211e2b8cfc
feat(iam): accept Null and IfExists condition operators at the write path ( #1145 )
2026-10-01 11:28:44 +10:00
74243730fa
fix(iam): resolve policy and instance-profile ARNs against the stored ARN ( #1144 )
2026-10-01 11:13:30 +10:00
2230e92ec2
feat(iam): accept negated, case-insensitive and NotIpAddress condition operators ( #1143 )
2026-10-01 10:49:51 +10:00
c7513c0394
fix: flaky test
2026-10-01 10:18:04 +10:00
c782585352
feat(iam): accept NotAction and NotResource on identity policies ( #1142 )
2026-10-01 10:09:39 +10:00
c98715f7a3
feat: supply iam:PassedToService on PassRole checks ( #1141 )
2026-10-01 09:24:46 +10:00
14ba518186
feat: source=exoscale external pool allocating Elastic IPs through the exo CLI ( #1140 )
...
* docs: add work-in-progress Exoscale integration guide with stack diagrams
* feat: source=exoscale external pool allocating Elastic IPs through the exo CLI
* docs: rewrite the Exoscale guide as a short end-user install, and test the exo fake, store and wiring
2026-09-30 15:08:26 -05:00
36d5788923
fix: require iam:PassRole for EKS cluster and node roles ( #1139 )
2026-09-30 16:22:16 +10:00
dc636cac63
fix: cut fixed waits from viperblockd and cmd tests
2026-09-30 15:42:48 +10:00
8a1045b4e7
fix: ack vpc.delete-nat in tests so teardown doesn't wait out the 15 s request timeout
2026-09-30 15:37:40 +10:00
51d855aa80
refactor: remove spx service stop/status and narrow service.Service to Start ( #1138 )
2026-09-30 15:18:49 +10:00
a06eccfdab
test: fuzz awsec2query parser and add make fuzz
...
Fuzz QueryParamsToStruct over query bodies decoded into EC2, ELBv2 and RDS
inputs: no panic, list entries bounded by MaxSliceLen and the input size, and
an entry past the first gap never changes the parse. make fuzz runs every
Fuzz* target for FUZZTIME each.
2026-09-30 14:35:48 +10:00
520b2d1689
fix: refuse request bodies the authz gate and handler would read differently
...
bodyscope lower-cased names with strings.ToLower and decoded into a map, while
handlers decode with encoding/json. A non-ASCII name that encoding/json folds
onto an ASCII field (repoſitoryName), or a repeated name whose later value is
null or an object, let the gate authorize one resource while the handler acted
on another. Parse now decodes with encoding/json/v2, which refuses repeated
names, and refuses non-ASCII names; both yield ErrAmbiguousBody.
FuzzGateMatchesHandler checks, for every identifier the ECR, ECS, EKS, ACM and
Bedrock resolvers read, that the gate and a handler-shaped decode agree.
2026-09-30 14:17:46 +10:00
7bbf78df78
chore: cleanup preflight
2026-09-30 13:52:47 +10:00
2b4ddad78a
chore: drop dead and redundant nolint directives
...
Removes directives for linters that are not enabled (noctx, exhaustive,
deadcode) and gosec suppressions already covered by config exclusions.
Tags ochrevector QueryResult and Filter with their existing field names
so musttag passes without changing the NATS wire format, and bounds the
RDS window slot conversion instead of suppressing G115.
2026-09-30 13:46:11 +10:00
39fdd132ee
fix: verify cluster CA on peer and predastore readiness probes
...
Peer /health and predastore readiness probes skipped TLS verification.
Both now trust the cluster CA (nats.cacert) that issues every node's server
cert. A node without the CA stops peer probing, leaving peers reachable,
and reports predastore not ready.
2026-09-30 13:43:22 +10:00
524a7a519f
chore: centralise arn splitting
2026-09-30 12:30:25 +10:00
a3ea962d1e
chore: shared e2e ssh harness
2026-09-30 12:21:57 +10:00
5f21fd27e3
chore: inline more
2026-09-30 12:01:21 +10:00
1344a8e3ca
chore: inline function wrappers
2026-09-30 11:55:40 +10:00
810aa019bf
chore: use strings.Cut
2026-09-30 11:48:27 +10:00
610ee9bab0
chore: use slices.Sorted
2026-09-30 11:44:17 +10:00
04c000e7b9
chore: use slices.ContainsFunc instead of manual loops
2026-09-30 11:37:43 +10:00
f4fe9cecb7
fix: match AWS's CreateRoute check order and messages, icmp duplicate-rule text and untagged default subnets
2026-09-30 11:24:02 +10:00
e4b7e520ca
fix: return AWS's messages for network not-found, dependency, duplicate and range errors
2026-09-30 11:15:44 +10:00
45fdbc0444
fix: apply tag:<key> filters to DescribeTags rows
2026-09-30 11:05:44 +10:00
5b2ca9373b
fix: add and drop network response fields to match AWS, as far as the SDK's shapes allow
2026-09-30 10:58:45 +10:00
c4b284b8c9
fix: treat a repeated identical CreateRoute as success, as AWS does
2026-09-30 10:48:34 +10:00
363aa1c4ab
fix: match AWS's error codes and messages for bad CIDRs, missing gateways and routes, the default group name and malformed IDs
2026-09-30 10:42:33 +10:00
485b828dde
fix: reject sg- group names, aws: tag keys and multi-attribute Modify*Attribute calls as AWS does
2026-09-30 10:28:04 +10:00
62b83e10fe
fix: omit ports on all-protocol permissions in DescribeSecurityGroups and match such rules regardless of ports
2026-09-30 10:20:18 +10:00
f67a326b97
fix: clean the subnet not-found message and name the subnet ID in DeleteSubnet and DescribeSubnets
2026-09-30 10:14:58 +10:00
5f60b2c7c7
fix: return InvalidGatewayID.NotFound with AWS's message when deleting a missing egress-only gateway
2026-09-30 10:06:12 +10:00
666ea4bb4b
fix: return OwnerId from CreateInternetGateway and DescribeInternetGateways
2026-09-30 10:04:02 +10:00
b3d1198d52
test: move paging tests to the external package and mark the VPC paging test in-package
2026-09-30 10:04:02 +10:00
9a57fa77f9
feat: page and validate MaxResults and NextToken on network Describe calls
2026-09-30 09:55:12 +10:00
8ddec0921f
fix: reject inverted TCP/UDP port ranges when creating security group rules
2026-09-30 09:38:13 +10:00
ba0e96082a
fix: return SubnetArn and AWS's default subnet fields from CreateSubnet and DescribeSubnets
2026-09-30 09:29:57 +10:00
a15084afd1
fix: accept tag-key and tag-value filters on network Describe calls and DescribeTags
2026-09-30 09:26:09 +10:00
e3fe9a634e
fix: return AWS's error messages for placement group, key pair, launch template and address errors
2026-09-29 16:12:56 +10:00
69b717b790
fix: report the account's default VPC from DescribeAccountAttributes
2026-09-29 16:06:50 +10:00
6a91a8419b
fix: match AWS key pair and image response fields
2026-09-29 16:03:35 +10:00
72ee50f6f3
fix: fail DeleteLaunchTemplateVersions on the default version and report missing versions as AWS does
2026-09-29 15:47:32 +10:00
957a5eac2a
fix: apply and validate DescribeRegions and DescribeAvailabilityZones filters and names
2026-09-29 15:41:09 +10:00
c85376c5a2
fix: return not-found for named public IPs and placement group IDs that do not exist
2026-09-29 15:34:24 +10:00
143229ef6b
fix: validate DescribeInstances and DescribeInstanceTypes MaxResults as AWS does
2026-09-29 15:29:49 +10:00
95e51008af
fix: page and filter DescribeInstanceTypes and reject unknown named types as AWS does
2026-09-29 15:24:30 +10:00
2b56d4e675
fix: reject KeyFormat=ppk on CreateKeyPair rather than silently returning a PEM
2026-09-29 15:19:41 +10:00
e0f9a11987
test: move the key-pair DescribeTags test to an external test package
2026-09-29 15:19:09 +10:00
9045f133c5
fix: project key-pair creation tags into the central tag store so DescribeTags lists them
2026-09-29 15:16:05 +10:00
Julian Sommer