Version History

Simfra follows semantic versioning. The full changelog with detailed notes is maintained in CHANGELOG.md at the root of the repository.

Releases

0.26.0 - 2026-07-03

A durability and fidelity release: engine data survives restarts and travels in backups, alongside a broad sweep of persistence, authorization, and concurrency fixes.

  • Engine data survives restarts - RDS, Redshift, DSQL, Redshift Serverless, ElastiCache (Redis/Valkey), MSK/Kafka, Amazon MQ, and OpenSearch now keep their data in named Docker volumes, so a database's contents survive container recreation and restarts, not just a graceful stop. Memcached is exempt (it has no persistence, matching AWS)
  • Backups include engine data - GET /_simfra/export now captures Docker engine databases, EFS files, and CodeCommit git repositories alongside resource metadata, so POST /_simfra/import restores a fully working environment on another machine. Control it with SIMFRA_EXPORT_VOLUMES or ?volumes=false, and use ?quiesce=true for an exact copy; dumps taken without volumes stay readable by older versions
  • Safer imports and wider persistence - an import fully validates the dump before replacing state, so a malformed or truncated dump no longer wipes your running environment, and many more resource classes are retained across restarts (RDS/DocDB global clusters, Lambda event-source mappings and layers, KMS key material, Step Functions versions/aliases, ELBv2 target registrations, EC2 instances, OpenSearch configuration, Secrets Manager replicas, RDS master passwords, and more)
  • SageMaker - 49 additional resource types are now creatable, describable, listable, and taggable, and a training job that was running before a restart resumes instead of hanging
  • Higher fidelity - list operations paginate with AWS-compatible tokens, idempotency tokens are honored on around 30 creation calls, async resources transition through realistic intermediate states, and default service quotas are enforced across 21 services
  • Security - closed a CloudFormation privilege-escalation gap by provisioning each resource under the stack caller's identity, gated the debug endpoints behind the admin token, and tightened SigV4, execution-role, and STS credential handling
  • Reliability - eliminated data races across several services, ensured a slow or hung Docker daemon can no longer stall unrelated operations, and switched large S3 uploads to stream to disk instead of buffering the whole body in memory

0.25.0 - 2026-07-01

Terraform data-source fidelity and encryption durability.

  • S3 placeholder objects - opt into the bucket tag simfra:PlaceholderObjects=true and GetObject/HeadObject return a synthetic 200 for keys that were never uploaded instead of 404 NoSuchKey, so Terraform data "aws_s3_object" lookups (for example a Lambda deployment zip referenced by infrastructure-as-code) resolve without a static seed list. Responses are deterministic - .zip keys return a minimal valid empty archive, the ETag is the body MD5, and LastModified is the bucket's creation time - so refreshes detect no drift. Existing objects and version-specific requests are unaffected
  • KMS encryption survives import and restart - a KMS key's backing material now travels in system dumps and SQLite persistence, so data encrypted under the key (such as SSE-KMS S3 objects) stays decryptable after a POST /_simfra/import, a SIMFRA_IMPORT launch, or a restart with persistence enabled. Previously the restored key got fresh random material and reads failed with decryption failed: cipher: message authentication failed
  • Lambda - a synchronous internal invocation that returned an error no longer causes a nil-receiver panic in the caller

0.24.0 - 2026-07-01

A convenience release for the backup feature: load a dump at startup.

  • Load a dump on launch - point SIMFRA_IMPORT at a dump produced by GET /_simfra/export and Simfra imports it at startup, before the server begins serving, instead of POST /_simfra/import to a running instance. The dump replaces current state on every launch, and with persistence enabled the imported state is written through to disk - useful for seeding CI environments, demos, and restoring a captured environment

0.23.0 - 2026-06-25

A backup-and-restore release: capture and move a full Simfra environment.

  • Backup and restore - GET /_simfra/export streams a portable .tar.gz snapshot of every resource across all accounts and regions - including S3 object bodies, Lambda code, and ECR layers - plus the account registry and its root credentials, and POST /_simfra/import restores a dump, replacing the current state. Export reads live state, so it works whether or not persistence is enabled, and both operations are available from the Persistent Storage page in the admin UI

0.22.0 - 2026-06-24

A Redshift release - a real Serverless query engine and the Redshift Data API - with wider observability coverage.

  • Redshift Data API - new redshift-data service for asynchronous SQL against both Redshift Serverless workgroups and provisioned clusters, with ExecuteStatement / BatchExecuteStatement (named parameters and client-token idempotency), the full statement lifecycle through DescribeStatement / ListStatements / CancelStatement, paginated results with column metadata via GetStatementResult / GetStatementResultV2, and catalog introspection (ListDatabases, ListSchemas, ListTables, DescribeTable); results are retained for 24 hours
  • Redshift Serverless - namespaces now run a real PostgreSQL query engine that executes your SQL, waking on the first query and scaling to zero when idle, plus GetCredentials temporary credential vending and AWS/Redshift-Serverless CloudWatch metrics (compute capacity and seconds, queries running/waiting, query duration, database connections) computed from real activity, with idle resources reporting truthful zeros
  • CloudWatch metrics - new metrics for EFS (StorageBytes) and FSx (FreeStorageCapacity / StorageCapacity)
  • EventBridge events - resource state changes now emit events for CodeCommit, Config rule compliance, ECR image push/delete, Redshift Data statement status, and Step Functions execution status
  • Configuration - SIMFRA_REDSHIFT_SERVERLESS_PORT_RANGE now defaults to 12000-12099 so its host ports no longer collide with SIMFRA_GLUE_PORT_RANGE

0.21.0 - 2026-06-23

A managed-file-transfer release plus a sweeping observability overhaul.

  • AWS Transfer Family - new service for managed file transfer over SFTP, FTP, and FTPS, with Docker-backed protocol servers fronting Amazon S3 and Amazon EFS, service-managed users with public-key authentication, IAM role assumption with session-policy scope-down, AS2 connectors/agreements/profiles, and managed workflows
  • Observability bus - a unified Hub now backs every service's CloudWatch metrics, CloudWatch Logs, EventBridge events, X-Ray traces, and CloudTrail events, so services emit through a single nil-safe path instead of per-service helpers
  • Real CloudWatch metrics - metrics across roughly 30 services are emitted from real activity instead of fabricated values, with idle resources reporting truthful zeros (EC2/ECS CPU and memory from live container stats, RDS and ElastiCache connections and throughput, API Gateway per-method request/latency/error, Amazon MSK, CloudFront, and more)
  • X-Ray distributed tracing - the trace context propagates across synchronous (API Gateway → Lambda → DynamoDB/S3/SNS/SQS/Kinesis) and asynchronous (SNS, EventBridge, S3, SQS event-source-mapping) calls, producing a single connected trace with correct parent/child segments
  • CloudTrail fidelity - events carry a resources array derived from the real request across many services, and trail delivery honors basic and advanced event selectors including management-vs-data classification and read/write type

0.20.1 - 2026-06-22

A stability fix for EventBridge target management under concurrent event delivery.

  • EventBridge - creating or removing rule targets (for example, a Terraform aws_cloudwatch_event_target) no longer crashes the process; target reads and writes are now serialized against concurrent event delivery on a rule's shared target map

0.20.0 - 2026-06-22

A web console release expanding service coverage and unifying the UI on shared primitives.

  • Web Console - new service consoles for 13 services: Application Auto Scaling, Bedrock Agent, Bedrock Data Automation, Cloud9, Cost Explorer, DMS, DocumentDB Elastic, ECR Public, Identity Store, FSx, Resource Groups, Route 53 Domains, and Service Quotas
  • Web Console - shared UI primitives (empty state, error state, delete-confirmation dialog, tags editor) plus SNS edit dialogs and per-service tag editors
  • Web Console - destructive dialogs and error/empty states across every console now use the shared primitives for consistent behavior

0.19.1 - 2026-06-18

A Terraform-fidelity patch release with four cross-service fixes.

  • Route 53 - hosted-zone IDs are now long, random, AWS-like strings instead of a sequential counter that restarted for every fresh process, so zones created by different scenarios no longer alias each other
  • Lambda - the Kinesis Event Source Mapping poller no longer advances the shard iterator when an invocation errors; it checkpoints the last successful sequence number and re-reads the failed batch, matching AWS's halt-on-error behavior
  • EventBridge - identity-policy authorization for PutEvents derives the target event-bus ARN from the request entries, so a policy scoped to a specific bus ARN is honored
  • API Gateway - a Lambda proxy integration whose function errors now returns 500 Internal Server Error instead of 200 with an empty body, on both the in-process and Docker paths

0.19.0 - 2026-06-17

A CloudFront custom-domain release with two Terraform-fidelity fixes.

  • CloudFront - distributions serve custom domains (alternate domain names) over HTTPS using a covering ACM or IAM viewer certificate, with wildcard-aware domain coverage and TLS termination at the edge, instead of only the default *.cloudfront certificate
  • CodeBuild - pipeline-triggered builds keep the project's buildspec when the input-artifact source is injected, so the build runs its commands and produces the expected artifact for CodeDeploy
  • EC2 - DescribeImages returns a deterministic order, so the Terraform aws_ami most_recent lookup no longer flips between equally-dated AMIs and forces needless instance replacement on re-apply

0.18.0 - 2026-06-17

A persistence release: resource durability is now uniform across every stateful service, driven by a background reconciler.

  • Persistence - a background reconciler periodically sweeps each service's in-memory state and writes only what changed, with a final flush on graceful shutdown, replacing scattered per-operation write-through; reads stay entirely in-memory
  • Persistence - many services that previously had no durability now survive restarts, including CodeBuild, CodeCommit, CodeDeploy, CodePipeline, SageMaker, DataSync, Bedrock, Resource Groups, Service Quotas, Braket, and AppSync
  • Persistence - closed durability gaps across CloudFront, ECS, Lambda, Kafka, OpenSearch, Cost Explorer, MQ, and S3 Control, restored ACM PCA and DMS resources that were saved but never reloaded, and fixed snapshot data races during background flushes

0.17.1 - 2026-06-17

A bug fix release.

  • Auto Scaling - DescribeWarmPool for a group with no warm pool returns an empty result (HTTP 200) instead of a ValidationError, unblocking the Terraform warm pool delete waiter
  • CloudFront - Key Value Store preserves the difference between an explicit empty-string comment and an unset comment, matching AWS and fixing inconsistent-result-after-apply on aws_cloudfront_key_value_store

0.17.0 - 2026-06-16

An AWS-fidelity release focused on verification flows, resource-name validation, and concurrency hardening.

  • SES - email identities are verified by clicking a link captured in the inbox, matching AWS's real verification flow, instead of being auto-approved. A new GET /_simfra/ses/verify-identity endpoint serves the confirmation page
  • Resource naming - name constraints (allowed characters, length, and patterns) are enforced with AWS-accurate validation across services
  • DynamoDB - the stream ARN and label returned for a table are derived from when the stream was enabled rather than when the table was created
  • Concurrency - eliminated worker-vs-serializer data races in read-handler DTOs, and ensured per-resource fields (including KMS keys) are read under the owning resource lock in background workers

0.16.0 - 2026-06-15

A large AWS-fidelity release: validation, error-code, pagination, and authorization behavior across roughly 40 services now matches AWS more closely, plus several new capabilities.

  • STS - GetFederationToken and AssumeRoleWithSAML; MFA token-code validation and fail-closed web-identity signature verification
  • Step Functions - full Express StartSyncExecution via a recursive synchronous executor
  • S3 - SSE-C (customer-provided encryption keys) including CopyObject and multipart upload; conditional GET/HEAD/PUT/Copy requests; Block Public Access and Object Ownership enforced on ACL writes
  • SNS - cidr and wildcard filter-policy operators
  • EventBridge - cross-account/region PutEvents gated by event-bus resource policy
  • CloudWatch - Alarm State Change events emitted to EventBridge
  • Fidelity hardening - validation, pagination, error-code, and authorization fixes across SQS, DynamoDB, Secrets Manager, Cognito, SSM, KMS, Lambda, IAM, Kinesis, ElastiCache, Batch, ECR, EKS, CloudWatch Logs, ELBv2, Route 53, and many more
  • Cross-service authorization - deliveries routed through authorized boundary methods; nil-DNS and request-context guards eliminate flaky worker-goroutine panics

0.15.2 - 2026-06-08

Bug fix release with cross-service integration hardening, EKS TF compatibility, and IAM policy evaluation edge cases.

  • Cross-service integration - 6 rounds of TDD-driven fixes for SNS→SQS, SNS/SQS→Lambda, S3→Lambda/SQS/SNS/EventBridge delivery, and SQS cross-account access
  • EKS - access entries, addons, nodegroups, cluster config, and encryption config fixes for TF provider acceptance tests
  • IAM - 28 edge case fixes for policy variable substitution, condition keys, and identity-based evaluation
  • TF compatibility - Bedrock (62/68), CloudFormation (58/73), Step Functions, and SageMaker acceptance test improvements
  • CodeBuild/CodePipeline - source artifact handoff and container ID parsing fixes

0.15.1 - 2026-06-03

Bug fix release with 10 fixes across API Gateway V1, IAM, ELBv2, FSx, MSK, and CloudFront.

  • API Gateway V1 - 7 fixes including JSON Pointer unescaping in patch operations, GetAccount defaults, PutRestApi YAML support, and missing DomainName fields
  • CloudFront - 5 AWS managed response headers policies now returned with real IDs
  • IAM, ELBv2, FSx, MSK - trust policy, certificate validation, ENI provisioning, and configuration deletion fixes

0.15.0 - 2026-06-03

Major ElastiCache and Auto Scaling TF provider compatibility milestones, cross-account DNS and CloudTrail delivery, and new Resource Groups service.

  • Resource Groups - new service (15 operations, REST-JSON) for resource group management, tagging, and resource membership
  • ElastiCache TF compatibility - acceptance tests jump from 3 to 123 passing
  • Auto Scaling TF compatibility - acceptance tests jump from 0 to 143 passing
  • EC2 ENI secondary IPs and IPv6 - ENIs support secondary private IPv4 addresses and IPv6 assignment via a standardized ENIProvisioner interface
  • Cross-account DNS validation - ACM certificate DNS validation resolves records globally across all accounts
  • Cross-account CloudTrail S3 delivery - trail log delivery resolves bucket owner for correct cross-account authorization
  • IAM outbound web identity federation - enable, disable, and query OWIF state

0.14.0 - 2026-05-28

Tag and header resource ID overrides replace the seed API.

  • simfra: tag overrides - add simfra:<FieldName> tags to create requests for deterministic resource IDs. Works with Terraform. Supported across EC2, KMS, IAM, and Organizations
  • X-Simfra-Id header - HTTP header for overriding IDs on resources that don't accept tags (Route53 hosted zones, Organizations)
  • Both mechanisms go through the full creation path, replacing the seed API which created skeleton resources

0.13.0 - 2026-05-27

Declarative seed API for creating resources with exact IDs (superseded by tag + header overrides in 0.14.0).

  • Seed API - POST /_simfra/seed accepts a YAML document to create accounts, organizations, EC2 transit gateways, TGW route tables, security groups, KMS keys, and Route53 hosted zones with specific IDs
  • SIMFRA_SEED env var - apply a seed YAML file at startup before bootstrap runs
  • Replaces the remap API introduced in 0.11.0

0.12.0 - 2026-05-27

Resource ID remap expanded to EC2 and KMS.

  • Remap API expansion - POST /_simfra/remap now supports EC2 transit gateways, transit gateway route tables, security groups, and KMS keys (superseded by seed API in 0.13.0)

0.11.0 - 2026-05-27

Resource ID remap API, S3 Express One Zone, FSx service, and debug endpoints.

  • Resource ID remap - POST /_simfra/remap for assigning specific IDs to resources after creation (superseded by seed API in 0.13.0)
  • FSx (10 ops) - Windows file system lifecycle with Lustre, ONTAP, and OpenZFS types
  • S3 Express One Zone - directory buckets, CreateSession credential resolution, CRC64NVME checksum
  • Debug endpoints - /_simfra/debug/requests for request log inspection and /_simfra/debug/pprof/ for profiling
  • RDS - pending modifications with maintenance window simulation

0.10.1 - 2026-05-22

A patch release fixing S3 access point routing and several EC2/S3 fidelity gaps.

  • S3 - operations using access point ARNs now route correctly when AWS_ENDPOINT_URL is set; CopyObject returns x-amz-copy-source-version-id for versioned source buckets; CreateBucketMetadataTableConfiguration returns the correct b_{bucket} namespace prefix
  • EC2 - DescribeImages now filters by tag-key and tag-value so the Terraform aws_ami data source lookups that rely on tag-presence filters return results

0.10.0 - 2026-05-21

An RDS Terraform compatibility release with EC2 AMI cross-account sharing fixes.

  • RDS - Terraform acceptance tests jump from 0 to 34 passing, covering engine versions, orderable instance options, certificates, snapshots, proxies, subnet groups, parameter groups, cluster endpoints, global clusters, and shard group CRUD
  • EC2 - DescribeImages with --owners or --executable-users self from a member account now returns AMIs shared via organization launch permissions

0.9.0 - 2026-05-21

EC2 AMI launch permissions with cross-account organization sharing.

  • EC2 - ModifyImageAttribute stores launch permissions for organizations, OUs, accounts, and public sharing. DescribeImages resolves shared AMIs cross-account via Organizations membership lookup. Block public access enforced for group=all
  • EC2 - DescribeImages now returns org-shared AMIs for --owners and --executable-users queries from member accounts

0.8.4 - 2026-05-21

EC2 tag concurrency fix and AMI fidelity improvements.

  • EC2 - concurrent CreateTags/DeleteTags calls alongside DescribeImages no longer trigger a fatal concurrent-map panic; tag reads now go through locking helpers across all resource types
  • EC2 - RegisterImage, CopyImage, and CreateImage handle more fields correctly (block device mappings, ENA support, hypervisor, platform details); ModifyImageAttribute updates the description; DescribeImages returns full block device mapping detail

0.8.3 - 2026-05-21

Kafka nil-pointer fix and Terraform plan stability improvements.

  • MSK - the background worker no longer panics with a nil pointer when the DNS service is not configured (non-Docker deployments and test harnesses)
  • Lambda - GetFunction now returns ReservedConcurrentExecutions; AddPermission uses the correct uppercase condition keys (AWS:SourceArn, AWS:SourceAccount) that Terraform expects
  • IAM - service-linked roles preserve CustomSuffix across persistence restarts; Organizations OrganizationAccountAccessRole uses an inline policy instead of a managed policy attachment

0.8.2 - 2026-05-21

Cross-account KMS key resolution fix.

  • KMS - services that reference a KMS key in another account via a full ARN (e.g., arn:aws:kms:us-east-1:OTHER_ACCOUNT:key/UUID) now resolve the key in the ARN-specified account; previously all lookups used the caller's account, breaking cross-account KMS patterns for CloudTrail, S3, SQS, SNS, and others

0.8.1 - 2026-05-21

S3 and CloudTrail authorization fixes.

  • S3 - PutBucketEncryption no longer requires the caller to hold KMS key permissions; key existence and type are validated at configuration time, and KMS permissions are checked at PutObject time, matching AWS behavior
  • CloudTrail - CreateTrail and UpdateTrail now accept S3 buckets owned by other accounts when the bucket policy grants the CloudTrail service principal access

0.8.0 - 2026-05-20

Cost Explorer service and KMS root delegation fix.

  • Cost Explorer (CE) (41 ops) - anomaly monitors and subscriptions, cost categories with rule-based classification, cost allocation tags, and cost/usage query stubs
  • KMS - key policies granting access to the account root principal now correctly delegate authority to IAM identity policies
  • Service Quotas - expanded quota definitions for Auto Scaling, EC2 VPC, S3, and IAM
  • 103 total services with 5,755 operations

0.7.1 - 2026-05-20

Cross-account S3 code source fix for Lambda.

  • Lambda - CreateFunction and UpdateFunctionCode now accept deployment packages stored in S3 buckets owned by other accounts when the bucket policy grants access (e.g., via aws:PrincipalOrgID); previously cross-account S3 references always failed with NoSuchKey

0.7.0 - 2026-05-20

SSM expansion, DMS, and Service Quotas.

  • SSM - 58 new operations: associations, maintenance windows, patch baselines, service settings, activations, and resource data sync. All 147 Terraform acceptance tests passing
  • DMS (118 ops) - Database Migration Service with Docker-backed replication between MySQL, PostgreSQL, and S3
  • Service Quotas (26 ops) - quota querying, increase requests, and templates with QuotaProvider interface across 38 services
  • EC2 - Allowed Images Settings operations
  • 102 total services with 5,714 operations

0.6.1 - 2026-05-19

Route53 Resolver Firewall per-region IDs and SSM expansion.

  • Route53 Resolver - AWS-managed Firewall domain lists now use correct per-region IDs instead of us-east-1 IDs everywhere
  • SSM - 58 new operations: associations, maintenance windows, patch baselines, service settings, activations, and resource data sync. Seeds 17 AWS-owned default patch baselines per account. All 147 Terraform acceptance tests passing
  • DMS (118 ops) - Database Migration Service with replication instances, endpoints, tasks, full-load and CDC between MySQL, PostgreSQL, and S3, Docker-backed replicator container
  • Service Quotas (26 ops) - quota querying, increase requests (auto-approved), and quota templates with QuotaProvider interface across 38 services
  • EC2 - Allowed Images Settings (Get/Enable/DisableImageBlockPublicAccess, GetAllowedImagesSettings)
  • 102 total services with 5,714 operations

0.6.0 - 2026-05-19

Route53 Resolver Firewall AWS-managed domain lists.

  • Route53 Resolver - the four AWS-managed Firewall domain lists (AWSManagedDomainsAggregateThreatList, AWSManagedDomainsMalwareDomainList, AWSManagedDomainsAmazonGuardDutyThreatList, AWSManagedDomainsBotnetCommandandControl) are now pre-created in every account and region with fixed IDs, matching real AWS; lists are protected from deletion or modification

0.5.9 - 2026-05-19

AWS global condition keys and org-scoped policy evaluation.

  • IAM - policy evaluation now populates aws:PrincipalOrgID, aws:PrincipalType, aws:userid, aws:username, aws:PrincipalTag/*, aws:ResourceAccount, and aws:ResourceOrgID across all authorization paths
  • S3 - cross-account bucket policy evaluation correctly passes condition keys; public access block recognizes org-scoped conditions as non-public
  • RAM - organization and OU principals resolved so member accounts discover shared resources; cross-region resource associations rejected

0.5.8 - 2026-05-19

RAM cross-region resource association validation.

  • RAM - AssociateResourceShare and CreateResourceShare now reject resource ARNs from a different region than the share, returning InvalidParameterException; previously cross-region associations were silently accepted

0.5.7 - 2026-05-19

S3 public access block accuracy for org-scoped policies.

  • S3 - BlockPublicPolicy no longer rejects bucket policies that use Principal: "*" with restrictive conditions (e.g., aws:PrincipalOrgID, aws:SourceVpc, fixed-value aws:SourceArn); these are correctly recognized as non-public, matching AWS behavior

0.5.6 - 2026-05-19

RAM cross-account resource visibility and Transit Gateway attachment fixes.

  • RAM - GetResourceShares, ListResources, ListPrincipals, and GetResourceShareAssociations now resolve organization and OU principals so member accounts can discover shared resources; ListResources and ListPrincipals no longer leak data from shares the caller is not a recipient of
  • EC2 - cross-account DescribeTransitGateways, DescribeSubnets, DescribeIpamPools, and DescribeCapacityReservations now return RAM-shared resources from other accounts; CreateTransitGatewayVpcAttachment works against a shared TGW with AutoAcceptSharedAttachments support

0.5.5 - 2026-05-19

RAM organization principal handling fix.

  • RAM - resource shares with allow_external_principals = false no longer reject organization ARN principals, OU ARN principals, or member account root ARN principals from the same organization; these are now correctly recognized as internal

0.5.4 - 2026-05-19

Cross-account trust policy fixes.

  • STS - cross-account AssumeRole with sts:ExternalId conditions no longer incorrectly denied
  • RAM - organization ARN principals recognized as internal when allow_external_principals = false

0.5.3 - 2026-05-18

Transit Gateway deterministic ID overrides.

  • EC2 - All Transit Gateway creation operations now support simfra: tag overrides for pinning resource IDs (gateway, attachments, route tables, multicast domains, connect peers, policy tables, metering policies)

0.5.2 - 2026-05-18

Organizations CreateAccount role provisioning.

  • Organizations - CreateAccount and CreateGovCloudAccount now automatically provision OrganizationAccountAccessRole (or the custom name from RoleName) in new member accounts with AdministratorAccess and a trust policy for the management account, matching real AWS behavior

0.5.1 - 2026-05-18

Override tag preservation and web console defaults.

  • Override tags are now preserved on resources instead of stripped, fixing Terraform plan/apply state drift
  • Health endpoint exposes defaultAccountId and defaultRegion; web console auto-initializes from server defaults
  • CreateDefaultVpc triggers VPC lifecycle hooks for Docker network setup

0.5.0 - 2026-05-17

App Runner service and codegen required field validation.

  • App Runner (33 ops) - service CRUD with auto scaling configurations, VPC connectors, custom domains, connections, observability configs, and async deployment lifecycle with state machine
  • Codegen - required:"true" struct tag emitted for required fields, enabling runtime validation
  • 100 total services with 5,562 operations

0.4.0 - 2026-05-15

New services, UI console expansion, and E2E scenario growth.

  • Braket (17 ops) - quantum circuit execution via containerized Amazon Braket Default Simulator (SV1/DM1), async task lifecycle, hybrid jobs, spending limits, and S3 result output
  • Cloud9 (13 ops) - cloud IDE with Docker-backed code-server environments, membership management, and automatic hibernation
  • Web console - added Braket, Direct Connect, ARC Region Switch, and ARC Zonal Shift service pages; enhanced KMS, ACM, WAFv2, Secrets Manager, Network Firewall, Security Hub, and Access Analyzer with inline editing and modification capabilities
  • 99 total services with 5,529 operations

0.3.0 - 2026-05-14

Organizations resource ID overrides and Docker image version pinning.

  • Organizations overrides - SIMFRA_ORG_ID and SIMFRA_ORG_ROOT_ID env vars for CreateOrganization, plus simfra:AccountId, simfra:OrganizationalUnitId tag overrides for deterministic resource IDs
  • Docker sidecar image versioning - sidecar container images are now pinned to the Simfra binary version tag instead of :latest

0.2.1 - 2026-05-13

Version and build metadata. The binary and Docker images now report their version via simfra --version, startup logs include the version and commit hash, and Docker images are tagged with semver versions (e.g., :0.2.1).

0.2.0 - 2026-05-13

TLS, CloudFront expansion, and UI mutations.

  • TLS support for the control plane via SIMFRA_TLS with auto-generated or user-provided certificates, and CA propagation to all Docker containers
  • CloudFront expanded from 31 to 107 operations - OAI, public keys, key groups, field-level encryption, KeyValueStore, monitoring, trust stores, VPC origins, continuous deployment policies, and CDN policy forwarding
  • Lambda presigned code URLs - GetFunction returns HMAC-signed download URLs for deployment packages
  • Web console UI mutations - create, update, and delete support across ~30 services
  • E2E test suite with Playwright specs across ~20 services
  • New scenarios - Multi-Region ARC Failover and SageMaker ML Pipeline

0.1.0 - 2026-05-04

Initial release - a single-binary AWS cloud emulator for local development and testing.

  • 97 AWS services with 5,400+ operations across compute, storage, database, networking, security, analytics, and AI
  • Docker-backed services - EC2, ECS, EKS, Lambda, RDS, ELBv2, Route53, API Gateway, MQ, DSQL, and more run real processes in containers
  • IAM policy evaluation - identity policies, resource policies, SCPs, permission boundaries, and session policies
  • Cross-service integrations - DynamoDB Streams triggering Lambda, EventBridge routing to Step Functions, SNS delivering to SQS, and 50+ other live integrations
  • Persistence - opt-in SQLite write-through with AES-256 field encryption for sensitive data
  • Web console UI - multi-account, multi-region management dashboard
  • 16 validated E2E scenarios - from serverless APIs to EKS platforms to financial CQRS systems