v2.9.7

🧰 Included Tools

Update AWS CLI packages @renovate (#932)

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
awscli (source, changelog)	==1.32.79 -> ==1.32.93
boto3	==1.34.79 -> ==1.34.93

---

Release Notes

aws/aws-cli (awscli)

v1.32.93

Compare Source

=======

• api-change:codepipeline: Add ability to manually and automatically roll back a pipeline stage to a previously successful execution.
• api-change:cognito-idp: Add LimitExceededException to SignUp errors
• api-change:connectcampaigns: This release adds support for specifying if Answering Machine should wait for prompt sound.
• api-change:marketplace-entitlement: Releasing minor endpoint updates.
• api-change:oam: This release introduces support for Source Accounts to define which Metrics and Logs to share with the Monitoring Account
• api-change:rds: SupportsLimitlessDatabase field added to describe-db-engine-versions to indicate whether the DB engine version supports Aurora Limitless Database.
• api-change:support: Releasing minor endpoint updates.
• enhancement:dependency: Bump upper bound of colorama to <0.4.7; fixes #&#8203;7086 <https://github.com/aws/aws-cli/issues/7086>__

v1.32.92

Compare Source

=======

• api-change:appsync: UpdateGraphQLAPI documentation update and datasource introspection secret arn update
• api-change:fms: AWS Firewall Manager adds support for network ACL policies to manage Amazon Virtual Private Cloud (VPC) network access control lists (ACLs) for accounts in your organization.
• api-change:ivs: Bug Fix: IVS does not support arns with the svs prefix
• api-change:ivs-realtime: Bug Fix: IVS Real Time does not support ARNs using the svs prefix.
• api-change:rds: Updates Amazon RDS documentation for setting local time zones for RDS for Db2 DB instances.
• api-change:stepfunctions: Add new ValidateStateMachineDefinition operation, which performs syntax checking on the definition of a Amazon States Language (ASL) state machine.

v1.32.91

Compare Source

=======

• api-change:datasync: This change allows users to disable and enable the schedules associated with their tasks.
• api-change:ec2: Launching capability for customers to enable or disable automatic assignment of public IPv4 addresses to their network interface
• api-change:emr-containers: EMRonEKS Service support for SecurityConfiguration enforcement for Spark Jobs.
• api-change:entityresolution: Support Batch Unique IDs Deletion.
• api-change:gamelift: Amazon GameLift releases container fleets support for public preview. Deploy Linux-based containerized game server software for hosting on Amazon GameLift.
• api-change:ssm: Add SSM DescribeInstanceProperties API to public AWS SDK.

v1.32.90

Compare Source

=======

• api-change:bedrock: This release introduces Model Evaluation and Guardrails for Amazon Bedrock.
• api-change:bedrock-agent: Introducing the ability to create multiple data sources per knowledge base, specify S3 buckets as data sources from external accounts, and exposing levers to define the deletion behavior of the underlying vector store data.
• api-change:bedrock-agent-runtime: This release introduces zero-setup file upload support for the RetrieveAndGenerate API. This allows you to chat with your data without setting up a Knowledge Base.
• api-change:bedrock-runtime: This release introduces Guardrails for Amazon Bedrock.
• api-change:ce: Added additional metadata that might be applicable to your reservation recommendations.
• api-change:ec2: This release introduces EC2 AMI Deregistration Protection, a new AMI property that can be enabled by customers to protect an AMI against an unintended deregistration. This release also enables the AMI owners to view the AMI 'LastLaunchedTime' in DescribeImages API.
• api-change:pi: Clarifies how aggregation works for GetResourceMetrics in the Performance Insights API.
• api-change:rds: Fix the example ARN for ModifyActivityStreamRequest
• api-change:workspaces-web: Added InstanceType and MaxConcurrentSessions parameters on CreatePortal and UpdatePortal Operations as well as the ability to read Customer Managed Key & Additional Encryption Context parameters on supported resources (Portal, BrowserSettings, UserSettings, IPAccessSettings)

v1.32.89

Compare Source

=======

• api-change:bedrock-agent: Releasing the support for simplified configuration and return of control
• api-change:bedrock-agent-runtime: Releasing the support for simplified configuration and return of control
• api-change:payment-cryptography: Adding support to TR-31/TR-34 exports for optional headers, allowing customers to add additional metadata (such as key version and KSN) when exporting keys from the service.
• api-change:redshift-serverless: Updates description of schedule field for scheduled actions.
• api-change:route53profiles: Route 53 Profiles allows you to apply a central DNS configuration across many VPCs regardless of account.
• api-change:sagemaker: This release adds support for Real-Time Collaboration and Shared Space for JupyterLab App on SageMaker Studio.
• api-change:servicediscovery: This release adds examples to several Cloud Map actions.
• api-change:transfer: Adding new API to support remote directory listing using SFTP connector

v1.32.88

Compare Source

=======

• api-change:glue: Adding RowFilter in the response for GetUnfilteredTableMetadata API
• api-change:internetmonitor: This update introduces the GetInternetEvent and ListInternetEvents APIs, which provide access to internet events displayed on the Amazon CloudWatch Internet Weather Map.
• api-change:personalize: This releases auto training capability while creating a solution and automatically syncing latest solution versions when creating/updating a campaign

v1.32.87

Compare Source

=======

• api-change:drs: Outpost ARN added to Source Server and Recovery Instance
• api-change:emr-serverless: This release adds the capability to publish detailed Spark engine metrics to Amazon Managed Service for Prometheus (AMP) for enhanced monitoring for Spark jobs.
• api-change:guardduty: Added IPv6Address fields for local and remote IP addresses
• api-change:quicksight: This release adds support for the Cross Sheet Filter and Control features, and support for warnings in asset imports for any permitted errors encountered during execution
• api-change:rolesanywhere: This release introduces the PutAttributeMapping and DeleteAttributeMapping APIs. IAM Roles Anywhere now provides the capability to define a set of mapping rules, allowing customers to specify which data is extracted from their X.509 end-entity certificates.
• api-change:sagemaker: Removed deprecated enum values and updated API documentation.
• api-change:workspaces: Adds new APIs for managing and sharing WorkSpaces BYOL configuration across accounts.

v1.32.86

Compare Source

=======

• api-change:ec2: Documentation updates for Elastic Compute Cloud (EC2).
• api-change:qbusiness: This release adds support for IAM Identity Center (IDC) as the identity gateway for Q Business. It also allows users to provide an explicit intent for Q Business to identify ...

v2.9.6

🧰 Included Tools

Update AWS CLI packages @renovate (#931)

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
awscli (source, changelog)	==1.32.69 -> ==1.32.79
boto3	==1.34.69 -> ==1.34.79

---

Release Notes

aws/aws-cli (awscli)

v1.32.79

Compare Source

=======

• api-change:quicksight: Adding IAMIdentityCenterInstanceArn parameter to CreateAccountSubscription
• api-change:resource-groups: Added a new QueryErrorCode RESOURCE_TYPE_NOT_SUPPORTED that is returned by the ListGroupResources operation if the group query contains unsupported resource types.
• api-change:verifiedpermissions: Adding BatchIsAuthorizedWithToken API which supports multiple authorization requests against a PolicyStore given a bearer token.

v1.32.78

Compare Source

=======

• api-change:b2bi: Adding support for X12 5010 HIPAA EDI version and associated transaction sets.
• api-change:cleanrooms: Feature: New schemaStatusDetails field to the existing Schema object that displays a status on Schema API responses to show whether a schema is queryable or not. New BatchGetSchemaAnalysisRule API to retrieve multiple schemaAnalysisRules using a single API call.
• api-change:ec2: Amazon EC2 G6 instances powered by NVIDIA L4 Tensor Core GPUs can be used for a wide range of graphics-intensive and machine learning use cases. Gr6 instances also feature NVIDIA L4 GPUs and can be used for graphics workloads with higher memory requirements.
• api-change:emr-containers: This release adds support for integration with EKS AccessEntry APIs to enable automatic Cluster Access for EMR on EKS.
• api-change:ivs: API update to include an SRT ingest endpoint and passphrase for all channels.
• api-change:verifiedpermissions: Adds GroupConfiguration field to Identity Source API's

v1.32.77

Compare Source

=======

• api-change:cleanroomsml: The release includes a public SDK for AWS Clean Rooms ML APIs, making them globally available to developers worldwide.
• api-change:cloudformation: This release would return a new field - PolicyAction in cloudformation's existed DescribeChangeSetResponse, showing actions we are going to apply on the physical resource (e.g., Delete, Retain) according to the user's template
• api-change:datazone: This release supports the feature of dataQuality to enrich asset with dataQualityResult in Amazon DataZone.
• api-change:docdb: This release adds Global Cluster Switchover capability which enables you to change your global cluster's primary AWS Region, the region that serves writes, while preserving the replication between all regions in the global cluster.
• api-change:groundstation: This release adds visibilityStartTime and visibilityEndTime to DescribeContact and ListContacts responses.
• api-change:lambda: Add Ruby 3.3 (ruby3.3) support to AWS Lambda
• api-change:medialive: Cmaf Ingest outputs are now supported in Media Live
• api-change:medical-imaging: SearchImageSets API now supports following enhancements - Additional support for searching on UpdatedAt and SeriesInstanceUID - Support for searching existing filters between dates/times - Support for sorting the search result by Ascending/Descending - Additional parameters returned in the response
• api-change:transfer: Add ability to specify Security Policies for SFTP Connectors

v1.32.76

Compare Source

=======

• api-change:ecs: Documentation only update for Amazon ECS.
• api-change:glue: Adding View related fields to responses of read-only Table APIs.
• api-change:ivschat: Doc-only update. Changed "Resources" to "Key Concepts" in docs and updated text.
• api-change:rolesanywhere: This release increases the limit on the roleArns request parameter for the *Profile APIs that support it. This parameter can now take up to 250 role ARNs.
• api-change:securityhub: Documentation updates for AWS Security Hub

v1.32.75

Compare Source

=======

• api-change:cloudwatch: This release adds support for CloudWatch Anomaly Detection on cross-account metrics. SingleMetricAnomalyDetector and MetricDataQuery inputs to Anomaly Detection APIs now take an optional AccountId field.
• api-change:datazone: This release supports the feature of AI recommendations for descriptions to enrich the business data catalog in Amazon DataZone.
• api-change:deadline: AWS Deadline Cloud is a new fully managed service that helps customers set up, deploy, and scale rendering projects in minutes, so they can improve the efficiency of their rendering pipelines and take on more projects.
• api-change:emr: This release fixes a broken link in the documentation.
• api-change:lightsail: This release adds support to upgrade the TLS version of the distribution.

v1.32.74

Compare Source

=======

• api-change:b2bi: Supporting new EDI X12 transaction sets for X12 versions 4010, 4030, and 5010.
• api-change:codebuild: Add new fleet status code for Reserved Capacity.
• api-change:codeconnections: Duplicating the CodeStar Connections service into the new, rebranded AWS CodeConnections service.
• api-change:internetmonitor: This release adds support to allow customers to track cross account monitors through ListMonitor, GetMonitor, ListHealthEvents, GetHealthEvent, StartQuery APIs.
• api-change:iotwireless: Add support for retrieving key historical and live metrics for LoRaWAN devices and gateways
• api-change:marketplace-catalog: This release enhances the ListEntities API to support ResaleAuthorizationId filter and sort for OfferEntity in the request and the addition of a ResaleAuthorizationId field in the response of OfferSummary.
• api-change:neptune-graph: Add the new API Start-Import-Task for Amazon Neptune Analytics.
• api-change:sagemaker: This release adds support for custom images for the CodeEditor App on SageMaker Studio
• enhancement:s3: Add parameter to validate source and destination S3 URIs to the mv command.

v1.32.73

Compare Source

=======

• api-change:codecatalyst: This release adds support for understanding pending changes to subscriptions by including two new response parameters for the GetSubscription API for Amazon CodeCatalyst.
• api-change:compute-optimizer: This release enables AWS Compute Optimizer to analyze and generate recommendations with a new customization preference, Memory Utilization.
• api-change:ec2: Amazon EC2 C7gd, M7gd and R7gd metal instances with up to 3.8 TB of local NVMe-based SSD block-level storage have up to 45% improved real-time NVMe storage performance than comparable Graviton2-based instances.
• api-change:eks: Add multiple customer error code to handle customer caused failure when managing EKS node groups
• api-change:guardduty: Add EC2 support for GuardDuty Runtime Monitoring auto management.
• api-change:neptune-graph: Update ImportTaskCancelled waiter to evaluate task state correctly and minor documentation changes.
• api-change:oam: This release adds support for sharing AWS::InternetMonitor::Monitor resources.
• api-change:quicksight: Amazon QuickSight: Adds support for setting up VPC Endpoint restrictions for accessing QuickSight Website.

v1.32.72

Compare Source

=======

• api-change:batch: This feature allows AWS Batch to supp...

v2.9.5

🧰 Included Tools

Update AWS CLI packages @renovate (#930)

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
awscli (source, changelog)	==1.32.54 -> ==1.32.69
boto3	==1.34.54 -> ==1.34.69

---

Release Notes

aws/aws-cli (awscli)

v1.32.69

Compare Source

=======

• api-change:firehose: Updates Amazon Firehose documentation for message regarding Enforcing Tags IAM Policy.
• api-change:kendra: Documentation update, March 2024. Corrects some docs for Amazon Kendra.
• api-change:pricing: Add ResourceNotFoundException to ListPriceLists and GetPriceListFileUrl APIs
• api-change:rolesanywhere: This release relaxes constraints on the durationSeconds request parameter for the *Profile APIs that support it. This parameter can now take on values that go up to 43200.
• api-change:securityhub: Added new resource detail object to ASFF, including resource for LastKnownExploitAt

v1.32.68

Compare Source

=======

• api-change:codeartifact: This release adds Package groups to CodeArtifact so you can more conveniently configure package origin controls for multiple packages.

v1.32.67

Compare Source

=======

• api-change:accessanalyzer: This release adds support for policy validation and external access findings for DynamoDB tables and streams. IAM Access Analyzer helps you author functional and secure resource-based policies and identify cross-account access. Updated service API, documentation, and paginators.
• api-change:codebuild: This release adds support for new webhook events (RELEASED and PRERELEASED) and filter types (TAG_NAME and RELEASE_NAME).
• api-change:connect: This release updates the *InstanceStorageConfig APIs to support a new ResourceType: REAL_TIME_CONTACT_ANALYSIS_CHAT_SEGMENTS. Use this resource type to enable streaming for real-time analysis of chat contacts and to associate a Kinesis stream where real-time analysis chat segments will be published.
• api-change:dynamodb: This release introduces 3 new APIs ('GetResourcePolicy', 'PutResourcePolicy' and 'DeleteResourcePolicy') and modifies the existing 'CreateTable' API for the resource-based policy support. It also modifies several APIs to accept a 'TableArn' for the 'TableName' parameter.
• api-change:managedblockchain-query: AMB Query: update GetTransaction to include transactionId as input
• api-change:savingsplans: Introducing the Savings Plans Return feature enabling customers to return their Savings Plans within 7 days of purchase.

v1.32.66

Compare Source

=======

• api-change:cloudformation: Documentation update, March 2024. Corrects some formatting.
• api-change:ec2: This release adds the new DescribeMacHosts API operation for getting information about EC2 Mac Dedicated Hosts. Users can now see the latest macOS versions that their underlying Apple Mac can support without needing to be updated.
• api-change:finspace: Adding new attributes readWrite and onDemand to dataview models for Database Maintenance operations.
• api-change:logs: Update LogSamples field in Anomaly model to be a list of LogEvent
• api-change:managedblockchain-query: Introduces a new API for Amazon Managed Blockchain Query: ListFilteredTransactionEvents.

v1.32.65

Compare Source

=======

• api-change:cloudformation: This release supports for a new API ListStackSetAutoDeploymentTargets, which provider auto-deployment configuration as a describable resource. Customers can now view the specific combinations of regions and OUs that are being auto-deployed.
• api-change:kms: Adds the ability to use the default policy name by omitting the policyName parameter in calls to PutKeyPolicy and GetKeyPolicy
• api-change:mediatailor: This release adds support to allow customers to show different content within a channel depending on metadata associated with the viewer.
• api-change:rds: This release launches the ModifyIntegration API and support for data filtering for zero-ETL Integrations.
• api-change:s3: Fix two issues with response root node names.
• api-change:timestream-query: Documentation updates, March 2024

v1.32.64

Compare Source

=======

• api-change:backup: This release introduces a boolean attribute ManagedByAWSBackupOnly as part of ListRecoveryPointsByResource api to filter the recovery points based on ownership. This attribute can be used to filter out the recovery points protected by AWSBackup.
• api-change:codebuild: AWS CodeBuild now supports overflow behavior on Reserved Capacity.
• api-change:connect: This release adds Hierarchy based Access Control fields to Security Profile public APIs and adds support for UserAttributeFilter to SearchUsers API.
• api-change:ec2: Add media accelerator and neuron device information on the describe instance types API.
• api-change:kinesisanalyticsv2: Support for Flink 1.18 in Managed Service for Apache Flink
• api-change:s3: Documentation updates for Amazon S3.
• api-change:sagemaker: Adds m6i, m6id, m7i, c6i, c6id, c7i, r6i r6id, r7i, p5 instance type support to Sagemaker Notebook Instances and miscellaneous wording fixes for previous Sagemaker documentation.
• api-change:workspaces-thin-client: Removed unused parameter kmsKeyArn from UpdateDeviceRequest

v1.32.63

Compare Source

=======

• api-change:amplify: Documentation updates for Amplify. Identifies the APIs available only to apps created using Amplify Gen 1.
• api-change:ec2-instance-connect: This release includes a new exception type "SerialConsoleSessionUnsupportedException" for SendSerialConsoleSSHPublicKey API.
• api-change:elbv2: This release allows you to configure HTTP client keep-alive duration for communication between clients and Application Load Balancers.
• api-change:fis: This release adds support for previewing target resources before running a FIS experiment. It also adds resource ARNs for actions, experiments, and experiment templates to API responses.
• api-change:rds: Updates Amazon RDS documentation for EBCDIC collation for RDS for Db2.
• api-change:secretsmanager: Doc only update for Secrets Manager
• api-change:timestream-influxdb: This is the initial SDK release for Amazon Timestream for InfluxDB. Amazon Timestream for InfluxDB is a new time-series database engine that makes it easy for application developers and DevOps teams to run InfluxDB databases on AWS for near real-time time-series applications using open source APIs.

v1.32.62

Compare Source

=======

• api-change:ivs-realtime: adds support for multiple new composition layout configuration options (grid, pip)
• api-change:kinesisanalyticsv2: Support new RuntimeEnvironmentUpdate parameter within UpdateApplication API allowing callers to change the Flink version upon which their application runs.
• api-change:s3: This release makes the default option for S3 on Outposts request signing to use the SigV4A algorithm when using AWS Common Runtime (CRT).

v1.32.61

Compare Source

=======

• api-change:cloudformation: CloudFormation documentation update for March, 2024
• api-change:connect: This release increases MaxResults limit to ...

v2.9.4

🧰 Included Tools

Add rakkess to linux/arm64 in Debian @Nuru (#929)

what

• Add rakkess to linux/arm64 Debian build

why

• Previously we excluded rakkess from the arm64 build because there was no binary available and it was not considered that useful a tool. However, with AWS now supporting a new mechanism for access control for EKS clusters, it is newly useful in verifying access control given that it access can no longer be determined by simply looking at Kubernetes resources.

references

• https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html
• https://github.com/corneliusweig/rakkess
• Some of the best documentation is in this issue comment

v2.9.3

🧰 Included Tools

Update AWS CLI packages @renovate (#928)

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
awscli (source, changelog)	==1.32.49 -> ==1.32.54
boto3	==1.34.49 -> ==1.34.54

---

Release Notes

aws/aws-cli (awscli)

v1.32.54

Compare Source

=======

• api-change:accessanalyzer: Fixed a typo in description field.
• api-change:autoscaling: With this release, Amazon EC2 Auto Scaling groups, EC2 Fleet, and Spot Fleet improve the default price protection behavior of attribute-based instance type selection of Spot Instances, to consistently select from a wide range of instance types.
• api-change:ec2: With this release, Amazon EC2 Auto Scaling groups, EC2 Fleet, and Spot Fleet improve the default price protection behavior of attribute-based instance type selection of Spot Instances, to consistently select from a wide range of instance types.

v1.32.53

Compare Source

=======

• api-change:docdb-elastic: Launched Elastic Clusters Readable Secondaries, Start/Stop, Configurable Shard Instance count, Automatic Backups and Snapshot Copying
• api-change:eks: Added support for new AL2023 AMIs to the supported AMITypes.
• api-change:lexv2-models: This release makes AMAZON.QnAIntent generally available in Amazon Lex. This generative AI feature leverages large language models available through Amazon Bedrock to automate frequently asked questions (FAQ) experience for end-users.
• api-change:migrationhuborchestrator: Adds new CreateTemplate, UpdateTemplate and DeleteTemplate APIs.
• api-change:quicksight: TooltipTarget for Combo chart visuals; ColumnConfiguration limit increase to 2000; Documentation Update
• api-change:sagemaker: Adds support for ModelDataSource in Model Packages to support unzipped models. Adds support to specify SourceUri for models which allows registration of models without mandating a container for hosting. Using SourceUri, customers can decouple the model from hosting information during registration.
• api-change:securitylake: Add capability to update the Data Lake's MetaStoreManager Role in order to perform required data lake updates to use Iceberg table format in their data lake or update the role for any other reason.

v1.32.52

Compare Source

=======

• api-change:batch: This release adds Batch support for configuration of multicontainer jobs in ECS, Fargate, and EKS. This support is available for all types of jobs, including both array jobs and multi-node parallel jobs.
• api-change:bedrock-agent-runtime: This release adds support to override search strategy performed by the Retrieve and RetrieveAndGenerate APIs for Amazon Bedrock Agents
• api-change:ce: This release introduces the new API 'GetApproximateUsageRecords', which retrieves estimated usage records for hourly granularity or resource-level data at daily granularity.
• api-change:ec2: This release increases the range of MaxResults for GetNetworkInsightsAccessScopeAnalysisFindings to 1,000.
• api-change:iot: This release reduces the maximum results returned per query invocation from 500 to 100 for the SearchIndex API. This change has no implications as long as the API is invoked until the nextToken is NULL.
• api-change:wafv2: AWS WAF now supports configurable time windows for request aggregation with rate-based rules. Customers can now select time windows of 1 minute, 2 minutes or 10 minutes, in addition to the previously supported 5 minutes.

v1.32.51

Compare Source

=======

• api-change:amplifyuibuilder: We have added the ability to tag resources after they are created

v1.32.50

Compare Source

=======

• api-change:apigateway: Documentation updates for Amazon API Gateway.
• api-change:drs: Added volume status to DescribeSourceServer replicated volumes.
• api-change:kafkaconnect: Adds support for tagging, with new TagResource, UntagResource and ListTagsForResource APIs to manage tags and updates to existing APIs to allow tag on create. This release also adds support for the new DeleteWorkerConfiguration API.
• api-change:rds: This release adds support for gp3 data volumes for Multi-AZ DB Clusters.

boto/boto3 (boto3)

v1.34.54

Compare Source

=======

• api-change:accessanalyzer: [botocore] Fixed a typo in description field.
• api-change:autoscaling: [botocore] With this release, Amazon EC2 Auto Scaling groups, EC2 Fleet, and Spot Fleet improve the default price protection behavior of attribute-based instance type selection of Spot Instances, to consistently select from a wide range of instance types.
• api-change:ec2: [botocore] With this release, Amazon EC2 Auto Scaling groups, EC2 Fleet, and Spot Fleet improve the default price protection behavior of attribute-based instance type selection of Spot Instances, to consistently select from a wide range of instance types.

v1.34.53

Compare Source

=======

• api-change:docdb-elastic: [botocore] Launched Elastic Clusters Readable Secondaries, Start/Stop, Configurable Shard Instance count, Automatic Backups and Snapshot Copying
• api-change:eks: [botocore] Added support for new AL2023 AMIs to the supported AMITypes.
• api-change:lexv2-models: [botocore] This release makes AMAZON.QnAIntent generally available in Amazon Lex. This generative AI feature leverages large language models available through Amazon Bedrock to automate frequently asked questions (FAQ) experience for end-users.
• api-change:migrationhuborchestrator: [botocore] Adds new CreateTemplate, UpdateTemplate and DeleteTemplate APIs.
• api-change:quicksight: [botocore] TooltipTarget for Combo chart visuals; ColumnConfiguration limit increase to 2000; Documentation Update
• api-change:sagemaker: [botocore] Adds support for ModelDataSource in Model Packages to support unzipped models. Adds support to specify SourceUri for models which allows registration of models without mandating a container for hosting. Using SourceUri, customers can decouple the model from hosting information during registration.
• api-change:securitylake: [botocore] Add capability to update the Data Lake's MetaStoreManager Role in order to perform required data lake updates to use Iceberg table format in their data lake or update the role for any other reason.

v1.34.52

Compare Source

=======

• api-change:batch: [botocore] This release adds Batch support for configuration of multicontainer jobs in ECS, Fargate, and EKS. This support is available for all types of jobs, including both array jobs and multi-node parallel jobs.
• api-change:bedrock-agent-runtime: [botocore] This release adds support to override search strategy performed by the Retrieve and RetrieveAndGenerate APIs for Amazon Bedrock Agents
• api-change:ce: [botocore] This release introduces the new API 'GetApproximateUsageRecords', which retrieves estimated usage records for hourly granularity or resource-level data at daily granularity.
• api-change:ec2: [botocore] This release increases the range of MaxResults for GetNetworkInsightsAccessScopeAnalysisFindings to 1,000.
• api-change:iot: [botocore] This release reduces the maximum results returned per query invocation from 500 to 100 for the SearchIn...

v2.9.2

🚀 Enhancements

Fix aws CLI auto-completions, use smaller kubectl package @Nuru (#924)

what

• Fix aws auto-completion
• Only install latest kubectl

why

• The aws CLI is provided in 2 versions, v1 and v2, and which version is in use is managed by update-alternatives. However, each version of the CLI has a corresponding version of the aws_completer utility to perform auto-completion, but until now, Geodesic always used the v1 completer (a python script), even with the v2 CLI. This mostly worked, but it is not supported or correct.
• Previously, we installed the kubectl package from packages.cloud.google.com, which is over 200 MB because it installs multiple versions of kubectl. We now install only the latest kubectl package from the Cloud Posse package repo, which is under 50 MB, to save space. Cloud Posse publishes packages for each minor version of kubectl (e.g. kubectl-1.29) so you can install the latest version compatible with your cluster if you do not want the current latest version.

references

This was brought to our attention by aws/aws-cli#8547 since upgrading to Python 3.12 in Geodesic v2.9.0.

🧰 Included Tools

Update AWS CLI packages @renovate (#925)

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
awscli (source, changelog)	==1.32.44 -> ==1.32.49
boto3	==1.34.44 -> ==1.34.49

---

Release Notes

aws/aws-cli (awscli)

v1.32.49

Compare Source

=======

• api-change:appsync: Documentation only updates for AppSync
• api-change:qldb: Clarify possible values for KmsKeyArn and EncryptionDescription.
• api-change:rds: Add pattern and length based validations for DBShardGroupIdentifier
• api-change:rum: Doc-only update for new RUM metrics that were added

v1.32.48

Compare Source

=======

• api-change:internetmonitor: This release adds IPv4 prefixes to health events
• api-change:kinesisvideo: Increasing NextToken parameter length restriction for List APIs from 512 to 1024.

v1.32.47

Compare Source

=======

• api-change:iotevents: Increase the maximum length of descriptions for Inputs, Detector Models, and Alarm Models
• api-change:lookoutequipment: This release adds a field exposing model quality to read APIs for models. It also adds a model quality field to the API response when creating an inference scheduler.
• api-change:medialive: MediaLive now supports the ability to restart pipelines in a running channel.
• api-change:ssm: This release adds support for sharing Systems Manager parameters with other AWS accounts.

v1.32.46

Compare Source

=======

• api-change:dynamodb: Publishing quick fix for doc only update.
• api-change:firehose: This release updates a few Firehose related APIs.
• api-change:lambda: Add .NET 8 (dotnet8) Runtime support to AWS Lambda.

v1.32.45

Compare Source

=======

• api-change:amplify: This release contains API changes that enable users to configure their Amplify domains with their own custom SSL/TLS certificate.
• api-change:chatbot: This release adds support for AWS Chatbot. You can now monitor, operate, and troubleshoot your AWS resources with interactive ChatOps using the AWS SDK.
• api-change:config: Documentation updates for the AWS Config CLI
• api-change:ivs: Changed description for latencyMode in Create/UpdateChannel and Channel/ChannelSummary.
• api-change:keyspaces: Documentation updates for Amazon Keyspaces
• api-change:mediatailor: MediaTailor: marking #AdBreak.OffsetMillis as required.

boto/boto3 (boto3)

v1.34.49

Compare Source

=======

• api-change:appsync: [botocore] Documentation only updates for AppSync
• api-change:qldb: [botocore] Clarify possible values for KmsKeyArn and EncryptionDescription.
• api-change:rds: [botocore] Add pattern and length based validations for DBShardGroupIdentifier
• api-change:rum: [botocore] Doc-only update for new RUM metrics that were added

v1.34.48

Compare Source

=======

• api-change:internetmonitor: [botocore] This release adds IPv4 prefixes to health events
• api-change:kinesisvideo: [botocore] Increasing NextToken parameter length restriction for List APIs from 512 to 1024.

v1.34.47

Compare Source

=======

• api-change:iotevents: [botocore] Increase the maximum length of descriptions for Inputs, Detector Models, and Alarm Models
• api-change:lookoutequipment: [botocore] This release adds a field exposing model quality to read APIs for models. It also adds a model quality field to the API response when creating an inference scheduler.
• api-change:medialive: [botocore] MediaLive now supports the ability to restart pipelines in a running channel.
• api-change:ssm: [botocore] This release adds support for sharing Systems Manager parameters with other AWS accounts.

v1.34.46

Compare Source

=======

• api-change:dynamodb: [botocore] Publishing quick fix for doc only update.
• api-change:firehose: [botocore] This release updates a few Firehose related APIs.
• api-change:lambda: [botocore] Add .NET 8 (dotnet8) Runtime support to AWS Lambda.

v1.34.45

Compare Source

=======

• api-change:amplify: [botocore] This release contains API changes that enable users to configure their Amplify domains with their own custom SSL/TLS certificate.
• api-change:chatbot: [botocore] This release adds support for AWS Chatbot. You can now monitor, operate, and troubleshoot your AWS resources with interactive ChatOps using the AWS SDK.
• api-change:config: [botocore] Documentation updates for the AWS Config CLI
• api-change:ivs: [botocore] Changed description for latencyMode in Create/UpdateChannel and Channel/ChannelSummary.
• api-change:keyspaces: [botocore] Documentation updates for Amazon Keyspaces
• api-change:mediatailor: [botocore] MediaTailor: marking #AdBreak.OffsetMillis as required.

---

Update dependency cryptography to v42.0.5 @renovate (#921)

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
cryptography (changelog)	==42.0.4 -> ==42.0.5			[](https://docs...

v2.9.1

🧰 Included Tools

Update dependency cryptography to v42.0.3 @renovate (#919)

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
cryptography (changelog)	==42.0.2 -> ==42.0.3

---

Release Notes

pyca/cryptography (cryptography)

v42.0.3

Compare Source

---

Update AWS CLI packages @renovate (#920)

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
awscli (source, changelog)	==1.32.39 -> ==1.32.44
boto3	==1.34.39 -> ==1.34.44

---

Release Notes

aws/aws-cli (awscli)

v1.32.44

Compare Source

=======

• api-change:connectparticipant: Doc only update to GetTranscript API reference guide to inform users about presence of events in the chat transcript.
• api-change:emr: adds fine grained control over Unhealthy Node Replacement to Amazon ElasticMapReduce
• api-change:firehose: This release adds support for Data Message Extraction for decompressed CloudWatch logs, and to use a custom file extension or time zone for S3 destinations.
• api-change:lambda: Documentation-only updates for Lambda to clarify a number of existing actions and properties.
• api-change:rds: Doc only update for a valid option in DB parameter group
• api-change:sns: This release marks phone numbers as sensitive inputs.

v1.32.43

Compare Source

=======

• api-change:artifact: This is the initial SDK release for AWS Artifact. AWS Artifact provides on-demand access to compliance and third-party compliance reports. This release includes access to List and Get reports, along with their metadata. This release also includes access to AWS Artifact notifications settings.
• api-change:codepipeline: Add ability to override timeout on action level.
• api-change:detective: Doc only updates for content enhancement
• api-change:guardduty: Marked fields IpAddressV4, PrivateIpAddress, Email as Sensitive.
• api-change:healthlake: This release adds a new response parameter, JobProgressReport, to the DescribeFHIRImportJob and ListFHIRImportJobs API operation. JobProgressReport provides details on the progress of the import job on the server.
• api-change:opensearch: Adds additional supported instance types.
• api-change:polly: Amazon Polly adds 1 new voice - Burcu (tr-TR)
• api-change:sagemaker: This release adds a new API UpdateClusterSoftware for SageMaker HyperPod. This API allows users to patch HyperPod clusters with latest platform softwares.
• api-change:secretsmanager: Doc only update for Secrets Manager
• api-change:endpoint-rules: Update endpoint-rules command to latest version

v1.32.42

Compare Source

=======

• api-change:controltower: Adds support for new Baseline and EnabledBaseline APIs for automating multi-account governance.
• api-change:lookoutequipment: This feature allows customers to see pointwise model diagnostics results for their models.
• api-change:qbusiness: This release adds the metadata-boosting feature, which allows customers to easily fine-tune the underlying ranking of retrieved RAG passages in order to optimize Q&A answer relevance. It also adds new feedback reasons for the PutFeedback API.

v1.32.41

Compare Source

=======

• api-change:lightsail: This release adds support to upgrade the major version of a database.
• api-change:marketplace-catalog: AWS Marketplace Catalog API now supports setting intent on requests
• api-change:resource-explorer-2: Resource Explorer now uses newly supported IPv4 'amazonaws.com' endpoints by default.
• api-change:securitylake: Documentation updates for Security Lake
• api-change:endpoint-rules: Update endpoint-rules command to latest version

v1.32.40

Compare Source

=======

• api-change:appsync: Adds support for new options on GraphqlAPIs, Resolvers and Data Sources for emitting Amazon CloudWatch metrics for enhanced monitoring of AppSync APIs.
• api-change:cloudwatch: Update cloudwatch command to latest version
• api-change:neptune-graph: Adding a new option "parameters" for data plane api ExecuteQuery to support running parameterized query via SDK.
• api-change:route53domains: This release adds bill contact support for RegisterDomain, TransferDomain, UpdateDomainContact and GetDomainDetail API.

boto/boto3 (boto3)

v1.34.44

Compare Source

=======

• api-change:connectparticipant: [botocore] Doc only update to GetTranscript API reference guide to inform users about presence of events in the chat transcript.
• api-change:emr: [botocore] adds fine grained control over Unhealthy Node Replacement to Amazon ElasticMapReduce
• api-change:firehose: [botocore] This release adds support for Data Message Extraction for decompressed CloudWatch logs, and to use a custom file extension or time zone for S3 destinations.
• api-change:lambda: [botocore] Documentation-only updates for Lambda to clarify a number of existing actions and properties.
• api-change:rds: [botocore] Doc only update for a valid option in DB parameter group
• api-change:sns: [botocore] This release marks phone numbers as sensitive inputs.

v1.34.43

Compare Source

=======

• api-change:artifact: [botocore] This is the initial SDK release for AWS Artifact. AWS Artifact provides on-demand access to compliance and third-party compliance reports. This release includes access to List and Get reports, along with their metadata. This release also includes access to AWS Artifact notifications settings.
• api-change:codepipeline: [botocore] Add ability to override timeout on action level.
• api-change:detective: [botocore] Doc only updates for content enhancement
• api-change:guardduty: [botocore] Marked fields IpAddressV4, PrivateIpAddress, Email as Sensitive.
• api-change:healthlake: [botocore] This release adds a new response parameter, JobProgressReport, to the DescribeFHIRImportJob and ListFHIRImportJobs API operation. JobProgressReport provides details on the progress of the import job on the server.
• api-change:opensearch: [botocore] Adds additional supported instance types.
• api-change:polly: [botocore] Amazon Polly adds 1 new voice - Burcu (tr-TR)
• api-change:sagemaker: [botocore] This release adds a new API Updat...

v2.9.0 Update to Debian 12.4 from 11.8 (minor breaking change)

In this release we upgrade from Debian 11 (buster) to Debian 12 (bookworm). This introduces a minor breaking change.

Debian 12 has symbolic links for /bin, /sbin, and /lib pointing to /usr/bin, /usr/sbin, and /usr/lib respectively. This can break certain customizations you may be making in your Dockerfile for your custom image, and can also affect Spacelift users.

If you are making a customized version of Geodesic

Previously, the Dockerfile command:

COPY rootfs/ /

worked fine even if you had /bin, /sbin, or /lib subdirectories under rootfs/. Previous versions of Geodesic did have a rootfs/sbin directory which contained a single file, docker, which was a script that explained that the docker command was not installed and gave instructions on how to install it. This caused the COPY command to fail with the error:

ERROR: failed to solve: cannot copy to non-directory: /var/lib/docker/overlay2/6568nfahv2cv3vak9y7g5xv4d/merged/bin

For this reason, we moved the docker stub from rootfs/sbin/ to rootfs/usr/bin. (The reason it had been in /sbin before was so that it would appear later on the path than /usr/bin, which is where the real docker command is installed. However, with the new symlinks, /usr/bin is the last real directory on the PATH, so we can no longer put the stub in a later directory. Now we put it in /usr/bin where it will get replaced when the real docker command is installed.)

To fix this error, move the content out of rootfs/bin, rootfs/sbin, and rootfs/lib and into rootfs/usr/bin, rootfs/usr/sbin, and rootfs/usr/lib.

---

If you are using Geodesic as the base image for Spacelift

Cloud Posse distributed Spacelift configuration scripts that included the line

ln -sfTv /bin/terraform /usr/bin/terraform

Since Debian replaced the /bin directory with a symlink to /usr/bin, this line should be changed to

[ /bin -ef /usr/bin ] || ln -sfTv /bin/terraform /usr/bin/terraform

or removed completely. Otherwise you will find that the terraform command cannot be found, and you might get an error like

Using Terraform: 
+ which terraform
[01HPMBE7B9D1XJBM622MGSGM46] Unexpected exit code when initializing workspace: 1

🚀 Enhancements

Update to Debian 12.4 and other updates @Nuru (#918)

what

• Update Google Cloud SDK from 455.0.0 to 463.0.0
• Update helm-diff from 3.8.1 to 3.9.4
• Updates to Debian-based Geodesic:
  • Update Debian from 11.8 to 12.4
  • Update Python from 3.11.6 to 3.12.2
  • Change architecture emulation message to inform user that native architecture is available
• Updates to Alpine-based Geodesic:
  • Update Alpine from 3.18.5 to 3.18.6
  • Add deprecation message to banner

why

• Reduce number of known vulnerabilities. See #916
• Inform Alpine users that we will be discontinuing support soon

references

A trivy image scan of a development build of this PR showed zero known fixed vulnerabilities present in the Debian version. It detected 1 known fixed vulnerability in the Alpine version: the Google Cloud SDK includes Python packages that include cryptography v41.0.7, which has a vulnerability that has been fixed in the site-wide installed Python package, version 42.0.2.

• Supersedes and closes #916

v2.8.7

🏗️ Build/Release Maintenance

Add OCI annotations @Nuru (#917)

what

• Add OCI annotations to published images

why

• Standard compliance and better support for third-party tooling

references

• OCI annotations
• Supersedes and closes #915

v2.8.6

🧰 Included Tools

Update dependency cryptography to v42 [Security] @renovate (#906)

GitHub Vulnerability Alerts

CVE-2023-50782

A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

• Closes #912
• Closes #913

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
cryptography (changelog)	==41.0.7 -> ==42.0.2

---

Release Notes

pyca/cryptography (cryptography)

v42.0.2

Compare Source

v42.0.1

Compare Source

v42.0.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

Update AWS CLI packages @renovate (#914)

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
awscli (source, changelog)	==1.32.34 -> ==1.32.39
boto3	==1.34.34 -> ==1.34.39

---

Release Notes

aws/aws-cli (awscli)

v1.32.39

Compare Source

=======

• api-change:amp: Overall documentation updates.
• api-change:batch: This feature allows Batch to support configuration of repository credentials for jobs running on ECS
• api-change:braket: Creating a job will result in DeviceOfflineException when using an offline device, and DeviceRetiredException when using a retired device.
• api-change:cost-optimization-hub: Adding includeMemberAccounts field to the response of ListEnrollmentStatuses API.
• api-change:ecs: Documentation only update for Amazon ECS.
• api-change:iot: This release allows AWS IoT Core users to enable Online Certificate Status Protocol (OCSP) Stapling for TLS X.509 Server Certificates when creating and updating AWS IoT Domain Configurations with Custom Domain.
• api-change:pricing: Add Throttling Exception to all APIs.

v1.32.38

Compare Source

=======

• api-change:codepipeline: Add ability to execute pipelines with new parallel & queued execution modes and add support for triggers with filtering on branches and file paths.
• api-change:quicksight: General Interactions for Visuals; Waterfall Chart Color Configuration; Documentation Update
• api-change:workspaces: This release introduces User-Decoupling feature. This feature allows Workspaces Core customers to provision workspaces without providing users. CreateWorkspaces and DescribeWorkspaces APIs will now take a new optional parameter "WorkspaceName".

v1.32.37

Compare Source

=======

• api-change:datasync: AWS DataSync now supports manifests for specifying files or objects to transfer.
• api-change:lexv2-models: Update lexv2-models command to latest version
• api-change:redshift: LisRecommendations API to fetch Amazon Redshift Advisor recommendations.

v1.32.36

Compare Source

=======

• api-change:appsync: Support for environment variables in AppSync GraphQL APIs
• api-change:ecs: This release is a documentation only update to address customer issues.
• api-change:es: This release adds clear visibility to the customers on the changes that they make on the domain.
• api-change:logs: This release adds a new field, logGroupArn, to the response of the logs:DescribeLogGroups action.
• api-change:opensearch: This release adds clear visibility to the customers on the changes that they make on the domain.
• api-change:wafv2: You can now delete an API key that you've created for use with your CAPTCHA JavaScript integration API.

v1.32.35

Compare Source

=======

• api-change:glue: Introduce Catalog Encryption Role within Glue Data Catalog Settings. Introduce SASL/PLAIN as an authentication method for Glue Kafka connections
• api-change:workspaces: Added definitions of various WorkSpace states

boto/boto3 (boto3)

v1.34.39

Compare Source

=======

• api-change:amp: [botocore] Overall documentation updates.
• api-change:batch: [botocore] This feature allows Batch to support configuration of repository credentials for jobs running on ECS
• api-change:braket: [botocore] Creating a job will result in DeviceOfflineException when using an offline device, and DeviceRetiredException when using a retired device.
• api-change:cost-optimization-hub: [botocore] Adding includeMemberAccounts field to the response of ListEnrollmentStatuses API.
• api-change:ecs: [botocore] Documentation only update for Amazon ECS.
• api-change:iot: [botocore] This release allows AWS IoT Core users to enable Online Certificate Status Protocol (OCSP) Stapling for TLS X.509 Server Certificates when creating and updating AWS IoT Domain Configurations with Custom Domain.
• api-change:pricing: [botocore] Add Throttling Exception to all APIs.

v1.34.38

Compare Source

=======

• api-change:codepipeline: [botocore] Add ability to execute pipelines with new parallel & queued execution modes and add support for triggers with filtering on branches and file paths.
• api-change:quicksight: [botocore] General Interactions for Visuals; Waterfall Chart Color Configuration; Documentation Update
• api-change:workspaces: [botocore] This release introduces User-Decoupling feature. This feature allows Workspaces Core customers to provision workspaces without providing users. CreateWorkspaces and DescribeWorkspaces APIs will now ta...