Skip to content

fix(stepfunctions): wrap optimized lambda:invoke result in the Invoke envelope - #2165

Merged
pgermosen merged 1 commit into
floci-io:mainfrom
soreavis:fix/sfn-lambda-invoke-envelope
Aug 13, 2026
Merged

fix(stepfunctions): wrap optimized lambda:invoke result in the Invoke envelope#2165
pgermosen merged 1 commit into
floci-io:mainfrom
soreavis:fix/sfn-lambda-invoke-envelope

Conversation

@soreavis

@soreavis soreavis commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Summary

Closes #2110.

A Task using the optimized arn:aws:states:::lambda:invoke integration returned the Lambda function's return value directly as the task result, with no ExecutedVersion / Payload / StatusCode keys. Real Step Functions nests the function output inside the Invoke response metadata for this integration, which is why the AWS examples read a Lambda result through $.Payload (JSONPath) or $states.result.Payload (JSONata). Against the unwrapped result those references resolve to nothing, the state still succeeds, and the execution ends SUCCEEDED carrying empty data.

In invokeResource() the direct-ARN branch and the optimized branch shared one if (functionName != null) block, so the output was returned raw for both. This gates the wrap to the optimized branch. A directly specified function ARN still returns only the function output — the documented behavior for that form, and now covered by a regression test.

Old task result for Resource: "arn:aws:states:::lambda:invoke", then new:

{"marker":"RET","echo":{"in":1}}
{"ExecutedVersion":"$LATEST","Payload":{"marker":"RET","echo":{"in":1}},"StatusCode":200}

Note this changes the task result shape for existing users. State machines that adapted to the unwrapped form — reading $.marker where AWS needs $.Payload.marker, or dropping the OutputPath: "$.Payload" that Workflow Studio sets by default — were already incompatible with real AWS and will now behave as they do there. Direct-ARN tasks, .waitForTaskToken tasks and every non-Lambda integration are unchanged.

Type of change

  • Bug fix (fix:)
  • New feature (feat:)
  • Breaking change (feat!: or fix!:)
  • Docs / chore

AWS Compatibility

Invoke Lambda with Step Functions: "When the Task result is returned, the function output is nested inside a dictionary of metadata", with an example carrying ExecutedVersion, Payload, SdkHttpMetadata, SdkResponseMetadata and StatusCode: 200. Same page: "The Payload field of the response is parsed from escaped Json to Json" (so Payload stays a parsed node, matching the existing readTree), and for the direct-ARN form, "the task result contains only the function output". The Task state reference reads the optimized integration's result as "Output": "{% $states.result.Payload %}", and Workflow Studio's docs state the default OutputPath for Lambda Invoke states is $.Payload, which "removes the additional metadata" — both only work if the envelope is there. The new tests cover both shapes.

Values come from real emulator state: ExecutedVersion from the resolved function's version (the same fn.getVersion() that LambdaService.invoke() reports since #2026), StatusCode from InvokeResult, Payload from the existing parse.

SdkHttpMetadata and SdkResponseMetadata are left out on purpose. Their contents are artifacts of a real HTTPS call — Date, X-Amzn-Trace-Id, x-amzn-RequestId, Content-Length — and floci invokes in process, so anything it put there would be invented. The documented read paths only touch the three keys emitted here, and a test pins the key set at exactly those three, so adding the blocks later is a deliberate change rather than a drift. Say the word if you want them and I'll add them.

Two pre-existing gaps this surfaces rather than fixes: extractLambdaFunctionName drops the qualifier (#1660), so a task using Qualifier or a qualified FunctionName still invokes $LATEST and will now report ExecutedVersion: "$LATEST" for it; and InvocationType is hardcoded to RequestResponse, so an InvocationType: "Event" task reports 200 where AWS reports 202. Both want their own issue — I can file them if you'd like them tracked.

Checklist

  • ./mvnw test passes locally (with pre-existing Docker-dependent failures unrelated to this change — see the test note)
  • New or updated integration test added
  • Commit messages follow Conventional Commits

New Docker-free AslExecutorLambdaInvokeResultTest, modeled on AslExecutorCatchTest (mocked LambdaExecutorService + LambdaFunctionStore, driven through executeSync): the envelope and its exact key set, the direct-ARN raw-output guard, ResultSelector over $.Payload.marker, OutputPath: "$.Payload", and JSONata $states.result.Payload. Reverting the AslExecutor change with the tests in place fails 4 of the 5, with the direct-ARN guard green on both sides. make docs-check passes; no handler action changed.

Test note: in the full ./mvnw test (8393 tests) all 27 services/stepfunctions classes are green. The failures on this machine sit in container-backed subsystems (DocumentDB, Neptune, WebSockets, ECR, API Gateway authorizers) — there is no Docker daemon here, and the same classes fail identically on a clean main tree.

@soreavis
fix(stepfunctions): wrap optimized lambda:invoke result in the Invoke…
e0b5fd9 
… envelope

A Task using the arn:aws:states:::lambda:invoke integration returned the
Lambda function's return value directly as the task result, with no
ExecutedVersion, Payload or StatusCode key. Real Step Functions nests the
function output inside the Invoke response metadata for this integration,
which is why $.Payload and the JSONata $states.result.Payload are the
documented ways to read a Lambda result.

Against the unwrapped result those references resolved to nothing, the
state still succeeded, and the execution finished SUCCEEDED carrying
silently-empty data — a pipeline accumulating results across stages looked
healthy while producing an empty result.

Both the direct-ARN branch and the optimized branch shared one block in
invokeResource(), so the parsed function output was returned raw for both.
Gate the wrap to the optimized branch: it now returns ExecutedVersion (from
the resolved function's version, matching what LambdaService.invoke already
reports), Payload (the parsed function output) and StatusCode (from the
invoke result). A directly specified function ARN keeps returning only the
function output, which is the documented behavior for that form.

SdkHttpMetadata and SdkResponseMetadata are deliberately not emitted. Their
contents are artifacts of a real HTTPS call to the Lambda service — Date,
X-Amzn-Trace-Id, RequestId, Content-Length — and floci invokes in process,
so any value it put there would be invented.

The .waitForTaskToken flow is unaffected: executeTaskState overwrites the
task result with the callback payload, so the envelope is discarded for
that pattern, as it should be.

Closes floci-io#2110
@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown

🎉 Thanks for your first pull request to Floci!

Your CI checks need a maintainer to approve them before they run. That is GitHub's standard gate on first-time contributors, not a problem with your PR — so if the checks look like they are doing nothing, that is why. Once a maintainer approves, CI and the compatibility suite start automatically. Nothing is needed from you in the meantime.

While you wait, a couple of things that make review faster:

  • Link the issue this fixes with Closes #N in the description
  • Commits follow Conventional Commits (feat(s3): ..., fix(dynamodb): ...)
  • Behaviour changes come with a test — see CONTRIBUTING.md

Come join us in Slack — it is the fastest way to reach maintainers if you get stuck, or want feedback on an approach before investing more time in it.

@greptile-apps

greptile-apps Bot commented Aug 7, 2026

Copy link
Copy Markdown

Greptile Summary

This PR makes optimized Step Functions Lambda invocations return an AWS-compatible Invoke envelope while preserving raw function output for direct Lambda ARNs.

  • Adds ExecutedVersion, parsed Payload, and StatusCode to optimized invocation results.
  • Adds regression coverage for envelope shape, direct-ARN behavior, JSONPath processing, and JSONata processing.

Confidence Score: 5/5

The PR appears safe to merge because the result-shape correction is narrowly gated and covered across the affected Step Functions output-processing paths.

The optimized integration now receives the documented envelope, direct Lambda ARNs retain their existing raw output, and no new blocking or non-blocking defect remains.

Important Files Changed
Filename Overview
src/main/java/io/github/hectorvent/floci/services/stepfunctions/AslExecutor.java Correctly distinguishes optimized Lambda invocation results from direct-ARN results and constructs the expected response envelope.
src/test/java/io/github/hectorvent/floci/services/stepfunctions/AslExecutorLambdaInvokeResultTest.java Provides focused coverage of both result shapes and their JSONPath and JSONata consumers.

Reviews (1): Last reviewed commit: "fix(stepfunctions): wrap optimized lambd..." | Re-trigger Greptile

@hectorvent hectorvent added bug Something isn't working sfn AWS Step Functions lambda AWS Lambda labels Aug 7, 2026
pgermosen
pgermosen approved these changes Aug 13, 2026
View reviewed changes

@pgermosen pgermosen left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checked this against the AWS Lambda/Step Functions integration docs directly rather than relying on the PR's own citations.

Everything matches verbatim: the documented envelope shape (ExecutedVersion/Payload/StatusCode) for the optimized arn:aws:states:::lambda:invoke integration, the "task result contains only the function output" behavior for a directly specified function ARN, and the escaped-JSON-to-JSON parsing note for Payload. Deliberately leaving out SdkHttpMetadata/SdkResponseMetadata (which would have to be invented, since floci invokes in-process) is the right call, and it's pinned by a test asserting exactly the three real keys, so it won't silently drift.

Also appreciated the honesty about what this doesn't fix -- the Qualifier-dropping bug and hardcoded InvocationType are called out as separate pre-existing issues rather than glossed over.

Approving.

@pgermosen
pgermosen merged commit 4581176 into floci-io:main Aug 13, 2026
15 checks passed
@hectorvent

hectorvent commented Aug 18, 2026

Copy link
Copy Markdown
Collaborator

🎉 This PR is included in version 1.7.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Adwrells pushed a commit to Adwrells/floci that referenced this pull request Aug 18, 2026
@semantic-release-bot
chore(release): 1.7.0
75c8cfc 
# [1.7.0](floci-io/floci@1.6.0...1.7.0) (2026-08-18)

### Bug Fixes

* **apigateway:** apply MOCK integration response headers ([floci-io#1822](floci-io#1822)) ([a49c3e5](floci-io@a49c3e5)), closes [floci-io#1955](floci-io#1955) [floci-io#1955](floci-io#1955)
* **apigateway:** create the stage when CreateDeployment carries a stageName ([floci-io#2130](floci-io#2130)) ([f34e0b5](floci-io@f34e0b5))
* **apigateway:** fall back to REST API region scan for non-SigV4 Authorization headers ([floci-io#2149](floci-io#2149)) ([5156095](floci-io@5156095)), closes [ApiGatewayV2Service#resolveHttpApiRegion](https://github.com/ApiGatewayV2Service/issues/resolveHttpApiRegion) [ApiGatewayService#resolveRestApiRegion](https://github.com/ApiGatewayService/issues/resolveRestApiRegion) [floci-io#2169](floci-io#2169) [floci-io#2169](floci-io#2169) [floci-io#2054](floci-io#2054) [floci-io#2054](floci-io#2054)
* **apigateway:** honor configured execute-api hostname ([floci-io#2286](floci-io#2286)) ([3cfa983](floci-io@3cfa983))
* **apigateway:** match Content-Type case-insensitively in Lambda proxy responses ([floci-io#2150](floci-io#2150)) ([10048ad](floci-io@10048ad))
* **apigateway:** preserve trailing slash in proxy event path ([floci-io#1863](floci-io#1863)) ([4236388](floci-io@4236388)), closes [floci-io#1557](floci-io#1557)
* **apigatewayv2:** encode binary Lambda request bodies ([floci-io#2203](floci-io#2203)) ([28e9f6e](floci-io@28e9f6e))
* **apigateway:** verify and propagate HTTP API v2 JWT authorizer claims ([floci-io#2353](floci-io#2353)) ([0444753](floci-io@0444753))
* **appconfig:** accept top-level resource ARNs in TagResource/ListTagsForResource ([floci-io#2279](floci-io#2279)) ([0818e5e](floci-io@0818e5e)), closes [AppConfigTagHandler#parseArn](https://github.com/AppConfigTagHandler/issues/parseArn)
* **appconfig:** add DeleteConfigurationProfile/DeleteHostedConfigurationVersion/ListDeploymentStrategies/DeleteDeploymentStrategy ([floci-io#2280](floci-io#2280)) ([be62502](floci-io@be62502))
* **cloudformation:** apply AssumeRolePolicyDocument when adopting an existing IAM role on update ([floci-io#2143](floci-io#2143)) ([4a5fae4](floci-io@4a5fae4))
* **cloudformation:** create AWS::IAM::Role inline Policies instead of silently dropping them ([floci-io#1969](floci-io#1969)) ([8d2a5bd](floci-io@8d2a5bd)), closes [floci-io#1952](floci-io#1952) [floci-io#1825](floci-io#1825) [floci-io#1952](floci-io#1952)
* **cloudformation:** don't double-encode string-form SNS RedrivePolicy and FilterPolicy ([floci-io#2325](floci-io#2325)) ([c12f3fa](floci-io@c12f3fa)), closes [CloudFormationTemplateEngine#resolveJsonAttribute](https://github.com/CloudFormationTemplateEngine/issues/resolveJsonAttribute)
* **cloudformation:** expand AWS::Serverless::HttpApi via SAM transform ([floci-io#2146](floci-io#2146)) ([5812910](floci-io@5812910)), closes [floci-io#1758](floci-io#1758) [floci-io#1758](floci-io#1758)
* **cloudformation:** expand SAM AutoPublishAlias into Version + Alias ([floci-io#1961](floci-io#1961)) ([7d66bf0](floci-io@7d66bf0)), closes [floci-io#1987](floci-io#1987) [floci-io#1988](floci-io#1988) [floci-io#1987](floci-io#1987) [floci-io#1987](floci-io#1987) [floci-io#1988](floci-io#1988) [floci-io#1987](floci-io#1987) [floci-io#1987](floci-io#1987)
* **cloudformation:** honor resource-level conditions ([floci-io#2255](floci-io#2255)) ([8ef71d6](floci-io@8ef71d6))
* **cloudformation:** honor stack status filters ([floci-io#2244](floci-io#2244)) ([34c9c6c](floci-io@34c9c6c))
* **cloudformation:** infer Lambda FunctionName mode for pre-fix persisted stacks ([floci-io#2177](floci-io#2177)) ([0cbfba8](floci-io@0cbfba8)), closes [floci-io#2163](floci-io#2163) [floci-io#1831](floci-io#1831) [floci-io#1831](floci-io#1831) [floci-io#2261](floci-io#2261)
* **cloudformation:** map FIFO and redrive attributes for AWS::SQS::Queue ([floci-io#1939](floci-io#1939)) ([58112b1](floci-io@58112b1))
* **cloudformation:** pass the CloudFront service argument in the provisioner tests ([floci-io#2261](floci-io#2261)) ([6ca7d44](floci-io@6ca7d44)), closes [floci-io#1820](floci-io#1820) [floci-io#1807](floci-io#1807)
* **cloudformation:** physically delete nested stacks and removed resources on update ([floci-io#2345](floci-io#2345)) ([291a974](floci-io@291a974))
* **cloudformation:** reconcile AWS::Logs::LogGroup in place on UpdateStack ([floci-io#2152](floci-io#2152)) ([76b264f](floci-io@76b264f)), closes [floci-io#1965](floci-io#1965)
* **cloudformation:** resolve ASG launch templates by id and MixedInstancesPolicy ([floci-io#2005](floci-io#2005)) ([floci-io#2019](floci-io#2019)) ([0971cf6](floci-io@0971cf6))
* **cloudwatch:** keep GetLogEvents paging inside the list bounds ([floci-io#2355](floci-io#2355)) ([c163a86](floci-io@c163a86))
* **cloudwatch:** page FilterLogEvents forward with a usable nextToken ([floci-io#2354](floci-io#2354)) ([112602f](floci-io@112602f))
* **cloudwatch:** reject invalid log event tokens ([floci-io#2249](floci-io#2249)) ([12cf6e2](floci-io@12cf6e2))
* **cloudwatch:** return logStreamName on FilterLogEvents results ([floci-io#2259](floci-io#2259)) ([a0adea9](floci-io@a0adea9)), closes [floci-io#2210](floci-io#2210)
* **cloudwatch:** warn on unsupported Logs Insights filter operators ([floci-io#2170](floci-io#2170)) ([f1c8197](floci-io@f1c8197)), closes [floci-io#2042](floci-io#2042)
* **cognito:** expire refresh tokens and scope them to their own pool in REFRESH_TOKEN_AUTH ([floci-io#2135](floci-io#2135)) ([7d8aced](floci-io@7d8aced)), closes [floci-io#2132](floci-io#2132) [floci-io#2139](floci-io#2139) [floci-io#2132](floci-io#2132)
* **cognito:** HMAC-sign refresh tokens to prevent forgery ([floci-io#2139](floci-io#2139)) ([c4f4181](floci-io@c4f4181))
* **cognito:** mark verified contact attribute on ConfirmSignUp ([floci-io#1881](floci-io#1881)) ([d891425](floci-io@d891425))
* **cognito:** reject invalid refresh tokens in InitiateAuth REFRESH_TOKEN_AUTH ([floci-io#2132](floci-io#2132)) ([3ce5041](floci-io@3ce5041)), closes [floci-io#2113](floci-io#2113)
* **cognito:** restore the SecureRandom import ([floci-io#2337](floci-io#2337)) ([7a2dc53](floci-io@7a2dc53)), closes [floci-io#2139](floci-io#2139) [floci-io#1881](floci-io#1881) [floci-io#1881](floci-io#1881)
* **compat:** install AWS CLI v2 in the compat image so AWS_ENDPOINT_URL is honored ([floci-io#2315](floci-io#2315)) ([9fda5f5](floci-io@9fda5f5))
* **core:** extract shared pagination helper, reject maxResults=0 ([floci-io#2343](floci-io#2343)) ([25b46e2](floci-io@25b46e2)), closes [floci-io#2339](floci-io#2339) [floci-io#2340](floci-io#2340)
* **core:** stop leaked executor threads from pinning test classloaders ([floci-io#2363](floci-io#2363)) ([6962e91](floci-io@6962e91))
* **docker:** fall back to Windows named pipe when docker-host is at its unix-socket default ([floci-io#2030](floci-io#2030)) ([c48c062](floci-io@c48c062))
* **docker:** label containers and volumes per emulator ([floci-io#2341](floci-io#2341)) ([d819c00](floci-io@d819c00))
* **dynamodb:** compare Value when legacy Expected supplies Exists ([floci-io#2125](floci-io#2125)) ([a2b20cc](floci-io@a2b20cc))
* **dynamodb:** isolate item storage and locks between accounts ([floci-io#2240](floci-io#2240)) ([a803626](floci-io@a803626))
* **dynamodb:** order Query by full composite sort key ([floci-io#2114](floci-io#2114)) ([cd3c6b5](floci-io@cd3c6b5)), closes [floci-io#1675](floci-io#1675)
* **ec2:** assign a public IP only when the subnet opts in via MapPublicIpOnLaunch ([floci-io#2023](floci-io#2023)) ([2ab795c](floci-io@2ab795c)), closes [floci-io#1984](floci-io#1984)
* **ec2:** delete key pairs by name through the storage backend ([floci-io#2187](floci-io#2187)) ([fc74987](floci-io@fc74987)), closes [floci-io#2185](floci-io#2185)
* **ec2:** keep the source on security group rules ([floci-io#2266](floci-io#2266)) ([a6f5f12](floci-io@a6f5f12)), closes [floci-io#2190](floci-io#2190)
* **ec2:** reject prefix list names AWS reserves for its own lists ([floci-io#2274](floci-io#2274)) ([2d003b5](floci-io@2d003b5)), closes [floci-io#2273](floci-io#2273)
* **ec2:** sshd can only be started from an absolute path since OpenSSH v3.9 ([floci-io#2351](floci-io#2351)) ([c194bff](floci-io@c194bff))
* **ec2:** start sshd even when run-instances omits a key pair ([floci-io#2245](floci-io#2245)) ([da5ff91](floci-io@da5ff91))
* **ec2:** type a security group rule's tags as security-group-rule ([floci-io#2272](floci-io#2272)) ([4058dfa](floci-io@4058dfa)), closes [floci-io#2270](floci-io#2270)
* **ecs:** report service deployments and MISSING failures on DescribeServices ([floci-io#2176](floci-io#2176)) ([8b8f837](floci-io@8b8f837)), closes [floci-io#2174](floci-io#2174)
* **eks:** validate subnet IDs exist before creating a cluster ([floci-io#1943](floci-io#1943)) ([66fd109](floci-io@66fd109)), closes [floci-io#1942](floci-io#1942)
* **elasticache:** clean up container by id on readiness-timeout rollback ([floci-io#2090](floci-io#2090)) ([91b6a40](floci-io@91b6a40))
* **elasticache:** store the user Engine instead of hardcoding redis ([floci-io#2331](floci-io#2331)) ([7a4fc45](floci-io@7a4fc45)), closes [floci-io#2290](floci-io#2290)
* **eventbridge:** boolean/numeric pattern values are matched correctly ([floci-io#1889](floci-io#1889)) ([517094a](floci-io@517094a))
* **firehose:** build S3 object keys with AWS prefix expressions and name suffix ([floci-io#1858](floci-io#1858)) ([a79e04e](floci-io@a79e04e)), closes [floci-io#1857](floci-io#1857)
* **firehose:** return Kinesis source in stream description ([floci-io#2025](floci-io#2025)) ([988696b](floci-io@988696b))
* **iam,lambda:** return resource tags in Get and Create responses ([floci-io#2262](floci-io#2262)) ([b71bfc4](floci-io@b71bfc4)), closes [floci-io#2155](floci-io#2155) [floci-io#2199](floci-io#2199)
* **iam:** include policy description in GetPolicy/ListPolicies/CreatePolicy responses ([floci-io#2155](floci-io#2155)) ([1150cfc](floci-io@1150cfc)), closes [floci-io#2154](floci-io#2154)
* **iam:** route long-term access keys to owning accounts ([floci-io#2319](floci-io#2319)) ([02898cf](floci-io@02898cf))
* **iam:** seed AmazonAPIGatewayPushToCloudWatchLogs managed policy ([floci-io#2147](floci-io#2147)) ([b1f953e](floci-io@b1f953e)), closes [floci-io#2121](floci-io#2121)
* **iam:** seed the full AWS managed policy catalog ([floci-io#2194](floci-io#2194)) ([527615b](floci-io@527615b)), closes [ClassLoader#getResourceAsStream](https://github.com/ClassLoader/issues/getResourceAsStream)
* **iot:** match topic rules outside the default region ([floci-io#2169](floci-io#2169)) ([9b451cc](floci-io@9b451cc)), closes [floci-io#2065](floci-io#2065)
* **kinesis:** reject records over the 1 MiB size limit ([floci-io#1896](floci-io#1896)) ([5afb60d](floci-io@5afb60d)), closes [floci-io#1755](floci-io#1755)
* **kinesis:** resolve LATEST shard iterator position at GetShardIterator time ([floci-io#1901](floci-io#1901)) ([3b760bd](floci-io@3b760bd)), closes [floci-io#1900](floci-io#1900)
* **kms:** reject mismatched keys in decryption requests ([floci-io#1893](floci-io#1893)) ([0cfffbe](floci-io@0cfffbe))
* **lambda,iam:** assume execution role for in-function SDK calls ([floci-io#1909](floci-io#1909)) ([573d4bd](floci-io@573d4bd)), closes [floci-io#2040](floci-io#2040)
* **lambda:** disable HTTP/2 cleartext on the runtime API server ([floci-io#2181](floci-io#2181)) ([cb06a73](floci-io@cb06a73))
* **lambda:** drain parked extensions before closing the runtime API server ([floci-io#2156](floci-io#2156)) ([c0f36ea](floci-io@c0f36ea))
* **lambda:** give published versions their code location ([floci-io#2012](floci-io#2012)) ([42022fe](floci-io@42022fe)), closes [floci-io#1988](floci-io#1988) [floci-io#1987](floci-io#1987) [floci-io#1987](floci-io#1987)
* **lambda:** propagate image inspection failures ([floci-io#2268](floci-io#2268)) ([9ebf9fe](floci-io@9ebf9fe))
* **lambda:** reassemble container log lines split across Docker frames ([floci-io#1953](floci-io#1953)) ([6344852](floci-io@6344852))
* **lambda:** reconcile code volumes against real Docker state and clean up superseded ones ([floci-io#2208](floci-io#2208)) ([a5daab6](floci-io@a5daab6)), closes [floci-io#2164](floci-io#2164)
* **lambda:** scope resource-policy statements to the request Qualifier ([floci-io#2129](floci-io#2129)) ([ea74b97](floci-io@ea74b97))
* **lambda:** SIGTERM container before closing runtime API socket ([floci-io#2098](floci-io#2098)) ([b911ccd](floci-io@b911ccd)), closes [floci-io#2091](floci-io#2091) [floci-io#2156](floci-io#2156) [floci-io#2156](floci-io#2156)
* **lambda:** validate Layers ARNs eagerly on CreateFunction/UpdateFunctionConfiguration ([floci-io#2282](floci-io#2282)) ([2f0ef45](floci-io@2f0ef45)), closes [floci-io#2280](floci-io#2280) [InMemoryStorage#get](https://github.com/InMemoryStorage/issues/get)
* **memorydb:** clean up container by id on readiness-timeout rollback ([floci-io#2092](floci-io#2092)) ([11d5275](floci-io@11d5275)), closes [floci-io#2090](floci-io#2090) [floci-io#2090](floci-io#2090)
* **rds:** advertise reachable endpoints ([floci-io#2074](floci-io#2074)) ([f417164](floci-io@f417164))
* **rds:** fault with DBInstanceNotFound/DBClusterNotFoundFault for missing identifiers in Describe* ([floci-io#1740](floci-io#1740)) ([02288ab](floci-io@02288ab))
* **rds:** preserve configured database images ([floci-io#2035](floci-io#2035)) ([9e7cdad](floci-io@9e7cdad))
* **rds:** resolve AWS-managed default DB cluster parameter groups on reference ([floci-io#1805](floci-io#1805)) ([b31cbb9](floci-io@b31cbb9)), closes [floci-io#1820](floci-io#1820) [floci-io#1823](floci-io#1823)
* **rds:** restore Terraform RDS and RabbitMQ compatibility ([floci-io#1951](floci-io#1951)) ([ea1231b](floci-io@ea1231b))
* **s3:** DeleteObjects honours empty key list ([floci-io#2201](floci-io#2201)) ([15d6ce8](floci-io@15d6ce8)), closes [floci-io#2198](floci-io#2198)
* **s3:** derive S3 host suffix matching from DNS config ([floci-io#1843](floci-io#1843)) ([188588b](floci-io@188588b))
* **s3:** enforce auth on object write paths when enforce-auth is enabled ([floci-io#2326](floci-io#2326)) ([16a8f04](floci-io@16a8f04)), closes [floci-io#2318](floci-io#2318)
* **s3:** Ensure tags are added on multipart s3 uploads. ([floci-io#2151](floci-io#2151)) ([f6faf0f](floci-io@f6faf0f))
* **s3:** isolate object byte storage between accounts ([floci-io#2241](floci-io#2241)) ([cdb2c36](floci-io@cdb2c36))
* **s3:** preserve literal '+' in object keys and support encoding-type=url in list-objects ([floci-io#1736](floci-io#1736)) ([93b6f5e](floci-io@93b6f5e)), closes [floci-io#1589](floci-io#1589)
* **s3:** route the accelerate subresource instead of falling through ([floci-io#2330](floci-io#2330)) ([833de25](floci-io@833de25)), closes [floci-io#2295](floci-io#2295)
* **s3:** validate FULL_OBJECT checksum on CompleteMultipartUpload ([floci-io#1980](floci-io#1980)) ([d039780](floci-io@d039780))
* **s3vectors:** return cosine distance from queries ([floci-io#2175](floci-io#2175)) ([2f5bc39](floci-io@2f5bc39))
* **s3vectors:** route ListVectors instead of falling through to S3 ([floci-io#2285](floci-io#2285)) ([6c4d63b](floci-io@6c4d63b)), closes [floci-io#2161](floci-io#2161)
* **s3:** verify SigV4 signature on presigned URLs when enforce-auth is enabled ([floci-io#1842](floci-io#1842)) ([3fe836a](floci-io@3fe836a))
* **ses:** pass the custom-verification-email store in the list-management test ([floci-io#2182](floci-io#2182)) ([396ef55](floci-io@396ef55)), closes [floci-io#1875](floci-io#1875) [floci-io#1840](floci-io#1840)
* **sqs:** delayed FIFO message no longer blocks its message group ([floci-io#2112](floci-io#2112)) ([fa8f8d7](floci-io@fa8f8d7)), closes [floci-io#2104](floci-io#2104)
* **stepfunctions:** publish execution status after its terminal fields ([floci-io#2234](floci-io#2234)) ([4ba854a](floci-io@4ba854a))
* **stepfunctions:** wrap optimized lambda:invoke result in the Invoke envelope ([floci-io#2165](floci-io#2165)) ([4581176](floci-io@4581176)), closes [floci-io#2110](floci-io#2110)
* **test:** pass the managed prefix list store in Ec2PublicIpOnLaunchTest ([floci-io#2288](floci-io#2288)) ([62ff490](floci-io@62ff490)), closes [floci-io#2023](floci-io#2023) [floci-io#2287](floci-io#2287)

### Features

* **apigateway:** API key management — UpdateApiKey, DeleteApiKey, UsagePlan custom-id, generateDistinctId ([floci-io#1883](floci-io#1883)) ([b6765b3](floci-io@b6765b3)), closes [floci-io#2045](floci-io#2045)
* **apigateway:** derive SQS QueueUrl from path-style integration URI when absent from template ([floci-io#1903](floci-io#1903)) ([cfbae88](floci-io@cfbae88))
* **apigateway:** route execute-api hostnames for HTTP APIs ([floci-io#2054](floci-io#2054)) ([33ba5ac](floci-io@33ba5ac))
* **apigatewayv2:** route execute-api hosts to WebSocket $connect and [@connections](https://github.com/connections) ([floci-io#2188](floci-io#2188)) ([45bb37f](floci-io@45bb37f)), closes [floci-io#2054](floci-io#2054) [floci-io#1846](floci-io#1846) [floci-io#1871](floci-io#1871) [floci-io#1871](floci-io#1871) [floci-io#1846](floci-io#1846)
* **applicationautoscaling:** add Application Auto Scaling control plane ([floci-io#2159](floci-io#2159)) ([1795e13](floci-io@1795e13)), closes [floci-io#2157](floci-io#2157)
* **appsync:** Phase 6 — Query Execution + HTTP Endpoint ([floci-io#1884](floci-io#1884)) ([819bfed](floci-io@819bfed))
* **bedrockagentcore:** emulate the AgentCore control plane and InvokeAgentRuntime stub ([floci-io#2316](floci-io#2316)) ([4e6e6df](floci-io@4e6e6df)), closes [lex00#2](lex00#2) [lex00#3](lex00#3) [lex00#4](lex00#4) [lex00#5](lex00#5) [lex00#6](lex00#6) [floci-io#7](floci-io#7) [floci-io#8](floci-io#8) [floci-io#9](floci-io#9) [floci-io#12](floci-io#12) [lex00#14](lex00#14) [floci-io#10](floci-io#10) [floci-io#11](floci-io#11) [floci-io#13](floci-io#13) [lex00#10](lex00#10) [lex00#11](lex00#11) [lex00#13](lex00#13) [floci-io#14](floci-io#14)
* **cloudcontrol:** implement CreateResource / DeleteResource / GetResource ([floci-io#2037](floci-io#2037)) ([43f47a3](floci-io@43f47a3))
* **cloudformation:** honor resource-level DeletionPolicy ([floci-io#2167](floci-io#2167)) ([7d9b9ae](floci-io@7d9b9ae)), closes [floci-io#1555](floci-io#1555)
* **cloudformation:** implement GetTemplateSummary ([floci-io#2148](floci-io#2148)) ([a235b76](floci-io@a235b76)), closes [floci-io#1964](floci-io#1964)
* **cloudformation:** provision ApiGateway::Account, AutoScaling::LifecycleHook, and EC2::FlowLog ([floci-io#2003](floci-io#2003)) ([9280369](floci-io@9280369)), closes [floci-io#2002](floci-io#2002)
* **cloudformation:** provision AWS::EC2::VPCEndpoint ([floci-io#1995](floci-io#1995)) ([a985fa4](floci-io@a985fa4)), closes [floci-io#1994](floci-io#1994)
* **cloudformation:** provision AWS::ECS::CapacityProvider and ClusterCapacityProviderAssociations ([floci-io#1999](floci-io#1999)) ([907a2df](floci-io@907a2df)), closes [floci-io#1998](floci-io#1998) [floci-io#1998](floci-io#1998) [floci-io#1825](floci-io#1825)
* **cloudformation:** provision AWS::Events::EventBus as a real custom bus ([floci-io#1807](floci-io#1807)) ([bc21367](floci-io@bc21367)), closes [floci-io#1803](floci-io#1803) [floci-io#2141](floci-io#2141)
* **cloudformation:** provision AWS::Lambda::Permission and fix Version and Alias updates ([floci-io#1997](floci-io#1997)) ([105a8ee](floci-io@105a8ee)), closes [floci-io#1996](floci-io#1996) [LambdaService#deleteVersion](https://github.com/LambdaService/issues/deleteVersion) [floci-io#1961](floci-io#1961)
* **cloudformation:** provision the network ACL family ([floci-io#2001](floci-io#2001)) ([5e01c07](floci-io@5e01c07)), closes [floci-io#2000](floci-io#2000)
* **cloudformation:** resolve dynamic references in RDS credentials ([floci-io#1809](floci-io#1809)) ([d9e4447](floci-io@d9e4447))
* **cloudfront:** enforce signed private content ([floci-io#1831](floci-io#1831)) ([5657e35](floci-io@5657e35)), closes [floci-io#1820](floci-io#1820) [floci-io#1823](floci-io#1823)
* **cloudfront:** serve distribution requests from S3 and custom origins ([floci-io#1820](floci-io#1820)) ([82f8016](floci-io@82f8016)), closes [floci-io#1823](floci-io#1823)
* **cloudhsmv2:** implement CloudHSM v2 service ([floci-io#1776](floci-io#1776)) ([1cc97d5](floci-io@1cc97d5)), closes [floci-io#2035](floci-io#2035) [floci-io#1810](floci-io#1810) [floci-io#1827](floci-io#1827)
* **cognito:** add AdminLinkProviderForUser ([floci-io#2166](floci-io#2166)) ([0203bc7](floci-io@0203bc7)), closes [floci-io#1563](floci-io#1563)
* **cognito:** add GetUserAttributeVerificationCode support ([floci-io#1898](floci-io#1898)) ([24cdabb](floci-io@24cdabb))
* **dynamodb:** global-table v2 replicas (UpdateTable ReplicaUpdates + Custom::DynamoDBReplica) ([floci-io#1811](floci-io#1811)) ([a29464a](floci-io@a29464a))
* **ec2:** add ReplaceRoute ([floci-io#2178](floci-io#2178)) ([d943e09](floci-io@d943e09)), closes [floci-io#2087](floci-io#2087)
* **ec2:** allow a security group rule to take a prefix list as its source ([floci-io#2271](floci-io#2271)) ([dfcd492](floci-io@dfcd492)), closes [floci-io#2269](floci-io#2269) [floci-io#2266](floci-io#2266)
* **ec2:** config toggle to report the AWS-faithful private IP ([floci-io#2024](floci-io#2024)) ([33d35b2](floci-io@33d35b2)), closes [floci-io#1983](floci-io#1983)
* **ec2:** DescribeImages synthesizes an AMI for an unmatched wildcard name lookup ([floci-io#2009](floci-io#2009)) ([cdb6811](floci-io@cdb6811)), closes [floci-io#2008](floci-io#2008)
* **ec2:** DescribeVpcEndpointServices returns the common interface services with AZs ([#2007](https://github.com/floci-io/floci/issues/2007)) ([42a79a7](floci-io@42a79a7)), closes [#2004](https://github.com/floci-io/floci/issues/2004)
* **ec2:** support CreateImage (create AMI from instance) ([#1979](https://github.com/floci-io/floci/issues/1979)) ([30a6164](floci-io@30a6164)), closes [#1978](https://github.com/floci-io/floci/issues/1978)
* **ec2:** support managed prefix lists ([#2105](https://github.com/floci-io/floci/issues/2105)) ([ac4b865](floci-io@ac4b865)), closes [#2100](https://github.com/floci-io/floci/issues/2100)
* **ec2:** support transit gateways ([#2329](https://github.com/floci-io/floci/issues/2329)) ([20470b7](floci-io@20470b7))
* **eks:** support IRSA with a real OIDC issuer and JWT validation ([#2108](https://github.com/floci-io/floci/issues/2108)) ([7e5afae](floci-io@7e5afae))
* **elbv2:** honor preserve_host_header parameter ([#2109](https://github.com/floci-io/floci/issues/2109)) ([2594705](floci-io@2594705))
* **eventbridge:** deliver events to event-bus targets ([#1814](https://github.com/floci-io/floci/issues/1814)) ([50fe67d](floci-io@50fe67d))
* **firehose:** honor BufferingHints with time and size based flush ([#2314](https://github.com/floci-io/floci/issues/2314)) ([bfda938](floci-io@bfda938)), closes [#1886](https://github.com/floci-io/floci/issues/1886)
* **guardduty:** add GuardDuty detector and organization configuration emulation ([#2346](https://github.com/floci-io/floci/issues/2346)) ([6779aa8](floci-io@6779aa8))
* **iam:** add GetAccountSummary support ([#1986](https://github.com/floci-io/floci/issues/1986)) ([c21337c](floci-io@c21337c))
* **iam:** add service-linked role create, delete and deletion status ([#2179](https://github.com/floci-io/floci/issues/2179)) ([c8403ac](floci-io@c8403ac)), closes [#2122](https://github.com/floci-io/floci/issues/2122)
* **iam:** support account aliases ([#2103](https://github.com/floci-io/floci/issues/2103)) ([1215429](floci-io@1215429)), closes [#2101](https://github.com/floci-io/floci/issues/2101)
* **iam:** support OIDC identity providers ([#2106](https://github.com/floci-io/floci/issues/2106)) ([f17dd1e](floci-io@f17dd1e)), closes [#2102](https://github.com/floci-io/floci/issues/2102)
* **kinesis:** add local inspection endpoints for UI ([#1880](https://github.com/floci-io/floci/issues/1880)) ([486be8f](floci-io@486be8f))
* **kinesisanalytics:** add Managed Service for Apache Flink (Kinesis Analytics V2) ([#1914](https://github.com/floci-io/floci/issues/1914)) ([d78520d](floci-io@d78520d))
* **kms:** implement UpdateAlias ([#2324](https://github.com/floci-io/floci/issues/2324)) ([984886f](floci-io@984886f))
* **lambdamicrovms:** AWS Lambda MicroVMs service module and its CloudFormation types ([#2079](https://github.com/floci-io/floci/issues/2079)) ([40e8aad](floci-io@40e8aad))
* **lambda:** support EFS file system configs ([#2053](https://github.com/floci-io/floci/issues/2053)) ([e1f389f](floci-io@e1f389f))
* **logs:** support log group deletion protection ([#2256](https://github.com/floci-io/floci/issues/2256)) ([4215006](floci-io@4215006))
* **msk:** add configuration CRUD (Create/List/Describe/Delete) ([#2336](https://github.com/floci-io/floci/issues/2336)) ([4c510e5](floci-io@4c510e5))
* **opensearch:** parse, store, and return AccessPolicies ([#2327](https://github.com/floci-io/floci/issues/2327)) ([78ad357](floci-io@78ad357))
* **rds-data:** adding data-api preparedstatement() support ([#1887](https://github.com/floci-io/floci/issues/1887)) ([19a32ab](floci-io@19a32ab))
* **rds:** model DB proxies and their target groups ([#1813](https://github.com/floci-io/floci/issues/1813)) ([e4010ec](floci-io@e4010ec))
* **s3:** resolve index documents for static-website directory requests ([#1815](https://github.com/floci-io/floci/issues/1815)) ([6d829ff](floci-io@6d829ff))
* **s3tables:** emulate metadata service ([#2322](https://github.com/floci-io/floci/issues/2322)) ([b45de1b](floci-io@b45de1b))
* **ses:** add DKIM actions with domain-inherited email DKIM ([#1904](https://github.com/floci-io/floci/issues/1904)) ([ff0201a](floci-io@ff0201a))
* **ses:** honor ConfigurationSetName on CreateEmailIdentity (v2) ([#1812](https://github.com/floci-io/floci/issues/1812)) ([cd3588b](floci-io@cd3588b))
* **ses:** implement custom verification email templates for v1 and v2 ([floci-io#1840](floci-io#1840)) ([aed50cc](floci-io@aed50cc))
* **ses:** implement PutAccountVdmAttributes and return VdmAttributes from GetAccount (v2) ([#2265](https://github.com/floci-io/floci/issues/2265)) ([80d1dc7](floci-io@80d1dc7))
* **ses:** implement SendCustomVerificationEmail for v1 and v2 ([#2191](https://github.com/floci-io/floci/issues/2191)) ([bd01c1a](floci-io@bd01c1a))
* **ses:** implement SendEmail ListManagementOptions suppression and unsubscribe (v2) ([floci-io#1875](floci-io#1875)) ([fa9ed91](floci-io@fa9ed91))
* **ses:** implement v1 receipt rule set actions (stored-but-inert) ([#2128](https://github.com/floci-io/floci/issues/2128)) ([ff8d6ef](floci-io@ff8d6ef))
* **stepfunctions:** add UpdateStateMachine and update in place on stack updates ([#1867](https://github.com/floci-io/floci/issues/1867)) ([97ac3ca](floci-io@97ac3ca))
* **stepfunctions:** emulate distributed Map ResultWriter (S3 export + manifest) ([floci-io#1823](floci-io#1823)) ([59cb643](floci-io@59cb643)), closes [floci-io#1820](floci-io#1820)
* **stepfunctions:** run Map iterations concurrently honoring MaxConcurrency ([floci-io#1810](floci-io#1810)) ([a7da1b9](floci-io@a7da1b9))
* **swf:** add Simple Workflow Service emulation ([#2257](https://github.com/floci-io/floci/issues/2257)) ([ecad6ac](floci-io@ecad6ac)), closes [com.amazonaws.swf.base.model#Fault](https://github.com/com.amazonaws.swf.base.model/issues/Fault)

### Performance Improvements

* **lambda:** reuse a populated code volume across restarts via a completion marker ([floci-io#1827](floci-io#1827)) ([5d61e95](floci-io@5d61e95))
@matheusandre1 matheusandre1 mentioned this pull request Sep 8, 2026
Merged
4 of 7 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pgermosen pgermosen pgermosen approved these changes

Assignees

No one assigned

Labels

bug Something isn't working lambda AWS Lambda released sfn AWS Step Functions

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[BUG] SFN Lambda task result missing Payload / StatusCode wrapper

3 participants

@soreavis @hectorvent @pgermosen