rejects) and read each query's state once immediately, though queries run asynchronously. It now creates the bucket and Glue database, uses LOCATION, and polls each query to a terminal state. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…rks end to end ssooidc (sso-oauth): RegisterClient, StartDeviceAuthorization, CreateToken (device_code with AuthorizationPending/SlowDown/ExpiredToken/AccessDenied, refresh_token, authorization_code with PKCE) and CreateTokenWithIAM. Device codes are approved at /_gopherstack/sso/device (optionally as a named identity-store user); /_gopherstack/sso/authorize serves the authorization-code redirect. sso portal (awsssoportal): ListAccounts, ListAccountRoles, GetRoleCredentials and Logout, scoped to the signed-in user's direct and group account assignments from SSO Admin and Identity Store. GetRoleCredentials provisions the AWSReservedSSO_<permission set> role with the permission set's policies and assumes it, so GetCallerIdentity returns the assumed SSO role. A full-stack test drives the SDK device flow and ssocreds provider. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ult values; reject external tables without LOCATION - cloudwatchlogs: JSON filter patterns support EXISTS, NOT EXISTS, IS NULL and IS NOT NULL; space-delimited patterns support &&/|| inside a term and an ellipsis at any position; more than three dimensions is InvalidParameterException; metric filter defaultValue is now published once per period in which a filter matched nothing (for filters without dimensions). A full-stack test checks PutLogEvents -> GetMetricData. - athena: CREATE EXTERNAL TABLE without LOCATION fails (it succeeded and registered nothing). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…n end-to-end flows - secretsmanager: PutSecretValue with VersionStages returned 500 (broke the AWSPENDING rotation step); replicating to the primary's own Region made it its own replica (DeleteSecret then skipped the recovery window); partial and mismatched ARNs resolved wrongly; BlockPublicPolicy defaulted to true and missed principal lists; KMS failures were 500s the SDK retried (now EncryptionFailure/DecryptionFailure). - ses: template HtmlPart was silently dropped (read as HTMLPart); friendly-from sources were rejected; SNS event destinations publish Send events with AWS's eventType casing, mail.tags and sendingAccountId. - sesv2: friendly-from accepted; Send and Delivery events are delivered to SNS event destinations (they were stored but never sent). - appsync: AWS scalars and directives are predefined, so real schemas load; results are projected to the selection set (aliases, __typename); NONE data sources pass the payload; DynamoDB resolvers return plain JSON and PutItem writes attributeValues; a graphql-ws real-time endpoint delivers @aws_subscribe subscriptions. - opensearch: a partial ClusterConfig update keeps omitted members (it blanked InstanceType and reset flags). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…d-to-end flows - glue: crawlers infer tables from S3 (format, CSV/TSV/JSON column types, TablePrefix, per-folder tables, Hive partitions; re-crawls update only crawler-owned tables) instead of creating empty placeholder tables (S3 wiring follows); partitions with the wrong number of values are rejected; workflow runs complete when their actions finish (they stayed RUNNING and blocked MaxConcurrentRuns); succeeded job runs report ExecutionTime. - emr: steps run one at a time PENDING->RUNNING->COMPLETED (a WAITING cluster reads RUNNING meanwhile); terminate cancels pending and interrupts running steps; auto-termination applies on describe/list. - sagemaker: InitialVariantWeight defaults to 1.0 (was 0); training artifacts land under <output>/<job>/output; notebook URLs use the notebook host (were built from the ARN); pipeline executions list their steps. - bedrock: ListGuardrails with an identifier returns every version; completed model customization jobs return endTime. - codepipeline: action executions report input and pipelineVersion. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…esolvers; SESv2 SNS events; Redshift Serverless lifecycle; leak tests out of the unit budget - appsync: DynamoDB resolvers support UpdateItem, DeleteItem, Query, Scan, BatchGetItem, BatchPutItem and BatchDeleteItem with conditions (ConditionalCheckFailedException in errorType), pagination and the AppSync result shapes; resolvers on non-root types run with $ctx.source. - sesv2: SNS event destinations are wired to SNS. - redshift: Serverless workgroups go CREATING/MODIFYING/DELETING with an opt-in --lifecycle-redshiftserverless window; busy resources reject updates and deletes with ConflictException; name, capacity and port validation. redshift-data checks WorkgroupName exists and is AVAILABLE. - ci: TestLeak* skip under -short (the sharded unit run hit its 10m limit) and run in a dedicated leak-tests job (make leak-test). - CodeQL: appsync result allocation and ssm exit-code narrowing. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…nd-to-end flows - kafka: GetBootstrapBrokers returned localhost:9092 always; it now lists one b-N.<cluster>.<id>.c2.kafka.<region>.amazonaws.com endpoint per broker, follows broker-count updates and ClientBroker (TLS-only by default; serverless returns only SASL/IAM). SCRAM batch responses carry clusterArn. Opt-in lifecycle delay: CREATING, UPDATING with operation tracking. - memorydb: DeleteCluster reported available; node CreateTime moved on every describe; snapshot restores ignored explicit node type, shards, engine and port; updates never showed updating; an existing FinalSnapshotName was silently overwritten. - docdb, neptune: deletes report deleting; snapshot restore keeps master username, port and KMS key (and final snapshots get an ARN); static parameter changes and group switches show pending-reboot until reboot; missing cluster parameter groups are DBClusterParameterGroupNotFound. Neptune instances report their parameter group. - elasticache: EngineVersion resolved against the catalog (it was ignored); clusters report their parameter group; node groups follow the replication group's transitional states; global datastores require an existing primary. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…rce, CodeBuild and S3 deploy; kafka lifecycle knob - glue: crawlers are wired to S3 (regional siblings inherit it), so StartCrawler infers tables, columns and partitions from the data. - codepipeline: Source/S3 reads the object and stages the output artifact in the artifact store (missing object fails with ConfigurationError); Build/CodeBuild starts the build with the input artifact as source and stays InProgress until the build finishes, then succeeds or fails with its status; Deploy/S3 copies or extracts the artifact. Builds pass the input through unchanged (no buildspec runs). - kafka: --lifecycle-kafka / KAFKA_LIFECYCLE_DELAY reaches the backend. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…pass on end-to-end flows - iot: CreateKeysAndCertificate/CreateCertificateFromCsr/provisioning returned one constant unparseable PEM; they now issue real X.509 certificates with SHA-256 certificate IDs. Fleet indexing parses Lucene queries (wildcards, boolean, ranges). DescribeEndpoint returns the per-type endpoints. The iot-jobs-data device API exists (jobs used to stay QUEUED forever). Thing type deprecation, recursive group listing and attach validation. - backup: jobs go CREATED -> RUNNING -> COMPLETED; ResourceType comes from the ARN; vault-lock retention is enforced; report plans and templates are validated. - transfer: resource IDs match the SDK patterns (Terraform validates workflow IDs); identity provider and home directory rules. - cognitoidentity: LookupDeveloperIdentity read a field the SDK never sends; re-login maps to the same identity (iss+sub); expired or foreign-client tokens are NotAuthorized; role and mapping validation; ASIA access key shape. - organizations: delegated-admin constraint reasons; policy types require ALL features; resource policy IDs match the SDK pattern. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…onvert default queue TestCloudFormationDashboard created a stack with no resources, which template preflight now rejects as AWS does; TestMediaConvertDashboard expected an empty queue list, but the account now has the SYSTEM Default queue AWS creates. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…stic ec2 port fake GetShardIterator stamped iterators with the backend clock, but decodeIterator checked expiry against wall time and GetRecords stamped the next iterator with time.Now(). With a backend clock that differs from wall time (fake clocks in tests, delayed parallel subtests in CI), iterators read as expired, so the Kinesis Analytics sampler and the EventBridge Kinesis target saw no records. Expiry and chaining now both use the backend clock; a root test drives every in-process Kinesis reader with the clock skewed both ways. The ec2 port-publishing test fake assigned host ports in map order; it now iterates sorted and the test asserts exact host ports. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
startProxy and startForwarder published the front end (atomic Store) before wg.Go(acceptLoop), while reap loads it in another goroutine and calls wg.Wait(); the first Add was not ordered before Wait, which the race detector flags when a backend closes while an engine unit starts. Add now happens before the Store, with Done deferred in the accept loop. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The root package runs with coverage instrumentation of every package plus -race and now exceeds 10m on CI runners (about 150s locally without coverage). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every AWS service's PARITY.md already claimed
overall: A. This PR makes those grades honest by working through the 685items_still_openentries across 152 services. Each item was handled in one of three ways:structural_gaps: it can never work in an emulator, for example because it needs a real ML engine, real hardware or billing data.685 open items are now 232, across 96 services. The remainder is tracked in a follow-up bd issue.
Highlights
Cross-service wiring (the
cli_*_wiring.gofiles), each covered by a root-level SDK test:Real bugs fixed along the way:
CreateEventBusreturned a 500 when Tags were given.CreateFunctiondefaulted toImageinstead ofZip.L,Wand#but never fired on them.GetConnection.Made-up data removed:
GetPositionEstimateno longer returns[0,0].PublishedBy="admin".TestInvokeAuthorizerno longer returns a fixed principal.Custom:Applicationschema.Engines added:
Behaviour changes worth a look
use_load_balancer_configuration.NumCacheNodes > 1is rejected, andDeleteGlobalReplicationGroupwithRetainPrimaryReplicationGroup=falsenow also deletes the primary replication group.GetExportrejects an unknown stage or export type.AutoRenewcan only change in the last 30 days of the commitment.AWS::DirectConnect::Lagis created with no connections.Verification
Run on the final tree:
go build ./...,go vet ./...andgo vet -tags e2e ./test/e2e/...go test -count=1 .for the root packageTestSnapshotVersionGuardand the full persistence packagegofmton all tracked Go filesgolangci-linton every touched packagego.modandgo.sumunchangedmake bd-audit, which found no trailer mismatchesNot run: the terraform and integration suites, which need Docker. Snapshot inventory changes are additive only, with no version bumps.
🤖 Generated with Claude Code