1.6.0

🎉 Highlights

This release adds three new services — Amazon MWAA, CloudWatch RUM, and Bedrock with real LLM proxy — brings the Lambda Extensions API, lands a substantial CloudFormation resource expansion, and ships the one-button release cut with ECR Public versioned publishing infrastructure. This is the first release in the 1.6.x series, and the version bump reflects the depth of platform additions: real LLMs via a proxy backend, real Airflow, and Lambda extensions collectively unlock service categories that previously required real AWS accounts.

🆕 Amazon MWAA backed by real Airflow

Amazon MWAA (Managed Workflows for Apache Airflow) emulation lands (#2086), backed by a real Airflow LocalExecutor. Data engineering workflows that depend on Airflow DAG scheduling can now be exercised locally without provisioning real MWAA environments. Continues the real-Docker-backed pattern (Postgres, Redis, k3s, RabbitMQ, Redpanda, Valkey).

🆕 CloudWatch RUM

CloudWatch RUM app-monitor service (#1797) enables local testing of real-user monitoring workflows. Front-end observability instrumentation and app monitor configurations can now be exercised without sending data to real CloudWatch.

🤖 Bedrock: proxy backend for real LLM responses

Bedrock gains a proxy backend for real LLM responses via an OpenAI-compatible API (#1789). This is a meaningful capability: Bedrock-backed applications can now be tested with real LLM inference by routing through any OpenAI-compatible endpoint (OpenAI, local models via Ollama/LM Studio, or other compatible providers), rather than mocked responses. Combined with the Bedrock managed policies added in this release (#2034), the Bedrock story is much more complete for AI/ML workloads.

🧩 Lambda Extensions API

The Lambda Extensions API (#1773) is now implemented. Applications using Lambda layers that ship as extensions — observability, secrets management, auth — can now be tested locally end to end. Combined with /etc/hosts support for launched containers (#2073), Lambda's environment story is meaningfully more realistic.

🧱 CloudFormation resource expansion

Six new CloudFormation resource types plus one intrinsic improvement:

• AWS::EC2::LaunchTemplate (#1973)
• AWS::EC2::VPCGatewayAttachment (#1972)
• AWS::SecretsManager::SecretTargetAttachment (#1804)
• AWS::Events::EventBus and EventBusPolicy (#1794)
• AWS::ApiGatewayV2::Authorizer with Route.AuthorizerId wiring (#1760)
• AWS::IAM::ManagedPolicy exposes PolicyArn for Fn::GetAtt (#2056)
• Fn::GetAtt [Vpc, DefaultSecurityGroup] resolves (#1977)
• Delete-of-already-removed DynamoDB tables and Lambda functions is idempotent (#1803)
• Uniqueness suffix preserved when truncating generated resource names (#1802)
• Subnet public IP setting preserved on updates (#2031)

Real IaC that provisions launch templates, event buses, and complex API Gateway v2 setups now deploys correctly.

🔐 IAM: managed policies expansion

Three coordinated IAM improvements:

• AWSCloudFormationReadOnlyAccess managed policy seeded (#2057)
• Amazon Bedrock managed policies seeded (#2034)
• CDK bootstrap managed policies seeded, and CDK scenario stacks attach correctly (#2064)
• ListEntitiesForPolicy implemented (#1808)

The CDK bootstrap coverage is particularly meaningful — CDK-based IaC workflows depend on specific bootstrap policies existing, and this closes a repeated pain point.

🚀 Release infrastructure

One-button release cut from main with ECR Public versioned publishing (#2127) is now in place. Releases are more consistent, image tags on ECR Public are properly versioned, and cutting a release requires fewer manual steps.

🎯 API Gateway: floci:override-id

floci:override-id support for both v1 and v2 API Gateway (#2045). Tests that depend on stable, predictable API IDs (rather than randomly generated ones) can now specify their own. Closes a long-open feature request.

🌐 EC2 / SQS / Cognito

• EC2 volume attach and detach support (#1787)
• SQS: MessageGroupId retained on standard queue messages (#1891)
• Cognito: ResendConfirmationCode implemented (#2071), unconfirmed users rejected in SRP auth (#2027)
• KMS: ListKeyPolicies implemented (#2046)

✨ New Features

New services

• feat(mwaa): add Amazon MWAA emulation backed by real Airflow (LocalExecutor) (#2086)
• feat(rum): add CloudWatch RUM app-monitor service (#1797)

Bedrock / Lambda

• feat(bedrock): add proxy backend for real LLM responses via OpenAI-compatible API (#1789)
• feat(lambda): implement the Lambda Extensions API (#1773)
• feat(lambda): support extra /etc/hosts entries on Lambda launch (#2073)

CloudFormation

• feat(cloudformation): provision AWS::EC2::LaunchTemplate (#1973)
• feat(cloudformation): provision AWS::EC2::VPCGatewayAttachment (#1972)
• feat(cloudformation): provision AWS::SecretsManager::SecretTargetAttachment (#1804)
• feat(cloudformation): support AWS::Events::EventBus and EventBusPolicy (#1794)

IAM

• feat(iam): add AWSCloudFormationReadOnlyAccess managed policy (#2057)
• feat(iam): seed Amazon Bedrock managed policies (#2034)
• feat(iam): seed CDK bootstrap managed policies and attach on scenario stacks (#2064)
• feat(iam): list entities attached to managed policies (#1808)

API Gateway / EC2 / KMS / Cognito / SQS / Cloud Control

• feat(apigateway): support floci:override-id for v1 and v2 (#2045)
• feat(ec2): volume attach and detach support (#1787)
• feat(ec2): return an empty set for DescribeVpnGateways (#1975)
• feat(kms): implement ListKeyPolicies (#2046)
• feat(cognito): implement ResendConfirmationCode (#2071)
• feat(sqs): retain MessageGroupId on standard queue messages (#1891)
• feat(cloudcontrol): include EC2 resource tags (#1933)

Release infrastructure

• feat(release): one-button release cut from main and ECR Public versioned publishing (#2127)

🐛 Bug Fixes

CloudFormation

• fix(cloudformation): AWS::IAM::ManagedPolicy exposes PolicyArn for Fn::GetAtt (#2056)
• fix(cloudformation): keep uniqueness suffix when truncating generated resource names (#1802)
• fix(cloudformation): preserve subnet public IP setting (#2031)
• fix(cloudformation): provision AWS::ApiGatewayV2::Authorizer and wire Route.AuthorizerId (#1760)
• fix(cloudformation): resolve Fn::GetAtt [Vpc, DefaultSecurityGroup] (#1977)
• fix(cloudformation): idempotent delete of DynamoDB tables and Lambda functions (#1803)

API Gateway

• fix(apigateway): fall through to less specific resources on method miss (#1630)
• fix(apigateway): import authorizers and security requirements from OpenAPI (#1798)
• fix(apigateway): use last duplicate header value (#1806)

S3

• fix(s3): accept a percent-encoded bucket/key separator in copy sources (#2060)
• fix(s3): apply CreateBucketConfiguration tags on bucket creation (#2115)
• fix(s3): include EventBridgeConfiguration in GetBucketNotification response (#2072)
• fix(s3): recognize virtual-hosted-style requests over HTTP/2 (#1954)

Lambda

• fix(lambda): carry the owning account into published version snapshots (#2041)
• fix(lambda): report resolved executed version (#2026)
• fix(lambda): reset volatile DynamoDB Streams ESM checkpoints on restart (#2077)

DynamoDB / EC2 / ECS / Athena

• fix(dynamodb): resolve nested document paths in ADD and DELETE update actions (#1908)
• fix(ec2): DescribeKeyPairs returns InvalidKeyPair.NotFound for missing names/ids (#1932)
• fix(ec2): return MissingParameter for CreateSubnet without VpcId (#2094)
• fix(ecs): resolve Secrets Manager JSON-key selectors in task definition secrets (#2133)
• fix(athena): report the result CSV object key as OutputLocation (#1895)

CodeBuild / Cognito / SSM / TLS / Pipes / Docker

• fix(codebuild): stabilize start and retry responses (#2052)
• fix(cognito): reject unconfirmed users in SRP auth (#2027)
• fix(ssm): report invalid batch parameter names (#2075)
• fix(tls): reuse the persisted self-signed certificate across restarts (#1799)
• fix(pipes): register kafka-clients reflection metadata for native image (#2068)
• fix(dockerfile): ensure docker-java compatibility (#2096)

Alarms

• fix: better populate describe alarm responses (#1792)

🚀 Performance

• perf(docker): stop duplicating the native binary into a second image layer (#2069)

Full Changelog: 1.5.34...1.6.0