localstack-core 4.10.1.dev42__py3-none-any.whl → 4.11.2.dev14__py3-none-any.whl

localstack/services/lambda_/resource_providers/aws_lambda_function.py

@@ -19,11 +19,24 @@ from localstack.utils.strings import is_base64, to_bytes
 from localstack.utils.testutil import create_zip_file
 
 
+class LambdaManagedInstancesCapacityProviderConfig(TypedDict):
+    CapacityProviderArn: str | None
+    PerExecutionEnvironmentMaxConcurrency: int | None
+    ExecutionEnvironmentMemoryGiBPerVCpu: float | None
+
+
+class CapacityProviderConfig(TypedDict):
+    LambdaManagedInstancesCapacityProviderConfig: (
+        LambdaManagedInstancesCapacityProviderConfig | None
+    )
+
+
 class LambdaFunctionProperties(TypedDict):
     Code: Code | None
     Role: str | None
     Architectures: list[str] | None
     Arn: str | None
+    CapacityProviderConfig: CapacityProviderConfig | None
     CodeSigningConfigArn: str | None
     DeadLetterConfig: DeadLetterConfig | None
     Description: str | None
@@ -297,6 +310,7 @@ def _transform_function_to_model(function):
         "Arn",
         "EphemeralStorage",
         "Architectures",
+        "CapacityProviderConfig",
     ]
     response_model = util.select_attributes(function, model_properties)
     response_model["Arn"] = function["FunctionArn"]
@@ -387,6 +401,7 @@ class LambdaFunctionProvider(ResourceProvider[LambdaFunctionProperties]):
                     "TracingConfig",
                     "VpcConfig",
                     "LoggingConfig",
+                    "CapacityProviderConfig",
                 ],
             )
             if "Timeout" in kwargs:
@@ -408,11 +423,27 @@ class LambdaFunctionProvider(ResourceProvider[LambdaFunctionProperties]):
                 }
 
             kwargs["Code"] = _get_lambda_code_param(model)
+
+            # For managed instance lambdas, we publish them immediately
+            if "CapacityProviderConfig" in kwargs:
+                kwargs["Publish"] = True
+                kwargs["PublishTo"] = "LATEST_PUBLISHED"
+
             create_response = lambda_client.create_function(**kwargs)
+            # TODO: if version is in the schema, just put it in the model instead of the custom context
+            request.custom_context["Version"] = create_response["Version"]  # $LATEST.PUBLISHED
             model["Arn"] = create_response["FunctionArn"]
 
-        get_fn_response = lambda_client.get_function(FunctionName=model["Arn"])
+        if request.custom_context.get("Version") == "$LATEST.PUBLISHED":
+            # for managed instance lambdas, we need to wait until the version is published & active
+            get_fn_response = lambda_client.get_function(
+                FunctionName=model["FunctionName"], Qualifier=request.custom_context["Version"]
+            )
+        else:
+            get_fn_response = lambda_client.get_function(FunctionName=model["Arn"])
+
         match get_fn_response["Configuration"]["State"]:
+            # TODO: explicitly handle new ActiveNonInvocable state?
             case "Pending":
                 return ProgressEvent(
                     status=OperationStatus.IN_PROGRESS,
@@ -541,6 +572,7 @@ class LambdaFunctionProvider(ResourceProvider[LambdaFunctionProperties]):
             "TracingConfig",
             "VpcConfig",
             "LoggingConfig",
+            "CapacityProviderConfig",
         ]
         update_config_props = util.select_attributes(request.desired_state, config_keys)
         function_name = request.previous_state["FunctionName"]

localstack/services/lambda_/runtimes.py

@@ -34,6 +34,7 @@ from localstack.aws.api.lambda_ import Runtime
 # => Synchronize the order with the "Supported runtimes" under "AWS Lambda runtimes" (a)
 # => Add comments for deprecated runtimes using <Deprecation date> => <Block function create> => <Block function update>
 IMAGE_MAPPING: dict[Runtime, str] = {
+    Runtime.nodejs24_x: "nodejs:24",
     Runtime.nodejs22_x: "nodejs:22",
     Runtime.nodejs20_x: "nodejs:20",
     Runtime.nodejs18_x: "nodejs:18",
@@ -112,6 +113,7 @@ ALL_RUNTIMES: list[Runtime] = list(IMAGE_MAPPING.keys())
 # => Remove deprecated runtimes from this testing list
 RUNTIMES_AGGREGATED = {
     "nodejs": [
+        Runtime.nodejs24_x,
         Runtime.nodejs22_x,
         Runtime.nodejs20_x,
         Runtime.nodejs18_x,
@@ -166,6 +168,6 @@ SNAP_START_SUPPORTED_RUNTIMES = [
 ]
 
 # An ordered list of all Lambda runtimes considered valid by AWS. Matching snapshots in test_create_lambda_exceptions
-VALID_RUNTIMES: str = "[nodejs20.x, python3.14, provided.al2023, python3.12, python3.13, nodejs22.x, java17, nodejs16.x, java25, dotnet8, python3.10, java11, python3.11, dotnet6, java21, nodejs18.x, provided.al2, ruby3.3, ruby3.4, java8.al2, ruby3.2, python3.8, python3.9]"
+VALID_RUNTIMES: str = "[nodejs20.x, python3.14, provided.al2023, python3.12, python3.13, nodejs24.x, nodejs22.x, java17, nodejs16.x, java25, dotnet8, python3.10, java11, python3.11, dotnet6, java21, nodejs18.x, provided.al2, ruby3.3, ruby3.4, java8.al2, ruby3.2, python3.8, python3.9]"
 # An ordered list of all Lambda runtimes for layers considered valid by AWS. Matching snapshots in test_layer_exceptions
 VALID_LAYER_RUNTIMES: str = "[ruby3.5, ruby2.6, dotnetcore1.0, python3.7, nodejs8.10, nasa, ruby2.7, python2.7-greengrass, dotnetcore2.0, python3.8, java21, dotnet6, dotnetcore2.1, python3.9, java11, nodejs6.10, provided, dotnetcore3.1, dotnet8, java25, java17, nodejs, nodejs4.3, java8.al2, go1.x, dotnet10, nodejs20.x, go1.9, byol, nodejs10.x, provided.al2023, nodejs22.x, python3.10, java8, nodejs12.x, python3.11, nodejs24.x, nodejs8.x, python3.12, nodejs14.x, nodejs8.9, nodejs26.x, python3.13, python3.14, nodejs16.x, python3.15, provided.al2, nodejs4.3-edge, nodejs18.x, ruby3.2, python3.4, ruby3.3, ruby3.4, ruby2.5, python3.6, python2.7]"

localstack/services/logs/provider.py

@@ -14,6 +14,7 @@ from moto.logs.models import LogStream as MotoLogStream
 from localstack.aws.api import CommonServiceException, RequestContext, handler
 from localstack.aws.api.logs import (
     AmazonResourceName,
+    DeletionProtectionEnabled,
     DescribeLogGroupsRequest,
     DescribeLogGroupsResponse,
     DescribeLogStreamsRequest,
@@ -43,6 +44,7 @@ from localstack.services import moto
 from localstack.services.logs.models import get_moto_logs_backend, logs_stores
 from localstack.services.moto import call_moto
 from localstack.services.plugins import ServiceLifecycleHook
+from localstack.state import StateVisitor
 from localstack.utils.aws import arns
 from localstack.utils.aws.client_types import ServicePrincipal
 from localstack.utils.bootstrap import is_api_enabled
@@ -57,6 +59,12 @@ class LogsProvider(LogsApi, ServiceLifecycleHook):
         super().__init__()
         self.cw_client = connect_to().cloudwatch
 
+    def accept_state_visitor(self, visitor: StateVisitor):
+        from moto.logs.models import logs_backends
+
+        visitor.visit(logs_backends)
+        visitor.visit(logs_stores)
+
     def put_log_events(
         self,
         context: RequestContext,
@@ -163,6 +171,7 @@ class LogsProvider(LogsApi, ServiceLifecycleHook):
         kms_key_id: KmsKeyId | None = None,
         tags: Tags | None = None,
         log_group_class: LogGroupClass | None = None,
+        deletion_protection_enabled: DeletionProtectionEnabled | None = None,
         **kwargs,
     ) -> None:
         call_moto(context)

localstack/services/opensearch/provider.py

@@ -116,6 +116,11 @@ DEFAULT_OPENSEARCH_DOMAIN_ENDPOINT_OPTIONS = DomainEndpointOptions(
     CustomEndpointEnabled=False,
 )
 
+DEFAULT_AUTOTUNE_OPTIONS = AutoTuneOptionsOutput(
+    State=AutoTuneState.ENABLED,
+    UseOffPeakWindow=False,
+)
+
 
 def cluster_manager() -> ClusterManager:
     global __CLUSTER_MANAGER
@@ -203,6 +208,13 @@ def _status_to_config(status: DomainStatus) -> DomainConfig:
     cluster_cfg = status.get("ClusterConfig") or {}
     default_cfg = DEFAULT_OPENSEARCH_CLUSTER_CONFIG
     config_status = get_domain_config_status()
+    autotune_options = status.get("AutoTuneOptions") or DEFAULT_AUTOTUNE_OPTIONS
+    autotune_state = autotune_options.get("State") or AutoTuneState.ENABLED
+    desired_state = (
+        AutoTuneDesiredState.ENABLED
+        if autotune_state == AutoTuneState.ENABLED
+        else AutoTuneDesiredState.DISABLED
+    )
     return DomainConfig(
         AccessPolicies=AccessPoliciesStatus(
             Options=status.get("AccessPolicies", ""),
@@ -275,15 +287,16 @@ def _status_to_config(status: DomainStatus) -> DomainConfig:
         ),
         AutoTuneOptions=AutoTuneOptionsStatus(
             Options=AutoTuneOptions(
-                DesiredState=AutoTuneDesiredState.ENABLED,
+                DesiredState=desired_state,
                 RollbackOnDisable=RollbackOnDisable.NO_ROLLBACK,
                 MaintenanceSchedules=[],
+                UseOffPeakWindow=autotune_options.get("UseOffPeakWindow", False),
             ),
             Status=AutoTuneStatus(
                 CreationDate=config_status.get("CreationDate"),
                 UpdateDate=config_status.get("UpdateDate"),
                 UpdateVersion=config_status.get("UpdateVersion"),
-                State=AutoTuneState.ENABLED,
+                State=autotune_state,
                 PendingDeletion=config_status.get("PendingDeletion"),
             ),
         ),
@@ -315,6 +328,22 @@ def get_domain_status(
         stored_status.update(request)
         default_cfg.update(request.get("ClusterConfig", {}))
 
+    autotune_options = stored_status.get("AutoTuneOptions") or deepcopy(DEFAULT_AUTOTUNE_OPTIONS)
+    if request and (request_options := request.get("AutoTuneOptions")):
+        desired_state = request_options.get("DesiredState") or AutoTuneDesiredState.ENABLED
+        state = (
+            AutoTuneState.ENABLED
+            if desired_state == AutoTuneDesiredState.ENABLED
+            else AutoTuneState.DISABLED
+        )
+        autotune_options = AutoTuneOptionsOutput(
+            State=state,
+            UseOffPeakWindow=request_options.get(
+                "UseOffPeakWindow", autotune_options.get("UseOffPeakWindow", False)
+            ),
+        )
+    stored_status["AutoTuneOptions"] = autotune_options
+
     domain_processing_status = stored_status.get("DomainProcessingStatus", None)
     processing = stored_status.get("Processing", True)
     if deleted:
@@ -377,7 +406,10 @@ def get_domain_status(
         AdvancedSecurityOptions=AdvancedSecurityOptions(
             Enabled=False, InternalUserDatabaseEnabled=False
         ),
-        AutoTuneOptions=AutoTuneOptionsOutput(State=AutoTuneState.ENABLE_IN_PROGRESS),
+        AutoTuneOptions=AutoTuneOptionsOutput(
+            State=stored_status.get("AutoTuneOptions", {}).get("State"),
+            UseOffPeakWindow=autotune_options.get("UseOffPeakWindow", False),
+        ),
     )
     return new_status
 
@@ -582,6 +614,24 @@ class OpensearchProvider(OpensearchApi, ServiceLifecycleHook):
             if domain_status is None:
                 raise ResourceNotFoundException(f"Domain not found: {domain_key.domain_name}")
 
+            if payload.get("AutoTuneOptions"):
+                auto_request = payload.pop("AutoTuneOptions")
+                desired_state = auto_request.get("DesiredState") or AutoTuneDesiredState.ENABLED
+
+                state = (
+                    AutoTuneState.ENABLED
+                    if desired_state == AutoTuneDesiredState.ENABLED
+                    else AutoTuneState.DISABLED
+                )
+
+                current_autotune = domain_status.get("AutoTuneOptions", {})
+                domain_status["AutoTuneOptions"] = AutoTuneOptionsOutput(
+                    State=state,
+                    UseOffPeakWindow=auto_request.get(
+                        "UseOffPeakWindow", current_autotune.get("UseOffPeakWindow", False)
+                    ),
+                )
+
             status_update: dict = _update_domain_config_request_to_status(payload)
             domain_status.update(status_update)
 

localstack/services/resource_groups/provider.py

@@ -1,5 +1,9 @@
 from localstack.aws.api.resource_groups import ResourceGroupsApi
+from localstack.state import StateVisitor
 
 
 class ResourceGroupsProvider(ResourceGroupsApi):
-    pass
+    def accept_state_visitor(self, visitor: StateVisitor):
+        from moto.resourcegroups.models import resourcegroups_backends
+
+        visitor.visit(resourcegroups_backends)

localstack/services/resourcegroupstaggingapi/provider.py

@@ -1,7 +1,12 @@
 from abc import ABC
 
 from localstack.aws.api.resourcegroupstaggingapi import ResourcegroupstaggingapiApi
+from localstack.state import StateVisitor
 
 
 class ResourcegroupstaggingapiProvider(ResourcegroupstaggingapiApi, ABC):
-    pass
+    def accept_state_visitor(self, visitor: StateVisitor):
+        # currently, Moto resourcegroupstaggingapi stores all tags into the other services backend, so their backend
+        # does not hold any state and is not worth saving. It only holds direct references to other services
+        # It only holds pagination tokens that are not worth keeping
+        pass

localstack/services/s3/provider.py

@@ -323,6 +323,7 @@ from localstack.services.s3.validation import (
 from localstack.services.s3.website_hosting import register_website_hosting_routes
 from localstack.state import AssetDirectory, StateVisitor
 from localstack.utils.aws.arns import s3_bucket_name
+from localstack.utils.aws.aws_stack import get_valid_regions_for_service
 from localstack.utils.collections import select_from_typed_dict
 from localstack.utils.strings import short_uid, to_bytes, to_str
 
@@ -491,16 +492,12 @@ class S3Provider(S3Api, ServiceLifecycleHook):
         if not is_bucket_name_valid(bucket_name):
             raise InvalidBucketName("The specified bucket is not valid.", BucketName=bucket_name)
 
-        # the XML parser returns an empty dict if the body contains the following:
-        # <CreateBucketConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/" />
-        # but it also returns an empty dict if the body is fully empty. We need to differentiate the 2 cases by checking
-        # if the body is empty or not
-        if context.request.data and (
-            (create_bucket_configuration := request.get("CreateBucketConfiguration")) is not None
-        ):
-            if not (bucket_region := create_bucket_configuration.get("LocationConstraint")):
-                raise MalformedXML()
-
+        create_bucket_configuration = request.get("CreateBucketConfiguration") or {}
+        bucket_region = create_bucket_configuration.get("LocationConstraint")
+        bucket_tags = create_bucket_configuration.get("Tags")
+        if bucket_tags:
+            validate_tag_set(bucket_tags, type_set="create-bucket")
+        if bucket_region:
             if context.region == AWS_REGION_US_EAST_1:
                 if bucket_region in ("us-east-1", "aws-global"):
                     raise InvalidLocationConstraint(
@@ -527,8 +524,9 @@ class S3Provider(S3Api, ServiceLifecycleHook):
             if existing_bucket_owner != context.account_id:
                 raise BucketAlreadyExists()
 
-            # if the existing bucket has the same owner, the behaviour will depend on the region
-            if bucket_region != "us-east-1":
+            # if the existing bucket has the same owner, the behaviour will depend on the region and if the request has
+            # tags
+            if bucket_region != AWS_REGION_US_EAST_1 or bucket_tags:
                 raise BucketAlreadyOwnedByYou(
                     "Your previous request to create the named bucket succeeded and you already own it.",
                     BucketName=bucket_name,
@@ -547,6 +545,7 @@ class S3Provider(S3Api, ServiceLifecycleHook):
         # see https://docs.aws.amazon.com/AmazonS3/latest/API/API_Owner.html
         owner = get_owner_for_account_id(context.account_id)
         acl = get_access_control_policy_for_new_resource_request(request, owner=owner)
+
         s3_bucket = S3Bucket(
             name=bucket_name,
             account_id=context.account_id,
@@ -559,6 +558,11 @@ class S3Provider(S3Api, ServiceLifecycleHook):
 
         store.buckets[bucket_name] = s3_bucket
         store.global_bucket_map[bucket_name] = s3_bucket.bucket_account_id
+        if bucket_tags:
+            store.TAGS.tag_resource(
+                arn=s3_bucket.bucket_arn,
+                tags=bucket_tags,
+            )
         self._cors_handler.invalidate_cache()
         self._storage_backend.create_bucket(bucket_name)
 
@@ -607,6 +611,13 @@ class S3Provider(S3Api, ServiceLifecycleHook):
         bucket_region: BucketRegion = None,
         **kwargs,
     ) -> ListBucketsOutput:
+        if bucket_region and not config.ALLOW_NONSTANDARD_REGIONS:
+            if bucket_region not in get_valid_regions_for_service(self.service):
+                raise InvalidArgument(
+                    f"Argument value {bucket_region} is not a valid AWS Region",
+                    ArgumentName="bucket-region",
+                )
+
         owner = get_owner_for_account_id(context.account_id)
         store = self.get_store(context.account_id, context.region)
 
@@ -1189,12 +1200,14 @@ class S3Provider(S3Api, ServiceLifecycleHook):
             response["ChecksumType"] = checksum_type
 
         add_encryption_to_response(response, s3_object=s3_object)
+        object_tags = store.TAGS.tags.get(
+            get_unique_key_id(bucket_name, object_key, s3_object.version_id)
+        )
+        if object_tags:
+            response["TagCount"] = len(object_tags)
 
         # if you specify the VersionId, AWS won't return the Expiration header, even if that's the current version
         if not version_id and s3_bucket.lifecycle_rules:
-            object_tags = store.TAGS.tags.get(
-                get_unique_key_id(bucket_name, object_key, s3_object.version_id)
-            )
             if expiration_header := self._get_expiration_header(
                 s3_bucket.lifecycle_rules,
                 bucket_name,

localstack/services/s3/utils.py

@@ -421,6 +421,7 @@ def get_failed_upload_part_copy_source_preconditions(
     if_none_match = request.get("CopySourceIfNoneMatch")
     if_unmodified_since = request.get("CopySourceIfUnmodifiedSince")
     if_modified_since = request.get("CopySourceIfModifiedSince")
+    last_modified = second_resolution_datetime(last_modified)
 
     if if_match:
         if if_match.strip('"') != etag.strip('"'):
@@ -431,15 +432,15 @@ def get_failed_upload_part_copy_source_preconditions(
         if if_unmodified_since:
             return None
 
-    if if_unmodified_since and if_unmodified_since < last_modified:
+    if if_unmodified_since and second_resolution_datetime(if_unmodified_since) < last_modified:
         return "x-amz-copy-source-If-Unmodified-Since"
 
     if if_none_match and if_none_match.strip('"') == etag.strip('"'):
         return "x-amz-copy-source-If-None-Match"
 
-    if if_modified_since and last_modified < if_modified_since < datetime.datetime.now(
-        tz=_gmt_zone_info
-    ):
+    if if_modified_since and last_modified <= second_resolution_datetime(
+        if_modified_since
+    ) < datetime.datetime.now(tz=_gmt_zone_info):
         return "x-amz-copy-source-If-Modified-Since"
 
 
@@ -701,6 +702,10 @@ def str_to_rfc_1123_datetime(value: str) -> datetime.datetime:
     return datetime.datetime.strptime(value, RFC1123).replace(tzinfo=_gmt_zone_info)
 
 
+def second_resolution_datetime(src: datetime.datetime) -> datetime.datetime:
+    return src.replace(microsecond=0)
+
+
 def add_expiration_days_to_datetime(user_datatime: datetime.datetime, exp_days: int) -> str:
     """
     This adds expiration days to a datetime, rounding to the next day at midnight UTC.
@@ -836,13 +841,20 @@ def parse_tagging_header(tagging_header: TaggingHeader) -> dict:
         )
 
 
-def validate_tag_set(tag_set: TagSet, type_set: Literal["bucket", "object"] = "bucket"):
+def validate_tag_set(
+    tag_set: TagSet, type_set: Literal["bucket", "object", "create-bucket"] = "bucket"
+):
     keys = set()
     for tag in tag_set:
         if set(tag) != {"Key", "Value"}:
             raise MalformedXML()
 
         key = tag["Key"]
+        value = tag["Value"]
+
+        if key is None or value is None:
+            raise MalformedXML()
+
         if key in keys:
             raise InvalidTag(
                 "Cannot provide multiple Tags with the same key",
@@ -852,11 +864,15 @@ def validate_tag_set(tag_set: TagSet, type_set: Literal["bucket", "object"] = "b
         if key.startswith("aws:"):
             if type_set == "bucket":
                 message = "System tags cannot be added/updated by requester"
-            else:
+            elif type_set == "object":
                 message = "Your TagKey cannot be prefixed with aws:"
+            else:
+                message = 'User-defined tag keys can\'t start with "aws:". This prefix is reserved for system tags. Remove "aws:" from your tag keys and try again.'
             raise InvalidTag(
                 message,
-                TagKey=key,
+                # weirdly, AWS does not return the `TagKey` field here, but it does if the TagKey does not match the
+                # regex in the next step
+                TagKey=key if type_set != "create-bucket" else None,
             )
 
         if not TAG_REGEX.match(key):
@@ -864,9 +880,9 @@ def validate_tag_set(tag_set: TagSet, type_set: Literal["bucket", "object"] = "b
                 "The TagKey you have provided is invalid",
                 TagKey=key,
             )
-        elif not TAG_REGEX.match(tag["Value"]):
+        elif not TAG_REGEX.match(value):
             raise InvalidTag(
-                "The TagValue you have provided is invalid", TagKey=key, TagValue=tag["Value"]
+                "The TagValue you have provided is invalid", TagKey=key, TagValue=value
             )
 
         keys.add(key)
@@ -908,6 +924,7 @@ def get_failed_precondition_copy_source(
     :param etag: source object ETag
     :return str: the failed precondition to raise
     """
+    last_modified = second_resolution_datetime(last_modified)
     if (cs_if_match := request.get("CopySourceIfMatch")) and etag.strip('"') != cs_if_match.strip(
         '"'
     ):
@@ -915,7 +932,7 @@ def get_failed_precondition_copy_source(
 
     elif (
         cs_if_unmodified_since := request.get("CopySourceIfUnmodifiedSince")
-    ) and last_modified > cs_if_unmodified_since:
+    ) and last_modified > second_resolution_datetime(cs_if_unmodified_since):
         return "x-amz-copy-source-If-Unmodified-Since"
 
     elif (cs_if_none_match := request.get("CopySourceIfNoneMatch")) and etag.strip(
@@ -925,7 +942,9 @@ def get_failed_precondition_copy_source(
 
     elif (
         cs_if_modified_since := request.get("CopySourceIfModifiedSince")
-    ) and last_modified < cs_if_modified_since < datetime.datetime.now(tz=_gmt_zone_info):
+    ) and last_modified <= second_resolution_datetime(cs_if_modified_since) < datetime.datetime.now(
+        tz=_gmt_zone_info
+    ):
         return "x-amz-copy-source-If-Modified-Since"
 
 
@@ -943,13 +962,13 @@ def validate_failed_precondition(
     """
     precondition_failed = None
     # last_modified needs to be rounded to a second so that strict equality can be enforced from a RFC1123 header
-    last_modified = last_modified.replace(microsecond=0)
+    last_modified = second_resolution_datetime(last_modified)
     if (if_match := request.get("IfMatch")) and etag != if_match.strip('"'):
         precondition_failed = "If-Match"
 
     elif (
         if_unmodified_since := request.get("IfUnmodifiedSince")
-    ) and last_modified > if_unmodified_since:
+    ) and last_modified > second_resolution_datetime(if_unmodified_since):
         precondition_failed = "If-Unmodified-Since"
 
     if precondition_failed:
@@ -960,7 +979,9 @@ def validate_failed_precondition(
 
     if ((if_none_match := request.get("IfNoneMatch")) and etag == if_none_match.strip('"')) or (
         (if_modified_since := request.get("IfModifiedSince"))
-        and last_modified <= if_modified_since < datetime.datetime.now(tz=_gmt_zone_info)
+        and last_modified
+        <= second_resolution_datetime(if_modified_since)
+        < datetime.datetime.now(tz=_gmt_zone_info)
     ):
         raise CommonServiceException(
             message="Not Modified",

localstack/services/s3control/provider.py

@@ -1,5 +1,104 @@
-from localstack.aws.api.s3control import S3ControlApi
+from localstack.aws.api import CommonServiceException, RequestContext
+from localstack.aws.api.s3control import (
+    AccountId,
+    ListTagsForResourceResult,
+    S3ControlApi,
+    S3ResourceArn,
+    TagKeyList,
+    TagList,
+    TagResourceResult,
+    UntagResourceResult,
+)
+from localstack.aws.forwarder import NotImplementedAvoidFallbackError
+from localstack.services.s3.models import s3_stores
+from localstack.services.s3control.validation import validate_tags
+from localstack.utils.tagging import TaggingService
+
+
+class NoSuchResource(CommonServiceException):
+    def __init__(self, message=None):
+        super().__init__("NoSuchResource", status_code=404, message=message)
 
 
 class S3ControlProvider(S3ControlApi):
-    pass
+    """
+    S3Control is a management interface for S3, and can access some of its internals with no public API
+    This requires us to access the s3 stores directly
+    """
+
+    @staticmethod
+    def _get_tagging_service_for_bucket(
+        resource_arn: S3ResourceArn,
+        partition: str,
+        region: str,
+        account_id: str,
+    ) -> TaggingService:
+        s3_prefix = f"arn:{partition}:s3:::"
+        if not resource_arn.startswith(s3_prefix):
+            # Moto does not support Tagging operations for S3 Control, so we should not forward those operations back
+            # to it
+            raise NotImplementedAvoidFallbackError(
+                "LocalStack only support Bucket tagging operations for S3Control"
+            )
+
+        store = s3_stores[account_id][region]
+        bucket_name = resource_arn.removeprefix(s3_prefix)
+        if bucket_name not in store.global_bucket_map:
+            raise NoSuchResource("The specified resource doesn't exist.")
+
+        return store.TAGS
+
+    def tag_resource(
+        self,
+        context: RequestContext,
+        account_id: AccountId,
+        resource_arn: S3ResourceArn,
+        tags: TagList,
+        **kwargs,
+    ) -> TagResourceResult:
+        # currently S3Control only supports tagging buckets
+        tagging_service = self._get_tagging_service_for_bucket(
+            resource_arn=resource_arn,
+            partition=context.partition,
+            region=context.region,
+            account_id=account_id,
+        )
+
+        validate_tags(tags=tags)
+        tagging_service.tag_resource(resource_arn, tags)
+
+        return TagResourceResult()
+
+    def untag_resource(
+        self,
+        context: RequestContext,
+        account_id: AccountId,
+        resource_arn: S3ResourceArn,
+        tag_keys: TagKeyList,
+        **kwargs,
+    ) -> UntagResourceResult:
+        # currently S3Control only supports tagging buckets
+        tagging_service = self._get_tagging_service_for_bucket(
+            resource_arn=resource_arn,
+            partition=context.partition,
+            region=context.region,
+            account_id=account_id,
+        )
+
+        tagging_service.untag_resource(resource_arn, tag_keys)
+
+        return TagResourceResult()
+
+    def list_tags_for_resource(
+        self, context: RequestContext, account_id: AccountId, resource_arn: S3ResourceArn, **kwargs
+    ) -> ListTagsForResourceResult:
+        # currently S3Control only supports tagging buckets
+        tagging_service = self._get_tagging_service_for_bucket(
+            resource_arn=resource_arn,
+            partition=context.partition,
+            region=context.region,
+            account_id=account_id,
+        )
+
+        tags = tagging_service.list_tags_for_resource(resource_arn)
+        return ListTagsForResourceResult(Tags=tags["Tags"])

localstack/services/s3control/validation.py

@@ -0,0 +1,50 @@
+from localstack.aws.api.s3 import InvalidTag
+from localstack.aws.api.s3control import Tag, TagList
+from localstack.services.s3.exceptions import MalformedXML
+from localstack.services.s3.utils import TAG_REGEX
+
+
+def validate_tags(tags: TagList):
+    """
+    Validate the tags provided. This is the same function as S3, but with different error messages
+    :param tags: a TagList object
+    :raises MalformedXML if the object does not conform to the schema
+    :raises InvalidTag if the tag key or value are outside the set of validations defined by S3 and S3Control
+    :return: None
+    """
+    keys = set()
+    for tag in tags:
+        tag: Tag
+        if set(tag) != {"Key", "Value"}:
+            raise MalformedXML()
+
+        key = tag["Key"]
+        value = tag["Value"]
+
+        if key is None or value is None:
+            raise MalformedXML()
+
+        if key in keys:
+            raise InvalidTag(
+                "There are duplicate tag keys in your request. Remove the duplicate tag keys and try again.",
+                TagKey=key,
+            )
+
+        if key.startswith("aws:"):
+            raise InvalidTag(
+                'User-defined tag keys can\'t start with "aws:". This prefix is reserved for system tags. Remove "aws:" from your tag keys and try again.',
+            )
+
+        if not TAG_REGEX.match(key):
+            raise InvalidTag(
+                "This request contains a tag key or value that isn't valid. Valid characters include the following: [a-zA-Z+-=._:/]. Tag keys can contain up to 128 characters. Tag values can contain up to 256 characters.",
+                TagKey=key,
+            )
+        elif not TAG_REGEX.match(value):
+            raise InvalidTag(
+                "This request contains a tag key or value that isn't valid. Valid characters include the following: [a-zA-Z+-=._:/]. Tag keys can contain up to 128 characters. Tag values can contain up to 256 characters.",
+                TagKey=key,
+                TagValue=value,
+            )
+
+        keys.add(key)