chore(aws-models): weekly refresh from aws/api-models-aws - #2514
Merged
Merged
Conversation
…added The refresh drifted 75 operation checksums across bedrock, ec2, ecs, kinesis, lambda, ses, and transfer, and added 14 brand-new operations to already implemented services. Fix the drift and implement every new operation for real. Kinesis delivery channels (CreateChannel, DescribeChannel, ListChannels, UpdateChannel, DeleteChannel): channels fan records from one or more source streams into an S3 bucket or into Iceberg tables on S3 Tables. Destination, freshness, encryption, logging, and tags are validated against the model, persisted, and round-tripped; the ARN carries the channel id the way AWS's own model examples show; a stream cannot be deleted while a channel draws from it. SES v2 identity certificates (AssociateEmailIdentityCertificate, DisassociateEmailIdentityCertificate, ListEmailIdentityCertificates) plus UpdateConfigurationSet: an ACM certificate ARN is associated with a verified identity (per from-address for domain identities), stored with its provisioning status, listed back with pagination, and dropped with the identity. AWS Support attachment uploads (GetAttachmentUploadLinks, CompleteAttachmentUpload, DescribeAttachmentUploadStatus, GetAttachmentDownloadLink) with the presigned data plane behind them: the links point back at the server and really transfer bytes, parts are ETag-checked before they are concatenated, and uploadIds attach to cases. The vendored support and transcribe model copies are re-synced with aws-models. EC2 ValidateSecurityGroupQuotasForInterface: resolves every referenced group out of state and answers from the real rule counts against the per-interface and per-group quotas. Docs, the operations index, and every evergreen count surface move with the implementation: 7,491 -> 7,505 operations (EC2 802, SES 116, Kinesis 44, Support 20).
vieiralucas
force-pushed
the
chore/refresh-aws-models
branch
from
September 13, 2026 17:23
fece601 to
1f15147
Compare
Support attachment uploads: - the presigned part PUT took axum's `Bytes` extractor, so its 2 MB default body limit rejected every part the multipart flow exists for; buffer the body with the same 1 GiB cap the dispatcher uses - `nextIndex` reported the next un-uploaded part instead of the next part to request links for, so a client following the documented paging contract looped forever; it is now the exclusive end of the range just issued, null once the last part has been handed out - re-issuing links rotated a part's signature (invalidating a URL the caller was still using) and renewed the upload's own deadline indefinitely; a live link is now returned as-is and the upload deadline never moves - `uploadRange.endIndex` is exclusive per the model, and a call returns at most ten links; a wider range is rejected - `CompleteAttachmentUpload` demanded every part in one call; the model allows one part per call, so completion is recorded per part and the attachment is assembled once every part is in - part sizes are enforced against `partSizeBytes` / `fileSizeBytes` instead of accepting a 4-byte stand-in for a 20 MB file - the assembled attachment no longer keeps a second copy of every part's bytes in memory and in every snapshot - expired download grants are pruned when a new one is minted rather than accumulating as live credentials until restart - `Content-Disposition` escapes the caller-supplied file name, so a name with a quote can no longer inject a second filename parameter and one with CR/LF no longer 500s Kinesis channels: - channel tags were write-only: the model's `ResourceARN` covers channel ARNs, so TagResource / UntagResource / ListTagsForResource now resolve them - `GSRSchemaARN` and `ServiceExecutionRoleARN` were validated at 2048; both are 512 in the model, and `ResourceARN` was not length-checked at all - `ListChannels` stream filters and the DeleteStream in-use guard compared raw ARNs while creation resolves them region-tolerantly, so a client in another region filtered to nothing and could delete a stream with a channel attached EC2 `Validate*` is read-only, so it no longer triggers a snapshot write.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated weekly refresh of
aws-models/from aws/api-models-aws. Generated by.github/workflows/refresh-aws-models.yml. Review the diff before merging — Smithy upstream changes may surface new conformance failures (new ops, renamed errors, etc.).Summary by cubic
Refreshes
aws-models/and implements the 14 new operations the refresh added, so they now return real responses instead of being unsupported.What changed
CreateChannel,DescribeChannel,ListChannels,UpdateChannel,DeleteChannel) fan records into S3 or Iceberg and block stream deletion while a channel draws from the stream.UpdateConfigurationSet; Support adds presigned attachment upload/download with links that point back at fakecloud and really transfer bytes.ValidateSecurityGroupQuotasForInterfacereports real rule counts against the per-interface and per-group quotas and is read-only, so it no longer triggers a snapshot write.Review fixes
nextIndex, keep issued links valid, accept per-part completion, enforce part sizes, and escape file names.ResourceARN, ARN length validation matches the model, and stream filters and the delete guard are region-tolerant.kinesis.jsonandsupport.jsondiffs deserve a shape-change look.resourcesis deprecated; MWAA constraints now allow empty values.Written for commit 36f4a1e. Summary will update on new commits.