localstack-core 4.10.1.dev7__py3-none-any.whl → 4.11.2.dev14__py3-none-any.whl

localstack/services/lambda_/resource_providers/aws_lambda_function.py

@@ -19,11 +19,24 @@ from localstack.utils.strings import is_base64, to_bytes
 from localstack.utils.testutil import create_zip_file
 
 
+class LambdaManagedInstancesCapacityProviderConfig(TypedDict):
+    CapacityProviderArn: str | None
+    PerExecutionEnvironmentMaxConcurrency: int | None
+    ExecutionEnvironmentMemoryGiBPerVCpu: float | None
+
+
+class CapacityProviderConfig(TypedDict):
+    LambdaManagedInstancesCapacityProviderConfig: (
+        LambdaManagedInstancesCapacityProviderConfig | None
+    )
+
+
 class LambdaFunctionProperties(TypedDict):
     Code: Code | None
     Role: str | None
     Architectures: list[str] | None
     Arn: str | None
+    CapacityProviderConfig: CapacityProviderConfig | None
     CodeSigningConfigArn: str | None
     DeadLetterConfig: DeadLetterConfig | None
     Description: str | None
@@ -297,6 +310,7 @@ def _transform_function_to_model(function):
         "Arn",
         "EphemeralStorage",
         "Architectures",
+        "CapacityProviderConfig",
     ]
     response_model = util.select_attributes(function, model_properties)
     response_model["Arn"] = function["FunctionArn"]
@@ -387,6 +401,7 @@ class LambdaFunctionProvider(ResourceProvider[LambdaFunctionProperties]):
                     "TracingConfig",
                     "VpcConfig",
                     "LoggingConfig",
+                    "CapacityProviderConfig",
                 ],
             )
             if "Timeout" in kwargs:
@@ -408,11 +423,27 @@ class LambdaFunctionProvider(ResourceProvider[LambdaFunctionProperties]):
                 }
 
             kwargs["Code"] = _get_lambda_code_param(model)
+
+            # For managed instance lambdas, we publish them immediately
+            if "CapacityProviderConfig" in kwargs:
+                kwargs["Publish"] = True
+                kwargs["PublishTo"] = "LATEST_PUBLISHED"
+
             create_response = lambda_client.create_function(**kwargs)
+            # TODO: if version is in the schema, just put it in the model instead of the custom context
+            request.custom_context["Version"] = create_response["Version"]  # $LATEST.PUBLISHED
             model["Arn"] = create_response["FunctionArn"]
 
-        get_fn_response = lambda_client.get_function(FunctionName=model["Arn"])
+        if request.custom_context.get("Version") == "$LATEST.PUBLISHED":
+            # for managed instance lambdas, we need to wait until the version is published & active
+            get_fn_response = lambda_client.get_function(
+                FunctionName=model["FunctionName"], Qualifier=request.custom_context["Version"]
+            )
+        else:
+            get_fn_response = lambda_client.get_function(FunctionName=model["Arn"])
+
         match get_fn_response["Configuration"]["State"]:
+            # TODO: explicitly handle new ActiveNonInvocable state?
             case "Pending":
                 return ProgressEvent(
                     status=OperationStatus.IN_PROGRESS,
@@ -541,6 +572,7 @@ class LambdaFunctionProvider(ResourceProvider[LambdaFunctionProperties]):
             "TracingConfig",
             "VpcConfig",
             "LoggingConfig",
+            "CapacityProviderConfig",
         ]
         update_config_props = util.select_attributes(request.desired_state, config_keys)
         function_name = request.previous_state["FunctionName"]

localstack/services/lambda_/runtimes.py

@@ -23,7 +23,7 @@ from localstack.aws.api.lambda_ import Runtime
 # 5. Run the unit test to check the runtime setup:
 # tests.unit.services.lambda_.test_api_utils.TestApiUtils.test_check_runtime
 # 6. Review special tests including:
-# a) [ext] tests.aws.services.lambda_.test_lambda_endpoint_injection
+# a) [pro] tests.aws.services.lambda_.test_lambda_endpoint_injection
 # 7. Before merging, run the ext integration tests to cover transparent endpoint injection testing.
 # 8. Add the new runtime to the K8 image build: https://github.com/localstack/lambda-images
 # 9. Inform the web team to update the resource browser (consider offering an endpoint in the future)
@@ -34,12 +34,14 @@ from localstack.aws.api.lambda_ import Runtime
 # => Synchronize the order with the "Supported runtimes" under "AWS Lambda runtimes" (a)
 # => Add comments for deprecated runtimes using <Deprecation date> => <Block function create> => <Block function update>
 IMAGE_MAPPING: dict[Runtime, str] = {
+    Runtime.nodejs24_x: "nodejs:24",
     Runtime.nodejs22_x: "nodejs:22",
     Runtime.nodejs20_x: "nodejs:20",
     Runtime.nodejs18_x: "nodejs:18",
     Runtime.nodejs16_x: "nodejs:16",
     Runtime.nodejs14_x: "nodejs:14",  # deprecated Dec 4, 2023  => Jan 9, 2024  => Feb 8, 2024
     Runtime.nodejs12_x: "nodejs:12",  # deprecated Mar 31, 2023 => Mar 31, 2023 => Apr 30, 2023
+    Runtime.python3_14: "python:3.14",
     Runtime.python3_13: "python:3.13",
     Runtime.python3_12: "python:3.12",
     Runtime.python3_11: "python:3.11",
@@ -47,6 +49,7 @@ IMAGE_MAPPING: dict[Runtime, str] = {
     Runtime.python3_9: "python:3.9",
     Runtime.python3_8: "python:3.8",
     Runtime.python3_7: "python:3.7",  # deprecated Dec 4, 2023 => Jan 9, 2024 => Feb 8, 2024
+    Runtime.java25: "java:25",
     Runtime.java21: "java:21",
     Runtime.java17: "java:17",
     Runtime.java11: "java:11",
@@ -110,12 +113,14 @@ ALL_RUNTIMES: list[Runtime] = list(IMAGE_MAPPING.keys())
 # => Remove deprecated runtimes from this testing list
 RUNTIMES_AGGREGATED = {
     "nodejs": [
+        Runtime.nodejs24_x,
         Runtime.nodejs22_x,
         Runtime.nodejs20_x,
         Runtime.nodejs18_x,
         Runtime.nodejs16_x,
     ],
     "python": [
+        Runtime.python3_14,
         Runtime.python3_13,
         Runtime.python3_12,
         Runtime.python3_11,
@@ -124,6 +129,7 @@ RUNTIMES_AGGREGATED = {
         Runtime.python3_8,
     ],
     "java": [
+        Runtime.java25,
         Runtime.java21,
         Runtime.java17,
         Runtime.java11,
@@ -155,12 +161,13 @@ SNAP_START_SUPPORTED_RUNTIMES = [
     Runtime.java11,
     Runtime.java17,
     Runtime.java21,
+    Runtime.java25,
     Runtime.python3_12,
     Runtime.python3_13,
     Runtime.dotnet8,
 ]
 
 # An ordered list of all Lambda runtimes considered valid by AWS. Matching snapshots in test_create_lambda_exceptions
-VALID_RUNTIMES: str = "[nodejs20.x, provided.al2023, python3.12, python3.13, nodejs22.x, java17, nodejs16.x, dotnet8, python3.10, java11, python3.11, dotnet6, java21, nodejs18.x, provided.al2, ruby3.3, ruby3.4, java8.al2, ruby3.2, python3.8, python3.9]"
+VALID_RUNTIMES: str = "[nodejs20.x, python3.14, provided.al2023, python3.12, python3.13, nodejs24.x, nodejs22.x, java17, nodejs16.x, java25, dotnet8, python3.10, java11, python3.11, dotnet6, java21, nodejs18.x, provided.al2, ruby3.3, ruby3.4, java8.al2, ruby3.2, python3.8, python3.9]"
 # An ordered list of all Lambda runtimes for layers considered valid by AWS. Matching snapshots in test_layer_exceptions
-VALID_LAYER_RUNTIMES: str = "[ruby2.6, dotnetcore1.0, python3.7, nodejs8.10, nasa, ruby2.7, python2.7-greengrass, dotnetcore2.0, python3.8, java21, dotnet6, dotnetcore2.1, python3.9, java11, nodejs6.10, provided, dotnetcore3.1, dotnet8, java25, java17, nodejs, nodejs4.3, java8.al2, go1.x, dotnet10, nodejs20.x, go1.9, byol, nodejs10.x, provided.al2023, nodejs22.x, python3.10, java8, nodejs12.x, python3.11, nodejs24.x, nodejs8.x, python3.12, nodejs14.x, nodejs8.9, python3.13, python3.14, nodejs16.x, provided.al2, nodejs4.3-edge, nodejs18.x, ruby3.2, python3.4, ruby3.3, ruby3.4, ruby2.5, python3.6, python2.7]"
+VALID_LAYER_RUNTIMES: str = "[ruby3.5, ruby2.6, dotnetcore1.0, python3.7, nodejs8.10, nasa, ruby2.7, python2.7-greengrass, dotnetcore2.0, python3.8, java21, dotnet6, dotnetcore2.1, python3.9, java11, nodejs6.10, provided, dotnetcore3.1, dotnet8, java25, java17, nodejs, nodejs4.3, java8.al2, go1.x, dotnet10, nodejs20.x, go1.9, byol, nodejs10.x, provided.al2023, nodejs22.x, python3.10, java8, nodejs12.x, python3.11, nodejs24.x, nodejs8.x, python3.12, nodejs14.x, nodejs8.9, nodejs26.x, python3.13, python3.14, nodejs16.x, python3.15, provided.al2, nodejs4.3-edge, nodejs18.x, ruby3.2, python3.4, ruby3.3, ruby3.4, ruby2.5, python3.6, python2.7]"

localstack/services/logs/provider.py

@@ -14,6 +14,7 @@ from moto.logs.models import LogStream as MotoLogStream
 from localstack.aws.api import CommonServiceException, RequestContext, handler
 from localstack.aws.api.logs import (
     AmazonResourceName,
+    DeletionProtectionEnabled,
     DescribeLogGroupsRequest,
     DescribeLogGroupsResponse,
     DescribeLogStreamsRequest,
@@ -22,10 +23,13 @@ from localstack.aws.api.logs import (
     InputLogEvents,
     InvalidParameterException,
     KmsKeyId,
+    ListLogGroupsRequest,
+    ListLogGroupsResponse,
     ListTagsForResourceResponse,
     ListTagsLogGroupResponse,
     LogGroupClass,
     LogGroupName,
+    LogGroupSummary,
     LogsApi,
     LogStreamName,
     PutLogEventsResponse,
@@ -40,10 +44,11 @@ from localstack.services import moto
 from localstack.services.logs.models import get_moto_logs_backend, logs_stores
 from localstack.services.moto import call_moto
 from localstack.services.plugins import ServiceLifecycleHook
+from localstack.state import StateVisitor
 from localstack.utils.aws import arns
 from localstack.utils.aws.client_types import ServicePrincipal
 from localstack.utils.bootstrap import is_api_enabled
-from localstack.utils.common import is_number
+from localstack.utils.numbers import is_number
 from localstack.utils.patch import patch
 
 LOG = logging.getLogger(__name__)
@@ -54,14 +59,20 @@ class LogsProvider(LogsApi, ServiceLifecycleHook):
         super().__init__()
         self.cw_client = connect_to().cloudwatch
 
+    def accept_state_visitor(self, visitor: StateVisitor):
+        from moto.logs.models import logs_backends
+
+        visitor.visit(logs_backends)
+        visitor.visit(logs_stores)
+
     def put_log_events(
         self,
         context: RequestContext,
         log_group_name: LogGroupName,
         log_stream_name: LogStreamName,
         log_events: InputLogEvents,
-        sequence_token: SequenceToken = None,
-        entity: Entity = None,
+        sequence_token: SequenceToken | None = None,
+        entity: Entity | None = None,
         **kwargs,
     ) -> PutLogEventsResponse:
         logs_backend = get_moto_logs_backend(context.account_id, context.region)
@@ -97,33 +108,32 @@ class LogsProvider(LogsApi, ServiceLifecycleHook):
     ) -> DescribeLogGroupsResponse:
         region_backend = get_moto_logs_backend(context.account_id, context.region)
 
-        prefix: str = request.get("logGroupNamePrefix", "")
-        pattern: str = request.get("logGroupNamePattern", "")
+        prefix: str | None = request.get("logGroupNamePrefix", "")
+        pattern: str | None = request.get("logGroupNamePattern", "")
 
         if pattern and prefix:
             raise InvalidParameterException(
                 "LogGroup name prefix and LogGroup name pattern are mutually exclusive parameters."
             )
 
-        copy_groups = copy.deepcopy(dict(region_backend.groups))
+        moto_groups = copy.deepcopy(dict(region_backend.groups)).values()
 
         groups = [
-            group.to_describe_dict()
-            for name, group in copy_groups.items()
+            {"logGroupClass": LogGroupClass.STANDARD} | group.to_describe_dict()
+            for group in sorted(moto_groups, key=lambda g: g.name)
             if not (prefix or pattern)
-            or (prefix and name.startswith(prefix))
-            or (pattern and pattern in name)
+            or (prefix and group.name.startswith(prefix))
+            or (pattern and pattern in group.name)
         ]
 
-        groups = sorted(groups, key=lambda x: x["logGroupName"])
         return DescribeLogGroupsResponse(logGroups=groups)
 
     @handler("DescribeLogStreams", expand=False)
     def describe_log_streams(
         self, context: RequestContext, request: DescribeLogStreamsRequest
     ) -> DescribeLogStreamsResponse:
-        log_group_name: str = request.get("logGroupName")
-        log_group_identifier: str = request.get("logGroupIdentifier")
+        log_group_name: str | None = request.get("logGroupName")
+        log_group_identifier: str | None = request.get("logGroupIdentifier")
 
         if log_group_identifier and log_group_name:
             raise CommonServiceException(
@@ -138,13 +148,30 @@ class LogsProvider(LogsApi, ServiceLifecycleHook):
 
         return moto.call_moto_with_request(context, request_copy)
 
+    @handler("ListLogGroups", expand=False)
+    def list_log_groups(
+        self, context: RequestContext, request: ListLogGroupsRequest
+    ) -> ListLogGroupsResponse:
+        pattern: str | None = request.get("logGroupNamePattern")
+        region_backend: LogsBackend = get_moto_logs_backend(context.account_id, context.region)
+        moto_groups = copy.deepcopy(region_backend.groups).values()
+        groups = [
+            LogGroupSummary(
+                logGroupName=group.name, logGroupArn=group.arn, logGroupClass=LogGroupClass.STANDARD
+            )
+            for group in sorted(moto_groups, key=lambda g: g.name)
+            if not pattern or pattern in group.name
+        ]
+        return ListLogGroupsResponse(logGroups=groups)
+
     def create_log_group(
         self,
         context: RequestContext,
         log_group_name: LogGroupName,
-        kms_key_id: KmsKeyId = None,
-        tags: Tags = None,
-        log_group_class: LogGroupClass = None,
+        kms_key_id: KmsKeyId | None = None,
+        tags: Tags | None = None,
+        log_group_class: LogGroupClass | None = None,
+        deletion_protection_enabled: DeletionProtectionEnabled | None = None,
         **kwargs,
     ) -> None:
         call_moto(context)
@@ -442,10 +469,9 @@ def moto_to_describe_dict(target, self):
     # reported race condition in https://github.com/localstack/localstack/issues/8011
     # making copy of "streams" dict here to avoid issues while summing up storedBytes
     copy_streams = copy.deepcopy(self.streams)
-    # parity tests shows that the arn ends with ":*"
-    arn = self.arn if self.arn.endswith(":*") else f"{self.arn}:*"
     log_group = {
-        "arn": arn,
+        "arn": f"{self.arn}:*",
+        "logGroupArn": self.arn,
         "creationTime": self.creation_time,
         "logGroupName": self.name,
         "metricFilterCount": 0,

localstack/services/opensearch/provider.py

@@ -116,6 +116,11 @@ DEFAULT_OPENSEARCH_DOMAIN_ENDPOINT_OPTIONS = DomainEndpointOptions(
     CustomEndpointEnabled=False,
 )
 
+DEFAULT_AUTOTUNE_OPTIONS = AutoTuneOptionsOutput(
+    State=AutoTuneState.ENABLED,
+    UseOffPeakWindow=False,
+)
+
 
 def cluster_manager() -> ClusterManager:
     global __CLUSTER_MANAGER
@@ -203,6 +208,13 @@ def _status_to_config(status: DomainStatus) -> DomainConfig:
     cluster_cfg = status.get("ClusterConfig") or {}
     default_cfg = DEFAULT_OPENSEARCH_CLUSTER_CONFIG
     config_status = get_domain_config_status()
+    autotune_options = status.get("AutoTuneOptions") or DEFAULT_AUTOTUNE_OPTIONS
+    autotune_state = autotune_options.get("State") or AutoTuneState.ENABLED
+    desired_state = (
+        AutoTuneDesiredState.ENABLED
+        if autotune_state == AutoTuneState.ENABLED
+        else AutoTuneDesiredState.DISABLED
+    )
     return DomainConfig(
         AccessPolicies=AccessPoliciesStatus(
             Options=status.get("AccessPolicies", ""),
@@ -275,15 +287,16 @@ def _status_to_config(status: DomainStatus) -> DomainConfig:
         ),
         AutoTuneOptions=AutoTuneOptionsStatus(
             Options=AutoTuneOptions(
-                DesiredState=AutoTuneDesiredState.ENABLED,
+                DesiredState=desired_state,
                 RollbackOnDisable=RollbackOnDisable.NO_ROLLBACK,
                 MaintenanceSchedules=[],
+                UseOffPeakWindow=autotune_options.get("UseOffPeakWindow", False),
             ),
             Status=AutoTuneStatus(
                 CreationDate=config_status.get("CreationDate"),
                 UpdateDate=config_status.get("UpdateDate"),
                 UpdateVersion=config_status.get("UpdateVersion"),
-                State=AutoTuneState.ENABLED,
+                State=autotune_state,
                 PendingDeletion=config_status.get("PendingDeletion"),
             ),
         ),
@@ -315,6 +328,22 @@ def get_domain_status(
         stored_status.update(request)
         default_cfg.update(request.get("ClusterConfig", {}))
 
+    autotune_options = stored_status.get("AutoTuneOptions") or deepcopy(DEFAULT_AUTOTUNE_OPTIONS)
+    if request and (request_options := request.get("AutoTuneOptions")):
+        desired_state = request_options.get("DesiredState") or AutoTuneDesiredState.ENABLED
+        state = (
+            AutoTuneState.ENABLED
+            if desired_state == AutoTuneDesiredState.ENABLED
+            else AutoTuneState.DISABLED
+        )
+        autotune_options = AutoTuneOptionsOutput(
+            State=state,
+            UseOffPeakWindow=request_options.get(
+                "UseOffPeakWindow", autotune_options.get("UseOffPeakWindow", False)
+            ),
+        )
+    stored_status["AutoTuneOptions"] = autotune_options
+
     domain_processing_status = stored_status.get("DomainProcessingStatus", None)
     processing = stored_status.get("Processing", True)
     if deleted:
@@ -377,7 +406,10 @@ def get_domain_status(
         AdvancedSecurityOptions=AdvancedSecurityOptions(
             Enabled=False, InternalUserDatabaseEnabled=False
         ),
-        AutoTuneOptions=AutoTuneOptionsOutput(State=AutoTuneState.ENABLE_IN_PROGRESS),
+        AutoTuneOptions=AutoTuneOptionsOutput(
+            State=stored_status.get("AutoTuneOptions", {}).get("State"),
+            UseOffPeakWindow=autotune_options.get("UseOffPeakWindow", False),
+        ),
     )
     return new_status
 
@@ -582,6 +614,24 @@ class OpensearchProvider(OpensearchApi, ServiceLifecycleHook):
             if domain_status is None:
                 raise ResourceNotFoundException(f"Domain not found: {domain_key.domain_name}")
 
+            if payload.get("AutoTuneOptions"):
+                auto_request = payload.pop("AutoTuneOptions")
+                desired_state = auto_request.get("DesiredState") or AutoTuneDesiredState.ENABLED
+
+                state = (
+                    AutoTuneState.ENABLED
+                    if desired_state == AutoTuneDesiredState.ENABLED
+                    else AutoTuneState.DISABLED
+                )
+
+                current_autotune = domain_status.get("AutoTuneOptions", {})
+                domain_status["AutoTuneOptions"] = AutoTuneOptionsOutput(
+                    State=state,
+                    UseOffPeakWindow=auto_request.get(
+                        "UseOffPeakWindow", current_autotune.get("UseOffPeakWindow", False)
+                    ),
+                )
+
             status_update: dict = _update_domain_config_request_to_status(payload)
             domain_status.update(status_update)
 

localstack/services/resource_groups/provider.py

@@ -1,5 +1,9 @@
 from localstack.aws.api.resource_groups import ResourceGroupsApi
+from localstack.state import StateVisitor
 
 
 class ResourceGroupsProvider(ResourceGroupsApi):
-    pass
+    def accept_state_visitor(self, visitor: StateVisitor):
+        from moto.resourcegroups.models import resourcegroups_backends
+
+        visitor.visit(resourcegroups_backends)

localstack/services/resourcegroupstaggingapi/provider.py

@@ -1,7 +1,12 @@
 from abc import ABC
 
 from localstack.aws.api.resourcegroupstaggingapi import ResourcegroupstaggingapiApi
+from localstack.state import StateVisitor
 
 
 class ResourcegroupstaggingapiProvider(ResourcegroupstaggingapiApi, ABC):
-    pass
+    def accept_state_visitor(self, visitor: StateVisitor):
+        # currently, Moto resourcegroupstaggingapi stores all tags into the other services backend, so their backend
+        # does not hold any state and is not worth saving. It only holds direct references to other services
+        # It only holds pagination tokens that are not worth keeping
+        pass

localstack/services/s3/provider.py

@@ -323,6 +323,7 @@ from localstack.services.s3.validation import (
 from localstack.services.s3.website_hosting import register_website_hosting_routes
 from localstack.state import AssetDirectory, StateVisitor
 from localstack.utils.aws.arns import s3_bucket_name
+from localstack.utils.aws.aws_stack import get_valid_regions_for_service
 from localstack.utils.collections import select_from_typed_dict
 from localstack.utils.strings import short_uid, to_bytes, to_str
 
@@ -491,18 +492,14 @@ class S3Provider(S3Api, ServiceLifecycleHook):
         if not is_bucket_name_valid(bucket_name):
             raise InvalidBucketName("The specified bucket is not valid.", BucketName=bucket_name)
 
-        # the XML parser returns an empty dict if the body contains the following:
-        # <CreateBucketConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/" />
-        # but it also returns an empty dict if the body is fully empty. We need to differentiate the 2 cases by checking
-        # if the body is empty or not
-        if context.request.data and (
-            (create_bucket_configuration := request.get("CreateBucketConfiguration")) is not None
-        ):
-            if not (bucket_region := create_bucket_configuration.get("LocationConstraint")):
-                raise MalformedXML()
-
+        create_bucket_configuration = request.get("CreateBucketConfiguration") or {}
+        bucket_region = create_bucket_configuration.get("LocationConstraint")
+        bucket_tags = create_bucket_configuration.get("Tags")
+        if bucket_tags:
+            validate_tag_set(bucket_tags, type_set="create-bucket")
+        if bucket_region:
             if context.region == AWS_REGION_US_EAST_1:
-                if bucket_region == "us-east-1":
+                if bucket_region in ("us-east-1", "aws-global"):
                     raise InvalidLocationConstraint(
                         "The specified location-constraint is not valid",
                         LocationConstraint=bucket_region,
@@ -527,8 +524,9 @@ class S3Provider(S3Api, ServiceLifecycleHook):
             if existing_bucket_owner != context.account_id:
                 raise BucketAlreadyExists()
 
-            # if the existing bucket has the same owner, the behaviour will depend on the region
-            if bucket_region != "us-east-1":
+            # if the existing bucket has the same owner, the behaviour will depend on the region and if the request has
+            # tags
+            if bucket_region != AWS_REGION_US_EAST_1 or bucket_tags:
                 raise BucketAlreadyOwnedByYou(
                     "Your previous request to create the named bucket succeeded and you already own it.",
                     BucketName=bucket_name,
@@ -547,6 +545,7 @@ class S3Provider(S3Api, ServiceLifecycleHook):
         # see https://docs.aws.amazon.com/AmazonS3/latest/API/API_Owner.html
         owner = get_owner_for_account_id(context.account_id)
         acl = get_access_control_policy_for_new_resource_request(request, owner=owner)
+
         s3_bucket = S3Bucket(
             name=bucket_name,
             account_id=context.account_id,
@@ -559,6 +558,11 @@ class S3Provider(S3Api, ServiceLifecycleHook):
 
         store.buckets[bucket_name] = s3_bucket
         store.global_bucket_map[bucket_name] = s3_bucket.bucket_account_id
+        if bucket_tags:
+            store.TAGS.tag_resource(
+                arn=s3_bucket.bucket_arn,
+                tags=bucket_tags,
+            )
         self._cors_handler.invalidate_cache()
         self._storage_backend.create_bucket(bucket_name)
 
@@ -607,6 +611,13 @@ class S3Provider(S3Api, ServiceLifecycleHook):
         bucket_region: BucketRegion = None,
         **kwargs,
     ) -> ListBucketsOutput:
+        if bucket_region and not config.ALLOW_NONSTANDARD_REGIONS:
+            if bucket_region not in get_valid_regions_for_service(self.service):
+                raise InvalidArgument(
+                    f"Argument value {bucket_region} is not a valid AWS Region",
+                    ArgumentName="bucket-region",
+                )
+
         owner = get_owner_for_account_id(context.account_id)
         store = self.get_store(context.account_id, context.region)
 
@@ -1189,12 +1200,14 @@ class S3Provider(S3Api, ServiceLifecycleHook):
             response["ChecksumType"] = checksum_type
 
         add_encryption_to_response(response, s3_object=s3_object)
+        object_tags = store.TAGS.tags.get(
+            get_unique_key_id(bucket_name, object_key, s3_object.version_id)
+        )
+        if object_tags:
+            response["TagCount"] = len(object_tags)
 
         # if you specify the VersionId, AWS won't return the Expiration header, even if that's the current version
         if not version_id and s3_bucket.lifecycle_rules:
-            object_tags = store.TAGS.tags.get(
-                get_unique_key_id(bucket_name, object_key, s3_object.version_id)
-            )
             if expiration_header := self._get_expiration_header(
                 s3_bucket.lifecycle_rules,
                 bucket_name,

localstack/services/s3/utils.py

@@ -421,6 +421,7 @@ def get_failed_upload_part_copy_source_preconditions(
     if_none_match = request.get("CopySourceIfNoneMatch")
     if_unmodified_since = request.get("CopySourceIfUnmodifiedSince")
     if_modified_since = request.get("CopySourceIfModifiedSince")
+    last_modified = second_resolution_datetime(last_modified)
 
     if if_match:
         if if_match.strip('"') != etag.strip('"'):
@@ -431,15 +432,15 @@ def get_failed_upload_part_copy_source_preconditions(
         if if_unmodified_since:
             return None
 
-    if if_unmodified_since and if_unmodified_since < last_modified:
+    if if_unmodified_since and second_resolution_datetime(if_unmodified_since) < last_modified:
         return "x-amz-copy-source-If-Unmodified-Since"
 
     if if_none_match and if_none_match.strip('"') == etag.strip('"'):
         return "x-amz-copy-source-If-None-Match"
 
-    if if_modified_since and last_modified < if_modified_since < datetime.datetime.now(
-        tz=_gmt_zone_info
-    ):
+    if if_modified_since and last_modified <= second_resolution_datetime(
+        if_modified_since
+    ) < datetime.datetime.now(tz=_gmt_zone_info):
         return "x-amz-copy-source-If-Modified-Since"
 
 
@@ -701,6 +702,10 @@ def str_to_rfc_1123_datetime(value: str) -> datetime.datetime:
     return datetime.datetime.strptime(value, RFC1123).replace(tzinfo=_gmt_zone_info)
 
 
+def second_resolution_datetime(src: datetime.datetime) -> datetime.datetime:
+    return src.replace(microsecond=0)
+
+
 def add_expiration_days_to_datetime(user_datatime: datetime.datetime, exp_days: int) -> str:
     """
     This adds expiration days to a datetime, rounding to the next day at midnight UTC.
@@ -836,13 +841,20 @@ def parse_tagging_header(tagging_header: TaggingHeader) -> dict:
         )
 
 
-def validate_tag_set(tag_set: TagSet, type_set: Literal["bucket", "object"] = "bucket"):
+def validate_tag_set(
+    tag_set: TagSet, type_set: Literal["bucket", "object", "create-bucket"] = "bucket"
+):
     keys = set()
     for tag in tag_set:
         if set(tag) != {"Key", "Value"}:
             raise MalformedXML()
 
         key = tag["Key"]
+        value = tag["Value"]
+
+        if key is None or value is None:
+            raise MalformedXML()
+
         if key in keys:
             raise InvalidTag(
                 "Cannot provide multiple Tags with the same key",
@@ -852,11 +864,15 @@ def validate_tag_set(tag_set: TagSet, type_set: Literal["bucket", "object"] = "b
         if key.startswith("aws:"):
             if type_set == "bucket":
                 message = "System tags cannot be added/updated by requester"
-            else:
+            elif type_set == "object":
                 message = "Your TagKey cannot be prefixed with aws:"
+            else:
+                message = 'User-defined tag keys can\'t start with "aws:". This prefix is reserved for system tags. Remove "aws:" from your tag keys and try again.'
             raise InvalidTag(
                 message,
-                TagKey=key,
+                # weirdly, AWS does not return the `TagKey` field here, but it does if the TagKey does not match the
+                # regex in the next step
+                TagKey=key if type_set != "create-bucket" else None,
             )
 
         if not TAG_REGEX.match(key):
@@ -864,9 +880,9 @@ def validate_tag_set(tag_set: TagSet, type_set: Literal["bucket", "object"] = "b
                 "The TagKey you have provided is invalid",
                 TagKey=key,
             )
-        elif not TAG_REGEX.match(tag["Value"]):
+        elif not TAG_REGEX.match(value):
             raise InvalidTag(
-                "The TagValue you have provided is invalid", TagKey=key, TagValue=tag["Value"]
+                "The TagValue you have provided is invalid", TagKey=key, TagValue=value
             )
 
         keys.add(key)
@@ -908,6 +924,7 @@ def get_failed_precondition_copy_source(
     :param etag: source object ETag
     :return str: the failed precondition to raise
     """
+    last_modified = second_resolution_datetime(last_modified)
     if (cs_if_match := request.get("CopySourceIfMatch")) and etag.strip('"') != cs_if_match.strip(
         '"'
     ):
@@ -915,7 +932,7 @@ def get_failed_precondition_copy_source(
 
     elif (
         cs_if_unmodified_since := request.get("CopySourceIfUnmodifiedSince")
-    ) and last_modified > cs_if_unmodified_since:
+    ) and last_modified > second_resolution_datetime(cs_if_unmodified_since):
         return "x-amz-copy-source-If-Unmodified-Since"
 
     elif (cs_if_none_match := request.get("CopySourceIfNoneMatch")) and etag.strip(
@@ -925,7 +942,9 @@ def get_failed_precondition_copy_source(
 
     elif (
         cs_if_modified_since := request.get("CopySourceIfModifiedSince")
-    ) and last_modified < cs_if_modified_since < datetime.datetime.now(tz=_gmt_zone_info):
+    ) and last_modified <= second_resolution_datetime(cs_if_modified_since) < datetime.datetime.now(
+        tz=_gmt_zone_info
+    ):
         return "x-amz-copy-source-If-Modified-Since"
 
 
@@ -943,13 +962,13 @@ def validate_failed_precondition(
     """
     precondition_failed = None
     # last_modified needs to be rounded to a second so that strict equality can be enforced from a RFC1123 header
-    last_modified = last_modified.replace(microsecond=0)
+    last_modified = second_resolution_datetime(last_modified)
     if (if_match := request.get("IfMatch")) and etag != if_match.strip('"'):
         precondition_failed = "If-Match"
 
     elif (
         if_unmodified_since := request.get("IfUnmodifiedSince")
-    ) and last_modified > if_unmodified_since:
+    ) and last_modified > second_resolution_datetime(if_unmodified_since):
         precondition_failed = "If-Unmodified-Since"
 
     if precondition_failed:
@@ -960,7 +979,9 @@ def validate_failed_precondition(
 
     if ((if_none_match := request.get("IfNoneMatch")) and etag == if_none_match.strip('"')) or (
         (if_modified_since := request.get("IfModifiedSince"))
-        and last_modified <= if_modified_since < datetime.datetime.now(tz=_gmt_zone_info)
+        and last_modified
+        <= second_resolution_datetime(if_modified_since)
+        < datetime.datetime.now(tz=_gmt_zone_info)
     ):
         raise CommonServiceException(
             message="Not Modified",